authflow-cli 0.6.0 → 0.7.0

package/dist/login.js

@@ -4,10 +4,25 @@ import { spawn } from "node:child_process";
 import { once } from "node:events";
 import { z } from "zod";
 import { credentialStore } from "./credentials.js";
+import { writeLoginCallback } from "./login-callback.js";
 const metadataSchema = z.object({
     issuer: z.string(), authorization_endpoint: z.string().url(), token_endpoint: z.string().url(),
     registration_endpoint: z.string().url(), revocation_endpoint: z.string().url().optional(),
+    authorization_response_iss_parameter_supported: z.boolean().optional(),
 });
+/**
+ * RFC 9207 mix-up defense. An issuer that advertises the `iss` authorization-response parameter
+ * (Rail does) must send exactly one, matching the issuer this login started with; a response
+ * without it is not from that issuer's authorization endpoint. Others may omit it, but never send
+ * a wrong or duplicated one.
+ */
+export function acceptsCallbackIssuer(values, issuer, required) {
+    if (values.length > 1)
+        return false;
+    if (values.length === 0)
+        return !required;
+    return values[0].replace(/\/+$/, "") === issuer;
+}
 const tokenSchema = z.object({ access_token: z.string().min(1), refresh_token: z.string().optional(), expires_in: z.number().positive(), token_type: z.string() });
 export function validatedIssuer(value) {
     const url = new URL(value);
@@ -35,87 +50,103 @@ export function matchesOAuthState(actual, expected) {
 }
 export async function login(issuerValue, workspaceId, open = true) {
     const issuer = validatedIssuer(issuerValue);
-    return credentialStore.withLock(issuer, async () => {
-        const discovery = await metadata(issuer);
-        const verifier = randomBytes(48).toString("base64url");
-        const state = randomBytes(32).toString("base64url");
-        const callback = createServer();
-        callback.listen(0, "127.0.0.1");
-        await once(callback, "listening");
-        const address = callback.address();
-        if (!address || typeof address === "string")
-            throw new Error("Cannot open the loopback callback.");
-        const redirectUri = `http://127.0.0.1:${address.port}/callback`;
-        try {
-            const registration = await fetch(discovery.registration_endpoint, {
-                method: "POST", headers: { "Content-Type": "application/json" }, redirect: "error", signal: AbortSignal.timeout(15_000),
-                body: JSON.stringify({ client_name: "Authflow CLI", application_type: "native", redirect_uris: [redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" }),
-            });
-            if (!registration.ok)
-                throw new Error(`CLI registration failed (${registration.status}).`);
-            const { client_id } = z.object({ client_id: z.string() }).parse(await registration.json());
-            const authorize = new URL(discovery.authorization_endpoint);
-            authorize.search = new URLSearchParams({ client_id, redirect_uri: redirectUri, response_type: "code", scope: "management:read management:write offline_access", resource: `${issuer}/management/mcp`, code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state, ...(workspaceId ? { workspace_id: workspaceId } : {}) }).toString();
-            const code = new Promise((resolve, reject) => {
-                const timeout = setTimeout(() => reject(new Error("Sign-in timed out. Run authflow login again.")), 300_000);
-                let completed = false;
-                callback.on("request", (request, response) => {
-                    let url;
-                    try {
-                        url = new URL(request.url ?? "/", redirectUri);
-                    }
-                    catch {
-                        response.writeHead(400).end("Invalid login callback.");
-                        return;
-                    }
-                    if (completed || request.method !== "GET" || url.origin !== new URL(redirectUri).origin || url.pathname !== "/callback"
-                        || request.headers.host !== `127.0.0.1:${address.port}` || url.searchParams.getAll("state").length !== 1
-                        || !matchesOAuthState(url.searchParams.get("state"), state)) {
-                        response.writeHead(400).end("Invalid login callback.");
-                        return;
-                    }
-                    completed = true;
-                    clearTimeout(timeout);
-                    const codeValue = url.searchParams.getAll("code").length === 1 && !url.searchParams.has("error") ? url.searchParams.get("code") : null;
-                    if (url.searchParams.getAll("iss").length > 1 || url.searchParams.get("iss") && url.searchParams.get("iss").replace(/\/+$/, "") !== issuer) {
-                        response.writeHead(400).end("Invalid issuer.");
-                        reject(new Error("Login issuer mismatch."));
-                        return;
-                    }
-                    response.writeHead(codeValue ? 200 : 400, { "Content-Type": "text/plain", "Cache-Control": "no-store" }).end(codeValue ? "Authflow sign-in finished. Return to your terminal." : "Sign-in was not completed. Return to your terminal.");
-                    if (codeValue)
-                        resolve(codeValue);
-                    else
-                        reject(new Error("Sign-in was declined or could not be completed."));
-                });
-                callback.on("close", () => clearTimeout(timeout));
+    // The browser step can take minutes. Holding the credential lock through it made every other
+    // CLI command and MCP call for this issuer give up after 45 s, so only the save is serialized.
+    const discovery = await metadata(issuer);
+    const verifier = randomBytes(48).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const callback = createServer();
+    callback.listen(0, "127.0.0.1");
+    await once(callback, "listening");
+    const address = callback.address();
+    if (!address || typeof address === "string")
+        throw new Error("Cannot open the loopback callback.");
+    const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+    try {
+        const registration = await fetch(discovery.registration_endpoint, {
+            method: "POST", headers: { "Content-Type": "application/json" }, redirect: "error", signal: AbortSignal.timeout(15_000),
+            body: JSON.stringify({ client_name: "Authflow CLI", application_type: "native", redirect_uris: [redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" }),
+        });
+        if (!registration.ok)
+            throw new Error(`CLI registration failed (${registration.status}).`);
+        const { client_id } = z.object({ client_id: z.string() }).parse(await registration.json());
+        const authorize = new URL(discovery.authorization_endpoint);
+        authorize.search = new URLSearchParams({ client_id, redirect_uri: redirectUri, response_type: "code", scope: "management:read management:write offline_access", resource: `${issuer}/management/mcp`, code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state, ...(workspaceId ? { workspace_id: workspaceId } : {}) }).toString();
+        const code = new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => reject(new Error("Sign-in timed out. Run authflow login again.")), 300_000);
+            let completed = false;
+            callback.on("request", (request, response) => {
+                let url;
+                try {
+                    url = new URL(request.url ?? "/", redirectUri);
+                }
+                catch {
+                    writeLoginCallback(response, "invalidCallback");
+                    return;
+                }
+                if (completed || request.method !== "GET" || url.origin !== new URL(redirectUri).origin || url.pathname !== "/callback"
+                    || request.headers.host !== `127.0.0.1:${address.port}` || url.searchParams.getAll("state").length !== 1
+                    || !matchesOAuthState(url.searchParams.get("state"), state)) {
+                    writeLoginCallback(response, "invalidCallback");
+                    return;
+                }
+                completed = true;
+                clearTimeout(timeout);
+                const codeValue = url.searchParams.getAll("code").length === 1 && !url.searchParams.has("error") ? url.searchParams.get("code") : null;
+                if (!acceptsCallbackIssuer(url.searchParams.getAll("iss"), issuer, discovery.authorization_response_iss_parameter_supported === true)) {
+                    writeLoginCallback(response, "invalidIssuer");
+                    reject(new Error("Login issuer mismatch."));
+                    return;
+                }
+                writeLoginCallback(response, codeValue ? "received" : "declined");
+                if (codeValue)
+                    resolve(codeValue);
+                else
+                    reject(new Error("Sign-in was declined or could not be completed."));
             });
-            process.stderr.write(`Complete sign-in in your browser:\n${authorize.href}\n`);
-            if (open)
-                openBrowser(authorize.href);
-            const authorizationCode = await code;
-            const tokenResponse = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "authorization_code", client_id, redirect_uri: redirectUri, code: authorizationCode, code_verifier: verifier, resource: `${issuer}/management/mcp` }) });
-            if (!tokenResponse.ok)
-                throw new Error(`Sign-in token exchange failed (${tokenResponse.status}).`);
-            const token = tokenSchema.parse(await tokenResponse.json());
-            if (token.token_type.toLowerCase() !== "bearer")
-                throw new Error("Unsupported token type.");
-            // Ask Rail which workspace this credential can access; never trust an unverified JWT decode.
-            const workspaceResponse = await fetch(`${issuer}/management/v1/workspaces`, { redirect: "error", headers: { Authorization: `Bearer ${token.access_token}` }, signal: AbortSignal.timeout(15_000) });
-            if (!workspaceResponse.ok)
-                throw new Error("The management credential has no accessible workspace.");
-            const workspaces = z.array(z.object({ id: z.string() })).parse(await workspaceResponse.json());
-            const workspace = workspaces.find(w => !workspaceId || w.id === workspaceId);
-            if (!workspace)
-                throw new Error("Create a workspace in the portal and run authflow login again.");
-            await credentialStore.save({ issuer, client_id, access_token: token.access_token, refresh_token: token.refresh_token, expires_at: Date.now() + token.expires_in * 1000, workspace_id: workspace.id });
-            return { issuer, workspace_id: workspace.id };
-        }
-        finally {
-            callback.close();
-            callback.closeAllConnections();
-        }
-    });
+            callback.on("close", () => clearTimeout(timeout));
+        });
+        process.stderr.write(`Complete sign-in in your browser:\n${authorize.href}\n`);
+        if (open)
+            openBrowser(authorize.href);
+        const authorizationCode = await code;
+        const tokenResponse = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "authorization_code", client_id, redirect_uri: redirectUri, code: authorizationCode, code_verifier: verifier, resource: `${issuer}/management/mcp` }) });
+        if (!tokenResponse.ok)
+            throw new Error(`Sign-in token exchange failed (${tokenResponse.status}).`);
+        const token = tokenSchema.parse(await tokenResponse.json());
+        if (token.token_type.toLowerCase() !== "bearer")
+            throw new Error("Unsupported token type.");
+        // Ask Rail which workspace this credential can access; never trust an unverified JWT decode.
+        const workspaceResponse = await fetch(`${issuer}/management/v1/workspaces`, { redirect: "error", headers: { Authorization: `Bearer ${token.access_token}` }, signal: AbortSignal.timeout(15_000) });
+        if (!workspaceResponse.ok)
+            throw new Error("The management credential has no accessible workspace.");
+        const workspaces = z.array(z.object({ id: z.string() })).parse(await workspaceResponse.json());
+        const workspace = workspaces.find(w => !workspaceId || w.id === workspaceId);
+        if (!workspace)
+            throw new Error("Create a workspace in the portal and run authflow login again.");
+        const credential = { issuer, client_id, access_token: token.access_token, refresh_token: token.refresh_token, expires_at: Date.now() + token.expires_in * 1000, workspace_id: workspace.id };
+        await credentialStore.withLock(issuer, async () => {
+            // An unreadable stored login is the repair case: there is nothing in it to revoke.
+            const previous = await credentialStore.read(issuer).catch(() => undefined);
+            if (previous) {
+                try {
+                    await revokeLogin(issuer, previous, discovery, true);
+                }
+                catch (error) {
+                    // Keep the earlier login, which is the only local copy of what could still revoke it, and do not
+                    // leave the sign-in just made behind as a second live grant nothing stores.
+                    await revokeLogin(issuer, credential, discovery).catch(() => undefined);
+                    throw new Error(`Your previous login for this issuer could not be revoked, so it was kept and this sign-in was discarded (${error instanceof Error ? error.message : "unknown error"}) Run authflow logout, or revoke the CLI in portal account settings and then authflow logout --local-only, and sign in again.`);
+                }
+            }
+            await credentialStore.save(credential);
+        });
+        return { issuer, workspace_id: workspace.id };
+    }
+    finally {
+        callback.close();
+        callback.closeAllConnections();
+    }
 }
 export async function managementCredential(issuerValue) {
     const issuer = validatedIssuer(issuerValue);
@@ -144,33 +175,48 @@ async function renewCredential(issuer, credential) {
 }
 export async function logout(issuerValue, options = {}) {
     const issuer = validatedIssuer(issuerValue);
-    await credentialStore.withLock(issuer, async () => {
+    return credentialStore.withLock(issuer, async () => {
+        // Local-only cleanup is also the repair path for an unreadable stored login, so it never reads it.
         if (options.localOnly) {
             await credentialStore.delete(issuer);
-            return;
+            return { signed_out: true, authorization_revoked: false };
         }
         const stored = await credentialStore.read(issuer);
         if (!stored)
-            return;
-        // A fresh access token is necessary to revoke the durable workspace grant,
-        // including other still-valid access tokens from this login.
-        const credential = await renewCredential(issuer, stored).catch(() => stored);
-        const discovery = await metadata(issuer);
-        if (!discovery.revocation_endpoint)
-            throw new Error("This issuer does not advertise revocation. Revoke the CLI in portal account settings before removing its login.");
-        const grantRevocation = await fetch(`${issuer}/management/v1/authorization/revoke`, {
-            method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), headers: { Authorization: `Bearer ${credential.access_token}` },
-        });
-        if (!grantRevocation.ok)
-            throw new Error("Rail could not confirm workspace authorization revocation. Retry logout, or revoke this CLI in portal account settings and then use authflow logout --local-only to clear this device.");
-        for (const token of [credential.refresh_token, credential.access_token].filter(Boolean)) {
-            const response = await fetch(discovery.revocation_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ client_id: credential.client_id, token: token }) });
-            if (!response.ok)
-                throw new Error("Rail could not revoke this login. Retry logout or revoke the CLI from portal account settings.");
-        }
+            return { signed_out: false, reason: "no_login" };
+        await revokeLogin(issuer, stored, await metadata(issuer));
         await credentialStore.delete(issuer);
+        return { signed_out: true, authorization_revoked: true };
     });
 }
+/**
+ * Revokes a stored login on the server: its durable workspace grant, then its latest refresh and
+ * access tokens. Logout uses it, and so does login before it replaces an earlier login, which would
+ * otherwise stay valid with no local copy left to revoke it.
+ * `replacing` tolerates an earlier login that is already unusable (it could not be renewed and its
+ * access token is refused), because a user re-authenticating is often doing so for exactly that reason.
+ */
+async function revokeLogin(issuer, stored, discovery, replacing = false) {
+    // A fresh access token is necessary to revoke the durable workspace grant,
+    // including other still-valid access tokens from this login.
+    let renewed = true;
+    const credential = await renewCredential(issuer, stored).catch(() => { renewed = false; return stored; });
+    if (!discovery.revocation_endpoint)
+        throw new Error("This issuer does not advertise revocation. Revoke the CLI in portal account settings before removing its login.");
+    const grantRevocation = await fetch(`${issuer}/management/v1/authorization/revoke`, {
+        method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), headers: { Authorization: `Bearer ${credential.access_token}` },
+    });
+    if (!grantRevocation.ok) {
+        if (replacing && !renewed && grantRevocation.status === 401)
+            return;
+        throw new Error("Rail could not confirm workspace authorization revocation. Retry logout, or revoke this CLI in portal account settings and then use authflow logout --local-only to clear this device.");
+    }
+    for (const token of [credential.refresh_token, credential.access_token].filter(Boolean)) {
+        const response = await fetch(discovery.revocation_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ client_id: credential.client_id, token: token }) });
+        if (!response.ok)
+            throw new Error("Rail could not revoke this login. Retry logout or revoke the CLI from portal account settings.");
+    }
+}
 function openBrowser(url) {
     const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
     const executable = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open";

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AAEzE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC1F,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnK,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvL,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7I,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1H,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YACnF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,QAAgB;IACvE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,WAAmB,EAAE,WAAoB,EAAE,IAAI,GAAG,IAAI;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE;gBAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBACvH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC;aACpO,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3F,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAC5D,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3X,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC7G,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;oBAC3C,IAAI,GAAQ,CAAC;oBACb,IAAI,CAAC;wBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;oBAAC,CAAC;oBACvD,MAAM,CAAC;wBAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACzE,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;2BAClH,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;2BACrG,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC9D,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;wBAAC,OAAO;oBACjE,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;oBACjB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACvI,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;wBAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;wBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACrP,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;oBACxO,IAAI,SAAS;wBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;wBAAM,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;gBAC/G,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;YAC/E,IAAI,IAAI;gBAAE,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC;YACrC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;YACvU,IAAI,CAAC,aAAa,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;YACnG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5F,6FAA6F;YAC7F,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpM,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACrG,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAClG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACtM,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC;gBAAS,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACrF,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAA2B;IACtE,IAAI,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,UAAU,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/S,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;IACnL,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,UAAmC,EAAE;IACrF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAChD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QACvK,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qCAAqC,EAAE;YAClF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE;SACxI,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;QACnO,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACvN,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACvH,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzF,8CAA8C,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAgB,EAAE,MAAc,EAAE,QAAiB;IACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnK,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvL,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7I,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1H,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YACnF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,QAAgB;IACvE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,WAAmB,EAAE,WAAoB,EAAE,IAAI,GAAG,IAAI;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAChC,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE;YAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACvH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC;SACpO,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3F,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC5D,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3X,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7G,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;gBAC3C,IAAI,GAAQ,CAAC;gBACb,IAAI,CAAC;oBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;gBAAC,CAAC;gBACvD,MAAM,CAAC;oBAAC,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAClE,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;uBAClH,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;uBACrG,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC9D,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAAC,OAAO;gBAC1D,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,8CAA8C,KAAK,IAAI,CAAC,EAAE,CAAC;oBAAC,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC9O,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAClE,IAAI,SAAS;oBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;oBAAM,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/E,IAAI,IAAI;YAAE,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;QACvU,IAAI,CAAC,aAAa,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5F,6FAA6F;QAC7F,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpM,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACrG,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAClG,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QAC7L,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAChD,mFAAmF;YACnF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3E,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,iGAAiG;oBACjG,4EAA4E;oBAC5E,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,4GAA4G,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,+HAA+H,CAAC,CAAC;gBACvT,CAAC;YACH,CAAC;YACD,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;IAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACrF,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAA2B;IACtE,IAAI,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,UAAU,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/S,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;IACnL,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AAChB,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,OAAO,GAA4B,EAAE;IACrF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAA2B,EAAE;QACxE,mGAAmG;QACnG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9D,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,MAAuB,EAAE,SAAoB,EAAE,SAAS,GAAG,KAAK;IACzG,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,SAAS,CAAC,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;IACvK,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qCAAqC,EAAE;QAClF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE;KACxI,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QACpE,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACtI,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACvH,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/management.d.ts

@@ -11,7 +11,18 @@ export declare class ManagementOperationError extends Error {
         allowed_actions?: string[];
         recovery: string;
     };
-    constructor(status: number, body: unknown);
+    /**
+     * The validation message of a 400 (ProblemDetails `detail`), bounded and with URL queries removed.
+     * Printed by the CLI to the user's terminal; deliberately not part of `result`, which tool replies use.
+     */
+    readonly detail?: string;
+    constructor(status: number, body: unknown, path?: string);
 }
+/**
+ * What the CLI prints for a failed command. A management failure carries what the user needs to
+ * act on (pending requirements, allowed actions, and for a 400 the validation message), which the
+ * one-line message alone used to drop.
+ */
+export declare function cliErrorText(error: unknown): string;
 export declare function currentWorkspacePath(issuer: string, workspaceId?: string): Promise<string>;
 export declare function redactToolSecrets(value: unknown): unknown;

package/dist/management.js

@@ -23,33 +23,68 @@ export async function managementRequest(issuer, path, method = "GET", body, quer
             result = await response.json();
         }
         catch {
-            throw new Error(`Rail returned an unreadable management response (${response.status}). Read current resource status before explicitly retrying a mutation.`);
+            // Rail answers an unknown resource with a bare 404, and a request it cannot bind with a bare
+            // 400. Both still have a precise recovery, which an "unreadable response" would hide.
+            if (response.status !== 400 && response.status !== 404)
+                throw new Error(`Rail returned an unreadable management response (${response.status}). Read current resource status before explicitly retrying a mutation.`);
         }
     }
     if (!response.ok) {
         // Do not print arbitrary server bodies: error details may contain a sensitive return URL.
-        throw new ManagementOperationError(response.status, result);
+        throw new ManagementOperationError(response.status, result, path);
     }
     return result;
 }
 /** Only machine-readable public fields may cross into an agent's error message. */
 export class ManagementOperationError extends Error {
     result;
-    constructor(status, body) {
+    /**
+     * The validation message of a 400 (ProblemDetails `detail`), bounded and with URL queries removed.
+     * Printed by the CLI to the user's terminal; deliberately not part of `result`, which tool replies use.
+     */
+    detail;
+    constructor(status, body, path = "") {
         const details = body && typeof body === "object" ? body : {};
         const identifier = (value) => typeof value === "string" && /^[a-z0-9_]{1,80}$/.test(value);
         const code = details.error_code ?? details.error;
         const recovery = status === 400
             ? "Check the supplied arguments against the tool's documented constraints, correct invalid values, and explicitly retry. Writes are never automatically retried."
-            : "Read the resource's current readiness, resolve its pending requirements, and explicitly retry the intended action. Writes are never automatically retried.";
+            : status === 404
+                ? path.startsWith("/docs/")
+                    ? "No such documentation page. Find a valid path with `authflow docs search` (MCP: authflow_search_docs)."
+                    : "Not found in this workspace. List resources with `authflow resource list` (MCP: authflow_list_resources)."
+                : "Read the resource's current readiness, resolve its pending requirements, and explicitly retry the intended action. Writes are never automatically retried.";
         super(`Management operation failed (${status}${identifier(code) ? `: ${code}` : ""}). ${recovery}`);
-        this.result = { status, error_code: identifier(code) ? code : status === 400 ? "validation_failed" : "management_operation_failed", recovery };
+        this.result = { status, error_code: identifier(code) ? code : status === 400 ? "validation_failed" : status === 404 ? "not_found" : "management_operation_failed", recovery };
         for (const field of ["pending_requirements", "allowed_actions"]) {
             if (Array.isArray(details[field]))
                 this.result[field] = details[field].filter(identifier).slice(0, 50);
         }
+        if (status === 400 && typeof details.detail === "string" && details.detail.trim())
+            this.detail = boundedDetail(details.detail);
     }
 }
+const maxDetailLength = 300;
+function boundedDetail(value) {
+    const text = value
+        .replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ")
+        .replace(/\b(https?:\/\/[^\s?#]*)[?#]\S*/gi, "$1")
+        .replace(/\s+/g, " ")
+        .trim();
+    return text.length > maxDetailLength ? `${text.slice(0, maxDetailLength - 1)}…` : text;
+}
+/**
+ * What the CLI prints for a failed command. A management failure carries what the user needs to
+ * act on (pending requirements, allowed actions, and for a 400 the validation message), which the
+ * one-line message alone used to drop.
+ */
+export function cliErrorText(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!(error instanceof ManagementOperationError))
+        return message;
+    const { recovery: _recovery, ...fields } = error.result;
+    return `${message}\n${JSON.stringify({ ...fields, ...(error.detail ? { detail: error.detail } : {}) }, null, 2)}`;
+}
 export async function currentWorkspacePath(issuer, workspaceId) {
     const credential = await managementCredential(issuer);
     const workspace = workspaceId ?? credential.workspace_id;

package/dist/management.js.map

@@ -1 +1 @@
-{"version":3,"file":"management.js","sourceRoot":"","sources":["../src/management.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAGrG,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc,EAAE,KAA8B;IAClI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iBAAiB,IAAI,GAAG,MAAM,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;QAClK,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IAClK,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACvC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;QAAC,CAAC;IACzK,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0FAA0F;QAC1F,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAwH;IACvI,YAAY,MAAc,EAAE,IAAa;QACvC,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG;YAC7B,CAAC,CAAC,+JAA+J;YACjK,CAAC,CAAC,4JAA4J,CAAC;QACjK,KAAK,CAAC,gCAAgC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B,EAAE,QAAQ,EAAE,CAAC;QAC/I,KAAK,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAU,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAoB;IAC7E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,IAAI,UAAU,CAAC,YAAY,CAAC;IACzD,IAAI,SAAS,KAAK,UAAU,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAC1J,OAAO,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,qGAAqG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5O,CAAC"}
+{"version":3,"file":"management.js","sourceRoot":"","sources":["../src/management.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAGrG,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc,EAAE,KAA8B;IAClI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iBAAiB,IAAI,GAAG,MAAM,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;QAClK,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IAClK,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACvC,MAAM,CAAC;YACL,6FAA6F;YAC7F,sFAAsF;YACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0FAA0F;QAC1F,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAwH;IACvI;;;OAGG;IACM,MAAM,CAAU;IACzB,YAAY,MAAc,EAAE,IAAa,EAAE,IAAI,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG;YAC7B,CAAC,CAAC,+JAA+J;YACjK,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBACzB,CAAC,CAAC,wGAAwG;oBAC1G,CAAC,CAAC,2GAA2G;gBAC/G,CAAC,CAAC,4JAA4J,CAAC;QACnK,KAAK,CAAC,gCAAgC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B,EAAE,QAAQ,EAAE,CAAC;QAC9K,KAAK,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAU,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,CAAC;CACF;AAED,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,KAAK;SACf,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC;SAC9C,OAAO,CAAC,kCAAkC,EAAE,IAAI,CAAC;SACjD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,KAAK,YAAY,wBAAwB,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACxD,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAoB;IAC7E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,IAAI,UAAU,CAAC,YAAY,CAAC;IACzD,IAAI,SAAS,KAAK,UAAU,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAC1J,OAAO,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,qGAAqG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5O,CAAC"}

package/dist/mcp/management-server.js

@@ -4,22 +4,26 @@ import { z } from "zod";
 import { requireIssuer } from "../config.js";
 import { currentWorkspacePath, managementRequest, managementResourceActions, ManagementOperationError, redactToolSecrets } from "../management.js";
 import { integrationFrameworks } from "../integration.js";
+import { originBaseUriProblem } from "../rail.js";
 import { cliVersion } from "../version.js";
+import { feedbackBody, feedbackInputSchema, feedbackInstruction, feedbackToolDescription, feedbackToolTitle, sendWorkspaceFeedback, withFeedbackRecovery } from "../feedback.js";
 const reply = (data) => ({ content: [{ type: "text", text: JSON.stringify(redactToolSecrets(data), null, 2) }] });
 async function attempt(operation) {
     try {
         return reply(await operation());
     }
     catch (error) {
-        if (error instanceof ManagementOperationError)
-            return { ...reply(error.result), structuredContent: error.result, isError: true };
-        return { content: [{ type: "text", text: error instanceof Error ? error.message : "The operation could not be completed." }], isError: true };
+        if (error instanceof ManagementOperationError) {
+            const result = { ...error.result, recovery: withFeedbackRecovery(error.result.recovery) };
+            return { ...reply(result), structuredContent: result, isError: true };
+        }
+        return { content: [{ type: "text", text: withFeedbackRecovery(error instanceof Error ? error.message : "The operation could not be completed.") }], isError: true };
     }
 }
 /** Local management uses the same owner/scoped HTTP operations as the hosted MCP and portal. */
 export function createManagementServer() {
-    const server = new McpServer({ name: "authflow-management", version: cliVersion }, {
-        instructions: "Use the workspace login stored by authflow login. Never request an admin key or OAuth token in chat. Create a draft, configure its origin and free or paid offer, retrieve its integration plan, verify, and explicitly publish. Free and gateway-metered MCPs need no origin key. Only paid origin_reported setup needs direct CLI secret-store delivery. Stripe requires the owner to complete a browser action. Use documentation search/get for details and return readiness requirements exactly as Rail reports them. Mutations are not automatically retried.",
+    const server = new McpServer({ name: "authflow-management", title: "Authflow workspace management", version: cliVersion, websiteUrl: "https://docs.authflow.ai/docs/tools/cli", icons: [{ src: "https://authflow.ai/brand/icon-192.png", mimeType: "image/png", sizes: ["192x192"] }] }, {
+        instructions: "Use the workspace login stored by authflow login. Never request an admin key or OAuth token in chat. Create a draft, configure its origin and free or paid offer, retrieve its integration plan, verify, and explicitly publish. Free and gateway-metered MCPs need no origin key. Only paid origin_reported setup needs direct CLI secret-store delivery. Stripe requires the owner to complete a browser action. Use documentation search/get for details and return readiness requirements exactly as Rail reports them. Mutations are not automatically retried." + feedbackInstruction,
     });
     const issuer = z.string().optional().describe("Authflow issuer; defaults to AUTHFLOW_ISSUER.");
     const slug = z.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/);
@@ -56,24 +60,36 @@ export function createManagementServer() {
         tool_units: z.record(z.string().min(1).max(128), meteringUnits)
             .refine(value => Object.keys(value).length <= 64, "At most 64 tools may declare a cost.").optional(),
     };
-    const draft = { slug, display_name: z.string().min(1).max(160), access_mode: z.enum(["free", "paid"]), currency: z.string().length(3).optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering };
+    // Create and update share one set of field rules; only optionality differs.
+    const displayName = z.string().min(1).max(160);
+    const currency = z.string().length(3);
+    const draft = { slug, display_name: displayName, access_mode: z.enum(["free", "paid"]), currency: currency.optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering };
+    // Rail requires an absolute URI with no path, query or fragment: the gateway appends /mcp itself.
+    const originBaseUri = z.string().url().superRefine((value, context) => {
+        const problem = originBaseUriProblem(value);
+        if (problem)
+            context.addIssue({ code: "custom", message: problem });
+    });
     server.registerTool("authflow_create_resource", { title: "Create an unpublished MCP draft", description: "Creates a free or paid draft, defaulting to gateway metering. Free and gateway-metered origins need no key. Paid origin_reported integrations require direct CLI secret-store delivery. Secrets are never returned in tool messages." + meteringConstraints, inputSchema: { issuer, workspace_id, ...draft }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, ...body }) => attempt(async () => {
         const base = requireIssuer(value);
         const path = await currentWorkspacePath(base, workspace);
         const result = await managementRequest(base, `${path}/resources`, "POST", body);
         return { ...result, integration_plan: { tool: "authflow_integration_plan", arguments: { workspace_id: decodeURIComponent(path.split("/")[2]), slug: body.slug }, frameworks: [...integrationFrameworks] } };
     }));
-    server.registerTool("authflow_update_resource", { title: "Update MCP name, offer, or metering", description: "Omitted fields are preserved. A supplied tool_units map replaces all tool overrides. Policy changes invalidate verification and publication; verify and explicitly republish." + meteringConstraints, inputSchema: { issuer, workspace_id, slug, display_name: z.string().optional(), access_mode: z.enum(["free", "paid"]).optional(), currency: z.string().optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, ...body }) => attempt(async () => {
+    server.registerTool("authflow_update_resource", { title: "Update MCP name, offer, or metering", description: "Omitted fields are preserved. A supplied tool_units map replaces all tool overrides. Policy changes invalidate verification and publication; verify and explicitly republish." + meteringConstraints, inputSchema: { issuer, workspace_id, slug, display_name: displayName.optional(), access_mode: z.enum(["free", "paid"]).optional(), currency: currency.optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, ...body }) => attempt(async () => {
         const base = requireIssuer(value);
         return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}`, "PATCH", body);
     }));
-    server.registerTool("authflow_set_origin", { title: "Set the MCP origin", inputSchema: { issuer, workspace_id, slug, origin_base_uri: z.string().url() }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, origin_base_uri }) => attempt(async () => {
+    server.registerTool("authflow_set_origin", { title: "Set the MCP origin", description: "origin_base_uri is the private origin's scheme and host only, with no path, query, fragment or /mcp suffix: the gateway appends /mcp.", inputSchema: { issuer, workspace_id, slug, origin_base_uri: originBaseUri }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, origin_base_uri }) => attempt(async () => {
         const base = requireIssuer(value);
         return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/origin`, "POST", { origin_base_uri });
     }));
-    server.registerTool("authflow_set_custom_domain", { title: "Set the MCP custom hostname", inputSchema: { issuer, workspace_id, slug, public_host: z.string(), public_path: z.string().default("/mcp") }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, public_host, public_path }) => attempt(async () => {
+    // public_path is sent only when given: Rail uses /mcp the first time a host is set and keeps the stored
+    // path afterwards, so a default here would silently reset a path the creator chose. An empty host
+    // clears the domain, which this non-destructive tool must not do by accident.
+    server.registerTool("authflow_set_custom_domain", { title: "Set the MCP custom hostname", description: "Sets public_host (a subdomain you control) before first publication. public_path is optional: Rail uses /mcp the first time a host is set and keeps the stored path when it is omitted. This tool never clears a domain; to return to the slug URL, the owner runs authflow resource domain <slug> --file with {\"public_host\": null}.", inputSchema: { issuer, workspace_id, slug, public_host: z.string().trim().min(1, "public_host is required; this tool never clears a domain."), public_path: z.string().min(1).optional() }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, public_host, public_path }) => attempt(async () => {
         const base = requireIssuer(value);
-        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/domain`, "POST", { public_host, public_path });
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/domain`, "POST", public_path === undefined ? { public_host } : { public_host, public_path });
     }));
     for (const action of managementResourceActions) {
         server.registerTool(action === "domain/refresh" ? "authflow_refresh_domain" : `authflow_${action}_resource`, { title: `${action === "publish" ? "Publish" : action === "disable" ? "Disable" : action === "verify" ? "Verify" : "Refresh domain for"} an MCP`, inputSchema: { issuer, workspace_id, slug }, annotations: annotations(false, action === "disable") }, ({ issuer: value, workspace_id: workspace, slug: resource }) => attempt(async () => {
@@ -95,6 +111,11 @@ export function createManagementServer() {
     }));
     server.registerTool("authflow_search_docs", { title: "Search Authflow documentation", inputSchema: { issuer, query: z.string().min(1).max(300), limit: z.number().int().min(1).max(25).default(8) }, annotations: annotations(true) }, ({ issuer: value, query, limit }) => attempt(() => managementRequest(requireIssuer(value), "/docs/search", "GET", undefined, { q: query, limit: String(limit) })));
     server.registerTool("authflow_get_doc", { title: "Read an Authflow documentation page or section", description: "Use a path or documentation URL returned by search. Retrieval is limited to Authflow's indexed public documentation.", inputSchema: { issuer, path: z.string().min(1).max(2048), section: z.string().max(256).optional() }, annotations: annotations(true) }, ({ issuer: value, path, section }) => attempt(() => managementRequest(requireIssuer(value), "/docs/page", "GET", undefined, { path, ...(section ? { section } : {}) })));
+    // Anonymous when there is no usable login: the report matters most when the login is what broke.
+    server.registerTool("authflow_send_feedback", { title: feedbackToolTitle, description: feedbackToolDescription, inputSchema: { issuer, workspace_id, ...feedbackInputSchema }, annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true } }, ({ issuer: value, workspace_id: workspace, ...report }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return sendWorkspaceFeedback(base, feedbackBody(report, { surface: "cli_management_mcp", client: server.server.getClientVersion(), serverVersion: cliVersion }), workspace);
+    }));
     return server;
 }
 export async function runManagementStdioServer() {