authflow-cli 0.5.0 → 0.7.0

package/dist/login-callback.d.ts

@@ -0,0 +1,29 @@
+import type { ServerResponse } from "node:http";
+declare const pages: {
+    readonly received: {
+        readonly status: 200;
+        readonly title: "Authorization received — return to your terminal";
+        readonly description: "Authflow received your browser authorization. Return to your terminal to finish connecting.";
+        readonly next: "Your client will confirm when it is ready. You can close this tab.";
+    };
+    readonly declined: {
+        readonly status: 400;
+        readonly title: "Sign-in was not completed";
+        readonly description: "Authorization was declined or could not be completed. No new connection was saved.";
+        readonly next: "Return to your terminal and run authflow login when you are ready to try again.";
+    };
+    readonly invalidIssuer: {
+        readonly status: 400;
+        readonly title: "Sign-in could not be verified";
+        readonly description: "The authorization response came from an unexpected issuer. No new connection was saved.";
+        readonly next: "Return to your terminal and run authflow login again.";
+    };
+    readonly invalidCallback: {
+        readonly status: 400;
+        readonly title: "This sign-in link is not valid";
+        readonly description: "This response does not match the sign-in request waiting in your terminal.";
+        readonly next: "Use the sign-in link from your terminal to continue. You can close this tab.";
+    };
+};
+export declare function writeLoginCallback(response: ServerResponse, outcome: keyof typeof pages): void;
+export {};

package/dist/login-callback.js

@@ -0,0 +1,79 @@
+import { createHash } from "node:crypto";
+import { brandMarkPng } from "./brand-mark.js";
+// Keep this loopback page self-contained, using the Rail sign-in palette and card proportions.
+// The mark is marketing's icon-48.png as a data: URI, lifted on dark backgrounds the way the
+// Rail shell lifts it; the CSP allows exactly that image source and this one hashed stylesheet.
+// Serve HTML: the affected Edge profile blocked plain-text callbacks after receiving them,
+// while an HTML callback rendered successfully without changing OAuth or browser settings.
+// Its only interpolated content is selected from the static messages below, never the OAuth URL.
+const styles = `
+:root { color-scheme: dark light; --canvas:#0c0e12; --surface:#14171e; --border:#2a3140; --fg:#f3f5f8; --muted:#9aa3b2; --accent:#7aa2ff; --raised:#1b1f28; }
+* { box-sizing:border-box; }
+body { margin:0; font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif; color:var(--fg); background:var(--canvas); background-image:radial-gradient(ellipse at 50% 0,rgba(122,162,255,.12),transparent 55%); line-height:1.55; }
+.rail-shell { display:flex; flex-direction:column; align-items:center; justify-content:center; min-height:100vh; min-height:100dvh; padding:1.5rem 1.15rem 2rem; gap:1.15rem; }
+.rail-brand { display:flex; align-items:center; gap:.55rem; color:var(--muted); font-size:.8125rem; font-weight:600; letter-spacing:.02em; }
+.rail-brand-mark { display:block; width:1.35rem; height:1.35rem; filter:brightness(1.65) saturate(.9); }
+.rail-card { width:100%; max-width:26.5rem; padding:1.75rem 1.5rem 1.45rem; border:1px solid var(--border); border-radius:1.25rem; background:var(--surface); box-shadow:0 24px 48px rgba(0,0,0,.2); }
+.rail-eyebrow { margin:0 0 .45rem; color:var(--accent); font-size:.6875rem; font-weight:600; letter-spacing:.08em; text-transform:uppercase; }
+h1 { margin:0; font-size:1.5rem; font-weight:600; line-height:1.25; letter-spacing:-.02em; }
+.rail-lead { margin:.85rem 0 0; color:var(--muted); font-size:.9375rem; }
+.rail-next { margin:1.35rem 0 0; padding:.85rem 1rem; border:1px solid var(--border); border-radius:.875rem; background:var(--raised); font-size:.875rem; }
+.rail-foot { margin:0; color:var(--muted); font-size:.75rem; }
+@media (prefers-color-scheme:light) { :root { --canvas:#eef0f4; --surface:#fff; --border:#d8dce3; --fg:#11141a; --muted:#5c6570; --accent:#3b6fe3; --raised:#f7f8fa; } .rail-card { box-shadow:0 18px 40px rgba(17,20,26,.08); } .rail-brand-mark { filter:none; } }
+`;
+const styleHash = createHash("sha256").update(styles).digest("base64");
+const pages = {
+    received: {
+        // Served before the token exchange and workspace check, so it must not claim completion.
+        status: 200, title: "Authorization received — return to your terminal",
+        description: "Authflow received your browser authorization. Return to your terminal to finish connecting.",
+        next: "Your client will confirm when it is ready. You can close this tab.",
+    },
+    declined: {
+        status: 400, title: "Sign-in was not completed",
+        description: "Authorization was declined or could not be completed. No new connection was saved.",
+        next: "Return to your terminal and run authflow login when you are ready to try again.",
+    },
+    invalidIssuer: {
+        status: 400, title: "Sign-in could not be verified",
+        description: "The authorization response came from an unexpected issuer. No new connection was saved.",
+        next: "Return to your terminal and run authflow login again.",
+    },
+    invalidCallback: {
+        status: 400, title: "This sign-in link is not valid",
+        description: "This response does not match the sign-in request waiting in your terminal.",
+        next: "Use the sign-in link from your terminal to continue. You can close this tab.",
+    },
+};
+export function writeLoginCallback(response, outcome) {
+    const page = pages[outcome];
+    response.writeHead(page.status, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff",
+        "Content-Security-Policy": `default-src 'none'; style-src 'sha256-${styleHash}'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+    }).end(`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>${page.title} · Authflow</title>
+<style>${styles}</style>
+</head>
+<body>
+<div class="rail-shell">
+<header class="rail-brand"><img class="rail-brand-mark" src="data:image/png;base64,${brandMarkPng}" alt="" width="48" height="48"><span>Authflow</span></header>
+<main class="rail-card">
+<p class="rail-eyebrow">Authflow CLI</p>
+<h1>${page.title}</h1>
+<p class="rail-lead">${page.description}</p>
+<p class="rail-next">${page.next}</p>
+</main>
+<p class="rail-foot">Secured by Authflow</p>
+</div>
+</body>
+</html>`);
+}
+//# sourceMappingURL=login-callback.js.map

package/dist/login-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-callback.js","sourceRoot":"","sources":["../src/login-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,+FAA+F;AAC/F,6FAA6F;AAC7F,gGAAgG;AAChG,2FAA2F;AAC3F,2FAA2F;AAC3F,iGAAiG;AACjG,MAAM,MAAM,GAAG;;;;;;;;;;;;;;CAcd,CAAC;AACF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,MAAM,KAAK,GAAG;IACZ,QAAQ,EAAE;QACR,yFAAyF;QACzF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kDAAkD;QACtE,WAAW,EAAE,6FAA6F;QAC1G,IAAI,EAAE,oEAAoE;KAC3E;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B;QAC/C,WAAW,EAAE,oFAAoF;QACjG,IAAI,EAAE,iFAAiF;KACxF;IACD,aAAa,EAAE;QACb,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,+BAA+B;QACnD,WAAW,EAAE,yFAAyF;QACtG,IAAI,EAAE,uDAAuD;KAC9D;IACD,eAAe,EAAE;QACf,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,gCAAgC;QACpD,WAAW,EAAE,4EAA4E;QACzF,IAAI,EAAE,8EAA8E;KACrF;CACO,CAAC;AAEX,MAAM,UAAU,kBAAkB,CAAC,QAAwB,EAAE,OAA2B;IACtF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE;QAC9B,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,yBAAyB,EAAE,yCAAyC,SAAS,+EAA+E;KAC7J,CAAC,CAAC,GAAG,CAAC;;;;;;SAMA,IAAI,CAAC,KAAK;SACV,MAAM;;;;qFAIsE,YAAY;;;MAG3F,IAAI,CAAC,KAAK;uBACO,IAAI,CAAC,WAAW;uBAChB,IAAI,CAAC,IAAI;;;;;QAKxB,CAAC,CAAC;AACV,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,26 @@
+import { type LoginCredential } from "./credentials.js";
+/**
+ * RFC 9207 mix-up defense. An issuer that advertises the `iss` authorization-response parameter
+ * (Rail does) must send exactly one, matching the issuer this login started with; a response
+ * without it is not from that issuer's authorization endpoint. Others may omit it, but never send
+ * a wrong or duplicated one.
+ */
+export declare function acceptsCallbackIssuer(values: string[], issuer: string, required: boolean): boolean;
+export declare function validatedIssuer(value: string): string;
+export declare function matchesOAuthState(actual: string | null, expected: string): boolean;
+export declare function login(issuerValue: string, workspaceId?: string, open?: boolean): Promise<{
+    issuer: string;
+    workspace_id: string;
+}>;
+export declare function managementCredential(issuerValue: string): Promise<LoginCredential>;
+/** What logout actually did. Without a stored login there is nothing to sign out of or revoke. */
+export type LogoutResult = {
+    signed_out: true;
+    authorization_revoked: boolean;
+} | {
+    signed_out: false;
+    reason: "no_login";
+};
+export declare function logout(issuerValue: string, options?: {
+    localOnly?: boolean;
+}): Promise<LogoutResult>;

package/dist/login.js

@@ -0,0 +1,227 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { z } from "zod";
+import { credentialStore } from "./credentials.js";
+import { writeLoginCallback } from "./login-callback.js";
+const metadataSchema = z.object({
+    issuer: z.string(), authorization_endpoint: z.string().url(), token_endpoint: z.string().url(),
+    registration_endpoint: z.string().url(), revocation_endpoint: z.string().url().optional(),
+    authorization_response_iss_parameter_supported: z.boolean().optional(),
+});
+/**
+ * RFC 9207 mix-up defense. An issuer that advertises the `iss` authorization-response parameter
+ * (Rail does) must send exactly one, matching the issuer this login started with; a response
+ * without it is not from that issuer's authorization endpoint. Others may omit it, but never send
+ * a wrong or duplicated one.
+ */
+export function acceptsCallbackIssuer(values, issuer, required) {
+    if (values.length > 1)
+        return false;
+    if (values.length === 0)
+        return !required;
+    return values[0].replace(/\/+$/, "") === issuer;
+}
+const tokenSchema = z.object({ access_token: z.string().min(1), refresh_token: z.string().optional(), expires_in: z.number().positive(), token_type: z.string() });
+export function validatedIssuer(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))) {
+        throw new Error("The issuer must be an HTTPS URL (HTTP loopback is allowed locally).");
+    }
+    return url.href.replace(/\/+$/, "");
+}
+async function metadata(issuer) {
+    const response = await fetch(`${issuer}/.well-known/oauth-authorization-server`, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+    if (!response.ok)
+        throw new Error(`Issuer discovery failed (${response.status}).`);
+    const result = metadataSchema.parse(await response.json());
+    if (result.issuer.replace(/\/+$/, "") !== issuer)
+        throw new Error("Discovery issuer does not match the selected issuer.");
+    for (const endpoint of [result.authorization_endpoint, result.token_endpoint, result.registration_endpoint, result.revocation_endpoint].filter(Boolean)) {
+        const url = new URL(endpoint);
+        if (url.origin !== new URL(issuer).origin || url.username || url.password || url.hash)
+            throw new Error("An OAuth endpoint is not a safe URL on the selected issuer origin.");
+    }
+    return result;
+}
+export function matchesOAuthState(actual, expected) {
+    return actual !== null && Buffer.byteLength(actual) === Buffer.byteLength(expected) && timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
+}
+export async function login(issuerValue, workspaceId, open = true) {
+    const issuer = validatedIssuer(issuerValue);
+    // The browser step can take minutes. Holding the credential lock through it made every other
+    // CLI command and MCP call for this issuer give up after 45 s, so only the save is serialized.
+    const discovery = await metadata(issuer);
+    const verifier = randomBytes(48).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const callback = createServer();
+    callback.listen(0, "127.0.0.1");
+    await once(callback, "listening");
+    const address = callback.address();
+    if (!address || typeof address === "string")
+        throw new Error("Cannot open the loopback callback.");
+    const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+    try {
+        const registration = await fetch(discovery.registration_endpoint, {
+            method: "POST", headers: { "Content-Type": "application/json" }, redirect: "error", signal: AbortSignal.timeout(15_000),
+            body: JSON.stringify({ client_name: "Authflow CLI", application_type: "native", redirect_uris: [redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" }),
+        });
+        if (!registration.ok)
+            throw new Error(`CLI registration failed (${registration.status}).`);
+        const { client_id } = z.object({ client_id: z.string() }).parse(await registration.json());
+        const authorize = new URL(discovery.authorization_endpoint);
+        authorize.search = new URLSearchParams({ client_id, redirect_uri: redirectUri, response_type: "code", scope: "management:read management:write offline_access", resource: `${issuer}/management/mcp`, code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state, ...(workspaceId ? { workspace_id: workspaceId } : {}) }).toString();
+        const code = new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => reject(new Error("Sign-in timed out. Run authflow login again.")), 300_000);
+            let completed = false;
+            callback.on("request", (request, response) => {
+                let url;
+                try {
+                    url = new URL(request.url ?? "/", redirectUri);
+                }
+                catch {
+                    writeLoginCallback(response, "invalidCallback");
+                    return;
+                }
+                if (completed || request.method !== "GET" || url.origin !== new URL(redirectUri).origin || url.pathname !== "/callback"
+                    || request.headers.host !== `127.0.0.1:${address.port}` || url.searchParams.getAll("state").length !== 1
+                    || !matchesOAuthState(url.searchParams.get("state"), state)) {
+                    writeLoginCallback(response, "invalidCallback");
+                    return;
+                }
+                completed = true;
+                clearTimeout(timeout);
+                const codeValue = url.searchParams.getAll("code").length === 1 && !url.searchParams.has("error") ? url.searchParams.get("code") : null;
+                if (!acceptsCallbackIssuer(url.searchParams.getAll("iss"), issuer, discovery.authorization_response_iss_parameter_supported === true)) {
+                    writeLoginCallback(response, "invalidIssuer");
+                    reject(new Error("Login issuer mismatch."));
+                    return;
+                }
+                writeLoginCallback(response, codeValue ? "received" : "declined");
+                if (codeValue)
+                    resolve(codeValue);
+                else
+                    reject(new Error("Sign-in was declined or could not be completed."));
+            });
+            callback.on("close", () => clearTimeout(timeout));
+        });
+        process.stderr.write(`Complete sign-in in your browser:\n${authorize.href}\n`);
+        if (open)
+            openBrowser(authorize.href);
+        const authorizationCode = await code;
+        const tokenResponse = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "authorization_code", client_id, redirect_uri: redirectUri, code: authorizationCode, code_verifier: verifier, resource: `${issuer}/management/mcp` }) });
+        if (!tokenResponse.ok)
+            throw new Error(`Sign-in token exchange failed (${tokenResponse.status}).`);
+        const token = tokenSchema.parse(await tokenResponse.json());
+        if (token.token_type.toLowerCase() !== "bearer")
+            throw new Error("Unsupported token type.");
+        // Ask Rail which workspace this credential can access; never trust an unverified JWT decode.
+        const workspaceResponse = await fetch(`${issuer}/management/v1/workspaces`, { redirect: "error", headers: { Authorization: `Bearer ${token.access_token}` }, signal: AbortSignal.timeout(15_000) });
+        if (!workspaceResponse.ok)
+            throw new Error("The management credential has no accessible workspace.");
+        const workspaces = z.array(z.object({ id: z.string() })).parse(await workspaceResponse.json());
+        const workspace = workspaces.find(w => !workspaceId || w.id === workspaceId);
+        if (!workspace)
+            throw new Error("Create a workspace in the portal and run authflow login again.");
+        const credential = { issuer, client_id, access_token: token.access_token, refresh_token: token.refresh_token, expires_at: Date.now() + token.expires_in * 1000, workspace_id: workspace.id };
+        await credentialStore.withLock(issuer, async () => {
+            // An unreadable stored login is the repair case: there is nothing in it to revoke.
+            const previous = await credentialStore.read(issuer).catch(() => undefined);
+            if (previous) {
+                try {
+                    await revokeLogin(issuer, previous, discovery, true);
+                }
+                catch (error) {
+                    // Keep the earlier login, which is the only local copy of what could still revoke it, and do not
+                    // leave the sign-in just made behind as a second live grant nothing stores.
+                    await revokeLogin(issuer, credential, discovery).catch(() => undefined);
+                    throw new Error(`Your previous login for this issuer could not be revoked, so it was kept and this sign-in was discarded (${error instanceof Error ? error.message : "unknown error"}) Run authflow logout, or revoke the CLI in portal account settings and then authflow logout --local-only, and sign in again.`);
+                }
+            }
+            await credentialStore.save(credential);
+        });
+        return { issuer, workspace_id: workspace.id };
+    }
+    finally {
+        callback.close();
+        callback.closeAllConnections();
+    }
+}
+export async function managementCredential(issuerValue) {
+    const issuer = validatedIssuer(issuerValue);
+    return credentialStore.withLock(issuer, async () => {
+        const credential = await credentialStore.read(issuer);
+        if (!credential)
+            throw new Error("Sign in first: authflow login --issuer <issuer>.");
+        return renewCredential(issuer, credential);
+    });
+}
+async function renewCredential(issuer, credential) {
+    if (credential.expires_at > Date.now() + 60_000)
+        return credential;
+    if (!credential.refresh_token)
+        throw new Error("Your login expired. Run authflow login again.");
+    const discovery = await metadata(issuer);
+    const response = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "refresh_token", client_id: credential.client_id, refresh_token: credential.refresh_token, resource: `${issuer}/management/mcp` }) });
+    if (!response.ok)
+        throw new Error(`Login renewal failed (${response.status}). Run authflow login again.`);
+    const token = tokenSchema.parse(await response.json());
+    if (token.token_type.toLowerCase() !== "bearer")
+        throw new Error("Unsupported token type.");
+    const next = { ...credential, access_token: token.access_token, refresh_token: token.refresh_token ?? credential.refresh_token, expires_at: Date.now() + token.expires_in * 1000 };
+    await credentialStore.save(next);
+    return next;
+}
+export async function logout(issuerValue, options = {}) {
+    const issuer = validatedIssuer(issuerValue);
+    return credentialStore.withLock(issuer, async () => {
+        // Local-only cleanup is also the repair path for an unreadable stored login, so it never reads it.
+        if (options.localOnly) {
+            await credentialStore.delete(issuer);
+            return { signed_out: true, authorization_revoked: false };
+        }
+        const stored = await credentialStore.read(issuer);
+        if (!stored)
+            return { signed_out: false, reason: "no_login" };
+        await revokeLogin(issuer, stored, await metadata(issuer));
+        await credentialStore.delete(issuer);
+        return { signed_out: true, authorization_revoked: true };
+    });
+}
+/**
+ * Revokes a stored login on the server: its durable workspace grant, then its latest refresh and
+ * access tokens. Logout uses it, and so does login before it replaces an earlier login, which would
+ * otherwise stay valid with no local copy left to revoke it.
+ * `replacing` tolerates an earlier login that is already unusable (it could not be renewed and its
+ * access token is refused), because a user re-authenticating is often doing so for exactly that reason.
+ */
+async function revokeLogin(issuer, stored, discovery, replacing = false) {
+    // A fresh access token is necessary to revoke the durable workspace grant,
+    // including other still-valid access tokens from this login.
+    let renewed = true;
+    const credential = await renewCredential(issuer, stored).catch(() => { renewed = false; return stored; });
+    if (!discovery.revocation_endpoint)
+        throw new Error("This issuer does not advertise revocation. Revoke the CLI in portal account settings before removing its login.");
+    const grantRevocation = await fetch(`${issuer}/management/v1/authorization/revoke`, {
+        method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), headers: { Authorization: `Bearer ${credential.access_token}` },
+    });
+    if (!grantRevocation.ok) {
+        if (replacing && !renewed && grantRevocation.status === 401)
+            return;
+        throw new Error("Rail could not confirm workspace authorization revocation. Retry logout, or revoke this CLI in portal account settings and then use authflow logout --local-only to clear this device.");
+    }
+    for (const token of [credential.refresh_token, credential.access_token].filter(Boolean)) {
+        const response = await fetch(discovery.revocation_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ client_id: credential.client_id, token: token }) });
+        if (!response.ok)
+            throw new Error("Rail could not revoke this login. Retry logout or revoke the CLI from portal account settings.");
+    }
+}
+function openBrowser(url) {
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    const executable = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open";
+    const child = spawn(executable, args, { stdio: "ignore", detached: true, windowsHide: true, shell: false });
+    child.on("error", () => process.stderr.write("Open the sign-in URL above in your browser.\n"));
+    child.unref();
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzF,8CAA8C,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAgB,EAAE,MAAc,EAAE,QAAiB;IACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnK,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvL,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7I,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1H,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YACnF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,QAAgB;IACvE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,WAAmB,EAAE,WAAoB,EAAE,IAAI,GAAG,IAAI;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAChC,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE;YAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACvH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC;SACpO,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3F,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC5D,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3X,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7G,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;gBAC3C,IAAI,GAAQ,CAAC;gBACb,IAAI,CAAC;oBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;gBAAC,CAAC;gBACvD,MAAM,CAAC;oBAAC,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAClE,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;uBAClH,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;uBACrG,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC9D,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAAC,OAAO;gBAC1D,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,8CAA8C,KAAK,IAAI,CAAC,EAAE,CAAC;oBAAC,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC9O,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAClE,IAAI,SAAS;oBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;oBAAM,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/E,IAAI,IAAI;YAAE,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;QACvU,IAAI,CAAC,aAAa,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5F,6FAA6F;QAC7F,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpM,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACrG,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAClG,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QAC7L,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAChD,mFAAmF;YACnF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3E,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,iGAAiG;oBACjG,4EAA4E;oBAC5E,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,4GAA4G,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,+HAA+H,CAAC,CAAC;gBACvT,CAAC;YACH,CAAC;YACD,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;IAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACrF,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAA2B;IACtE,IAAI,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,UAAU,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/S,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;IACnL,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AAChB,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,OAAO,GAA4B,EAAE;IACrF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAA2B,EAAE;QACxE,mGAAmG;QACnG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9D,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,MAAuB,EAAE,SAAoB,EAAE,SAAS,GAAG,KAAK;IACzG,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,SAAS,CAAC,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;IACvK,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qCAAqC,EAAE;QAClF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE;KACxI,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QACpE,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACtI,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACvH,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/management.d.ts

@@ -0,0 +1,28 @@
+export declare const managementResourceActions: readonly ["verify", "publish", "disable", "domain/refresh"];
+export type ManagementResourceAction = typeof managementResourceActions[number];
+/** Same owner-scoped API used by the portal and hosted MCP. Never retries a write. */
+export declare function managementRequest(issuer: string, path: string, method?: string, body?: unknown, query?: Record<string, string>): Promise<unknown>;
+/** Only machine-readable public fields may cross into an agent's error message. */
+export declare class ManagementOperationError extends Error {
+    readonly result: {
+        status: number;
+        error_code: string;
+        pending_requirements?: string[];
+        allowed_actions?: string[];
+        recovery: string;
+    };
+    /**
+     * The validation message of a 400 (ProblemDetails `detail`), bounded and with URL queries removed.
+     * Printed by the CLI to the user's terminal; deliberately not part of `result`, which tool replies use.
+     */
+    readonly detail?: string;
+    constructor(status: number, body: unknown, path?: string);
+}
+/**
+ * What the CLI prints for a failed command. A management failure carries what the user needs to
+ * act on (pending requirements, allowed actions, and for a 400 the validation message), which the
+ * one-line message alone used to drop.
+ */
+export declare function cliErrorText(error: unknown): string;
+export declare function currentWorkspacePath(issuer: string, workspaceId?: string): Promise<string>;
+export declare function redactToolSecrets(value: unknown): unknown;

package/dist/management.js

@@ -0,0 +1,102 @@
+import { managementCredential } from "./login.js";
+export const managementResourceActions = ["verify", "publish", "disable", "domain/refresh"];
+/** Same owner-scoped API used by the portal and hosted MCP. Never retries a write. */
+export async function managementRequest(issuer, path, method = "GET", body, query) {
+    if (!path.startsWith("/") || path.includes("..") || /[?#\\]/.test(path))
+        throw new Error("Invalid management path.");
+    const credential = await managementCredential(issuer);
+    const suffix = query ? `?${new URLSearchParams(query)}` : "";
+    const response = await fetch(`${credential.issuer}/management/v1${path}${suffix}`, {
+        method, redirect: "error", signal: AbortSignal.timeout(60_000),
+        headers: { Authorization: `Bearer ${credential.access_token}`, Accept: "application/json", ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    // Handle empty authentication responses before parsing. A JSON parser can include
+    // response excerpts in its exception, which must never become a tool message.
+    if (response.status === 401)
+        throw new Error("Your Authflow login expired or was revoked. Run authflow login again.");
+    if (response.status === 403)
+        throw new Error("This login cannot perform the requested workspace operation. Reconnect with the appropriate workspace and scopes.");
+    let result = null;
+    if (response.status !== 204) {
+        try {
+            result = await response.json();
+        }
+        catch {
+            // Rail answers an unknown resource with a bare 404, and a request it cannot bind with a bare
+            // 400. Both still have a precise recovery, which an "unreadable response" would hide.
+            if (response.status !== 400 && response.status !== 404)
+                throw new Error(`Rail returned an unreadable management response (${response.status}). Read current resource status before explicitly retrying a mutation.`);
+        }
+    }
+    if (!response.ok) {
+        // Do not print arbitrary server bodies: error details may contain a sensitive return URL.
+        throw new ManagementOperationError(response.status, result, path);
+    }
+    return result;
+}
+/** Only machine-readable public fields may cross into an agent's error message. */
+export class ManagementOperationError extends Error {
+    result;
+    /**
+     * The validation message of a 400 (ProblemDetails `detail`), bounded and with URL queries removed.
+     * Printed by the CLI to the user's terminal; deliberately not part of `result`, which tool replies use.
+     */
+    detail;
+    constructor(status, body, path = "") {
+        const details = body && typeof body === "object" ? body : {};
+        const identifier = (value) => typeof value === "string" && /^[a-z0-9_]{1,80}$/.test(value);
+        const code = details.error_code ?? details.error;
+        const recovery = status === 400
+            ? "Check the supplied arguments against the tool's documented constraints, correct invalid values, and explicitly retry. Writes are never automatically retried."
+            : status === 404
+                ? path.startsWith("/docs/")
+                    ? "No such documentation page. Find a valid path with `authflow docs search` (MCP: authflow_search_docs)."
+                    : "Not found in this workspace. List resources with `authflow resource list` (MCP: authflow_list_resources)."
+                : "Read the resource's current readiness, resolve its pending requirements, and explicitly retry the intended action. Writes are never automatically retried.";
+        super(`Management operation failed (${status}${identifier(code) ? `: ${code}` : ""}). ${recovery}`);
+        this.result = { status, error_code: identifier(code) ? code : status === 400 ? "validation_failed" : status === 404 ? "not_found" : "management_operation_failed", recovery };
+        for (const field of ["pending_requirements", "allowed_actions"]) {
+            if (Array.isArray(details[field]))
+                this.result[field] = details[field].filter(identifier).slice(0, 50);
+        }
+        if (status === 400 && typeof details.detail === "string" && details.detail.trim())
+            this.detail = boundedDetail(details.detail);
+    }
+}
+const maxDetailLength = 300;
+function boundedDetail(value) {
+    const text = value
+        .replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ")
+        .replace(/\b(https?:\/\/[^\s?#]*)[?#]\S*/gi, "$1")
+        .replace(/\s+/g, " ")
+        .trim();
+    return text.length > maxDetailLength ? `${text.slice(0, maxDetailLength - 1)}…` : text;
+}
+/**
+ * What the CLI prints for a failed command. A management failure carries what the user needs to
+ * act on (pending requirements, allowed actions, and for a 400 the validation message), which the
+ * one-line message alone used to drop.
+ */
+export function cliErrorText(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!(error instanceof ManagementOperationError))
+        return message;
+    const { recovery: _recovery, ...fields } = error.result;
+    return `${message}\n${JSON.stringify({ ...fields, ...(error.detail ? { detail: error.detail } : {}) }, null, 2)}`;
+}
+export async function currentWorkspacePath(issuer, workspaceId) {
+    const credential = await managementCredential(issuer);
+    const workspace = workspaceId ?? credential.workspace_id;
+    if (workspace !== credential.workspace_id)
+        throw new Error("This login is bound to another workspace. Run authflow login --workspace <id> to select it.");
+    return `/workspaces/${encodeURIComponent(workspace)}`;
+}
+export function redactToolSecrets(value) {
+    if (Array.isArray(value))
+        return value.map(redactToolSecrets);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !/^(origin_api_key|admin_api_key|access_token|refresh_token|onboarding_url|stripe_url|client_secret)$/.test(key)).map(([key, item]) => [key, redactToolSecrets(item)]));
+}
+//# sourceMappingURL=management.js.map

package/dist/management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.js","sourceRoot":"","sources":["../src/management.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAGrG,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc,EAAE,KAA8B;IAClI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iBAAiB,IAAI,GAAG,MAAM,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;QAClK,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IAClK,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACvC,MAAM,CAAC;YACL,6FAA6F;YAC7F,sFAAsF;YACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0FAA0F;QAC1F,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAwH;IACvI;;;OAGG;IACM,MAAM,CAAU;IACzB,YAAY,MAAc,EAAE,IAAa,EAAE,IAAI,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG;YAC7B,CAAC,CAAC,+JAA+J;YACjK,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBACzB,CAAC,CAAC,wGAAwG;oBAC1G,CAAC,CAAC,2GAA2G;gBAC/G,CAAC,CAAC,4JAA4J,CAAC;QACnK,KAAK,CAAC,gCAAgC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B,EAAE,QAAQ,EAAE,CAAC;QAC9K,KAAK,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAU,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,CAAC;CACF;AAED,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,KAAK;SACf,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC;SAC9C,OAAO,CAAC,kCAAkC,EAAE,IAAI,CAAC;SACjD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,KAAK,YAAY,wBAAwB,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACxD,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAoB;IAC7E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,IAAI,UAAU,CAAC,YAAY,CAAC;IACzD,IAAI,SAAS,KAAK,UAAU,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAC1J,OAAO,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,qGAAqG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5O,CAAC"}

package/dist/mcp/management-server.d.ts

@@ -0,0 +1,4 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Local management uses the same owner/scoped HTTP operations as the hosted MCP and portal. */
+export declare function createManagementServer(): McpServer;
+export declare function runManagementStdioServer(): Promise<void>;