authflow-cli 0.5.0 → 0.7.0

package/dist/secrets.d.ts

@@ -1,28 +1,61 @@
-/**
- * Where `register --write-secrets` puts the origin API key.
- *
- * The key is shown exactly once, so the default path of "write the receipt to disk and sort the
- * secret out later" reliably ends with a plaintext credential in a JSON file next to the source —
- * and often in git. Each target below hands it to something built to hold it.
- */
 export type SecretTarget = "user-secrets" | "env-file" | "keyvault";
 export declare const secretTargets: readonly SecretTarget[];
-/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
 export declare const originApiKeyConfigKey = "Authflow:OriginApiKey";
-/** Environment variable form of the same setting, for non-.NET origins. */
 export declare const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
-/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
 export declare const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
+export type SecretResource = {
+    issuer: string;
+    workspaceId: string;
+    slug: string;
+};
 export type WriteSecretRequest = {
     target: SecretTarget;
     value: string;
-    /** Project directory for `user-secrets`, file path for `env-file`, vault name for `keyvault`. */
+    /** Project directory/file, env-file path, or Azure Key Vault name. */
     destination?: string;
+    resource?: SecretResource;
 };
-/** Human-readable description of where the secret landed, for the receipt and console. */
-/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
-export declare function writeAdminApiKey(request: {
-    value: string;
-    destination?: string;
-}): Promise<string>;
-export declare function writeOriginApiKey(request: WriteSecretRequest): Promise<string>;
+export type PreparedSecretDestination = {
+    description: string;
+    write: (value: string) => Promise<void>;
+};
+/** Resolve the destination before a one-time key is issued. Never prints child output or secrets. */
+export declare function prepareOriginApiKey(request: Omit<WriteSecretRequest, "value">): Promise<PreparedSecretDestination>;
+/** Stable across retries; separates resources, workspaces and staging/production issuers. */
+export declare function originSecretName(resource: SecretResource): string;
+/**
+ * Destination for the legacy admin-key commands, which keep their historical defaults (`.` for
+ * user-secrets, `.env.local` for env-file). It is resolved before the rail issues anything: a key
+ * the rail has already rotated cannot be un-rotated when the destination turns out to be unusable.
+ * Key Vault secret names are scoped to a workspace, which an admin key does not have, so it is
+ * refused here rather than after the mutation.
+ */
+export declare function prepareLegacyOriginApiKey(target: SecretTarget, destination?: string): Promise<PreparedSecretDestination>;
+export declare function prepareAdminApiKey(destination?: string): Promise<PreparedSecretDestination>;
+export type IssuedKeyDelivery = {
+    stored: true;
+    description: string;
+} | {
+    stored: false;
+    reason: string;
+};
+/**
+ * Store a key the rail has already issued. A failure here cannot be repaired by retrying the
+ * mutation (the previous key may already be revoked), so it is reported to the caller, which then
+ * shows the key once rather than losing it. The reason never contains the key itself.
+ */
+export declare function deliverIssuedKey(prepared: PreparedSecretDestination, value: string): Promise<IssuedKeyDelivery>;
+type ProcessResult = {
+    code: number | null;
+    stdout: string;
+};
+/** One subprocess boundary for destination preflight and stdin delivery; all diagnostics are sanitized. */
+declare function run(command: string, args: readonly string[], stdin?: string): Promise<ProcessResult>;
+export declare const secretProcess: {
+    run: typeof run;
+};
+export declare const secretDelivery: {
+    prepare: typeof prepareOriginApiKey;
+    prepareAdmin: typeof prepareAdminApiKey;
+};
+export {};

package/dist/secrets.js

@@ -1,117 +1,262 @@
 import { spawn } from "node:child_process";
-import { appendFile, chmod, readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { access, appendFile, lstat, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 export const secretTargets = ["user-secrets", "env-file", "keyvault"];
-/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
 export const originApiKeyConfigKey = "Authflow:OriginApiKey";
-/** Environment variable form of the same setting, for non-.NET origins. */
 export const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
-/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
 export const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
-/** Human-readable description of where the secret landed, for the receipt and console. */
-/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
-export async function writeAdminApiKey(request) {
-    return writeNamedEnvVar(adminApiKeyEnvVar, request.value, request.destination);
-}
-export async function writeOriginApiKey(request) {
-    switch (request.target) {
-        case "user-secrets":
-            return writeUserSecret(request);
-        case "env-file":
-            return writeEnvFile(request);
-        case "keyvault":
-            return writeKeyVault(request);
+/** Resolve the destination before a one-time key is issued. Never prints child output or secrets. */
+export async function prepareOriginApiKey(request) {
+    if (!secretTargets.includes(request.target))
+        throw new Error("Choose user-secrets, env-file, or keyvault.");
+    if (!request.destination?.trim())
+        throw new Error("Choose an explicit --secret-destination before issuing an origin key.");
+    if (request.target === "user-secrets") {
+        const path = resolve(request.destination);
+        let project = path;
+        if ((await stat(path)).isDirectory()) {
+            const projects = (await readdir(path)).filter(name => /\.(cs|fs|vb)proj$/i.test(name));
+            if (projects.length !== 1)
+                throw new Error("The user-secrets destination must identify one .NET project.");
+            project = join(path, projects[0]);
+        }
+        const inspected = await secretProcess.run("dotnet", ["msbuild", project, "-getProperty:UserSecretsId", "-nologo"]);
+        if (inspected.code !== 0 || !inspected.stdout.trim() || /[\r\n]/.test(inspected.stdout.trim()))
+            throw new Error("The project must have a UserSecretsId. Initialize user-secrets in that project before issuing the key.");
+        return {
+            description: `dotnet user-secrets (${originApiKeyConfigKey}) in ${project}`,
+            write: async (value) => {
+                const result = await secretProcess.run("dotnet", ["user-secrets", "set", "--project", project], JSON.stringify({ [originApiKeyConfigKey]: value }));
+                if (result.code !== 0)
+                    throw new Error("The origin key could not be saved to .NET user-secrets.");
+            },
+        };
     }
+    if (request.target === "env-file")
+        return prepareEnvFile(originApiKeyEnvVar, request.destination);
+    const vault = request.destination.toLowerCase();
+    if (!/^[a-z][a-z0-9-]{1,22}[a-z0-9]$/.test(vault) || vault.includes("--"))
+        throw new Error("The Key Vault destination must be an Azure vault name, not a URL.");
+    if (!request.resource)
+        throw new Error("Key Vault delivery requires a workspace-scoped resource command.");
+    const name = originSecretName(request.resource);
+    const login = await secretProcess.run("az", ["account", "get-access-token", "--resource", "https://vault.azure.net", "--query", "accessToken", "--output", "tsv", "--only-show-errors"]);
+    const token = login.stdout.trim();
+    if (login.code !== 0 || !token || /\s/.test(token))
+        throw new Error("Sign in to the intended Azure account before issuing the origin key.");
+    const reference = `https://${vault}.vault.azure.net/secrets/${name}`;
+    await preflightVault(reference, token);
+    return {
+        description: reference,
+        write: async (value) => {
+            let response;
+            try {
+                response = await fetch(`${reference}?api-version=7.4`, {
+                    method: "PUT", redirect: "error", signal: AbortSignal.timeout(30_000),
+                    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+                    body: JSON.stringify({ value }),
+                });
+            }
+            catch {
+                throw new Error("Key Vault delivery failed. The key may not have been saved; inspect the destination before rotating again.");
+            }
+            // Key Vault responses can include the secret value. Neither success nor error bodies are printed.
+            if (!response.ok)
+                throw new Error(`Key Vault refused secret delivery (${response.status}). Check the selected account, vault and secret-write permission.`);
+            await response.body?.cancel();
+        },
+    };
 }
-async function writeUserSecret(request) {
-    const project = request.destination ?? ".";
-    await run("dotnet", ["user-secrets", "set", originApiKeyConfigKey, request.value, "--project", project]);
-    return `dotnet user-secrets (${originApiKeyConfigKey}) in ${resolve(project)}`;
-}
-async function writeEnvFile(request) {
-    return writeNamedEnvVar(originApiKeyEnvVar, request.value, request.destination);
+async function preflightVault(reference, token) {
+    let response;
+    try {
+        // Versions list returns metadata only. Never retrieve the existing secret value.
+        response = await fetch(`${reference}/versions?api-version=7.4&maxresults=1`, {
+            method: "GET", redirect: "error", signal: AbortSignal.timeout(15_000),
+            headers: { Authorization: `Bearer ${token}` },
+        });
+    }
+    catch {
+        throw new Error("The selected Key Vault could not be reached. Fix the destination before issuing the origin key.");
+    }
+    if (response.ok) {
+        await response.body?.cancel();
+        return;
+    }
+    const codes = [];
+    try {
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let length = 0;
+        if (reader) {
+            try {
+                for (;;) {
+                    const { value, done } = await reader.read();
+                    if (done)
+                        break;
+                    length += value.byteLength;
+                    if (length > 16_384)
+                        throw new Error("Oversized metadata error.");
+                    chunks.push(value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+        }
+        let error = JSON.parse(Buffer.concat(chunks).toString("utf8")).error;
+        for (let depth = 0; depth < 4 && error && typeof error === "object"; depth++) {
+            const current = error;
+            if (typeof current.code === "string")
+                codes.push(current.code.toLowerCase());
+            error = current.innererror;
+        }
+    }
+    catch { /* No response content or diagnostic message is ever exposed. */ }
+    if (codes.some(code => ["vaultnotfound", "forbiddenbyfirewall", "forbiddenbyconnection"].includes(code)))
+        throw new Error("The selected Key Vault is unavailable or blocks this connection. Fix the destination before issuing the origin key.");
+    if (response.status === 404 && codes.includes("secretnotfound"))
+        return;
+    // Listing and writing have separate permissions; a valid write-only principal may receive 403.
+    // This probe establishes reachability, not secrets/set authorization. Delivery still may fail.
+    if (response.status === 403)
+        return;
+    throw new Error(`Key Vault destination preflight failed (${response.status}). Check the selected account and vault before issuing the origin key.`);
 }
-async function writeNamedEnvVar(name, value, destination) {
-    const path = resolve(destination ?? ".env.local");
-    const line = `${name}=${value}\n`;
-    const existing = await readFileOrEmpty(path);
-    const next = existing ? `${stripVar(existing, name)}${line}` : line;
-    await writeFile(path, next, "utf8");
-    // Best-effort: a no-op on Windows, which is exactly why this is not the recommended target.
-    await chmod(path, 0o600).catch(() => undefined);
-    await ensureGitIgnored(path);
-    return path;
+/** Stable across retries; separates resources, workspaces and staging/production issuers. */
+export function originSecretName(resource) {
+    if (!/^[a-z0-9][a-z0-9-]{0,31}$/.test(resource.slug) || !resource.issuer || !resource.workspaceId)
+        throw new Error("A scoped resource is required to name its origin secret.");
+    const scope = createHash("sha256").update(JSON.stringify([resource.issuer.replace(/\/+$/, ""), resource.workspaceId, resource.slug])).digest("hex").slice(0, 16);
+    return `authflow-${resource.slug}-origin-${scope}`;
 }
-async function writeKeyVault(request) {
-    const vault = request.destination;
-    if (!vault) {
-        throw new Error("--secret-destination <vault-name> is required for --write-secrets keyvault.");
+/**
+ * Destination for the legacy admin-key commands, which keep their historical defaults (`.` for
+ * user-secrets, `.env.local` for env-file). It is resolved before the rail issues anything: a key
+ * the rail has already rotated cannot be un-rotated when the destination turns out to be unusable.
+ * Key Vault secret names are scoped to a workspace, which an admin key does not have, so it is
+ * refused here rather than after the mutation.
+ */
+export async function prepareLegacyOriginApiKey(target, destination) {
+    if (target === "keyvault") {
+        throw new Error("Key Vault delivery needs a workspace-scoped resource. Run authflow login, then authflow resource rotate-key <slug> --write-secrets keyvault --secret-destination <vault>. Nothing was issued.");
     }
-    // Key Vault names cannot contain ':'; keep the mapping mechanical so it is guessable from config.
-    const name = originApiKeyConfigKey.replace(/:/g, "--");
-    await run("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", request.value]);
-    return `Azure Key Vault ${vault}/${name}`;
+    return secretDelivery.prepare({ target, destination: destination ?? (target === "user-secrets" ? "." : ".env.local") });
+}
+export async function prepareAdminApiKey(destination) {
+    return prepareEnvFile(adminApiKeyEnvVar, destination ?? ".env.local");
 }
 /**
- * Adds the secret file to .gitignore if it is not already covered.
- *
- * Deliberately conservative: it only appends when the exact pattern is absent, because a
- * false-negative here costs one duplicate line and a false-positive leaks a credential.
+ * Store a key the rail has already issued. A failure here cannot be repaired by retrying the
+ * mutation (the previous key may already be revoked), so it is reported to the caller, which then
+ * shows the key once rather than losing it. The reason never contains the key itself.
  */
-async function ensureGitIgnored(secretPath) {
-    const gitignore = resolve(dirname(secretPath), ".gitignore");
-    const pattern = secretPath.split(/[/\\]/).pop();
-    if (!pattern) {
-        return;
+export async function deliverIssuedKey(prepared, value) {
+    try {
+        await prepared.write(value);
+        return { stored: true, description: prepared.description };
     }
-    const existing = await readFileOrEmpty(gitignore);
-    if (existing.split(/\r?\n/).some((line) => line.trim() === pattern)) {
-        return;
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return { stored: false, reason: value ? reason.split(value).join("<redacted>") : reason };
     }
-    const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-    await appendFile(gitignore, `${prefix}${pattern}\n`, "utf8");
+}
+async function prepareEnvFile(name, destination) {
+    const path = resolve(destination);
+    await access(dirname(path), constants.W_OK);
+    const existing = await lstat(path).catch((error) => { if (error.code === "ENOENT")
+        return undefined; throw error; });
+    if (existing && (!existing.isFile() || existing.isSymbolicLink()))
+        throw new Error("The env-file destination must be a regular file, not a symbolic link.");
+    if (existing)
+        await access(path, constants.W_OK);
+    // Without git installed nothing on this machine can be tracked: treat it like "not a repository".
+    const tracked = await secretProcess.run("git", ["-C", dirname(path), "ls-files", "--error-unmatch", "--", basename(path)])
+        .catch((error) => {
+        if (error.code === "ENOENT")
+            return { code: 128, stdout: "" };
+        throw error;
+    });
+    if (tracked.code === 0)
+        throw new Error("The env-file destination is tracked by git. Choose an untracked local secret file.");
+    if (tracked.code !== 1 && tracked.code !== 128)
+        throw new Error("Could not verify that the env-file destination is untracked.");
+    await readFileOrEmpty(path); // Permission/read failures must happen before key issuance where possible.
+    return {
+        description: path,
+        write: async (value) => {
+            if (/[\r\n]/.test(value))
+                throw new Error("An origin credential must fit on one env-file line.");
+            const current = await lstat(path).catch((error) => { if (error.code === "ENOENT")
+                return undefined; throw error; });
+            if (current && (!current.isFile() || current.isSymbolicLink()))
+                throw new Error("The env-file destination changed. Secret delivery stopped.");
+            const contents = await readFileOrEmpty(path);
+            // Replace every existing assignment, including `export NAME=` and `NAME = value` spellings,
+            // so the file never holds a stale key that a loader might read first.
+            const assignment = new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=`);
+            const kept = contents.split(/\r?\n/).filter(line => !assignment.test(line)).join("\n").replace(/\n+$/, "");
+            const next = `${kept ? kept + "\n" : ""}${name}=${value}\n`;
+            await ensureGitIgnored(path);
+            const temporary = join(dirname(path), `.authflow-secret-${randomBytes(16).toString("hex")}`);
+            try {
+                await writeFile(temporary, next, { encoding: "utf8", mode: 0o600, flag: "wx" });
+                await rename(temporary, path);
+            }
+            finally {
+                await rm(temporary, { force: true });
+            }
+        },
+    };
+}
+async function ensureGitIgnored(secretPath) {
+    const gitignore = join(dirname(secretPath), ".gitignore");
+    const pattern = `/${basename(secretPath).replace(/([*?\[\]\\])/g, "\\$1")}`;
+    const existing = await readFileOrEmpty(gitignore);
+    if (!existing.split(/\r?\n/).some(line => line.trim() === pattern))
+        await appendFile(gitignore, `${existing && !existing.endsWith("\n") ? "\n" : ""}${pattern}\n`, "utf8");
 }
 async function readFileOrEmpty(path) {
     try {
         return await readFile(path, "utf8");
     }
-    catch {
-        return "";
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "";
+        throw error;
     }
 }
-function stripVar(contents, name) {
-    const kept = contents
-        .split(/\r?\n/)
-        .filter((line) => !line.startsWith(`${name}=`))
-        .join("\n")
-        .replace(/\n+$/, "");
-    return kept ? `${kept}\n` : "";
-}
-/**
- * Runs a tool with the secret in argv.
- *
- * `shell: false` matters: the secret is passed as a discrete argument, so no shell ever parses it
- * and a value containing quotes or `$` cannot turn into a command.
- */
-function run(command, args) {
+/** One subprocess boundary for destination preflight and stdin delivery; all diagnostics are sanitized. */
+async function run(command, args, stdin) {
     return new Promise((resolvePromise, reject) => {
-        const child = spawn(command, [...args], { stdio: ["ignore", "ignore", "pipe"], shell: false });
-        let stderr = "";
-        child.stderr?.on("data", (chunk) => {
-            stderr += chunk.toString();
-        });
-        child.on("error", (err) => {
-            reject(err.code === "ENOENT"
-                ? new Error(`${command} was not found on PATH. Install it or use --write-secrets env-file.`)
-                : err);
-        });
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolvePromise();
-                return;
+        // Azure CLI ships az.cmd on Windows. Its only invocation here has fixed, nonsecret arguments.
+        const windowsAzure = process.platform === "win32" && command === "az";
+        if (windowsAzure && args.some(arg => !/^[a-zA-Z0-9.:/-]+$/.test(arg))) {
+            reject(new Error("Unsafe Azure CLI arguments."));
+            return;
+        }
+        const child = spawn(windowsAzure ? (process.env.ComSpec ?? "cmd.exe") : command, windowsAzure ? ["/d", "/s", "/c", "az", ...args] : [...args], { stdio: ["pipe", "pipe", "ignore"], shell: false, windowsHide: true });
+        let stdout = "";
+        const timeout = setTimeout(() => { child.kill(); reject(new Error(`${command} timed out while preparing or writing the secret destination.`)); }, 60_000);
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+            if (stdout.length > 1_048_576) {
+                child.kill();
+                reject(new Error(`${command} returned an unexpectedly large response.`));
             }
-            reject(new Error(`${command} exited with ${code}: ${stderr.trim().slice(0, 400)}`));
         });
+        child.stdin.on("error", () => { });
+        child.on("error", (error) => {
+            clearTimeout(timeout);
+            // Keep only the error code (ENOENT: not installed); the message could echo arguments.
+            reject(Object.assign(new Error(`${command} is unavailable. Fix the destination before issuing the key.`), { code: error.code }));
+        });
+        child.on("close", code => { clearTimeout(timeout); resolvePromise({ code, stdout }); });
+        child.stdin.end(stdin);
     });
 }
+export const secretProcess = { run };
+export const secretDelivery = { prepare: prepareOriginApiKey, prepareAdmin: prepareAdminApiKey };
 //# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,CAAC,MAAM,aAAa,GAA4B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE/F,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAS1D,0FAA0F;AAC1F,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgD;IACrF,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B;IACjE,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC3C,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzG,OAAO,wBAAwB,qBAAqB,QAAQ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA2B;IACrD,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,WAAoB;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,4FAA4F;IAC5F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAA2B;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,kGAAkG;IAClG,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,OAAO,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAC,OAAe,EAAE,IAAuB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,MAAM,CACJ,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,qEAAqE,CAAC;gBAC5F,CAAC,CAAC,GAAG,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,gBAAgB,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG7D,MAAM,CAAC,MAAM,aAAa,GAA4B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAe1D,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA0C;IAClF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC3G,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,SAAS,CAAC,CAAC,CAAC;QACnH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,OAAO;YACL,WAAW,EAAE,wBAAwB,qBAAqB,QAAQ,OAAO,EAAE;YAC3E,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gBACnB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBACpJ,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpG,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,yBAAyB,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzL,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,WAAW,KAAK,4BAA4B,IAAI,EAAE,CAAC;IACrE,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO;QACL,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACnB,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;oBACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;YAAC,CAAC;YAC1I,kGAAkG;YAClG,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,mEAAmE,CAAC,CAAC;YAC5J,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa;IAC5D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,iFAAiF;QACjF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,wCAAwC,EAAE;YAC3E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IAAC,CAAC;IAC/H,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAE3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,SAAS,CAAC;oBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;oBAC3B,IAAI,MAAM,GAAG,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAyB,CAAC,KAAK,CAAC;QACvG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,KAAiD,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,gEAAgE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACzI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO;IACxE,+FAA+F;IAC/F,+FAA+F;IAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;AACtJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW;QAC/F,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjK,OAAO,YAAY,QAAQ,CAAC,IAAI,WAAW,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAoB,EAAE,WAAoB;IACxF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+LAA+L,CAAC,CAAC;IACnN,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAoB;IAC3D,OAAO,cAAc,CAAC,iBAAiB,EAAE,WAAW,IAAI,YAAY,CAAC,CAAC;AACxE,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAmC,EAAE,KAAa;IACvF,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,WAAmB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC5J,IAAI,QAAQ;QAAE,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,kGAAkG;IAClG,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;SACvH,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACzF,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACL,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAC9H,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAChI,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,2EAA2E;IACxG,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACnB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3I,IAAI,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC9I,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,4FAA4F;YAC5F,sEAAsE;YACtE,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,uBAAuB,IAAI,OAAO,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3G,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,oBAAoB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;QAChE,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACnG,CAAC;AAGD,2GAA2G;AAC3G,KAAK,UAAU,GAAG,CAAC,OAAe,EAAE,IAAuB,EAAE,KAAc;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,8FAA8F;QAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI,CAAC;QACtE,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAAC,OAAO;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAC7E,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAC5D,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,+DAA+D,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1J,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,2CAA2C,CAAC,CAAC,CAAC;YAAC,CAAC;QAC5H,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAiF,CAAC,CAAC,CAAC;QACjH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACjD,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,sFAAsF;YACtF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,8DAA8D,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/status.js

@@ -78,6 +78,14 @@ export function resourceReadiness(receipt) {
                     : undefined,
         },
     ];
+    if (receipt.access_mode === "free")
+        steps.splice(2, 2);
+    if (blocked("paid_offer"))
+        steps.push({
+            name: "paid offer configured", done: false,
+            detail: "A paid MCP needs a positive price and credit allowance.",
+            command: `authflow resource update ${slug} --file offer.json`,
+        });
     // A custom host is a requirement of its own: until the tenant's DNS is in place and the edge has
     // a certificate, the resource's URL does not answer, and from the outside that looks exactly like
     // an origin that was never wired up.
@@ -102,7 +110,7 @@ export function resourceReadiness(receipt) {
     // Conformance is recorded on the receipt after POST /origin/v1/conformance. Prompt until
     // a run has passed so it is not silently skipped, and stop prompting after a pass.
     if (receipt.origin_base_uri) {
-        const probed = receipt.last_probe_passed === true;
+        const probed = receipt.last_probe_passed === true && !blocked("origin_verification");
         const at = receipt.last_probe_at_utc?.trim();
         steps.push({
             name: "conformance probed",
@@ -117,7 +125,7 @@ export function resourceReadiness(receipt) {
     }
     return {
         slug,
-        status: receipt.status ?? (pending.length === 0 ? "live" : "draft"),
+        status: receipt.status ?? "draft",
         ready: pending.length === 0 && receipt.status === "live",
         gatewayUrl: receipt.gateway_url ?? receipt.resource,
         customDomain,

package/dist/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAiCD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,qCAAqC;IACrC,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,YAAY,EAAE,IAAI,IAAI,qBAAqB,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC3F,KAAK,EACH,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC;oBACE,EAAE;oBACF,GAAG,gBAAgB,CAAC,OAAO,CAAC;oBAC5B,GAAG,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;gBACH,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAClD,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,CAAC,CAAC,EAAE;oBACF,CAAC,CAAC,sBAAsB,EAAE,EAAE;oBAC5B,CAAC,CAAC,2EAA2E;YACjF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB;QACtD,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACjC,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,SAAS;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;QAC1C,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,wEAAwE;YACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAiCD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK;YAC1C,MAAM,EAAE,yDAAyD;YACjE,OAAO,EAAE,4BAA4B,IAAI,oBAAoB;SAC9D,CAAC,CAAC;IAEH,iGAAiG;IACjG,kGAAkG;IAClG,qCAAqC;IACrC,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,YAAY,EAAE,IAAI,IAAI,qBAAqB,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC3F,KAAK,EACH,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC;oBACE,EAAE;oBACF,GAAG,gBAAgB,CAAC,OAAO,CAAC;oBAC5B,GAAG,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;gBACH,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACrF,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,CAAC,CAAC,EAAE;oBACF,CAAC,CAAC,sBAAsB,EAAE,EAAE;oBAC5B,CAAC,CAAC,2EAA2E;YACjF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB;QACtD,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACjC,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,SAAS;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;QAC1C,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,wEAAwE;YACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/surface.d.ts

@@ -19,5 +19,6 @@ export declare const mcpToolToCliCommand: {
     readonly authflow_probe: "probe";
     readonly authflow_mint_test_header: "mint-header";
     readonly authflow_rotate_origin_key: "rotate-origin-key";
+    readonly authflow_send_feedback: "feedback";
 };
 export type McpOnboardingTool = keyof typeof mcpToolToCliCommand;

package/dist/surface.js

@@ -19,5 +19,6 @@ export const mcpToolToCliCommand = {
     authflow_probe: "probe",
     authflow_mint_test_header: "mint-header",
     authflow_rotate_origin_key: "rotate-origin-key",
+    authflow_send_feedback: "feedback",
 };
 //# sourceMappingURL=surface.js.map

package/dist/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,0BAA0B,EAAE,YAAY;IACxC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,0BAA0B,EAAE,YAAY;IACxC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;IAC/C,sBAAsB,EAAE,UAAU;CAC1B,CAAC"}

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,cAAc,EAAE,CAAC;AAEnD,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA2B,CAAC,OAAO,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,cAAc,EAAE,CAAC;AAEnD,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA2B,CAAC,OAAO,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "authflow-cli",
-  "version": "0.5.0",
-  "description": "Authflow Rail onboarding CLI — register, mint-header, probe, scaffold",
+  "version": "0.7.0",
+  "description": "Authflow creator CLI — browser login, workspace and MCP resource management, Stripe setup, and a local management MCP adapter",
   "type": "module",
   "bin": {
     "authflow": "dist/cli.js"
@@ -12,7 +12,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node scripts/copy-integration-plans.mjs",
     "start": "node dist/cli.js",
     "authflow": "tsx src/cli.ts",
     "test": "node --import tsx --test \"test/**/*.test.ts\"",
@@ -20,17 +20,18 @@
     "prepublishOnly": "npm run build"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.12.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "commander": "^13.1.0",
-    "zod": "^4.5.4"
+    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@napi-rs/keyring": "2.1.0",
+    "commander": "^15.0.0",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^22.13.10",
-    "tsx": "^4.19.3",
-    "typescript": "^5.8.2"
+    "@types/node": "^22.20.4",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2"
   },
   "homepage": "https://docs.authflow.ai/docs/tools/cli",
   "bugs": {