dns-doctor 0.2.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,89 @@
+# dns-doctor — DNS Doctor from the terminal
+
+Scan, fix and verify a domain's DNS without leaving the shell: email
+authentication (SPF, DMARC, DKIM), MX, DNS health, blacklists, domain/SSL expiry
+and propagation read from six locations on four continents. Every fix record
+comes from a deterministic, validating engine — RFC grammar plus the SPF
+10-lookup counter — **never an AI guess**, and a human approves every DNS change.
+
+```
+npx dns-doctor scan example.com
+```
+
+No account, no key. The CLI calls the public DNS Doctor API
+(https://dnsdoctor.dev) and prints what it returns.
+
+## Commands
+
+Every tool the DNS Doctor MCP server exposes has a command here.
+
+```
+scan & fix
+  dns-doctor scan <domain> [--fresh]              the seven-check report (persisted, or fresh on a miss)
+  dns-doctor dmarc-upgrade <domain>               the next safe DMARC step as a record, or why there is none
+  dns-doctor parked <domain> --confirm-no-mail    the hardening pack for a domain that sends no mail
+  dns-doctor signup-url <domain>                  a sign-up link to hand the domain's owner for monitoring
+
+records
+  dns-doctor dmarc-validate "<record>"            every tag checked, with the safe next step
+  dns-doctor dmarc-generate <none|quarantine|reject> [--rua <email>] [--subdomain-policy <p>] [--strict]
+  dns-doctor spf-count <domain | "v=spf1 …">      DNS lookups against the 10-lookup limit
+  dns-doctor spf-audit <domain>                   the SPF include tree with registration and lookup findings
+  dns-doctor dkim <domain> --selector <s>         a DKIM selector's published key
+  dns-doctor report-parse <file.xml|.gz|.zip>     one DMARC aggregate report as a table
+
+live DNS
+  dns-doctor record <domain> --kind <spf|dmarc|txt|mx|cname|a|aaaa> [--host <label>]
+  dns-doctor propagation <name> [--type A] [--expect <value>]
+  dns-doctor reverse-dns <ip>
+
+monitoring (DNSDOCTOR_API_TOKEN required)
+  dns-doctor alerts [--domain d] [--since t] [--before t] [--alert-type t] [--limit n]
+  dns-doctor readiness <domain>
+```
+
+Add `--json` to any command to print the API response verbatim — the path for
+scripts and agents.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | nothing failing |
+| 1 | a failing verdict (a failed check, an invalid or over-limit record, a name not propagated, a reverse name that does not point back, nameservers that disagree) |
+| 2 | an error — including every transient: rate limit, a paid-retry offer (HTTP 402), an outage. **Never read 2 as a verdict about the domain.** |
+
+## Example
+
+```
+$ dns-doctor scan example.com
+example.com  (scanned 2026-09-06T10:12:03Z)
+  FAIL  dmarc    No DMARC record found — receivers can't verify your mail
+        fix (paste verbatim, a human must approve the DNS change):
+        v=DMARC1; p=none; np=reject
+  WARN  dkim     No DKIM key found at the common selectors
+  PASS  spf      SPF record is valid
+  …
+  report: https://dnsdoctor.dev/scan/example.com
+```
+
+The record printed under `fix` is the API's bytes. The CLI never composes,
+reformats or "improves" a record; SPF is diagnose-only by design (an SPF edit
+can silently de-authorise a real sender), so no SPF record is ever proposed.
+
+## Environment
+
+- `DNSDOCTOR_API_TOKEN` — optional bearer token (mint one in the DNS Doctor
+  dashboard); raises the anonymous budget. Never required for the commands above.
+- `DNSDOCTOR_API_BASE` — override the API origin for local runs.
+
+Past the free per-caller allowance the API answers HTTP 402 with an x402 offer
+(USDC on Base). This CLI holds no wallet: it reports the offer and exits 2. Pay
+with an x402 client or wait and retry.
+
+## Also
+
+- Hosted MCP server: `https://dnsdoctor.dev/mcp` · stdio client: `npx -y @dnsdoctor/mcp`
+- Methodology: https://dnsdoctor.dev/methodology · API: https://dnsdoctor.dev/openapi.json
+
+Apache-2.0.

package/dist/api.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The CLI's request layer — the same two rules as the `@dnsdoctor/mcp` client:
+ *
+ * 1. **Relay, never compose.** Every response is returned untouched; the
+ *    record strings a command prints are the API's bytes.
+ * 2. **A transport failure is never a verdict.** 429/402/5xx/network faults are
+ *    `transient` errors and exit 2 — a script must never read them as "the
+ *    domain failed".
+ *
+ * Deliberately a small copy of the MCP client's layer rather than an import:
+ * the client's `package.json` version is a pinned carrier across every
+ * published artifact, and a CLI release must not force that wave. The backend
+ * test `tests/mcp_server/test_cli_routes.py` pins this package's `ROUTES` to
+ * the real app so the two layers cannot drift onto different paths.
+ */
+export declare const DEFAULT_API_BASE = "https://dnsdoctor.dev";
+export declare const TRANSIENT_SUFFIX = "retry; this is not a verdict about the domain";
+export declare const RATE_LIMITED_MESSAGE = "rate limited \u2014 slow down and retry";
+export declare const PAYMENT_REQUIRED_MESSAGE = "past the free per-caller allowance \u2014 the API offered a paid retry over x402 (USDC on Base); pay with an x402 client, or wait and retry";
+export declare class ApiError extends Error {
+    readonly status: number | null;
+    readonly transient: boolean;
+    constructor(message: string, status: number | null, transient: boolean);
+}
+/** Base URL for the DNS Doctor API; `DNSDOCTOR_API_BASE` overrides for local runs. */
+export declare function apiBase(): string;
+export declare function packageVersion(): string;
+/**
+ * The UA every call carries — this CLI's only attribution. `api/agents.py::
+ * agent_family` is an allowlist, and `dnsdoctor-cli` is its entry: without
+ * this marker the CLI channel would be invisible in the agent-request metric.
+ */
+export declare function userAgent(): string;
+export declare function toApiError(response: Response): Promise<ApiError>;
+/** GET a JSON resource. `path` is API-root-relative and already encoded. */
+export declare function getJson(path: string): Promise<unknown>;
+/** POST a JSON body and return the parsed response, untouched. */
+export declare function postJson(path: string, body: unknown): Promise<unknown>;
+/**
+ * POST one file as multipart (`dmarc-report-parse`). The API reads bytes only;
+ * the filename is cosmetic. Node ≥ 20 ships FormData/Blob natively.
+ */
+export declare function postFile(path: string, field: string, bytes: Uint8Array, filename: string): Promise<unknown>;

package/dist/api.js

@@ -0,0 +1,142 @@
+/**
+ * The CLI's request layer — the same two rules as the `@dnsdoctor/mcp` client:
+ *
+ * 1. **Relay, never compose.** Every response is returned untouched; the
+ *    record strings a command prints are the API's bytes.
+ * 2. **A transport failure is never a verdict.** 429/402/5xx/network faults are
+ *    `transient` errors and exit 2 — a script must never read them as "the
+ *    domain failed".
+ *
+ * Deliberately a small copy of the MCP client's layer rather than an import:
+ * the client's `package.json` version is a pinned carrier across every
+ * published artifact, and a CLI release must not force that wave. The backend
+ * test `tests/mcp_server/test_cli_routes.py` pins this package's `ROUTES` to
+ * the real app so the two layers cannot drift onto different paths.
+ */
+import { readFileSync } from "node:fs";
+export const DEFAULT_API_BASE = "https://dnsdoctor.dev";
+export const TRANSIENT_SUFFIX = "retry; this is not a verdict about the domain";
+export const RATE_LIMITED_MESSAGE = "rate limited — slow down and retry";
+export const PAYMENT_REQUIRED_MESSAGE = "past the free per-caller allowance — the API offered a paid retry over x402 (USDC on Base); pay with an x402 client, or wait and retry";
+export class ApiError extends Error {
+    status;
+    transient;
+    constructor(message, status, transient) {
+        super(message);
+        this.status = status;
+        this.transient = transient;
+        this.name = "ApiError";
+    }
+}
+/** Base URL for the DNS Doctor API; `DNSDOCTOR_API_BASE` overrides for local runs. */
+export function apiBase() {
+    const raw = process.env.DNSDOCTOR_API_BASE?.trim();
+    const base = raw ? raw : DEFAULT_API_BASE;
+    return base.replace(/\/+$/, "");
+}
+/** A bearer token raises the anonymous budget; never prompted for, never required. */
+function authHeaders() {
+    const token = process.env.DNSDOCTOR_API_TOKEN?.trim();
+    return token ? { Authorization: `Bearer ${token}` } : {};
+}
+export function packageVersion() {
+    try {
+        const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8");
+        const version = JSON.parse(raw).version;
+        return typeof version === "string" ? version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+/**
+ * The UA every call carries — this CLI's only attribution. `api/agents.py::
+ * agent_family` is an allowlist, and `dnsdoctor-cli` is its entry: without
+ * this marker the CLI channel would be invisible in the agent-request metric.
+ */
+export function userAgent() {
+    return `dnsdoctor-cli/${packageVersion()} (+https://dnsdoctor.dev)`;
+}
+function detailOf(body) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const detail = body.detail;
+    if (typeof detail === "string")
+        return detail;
+    if (detail === undefined || detail === null)
+        return null;
+    return JSON.stringify(detail);
+}
+async function readBody(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+export async function toApiError(response) {
+    const detail = detailOf(await readBody(response));
+    const status = response.status;
+    if (status === 429) {
+        return new ApiError(detail ? `${RATE_LIMITED_MESSAGE} (${detail})` : RATE_LIMITED_MESSAGE, status, true);
+    }
+    if (status === 402)
+        return new ApiError(PAYMENT_REQUIRED_MESSAGE, status, true);
+    if (status === 503) {
+        return new ApiError(`DNS Doctor could not complete the lookup (transient) — ${TRANSIENT_SUFFIX}`, status, true);
+    }
+    if (status >= 500) {
+        return new ApiError(`DNS Doctor returned a server error (HTTP ${status}) — ${TRANSIENT_SUFFIX}`, status, true);
+    }
+    // 4xx — the API's own `detail` is the answer (422 malformed input, opaque 404). Verbatim.
+    return new ApiError(detail ?? `DNS Doctor request failed (HTTP ${status})`, status, false);
+}
+async function send(path, init) {
+    const url = `${apiBase()}${path}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            ...init,
+            headers: {
+                Accept: "application/json",
+                "User-Agent": userAgent(),
+                ...authHeaders(),
+                ...(init.headers ?? {}),
+            },
+        });
+    }
+    catch (error) {
+        const cause = error instanceof Error ? error.message : String(error);
+        throw new ApiError(`Could not reach the DNS Doctor API (${cause}) — ${TRANSIENT_SUFFIX}`, null, true);
+    }
+    if (!response.ok)
+        throw await toApiError(response);
+    const body = await readBody(response);
+    if (body === null) {
+        throw new ApiError(`DNS Doctor returned an unreadable response (HTTP ${response.status}) — ${TRANSIENT_SUFFIX}`, response.status, true);
+    }
+    return body;
+}
+/** GET a JSON resource. `path` is API-root-relative and already encoded. */
+export function getJson(path) {
+    return send(path, { method: "GET" });
+}
+/** POST a JSON body and return the parsed response, untouched. */
+export function postJson(path, body) {
+    return send(path, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+}
+/**
+ * POST one file as multipart (`dmarc-report-parse`). The API reads bytes only;
+ * the filename is cosmetic. Node ≥ 20 ships FormData/Blob natively.
+ */
+export function postFile(path, field, bytes, filename) {
+    const form = new FormData();
+    form.append(field, new Blob([bytes], { type: "application/octet-stream" }), filename);
+    return send(path, { method: "POST", body: form });
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,+CAA+C,CAAC;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AACzE,MAAM,CAAC,MAAM,wBAAwB,GACnC,wIAAwI,CAAC;AAE3I,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IAHlB,YACE,OAAe,EACC,MAAqB,EACrB,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAe;QACrB,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC,OAAO,CAAC;QACnE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,iBAAiB,cAAc,EAAE,2BAA2B,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,0DAA0D,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,QAAQ,CAAC,4CAA4C,MAAM,OAAO,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjH,CAAC;IACD,0FAA0F;IAC1F,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,mCAAmC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAiB;IACjD,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAClC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,SAAS,EAAE;gBACzB,GAAG,WAAW,EAAE;gBAChB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,IAAI,QAAQ,CAAC,uCAAuC,KAAK,OAAO,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,QAAQ,CAChB,oDAAoD,QAAQ,CAAC,MAAM,OAAO,gBAAgB,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAa;IAClD,OAAO,IAAI,CAAC,IAAI,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,KAAiB,EAAE,QAAgB;IACvF,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,KAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/format.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Human output. Everything printed here is read off the API response:
+ * statuses, titles, record strings (verbatim, never reformatted), URLs.
+ *
+ * Ordering is the one editorial act — failing checks first, the way the report
+ * page reads — and the exit code is a pure function of the API's own verdicts.
+ */
+/** `scan`: the `ScanReport` (+ `next_steps`) as a worst-first check list. */
+export declare function formatReport(body: unknown): string;
+/** `propagation`: verdict, coverage, one line per location. */
+export declare function formatPropagation(body: unknown): string;
+/** `dmarc-upgrade`: the record verbatim when there is one, else the rationale. */
+export declare function formatDmarcUpgrade(body: unknown): string;
+/** `reverse-dns`: verdict, PTR, the addresses the name resolves to. */
+export declare function formatReverseDns(body: unknown): string;
+/** `spf-audit`: the walk's findings, then the lookup total. */
+export declare function formatSpfAudit(body: unknown): string;
+/** `spf-count`: the count against the limit, the findings, the record. */
+export declare function formatSpfCount(body: unknown): string;
+/** `dmarc-validate` / `dmarc-generate`: validity, findings, the record(s) verbatim. */
+export declare function formatDmarcRecord(body: unknown): string;
+/** `dkim`: the status line, the parsed key when present, the record verbatim. */
+export declare function formatDkim(body: unknown): string;
+/** `report-parse`: the report's totals and one line per source. */
+export declare function formatReportParse(body: unknown): string;
+/** `record`: the authoritative answer beside what the caches still hold. */
+export declare function formatRecord(body: unknown): string;
+/** `parked`: the pack verbatim, or the refusal and its rationale. */
+export declare function formatParked(body: unknown): string;
+/** `signup-url`: the two links verbatim and the message. */
+export declare function formatSignupUrl(body: unknown): string;
+/** `alerts`: one line per alert, newest first as the API orders them. */
+export declare function formatAlerts(body: unknown): string;
+/** `readiness`: ready or not, the blockers, the next record verbatim. */
+export declare function formatReadiness(body: unknown): string;
+export declare function render(command: string, body: unknown): string;
+/**
+ * Exit code from the API's own verdicts: 0 = nothing failing, 1 = a failing
+ * verdict. Transient errors never reach here (they exit 2 in `main`).
+ */
+export declare function exitCodeFor(command: string, body: unknown): 0 | 1;

package/dist/format.js

@@ -0,0 +1,313 @@
+/**
+ * Human output. Everything printed here is read off the API response:
+ * statuses, titles, record strings (verbatim, never reformatted), URLs.
+ *
+ * Ordering is the one editorial act — failing checks first, the way the report
+ * page reads — and the exit code is a pure function of the API's own verdicts.
+ */
+const STATUS_ORDER = { fail: 0, warn: 1, temperror: 2, info: 3, pass: 4 };
+const STATUS_WORD = {
+    fail: "FAIL",
+    warn: "WARN",
+    temperror: "TEMP",
+    info: "INFO",
+    pass: "PASS",
+};
+const RECORD_NOTE = "paste verbatim; a human must approve the DNS change";
+function str(value) {
+    return typeof value === "string" ? value : null;
+}
+function rec(obj) {
+    return typeof obj === "object" && obj !== null ? obj : {};
+}
+function list(value) {
+    return Array.isArray(value) ? value : [];
+}
+function checksOf(report) {
+    return list(report.checks);
+}
+/** `scan`: the `ScanReport` (+ `next_steps`) as a worst-first check list. */
+export function formatReport(body) {
+    const top = rec(body);
+    const report = rec(top.report ?? top);
+    const lines = [];
+    const domain = str(report.domain) ?? "?";
+    if (report.not_registered === true) {
+        return `${domain}: not registered — no DNS records exist, so no check ran.`;
+    }
+    lines.push(`${domain}${str(report.scanned_at) ? `  (scanned ${str(report.scanned_at)})` : ""}`);
+    const checks = [...checksOf(report)].sort((a, b) => (STATUS_ORDER[str(a.status) ?? ""] ?? 9) - (STATUS_ORDER[str(b.status) ?? ""] ?? 9));
+    for (const check of checks) {
+        const status = str(check.status) ?? "?";
+        const word = STATUS_WORD[status] ?? status.toUpperCase();
+        lines.push(`  ${word.padEnd(4)}  ${(str(check.check) ?? "").padEnd(8)} ${str(check.title) ?? ""}`);
+        for (const detail of list(check.details))
+            if (typeof detail === "string")
+                lines.push(`        · ${detail}`);
+        const fix = str(check.fix_record);
+        if (fix) {
+            lines.push(`        fix (${RECORD_NOTE}):`);
+            lines.push(`        ${fix}`);
+        }
+    }
+    const reportUrl = str(rec(top.next_steps).report_url);
+    if (reportUrl)
+        lines.push(`  report: ${reportUrl}`);
+    return lines.join("\n");
+}
+/** `propagation`: verdict, coverage, one line per location. */
+export function formatPropagation(body) {
+    const result = rec(body);
+    const lines = [];
+    lines.push(`${str(result.name) ?? "?"} ${str(result.record_type) ?? ""}: ${str(result.verdict) ?? "?"} — ${result.vantage_reached ?? "?"} of ${result.vantage_total ?? "?"} locations answered`);
+    for (const row of list(result.vantages)) {
+        const v = rec(row);
+        const label = `${str(v.label) ?? str(v.region) ?? "?"}`.padEnd(18);
+        if (v.reached !== true) {
+            lines.push(`  ${label} unreached${str(v.detail) ? ` — ${str(v.detail)}` : ""}`);
+            continue;
+        }
+        const cells = list(v.cells).map((c) => {
+            const cell = rec(c);
+            const answers = list(cell.answers).join(",");
+            return { resolver: str(cell.resolver) ?? "?", status: str(cell.status) ?? "?", answers };
+        });
+        const agree = cells.length > 0 && cells.every((c) => c.status === cells[0]?.status && c.answers === cells[0]?.answers);
+        if (agree) {
+            // One line when every resolver at the location said the same thing —
+            // the reader wants the answer, not three copies of it.
+            const first = cells[0];
+            lines.push(`  ${label} ${first?.status}${first?.answers ? ` ${first.answers}` : ""}  (${cells.length} resolver${cells.length === 1 ? "" : "s"} agree)`);
+            continue;
+        }
+        lines.push(`  ${label} ${cells.map((c) => `${c.resolver}=${c.status}${c.answers ? ` ${c.answers}` : ""}`).join("  ")}`);
+    }
+    return lines.join("\n");
+}
+/** `dmarc-upgrade`: the record verbatim when there is one, else the rationale. */
+export function formatDmarcUpgrade(body) {
+    const result = rec(body);
+    const lines = [`${str(result.domain) ?? "?"}: current policy ${str(result.current_policy) ?? "none published"}`];
+    const record = str(result.record);
+    if (record) {
+        lines.push(`  record (TXT at _dmarc; ${RECORD_NOTE}):`, `  ${record}`);
+    }
+    else {
+        lines.push("  no record recommended");
+    }
+    const rationale = str(result.rationale);
+    if (rationale)
+        lines.push(`  ${rationale}`);
+    return lines.join("\n");
+}
+/** `reverse-dns`: verdict, PTR, the addresses the name resolves to. */
+export function formatReverseDns(body) {
+    const result = rec(body);
+    return [
+        `${str(result.ip) ?? "?"}: ${str(result.verdict) ?? "?"}`,
+        `  reverse name: ${str(result.ptr) ?? "(none)"}`,
+        `  resolves to:  ${list(result.addresses).join(", ") || "(nothing)"}`,
+    ].join("\n");
+}
+/** `spf-audit`: the walk's findings, then the lookup total. */
+export function formatSpfAudit(body) {
+    const result = rec(body);
+    const lines = [`${str(result.domain) ?? "?"}: ${result.total_lookups ?? "?"} lookups${result.truncated === true ? " (walk truncated)" : ""}`];
+    const findings = list(result.findings);
+    if (findings.length === 0)
+        lines.push("  no findings");
+    for (const f of findings) {
+        const finding = rec(f);
+        lines.push(`  ${String(finding.severity ?? "").toUpperCase().padEnd(5)} ${str(finding.domain) ?? ""}: ${str(finding.message) ?? ""}`);
+    }
+    const record = str(result.record);
+    if (record)
+        lines.push(`  record: ${record}`);
+    return lines.join("\n");
+}
+/** `spf-count`: the count against the limit, the findings, the record. */
+export function formatSpfCount(body) {
+    const result = rec(body);
+    const lines = [`${result.lookup_count ?? "?"} of ${result.lookup_limit ?? 10} DNS lookups${result.recursive === true ? " (recursive)" : ""}`];
+    for (const f of list(result.findings))
+        if (typeof f === "string")
+            lines.push(`  · ${f}`);
+    const record = str(result.record);
+    if (record)
+        lines.push(`  record: ${record}`);
+    return lines.join("\n");
+}
+/** `dmarc-validate` / `dmarc-generate`: validity, findings, the record(s) verbatim. */
+export function formatDmarcRecord(body) {
+    const result = rec(body);
+    const lines = [result.valid === true ? "valid" : "not valid"];
+    const policy = str(result.policy);
+    if (policy)
+        lines[0] += ` · p=${policy}`;
+    for (const f of list(result.findings)) {
+        const finding = rec(f);
+        lines.push(`  ${String(finding.level ?? "").toUpperCase().padEnd(5)} ${str(finding.message) ?? ""}`);
+    }
+    const record = str(result.record);
+    if (record)
+        lines.push(`  record (${RECORD_NOTE}):`, `  ${record}`);
+    const upgrade = str(result.upgrade_record);
+    if (upgrade)
+        lines.push(`  next step (${RECORD_NOTE}):`, `  ${upgrade}`);
+    const note = str(result.upgrade_note);
+    if (note)
+        lines.push(`  ${note}`);
+    return lines.join("\n");
+}
+/** `dkim`: the status line, the parsed key when present, the record verbatim. */
+export function formatDkim(body) {
+    const result = rec(body);
+    const lines = [`${str(result.selector) ?? "?"}._domainkey.${str(result.domain) ?? "?"}: ${str(result.status) ?? "?"} — ${str(result.title) ?? ""}`];
+    const key = rec(result.key);
+    if (Object.keys(key).length > 0) {
+        lines.push(`  key: ${str(key.algorithm) ?? "?"} · ${key.bits ?? "?"} bit · ${key.revoked === true ? "revoked" : "active"}${key.testing === true ? " · testing" : ""}`);
+    }
+    const record = str(result.record);
+    if (record)
+        lines.push(`  record: ${record}`);
+    return lines.join("\n");
+}
+/** `report-parse`: the report's totals and one line per source. */
+export function formatReportParse(body) {
+    const result = rec(body);
+    const lines = [
+        `${str(result.org_name) ?? "?"} → ${str(result.domain) ?? "?"}  ${str(result.date_begin) ?? ""} – ${str(result.date_end) ?? ""}`,
+        `  ${result.total_messages ?? "?"} messages · ${result.aligned_pct ?? "?"}% aligned · published ${str(result.published_policy) ?? "?"}`,
+    ];
+    for (const s of list(result.sources)) {
+        const source = rec(s);
+        lines.push(`  ${String(source.ip ?? "?").padEnd(40)} ${String(source.total ?? "?").padStart(6)}  aligned ${source.aligned_pct ?? "?"}%`);
+    }
+    return lines.join("\n");
+}
+/** `record`: the authoritative answer beside what the caches still hold. */
+export function formatRecord(body) {
+    const result = rec(body);
+    const auth = rec(result.authoritative);
+    const lines = [
+        `${str(result.name) ?? "?"} ${str(result.rdtype) ?? ""}: ${result.in_sync === true ? "in sync" : `caches still clearing (up to ${result.max_wait_seconds ?? "?"} s)`}`,
+        `  authoritative: ${list(auth.values).join(", ") || "(none)"}  TTL ${auth.ttl ?? "?"}  ${auth.nameservers_queried ?? "?"} NS${auth.ns_in_agreement === false ? " — DISAGREE" : ""}`,
+    ];
+    for (const c of list(result.cached)) {
+        const cache = rec(c);
+        lines.push(`  ${String(cache.resolver ?? "?").padEnd(14)} ${list(cache.values).join(", ") || "(none)"}  ${cache.ttl_remaining ?? "?"} s left`);
+    }
+    return lines.join("\n");
+}
+/** `parked`: the pack verbatim, or the refusal and its rationale. */
+export function formatParked(body) {
+    const result = rec(body);
+    const lines = [`${str(result.domain) ?? "?"}`];
+    const records = result.records;
+    if (Array.isArray(records) && records.length > 0) {
+        lines.push(`  hardening pack (${RECORD_NOTE}):`);
+        for (const r of records) {
+            const row = rec(r);
+            lines.push(`  ${str(row.host) ?? ""}  ${str(row.record_type) ?? ""}  ${str(row.value) ?? str(row.record) ?? ""}`);
+        }
+    }
+    else {
+        lines.push("  no pack issued");
+    }
+    const rationale = str(result.rationale);
+    if (rationale)
+        lines.push(`  ${rationale}`);
+    const note = str(result.apply_note);
+    if (note)
+        lines.push(`  ${note}`);
+    return lines.join("\n");
+}
+/** `signup-url`: the two links verbatim and the message. */
+export function formatSignupUrl(body) {
+    const result = rec(body);
+    return [
+        `signup: ${str(result.signup_url) ?? "?"}`,
+        `report: ${str(result.report_url) ?? "?"}`,
+        `${str(result.message) ?? ""}`,
+    ].join("\n");
+}
+/** `alerts`: one line per alert, newest first as the API orders them. */
+export function formatAlerts(body) {
+    const result = rec(body);
+    const alerts = list(result.alerts);
+    if (alerts.length === 0)
+        return "no alerts";
+    const lines = alerts.map((a) => {
+        const alert = rec(a);
+        return `${String(alert.created_at ?? "").slice(0, 19)}  ${String(alert.domain ?? "").padEnd(24)} ${String(alert.type ?? "").padEnd(20)} ${str(alert.summary) ?? ""}${str(alert.delivery_class) ? ` [${str(alert.delivery_class)}]` : ""}`;
+    });
+    const next = str(result.next_before);
+    if (next)
+        lines.push(`  more: --before ${next}`);
+    return lines.join("\n");
+}
+/** `readiness`: ready or not, the blockers, the next record verbatim. */
+export function formatReadiness(body) {
+    const result = rec(body);
+    const progress = rec(result.progress);
+    const lines = [
+        `${result.ready === true ? "ready" : "not ready"} for ${str(result.next_step) ?? "the next step"} — ${result.total_messages ?? "?"} messages over ${result.window_days ?? "?"} days${progress.progress_pct !== undefined ? ` · ${progress.progress_pct}%` : ""}`,
+    ];
+    for (const b of list(result.blockers)) {
+        const blocker = rec(b);
+        lines.push(`  blocker: ${str(blocker.source) ?? ""} ${str(blocker.metric) ?? ""}${str(blocker.fix_hint) ? ` — ${str(blocker.fix_hint)}` : ""}`);
+    }
+    const next = str(result.next_record);
+    if (next)
+        lines.push(`  next record (${RECORD_NOTE}):`, `  ${next}`);
+    return lines.join("\n");
+}
+const RENDERERS = {
+    scan: formatReport,
+    propagation: formatPropagation,
+    "dmarc-upgrade": formatDmarcUpgrade,
+    "reverse-dns": formatReverseDns,
+    "spf-audit": formatSpfAudit,
+    "spf-count": formatSpfCount,
+    "dmarc-validate": formatDmarcRecord,
+    "dmarc-generate": formatDmarcRecord,
+    dkim: formatDkim,
+    "report-parse": formatReportParse,
+    record: formatRecord,
+    parked: formatParked,
+    "signup-url": formatSignupUrl,
+    alerts: formatAlerts,
+    readiness: formatReadiness,
+};
+export function render(command, body) {
+    const renderer = RENDERERS[command];
+    return renderer ? renderer(body) : JSON.stringify(body, null, 2);
+}
+/**
+ * Exit code from the API's own verdicts: 0 = nothing failing, 1 = a failing
+ * verdict. Transient errors never reach here (they exit 2 in `main`).
+ */
+export function exitCodeFor(command, body) {
+    const result = rec(body);
+    switch (command) {
+        case "scan":
+            return checksOf(rec(result.report ?? result)).some((c) => str(c.status) === "fail") ? 1 : 0;
+        case "propagation": {
+            const verdict = str(result.verdict);
+            return verdict === "not_propagated" || verdict === "inconsistent" ? 1 : 0;
+        }
+        case "reverse-dns":
+            return str(result.verdict) === "confirmed" ? 0 : 1;
+        case "spf-audit":
+            return list(result.findings).some((f) => String(rec(f).severity ?? "").toLowerCase() === "high") ? 1 : 0;
+        case "spf-count":
+            return result.over_limit === true || result.record_valid === false || result.has_pass_all === true ? 1 : 0;
+        case "dmarc-validate":
+            return result.valid === false ? 1 : 0;
+        case "record":
+            return rec(result.authoritative).ns_in_agreement === false ? 1 : 0;
+        default:
+            return 0;
+    }
+}
+//# sourceMappingURL=format.js.map

package/dist/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,YAAY,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAClG,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAW1E,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,MAA+B;IAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAY,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,GAAG,MAAM,2DAA2D,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAC9F,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,gBAAgB,WAAW,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,IAAI,GAAG,OAAO,MAAM,CAAC,aAAa,IAAI,GAAG,qBAAqB,CACrL,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3G,IAAI,KAAK,EAAE,CAAC;YACV,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACxJ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,oBAAoB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,4BAA4B,WAAW,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO;QACL,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;QACzD,mBAAmB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE;QAChD,mBAAmB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,aAAa,IAAI,GAAG,WAAW,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,OAAO,MAAM,CAAC,YAAY,IAAI,EAAE,eAAe,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,WAAW,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,WAAW,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,eAAe,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpJ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,UAAU,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzK,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;QAChI,KAAK,MAAM,CAAC,cAAc,IAAI,GAAG,eAAe,MAAM,CAAC,WAAW,IAAI,GAAG,yBAAyB,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE;KACxI,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,WAAW,IAAI,GAAG,GAAG,CAAC,CAAC;IAC3I,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,MAAM,CAAC,gBAAgB,IAAI,GAAG,KAAK,EAAE;QACtK,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,mBAAmB,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE;KACpL,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,aAAa,IAAI,GAAG,SAAS,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,qBAAqB,WAAW,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO;QACL,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE;QAC1C,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE;QAC1C,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5O,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,QAAQ,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,eAAe,MAAM,MAAM,CAAC,cAAc,IAAI,GAAG,kBAAkB,MAAM,CAAC,WAAW,IAAI,GAAG,QAAQ,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACjQ,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,WAAW,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,SAAS,GAA8C;IAC3D,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,iBAAiB;IAC9B,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,cAAc;IAC3B,gBAAgB,EAAE,iBAAiB;IACnC,gBAAgB,EAAE,iBAAiB;IACnC,IAAI,EAAE,UAAU;IAChB,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,YAAY,EAAE,eAAe;IAC7B,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;CAC3B,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,IAAa;IACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAa;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,KAAK,gBAAgB;YACnB,OAAO,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * `dns-doctor` — the DNS Doctor API from the terminal, every tool the MCP
+ * server exposes as a command.
+ *
+ * `--json` prints the API response verbatim (the path for scripts and agents).
+ * Exit codes: 0 nothing failing · 1 a failing verdict · 2 error, incl. every
+ * transient (rate limit, 402 offer, outage) — never read 2 as a verdict.
+ */
+export interface Parsed {
+    command: string;
+    target: string | undefined;
+    json: boolean;
+    fresh: boolean;
+    type: string;
+    expect: string | undefined;
+    selector: string | undefined;
+    kind: string | undefined;
+    host: string | undefined;
+    rua: string | undefined;
+    subdomainPolicy: string | undefined;
+    strict: boolean;
+    confirmNoMail: boolean;
+    domain: string | undefined;
+    since: string | undefined;
+    before: string | undefined;
+    alertType: string | undefined;
+    limit: string | undefined;
+}
+export declare function parse(argv: string[]): Parsed | "help" | "version";
+/** One request per command — the endpoint's own field names, nothing renamed. */
+export declare function run(p: Parsed): Promise<unknown>;
+export declare function main(argv: string[]): Promise<number>;

package/dist/index.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+/**
+ * `dns-doctor` — the DNS Doctor API from the terminal, every tool the MCP
+ * server exposes as a command.
+ *
+ * `--json` prints the API response verbatim (the path for scripts and agents).
+ * Exit codes: 0 nothing failing · 1 a failing verdict · 2 error, incl. every
+ * transient (rate limit, 402 offer, outage) — never read 2 as a verdict.
+ */
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+import { parseArgs } from "node:util";
+import { ApiError, DEFAULT_API_BASE, getJson, packageVersion, postFile, postJson } from "./api.js";
+import { exitCodeFor, render } from "./format.js";
+import { COMMANDS, reportPath, routeFor } from "./routes.js";
+const USAGE = `dns-doctor ${packageVersion()} — scan, fix and verify a domain's DNS (${DEFAULT_API_BASE})
+
+usage: dns-doctor <command> [target] [options]
+
+scan & fix
+  scan <domain> [--fresh]              the seven-check report (persisted, or a fresh scan on a miss)
+  dmarc-upgrade <domain>               the next safe DMARC policy step as a record, or why there is none
+  parked <domain> --confirm-no-mail    the three-record hardening pack for a domain that sends no mail
+  signup-url <domain>                  a sign-up link to hand the domain's owner for monitoring
+
+records
+  dmarc-validate "<record>"            every tag of a DMARC record checked, with the safe next step
+  dmarc-generate <none|quarantine|reject> [--rua <email>] [--subdomain-policy <p>] [--strict]
+  spf-count <domain | "<SPF record>">  DNS lookups against the 10-lookup limit
+  spf-audit <domain>                   the SPF include tree with registration and lookup findings
+  dkim <domain> --selector <s>         a DKIM selector's published key
+  report-parse <file.xml|.gz|.zip>     one DMARC aggregate report as a table
+
+live DNS
+  record <domain> --kind <spf|dmarc|txt|mx|cname|a|aaaa> [--host <label>]
+                                       authoritative answer beside two public caches, with TTLs
+  propagation <name> [--type A] [--expect <value>]
+                                       one name read from six locations on four continents
+  reverse-dns <ip>                     forward-confirmed reverse DNS for a mail server address
+
+monitoring (DNSDOCTOR_API_TOKEN required)
+  alerts [--domain d] [--since t] [--before t] [--alert-type t] [--limit n]
+  readiness <domain>                   enforcement readiness from aggregate-report evidence
+
+options
+  --json                               print the API response verbatim
+  --version, --help
+
+Fix records are generated by a deterministic engine and printed verbatim; a human
+approves every DNS change. SPF is diagnose-only: no SPF record is ever proposed.`;
+const TARGETLESS = new Set(["alerts"]);
+export function parse(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            json: { type: "boolean", default: false },
+            fresh: { type: "boolean", default: false },
+            type: { type: "string", default: "A" },
+            expect: { type: "string" },
+            selector: { type: "string" },
+            kind: { type: "string" },
+            host: { type: "string" },
+            rua: { type: "string" },
+            "subdomain-policy": { type: "string" },
+            strict: { type: "boolean", default: false },
+            "confirm-no-mail": { type: "boolean", default: false },
+            domain: { type: "string" },
+            since: { type: "string" },
+            before: { type: "string" },
+            "alert-type": { type: "string" },
+            limit: { type: "string" },
+            help: { type: "boolean", default: false },
+            version: { type: "boolean", default: false },
+        },
+    });
+    if (values.version)
+        return "version";
+    const [command, target] = positionals;
+    if (values.help || !command || !COMMANDS.includes(command))
+        return "help";
+    if (!target && !TARGETLESS.has(command))
+        return "help";
+    return {
+        command,
+        target,
+        json: values.json,
+        fresh: values.fresh,
+        type: values.type,
+        expect: values.expect,
+        selector: values.selector,
+        kind: values.kind,
+        host: values.host,
+        rua: values.rua,
+        subdomainPolicy: values["subdomain-policy"],
+        strict: values.strict,
+        confirmNoMail: values["confirm-no-mail"],
+        domain: values.domain,
+        since: values.since,
+        before: values.before,
+        alertType: values["alert-type"],
+        limit: values.limit,
+    };
+}
+function need(value, what) {
+    if (!value)
+        throw new ApiError(`${what} is required — see dns-doctor --help`, null, false);
+    return value;
+}
+function query(path, params) {
+    const search = new URLSearchParams();
+    for (const [key, value] of Object.entries(params))
+        if (value !== undefined)
+            search.set(key, value);
+    const encoded = search.toString();
+    return encoded ? `${path}?${encoded}` : path;
+}
+/** One request per command — the endpoint's own field names, nothing renamed. */
+export async function run(p) {
+    const path = (command) => routeFor(command).path;
+    const target = p.target ?? "";
+    switch (p.command) {
+        case "scan":
+            return p.fresh ? postJson(path("scan"), { domain: target }) : getJson(reportPath(target));
+        case "dmarc-upgrade":
+            return postJson(path("dmarc-upgrade"), { domain: target });
+        case "signup-url":
+            return postJson(path("signup-url"), { domain: target });
+        case "parked": {
+            // The gate is the human's: only the domain's owner can assert it sends no
+            // mail, and only the API decides whether the evidence permits the pack.
+            if (!p.confirmNoMail) {
+                throw new ApiError("parked requires --confirm-no-mail: only the domain's owner can assert that it sends no mail", null, false);
+            }
+            const body = { domain: target, confirm_no_mail: true };
+            if (p.rua !== undefined)
+                body.rua_email = p.rua;
+            return postJson(path("parked"), body);
+        }
+        case "dmarc-validate":
+            return postJson(path("dmarc-validate"), { record: target });
+        case "dmarc-generate": {
+            const body = { policy: target, strict_alignment: p.strict };
+            if (p.rua !== undefined)
+                body.rua_email = p.rua;
+            if (p.subdomainPolicy !== undefined)
+                body.subdomain_policy = p.subdomainPolicy;
+            return postJson(path("dmarc-generate"), body);
+        }
+        case "spf-count":
+            // A pasted record has spaces or '='; a domain has neither. No record
+            // literal here — the API decides what a record is.
+            return postJson(path("spf-count"), /[\s=]/.test(target.trim()) ? { record: target } : { domain: target });
+        case "spf-audit":
+            return postJson(path("spf-audit"), { domain: target });
+        case "dkim":
+            return postJson(path("dkim"), { domain: target, selector: need(p.selector, "--selector") });
+        case "report-parse": {
+            const route = routeFor("report-parse");
+            return postFile(route.path, route.field, readFileSync(target), basename(target));
+        }
+        case "record": {
+            const body = { domain: target, kind: need(p.kind, "--kind") };
+            if (p.host !== undefined)
+                body.host = p.host;
+            return postJson(path("record"), body);
+        }
+        case "propagation": {
+            const body = { name: target, record_type: p.type };
+            if (p.expect !== undefined)
+                body.expected_value = p.expect;
+            return postJson(path("propagation"), body);
+        }
+        case "reverse-dns":
+            return postJson(path("reverse-dns"), { ip: target });
+        case "alerts":
+            return getJson(query(path("alerts"), { domain: p.domain, since: p.since, before: p.before, type: p.alertType, limit: p.limit }));
+        case "readiness":
+            return getJson(query(path("readiness"), { domain: target }));
+        default:
+            throw new Error(`unknown command ${p.command}`);
+    }
+}
+export async function main(argv) {
+    const parsed = parse(argv);
+    if (parsed === "version") {
+        process.stdout.write(`${packageVersion()}\n`);
+        return 0;
+    }
+    if (parsed === "help") {
+        process.stdout.write(`${USAGE}\n`);
+        return argv.includes("--help") ? 0 : 2;
+    }
+    try {
+        const body = await run(parsed);
+        process.stdout.write(`${parsed.json ? JSON.stringify(body, null, 2) : render(parsed.command, body)}\n`);
+        return exitCodeFor(parsed.command, body);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`dns-doctor: ${message}\n`);
+        return 2;
+    }
+}
+const invokedDirectly = typeof process.argv[1] === "string" && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+if (invokedDirectly) {
+    main(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,KAAK,GAAG,cAAc,cAAc,EAAE,2CAA2C,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iFAkCtB,CAAC;AAuBlF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEvC,MAAM,UAAU,KAAK,CAAC,IAAc;IAClC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC3C,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC7C;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACvD,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,eAAe,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAyB,EAAE,IAAY;IACnD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,sCAAsC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,MAA0C;IACrE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,CAAS;IACjC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAc,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,IAAI,QAAQ,CAChB,6FAA6F,EAC7F,IAAI,EACJ,KAAK,CACN,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;YAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACrF,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;YAChD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;gBAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,eAAe,CAAC;YAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,WAAW;YACd,qEAAqE;YACrE,mDAAmD;YACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5G,KAAK,WAAW;YACd,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAc,EAAE,KAAK,CAAC,KAAe,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnI,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/D;YACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GACnB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AACvG,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Command → REST endpoint. The CLI translates nothing: each command sends the
+ * endpoint's own field names and prints what comes back.
+ *
+ * Every one of the 16 MCP tools has a command here, so the CLI and the MCP
+ * clients cover the same API. Pinned by the backend's
+ * `tests/mcp_server/test_cli_routes.py` against the real app (path exists,
+ * field names are the request model's, and the path SET equals the MCP
+ * client's) — a renamed route fails CI before it 404s a published CLI. Keep
+ * the literal shape: that test parses it.
+ */
+export interface Route {
+    kind: "json" | "report" | "query" | "upload";
+    path?: string;
+    field?: string;
+}
+export declare function routeFor(command: string): Route;
+/** The persisted-report path; the one route whose path is built from an argument. */
+export declare function reportPath(domain: string): string;
+export declare const COMMANDS: string[];

package/dist/routes.js

@@ -0,0 +1,41 @@
+/**
+ * Command → REST endpoint. The CLI translates nothing: each command sends the
+ * endpoint's own field names and prints what comes back.
+ *
+ * Every one of the 16 MCP tools has a command here, so the CLI and the MCP
+ * clients cover the same API. Pinned by the backend's
+ * `tests/mcp_server/test_cli_routes.py` against the real app (path exists,
+ * field names are the request model's, and the path SET equals the MCP
+ * client's) — a renamed route fails CI before it 404s a published CLI. Keep
+ * the literal shape: that test parses it.
+ */
+const ROUTES = {
+    scan: { kind: "json", path: "/api/v1/scan" },
+    report: { kind: "report" },
+    "dmarc-upgrade": { kind: "json", path: "/api/v1/dmarc-upgrade" },
+    "signup-url": { kind: "json", path: "/api/v1/signup-url" },
+    "spf-count": { kind: "json", path: "/api/tools/spf-count" },
+    "dmarc-validate": { kind: "json", path: "/api/tools/dmarc-validate" },
+    "dmarc-generate": { kind: "json", path: "/api/tools/dmarc-generate" },
+    dkim: { kind: "json", path: "/api/tools/dkim-check" },
+    "report-parse": { kind: "upload", path: "/api/tools/dmarc-report-parse", field: "file" },
+    record: { kind: "json", path: "/api/tools/check-record" },
+    propagation: { kind: "json", path: "/api/tools/propagation-check" },
+    "reverse-dns": { kind: "json", path: "/api/tools/reverse-dns-check" },
+    "spf-audit": { kind: "json", path: "/api/tools/spf-audit" },
+    parked: { kind: "json", path: "/api/tools/parked-domain-records" },
+    alerts: { kind: "query", path: "/api/v1/alerts" },
+    readiness: { kind: "query", path: "/api/v1/readiness" },
+};
+export function routeFor(command) {
+    const route = ROUTES[command];
+    if (!route)
+        throw new Error(`no route for command '${command}'`);
+    return route;
+}
+/** The persisted-report path; the one route whose path is built from an argument. */
+export function reportPath(domain) {
+    return `/api/v1/report/${encodeURIComponent(domain)}`;
+}
+export const COMMANDS = Object.keys(ROUTES).filter((c) => c !== "report");
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,MAAM,GAA0B;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;IAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAChE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC1D,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC3D,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACrE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACrE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACrD,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,EAAE;IACxF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACzD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACnE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACrE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC3D,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAClE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACjD,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE;CACxD,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "dns-doctor",
+  "version": "0.2.0",
+  "description": "Command-line DNS Doctor — scan, fix and verify a domain's DNS from the terminal: SPF, DMARC, DKIM, MX, DNS health, blacklists, expiry and six-vantage propagation, over the public DNS Doctor API. Fix records come from a deterministic engine, never an AI guess.",
+  "license": "Apache-2.0",
+  "author": {
+    "name": "DNS Doctor",
+    "url": "https://dnsdoctor.dev"
+  },
+  "homepage": "https://dnsdoctor.dev/methodology",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dnsdoctor/cli.git"
+  },
+  "keywords": [
+    "dns",
+    "dmarc",
+    "spf",
+    "dkim",
+    "email",
+    "deliverability",
+    "propagation",
+    "cli"
+  ],
+  "type": "module",
+  "bin": {
+    "dns-doctor": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  }
+}