paygate-mcp 0.6.0 → 0.8.0

package/README.md

@@ -28,9 +28,16 @@ Agent → PayGate (auth + billing) → Your MCP Server (stdio or HTTP)
 
 - **API Key Auth** — Clients need a valid `X-API-Key` to call tools
 - **Credit Billing** — Each tool call costs credits (configurable per-tool)
-- **Rate Limiting** — Sliding window per-key rate limits
+- **Rate Limiting** — Sliding window per-key rate limits + per-tool rate limits
 - **Usage Metering** — Track who called what, when, and how much they spent
 - **Two Transports** — Wrap local servers via stdio or remote servers via Streamable HTTP
+- **Per-Tool ACL** — Whitelist/blacklist tools per API key (enterprise access control)
+- **Per-Tool Rate Limits** — Independent rate limits per tool, not just global
+- **Key Expiry (TTL)** — Auto-expire API keys after a set time
+- **Spending Limits** — Cap total spend per API key to prevent runaway costs
+- **Refund on Failure** — Automatically refund credits when downstream tool calls fail
+- **Webhook Events** — POST batched usage events to any URL for external billing/alerting
+- **Config File Mode** — Load all settings from a JSON file (`--config`)
 - **Shadow Mode** — Log everything without enforcing payment (for testing)
 - **Persistent Storage** — Keys and credits survive restarts with `--state-file`
 - **Zero Dependencies** — No external npm packages. Uses only Node.js built-ins.
@@ -123,28 +130,7 @@ curl http://localhost:3402/balance \
   -H "X-API-Key: CLIENT_API_KEY"
 ```
 
-Returns credits, total spent, call count, and last used timestamp. If spending limits are set, also returns current daily/monthly spend and limits. Clients can check their own balance without needing admin access.
-
-### Set Spending Limits (Admin)
-
-```bash
-# Set daily and monthly credit caps for a key
-curl -X POST http://localhost:3402/keys/limits \
-  -H "Content-Type: application/json" \
-  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
-  -d '{"key": "CLIENT_API_KEY", "dailyLimit": 50, "monthlyLimit": 500}'
-```
-
-Prevents runaway AI agents from draining credits. When a key's daily or monthly spend reaches its cap, further tool calls are denied until the next day/month (UTC). Set to 0 for unlimited.
-
-You can also set limits when creating a key:
-
-```bash
-curl -X POST http://localhost:3402/keys \
-  -H "Content-Type: application/json" \
-  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
-  -d '{"name": "agent-key", "credits": 1000, "dailyLimit": 50, "monthlyLimit": 500}'
-```
+Returns credits, total spent, call count, and last used timestamp. Clients can check their own balance without needing admin access.
 
 ### Export Usage Data (Admin)
 
@@ -188,12 +174,14 @@ A real-time admin UI for managing keys, viewing usage, and monitoring tool calls
 | Endpoint | Method | Auth | Description |
 |----------|--------|------|-------------|
 | `/mcp` | POST | `X-API-Key` | JSON-RPC 2.0 proxy to wrapped MCP server |
-| `/balance` | GET | `X-API-Key` | Client self-service — check own credits |
-| `/keys` | POST | `X-Admin-Key` | Create a new API key with credits |
-| `/keys` | GET | `X-Admin-Key` | List all keys (masked) |
+| `/balance` | GET | `X-API-Key` | Client self-service — check own credits, ACL, expiry |
+| `/keys` | POST | `X-Admin-Key` | Create API key (with ACL, expiry, credits) |
+| `/keys` | GET | `X-Admin-Key` | List all keys (masked, with expiry status) |
 | `/topup` | POST | `X-Admin-Key` | Add credits to an existing key |
 | `/keys/revoke` | POST | `X-Admin-Key` | Revoke an API key |
-| `/keys/limits` | POST | `X-Admin-Key` | Set daily/monthly spending limits |
+| `/keys/acl` | POST | `X-Admin-Key` | Set tool ACL (whitelist/blacklist) on a key |
+| `/keys/expiry` | POST | `X-Admin-Key` | Set or remove key expiry (TTL) |
+| `/limits` | POST | `X-Admin-Key` | Set spending limit on a key |
 | `/usage` | GET | `X-Admin-Key` | Export usage data (JSON or CSV) |
 | `/status` | GET | `X-Admin-Key` | Full dashboard with usage stats |
 | `/dashboard` | GET | None (admin key in-browser) | Real-time admin web dashboard |
@@ -220,8 +208,9 @@ These MCP methods pass through without auth or billing:
 --import-key <k:c>   Import existing key with credits (e.g. "pg_abc:100")
 --state-file <path>  Persist keys/credits to a JSON file (survives restarts)
 --stripe-secret <s>  Stripe webhook signing secret (enables /stripe/webhook)
---daily-limit <n>    Default daily credit limit per key (0=unlimited)
---monthly-limit <n>  Default monthly credit limit per key (0=unlimited)
+--webhook-url <url>  POST batched usage events to this URL
+--refund-on-failure  Refund credits when downstream tool call fails
+--config <path>      Load settings from a JSON config file
 ```
 
 > **Note:** Use `--server` OR `--remote-url`, not both.
@@ -261,6 +250,150 @@ When a customer completes payment, credits are automatically added to their API
 - Payment status verification (only `paid` triggers credits)
 - Zero dependencies — uses Node.js built-in `crypto`
 
+### Per-Tool ACL (Access Control)
+
+Control which tools each API key can access:
+
+```bash
+# Create a key that can only access search and read tools
+curl -X POST http://localhost:3402/keys \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"name": "limited-client", "credits": 100, "allowedTools": ["search", "read_file"]}'
+
+# Create a key with specific tools blocked
+curl -X POST http://localhost:3402/keys \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"name": "safe-client", "credits": 100, "deniedTools": ["delete_file", "admin_reset"]}'
+
+# Update ACL on an existing key
+curl -X POST http://localhost:3402/keys/acl \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"key": "CLIENT_API_KEY", "allowedTools": ["search"], "deniedTools": ["admin"]}'
+```
+
+- **allowedTools** (whitelist): Only these tools are accessible. Empty = all tools.
+- **deniedTools** (blacklist): These tools are always denied. Applied after allowedTools.
+- ACL also filters `tools/list` — clients only see their permitted tools.
+
+### Per-Tool Rate Limits
+
+Set independent rate limits per tool (on top of the global limit):
+
+```json
+{
+  "toolPricing": {
+    "expensive_analyze": { "creditsPerCall": 10, "rateLimitPerMin": 5 },
+    "search": { "creditsPerCall": 1, "rateLimitPerMin": 30 },
+    "cheap_read": { "creditsPerCall": 1 }
+  }
+}
+```
+
+Per-tool limits are enforced independently per API key. A key can be rate-limited on one tool while still accessing others. The global `--rate-limit` applies across all tools.
+
+### Key Expiry (TTL)
+
+Create API keys that auto-expire:
+
+```bash
+# Create a key that expires in 1 hour (3600 seconds)
+curl -X POST http://localhost:3402/keys \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"name": "trial-user", "credits": 50, "expiresIn": 3600}'
+
+# Create a key with a specific expiry date
+curl -X POST http://localhost:3402/keys \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"name": "quarterly", "credits": 1000, "expiresAt": "2026-06-01T00:00:00Z"}'
+
+# Set or extend expiry on an existing key
+curl -X POST http://localhost:3402/keys/expiry \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"key": "CLIENT_API_KEY", "expiresIn": 86400}'
+
+# Remove expiry (key never expires)
+curl -X POST http://localhost:3402/keys/expiry \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"key": "CLIENT_API_KEY", "expiresAt": null}'
+```
+
+Expired keys return a clear `api_key_expired` error. Admins can extend or remove expiry at any time.
+
+### Spending Limits
+
+Cap the total credits any API key can spend:
+
+```bash
+# Set a spending limit on a key (admin only)
+curl -X POST http://localhost:3402/limits \
+  -H "Content-Type: application/json" \
+  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
+  -d '{"key": "CLIENT_API_KEY", "spendingLimit": 500}'
+
+# Check remaining budget
+curl http://localhost:3402/balance -H "X-API-Key: CLIENT_API_KEY"
+# → { "spendingLimit": 500, "remainingBudget": 350, ... }
+```
+
+Set `spendingLimit` to `0` for unlimited. When a key hits its limit, tool calls are denied with a clear error.
+
+### Refund on Failure
+
+Automatically return credits when a downstream tool call fails:
+
+```bash
+npx paygate-mcp wrap --server "node server.js" --refund-on-failure
+```
+
+Credits are deducted before the tool call. If the wrapped server returns an error, credits are refunded and `totalSpent` / `totalCalls` are rolled back. Prevents charging users for failed operations.
+
+### Webhook Events
+
+POST usage events to any external URL for billing, alerting, or analytics:
+
+```bash
+npx paygate-mcp wrap --server "node server.js" --webhook-url "https://billing.example.com/events"
+```
+
+Events are batched (up to 10 per POST) and flushed every 5 seconds. Each event includes tool name, credits charged, API key, and timestamp. Fire-and-forget with one retry on failure.
+
+### Config File Mode
+
+Load all settings from a JSON file instead of CLI flags:
+
+```bash
+npx paygate-mcp wrap --config paygate.json
+```
+
+Example `paygate.json`:
+```json
+{
+  "serverCommand": "npx",
+  "serverArgs": ["@modelcontextprotocol/server-filesystem", "/tmp"],
+  "port": 3402,
+  "defaultCreditsPerCall": 2,
+  "globalRateLimitPerMin": 30,
+  "webhookUrl": "https://billing.example.com/events",
+  "refundOnFailure": true,
+  "stateFile": "~/.paygate/state.json",
+  "toolPricing": {
+    "premium_analyze": { "creditsPerCall": 10 }
+  },
+  "importKeys": {
+    "pg_abc123def456": 500
+  }
+}
+```
+
+CLI flags override config file values when both are specified.
+
 ## Programmatic API
 
 ```typescript
@@ -298,9 +431,12 @@ const { port, adminKey } = await server.start();
 - API keys never forwarded to remote servers (HTTP transport)
 - Rate limiting is per-key, concurrent-safe
 - Stripe webhook signature verification (HMAC-SHA256, timing-safe)
-- Per-key daily/monthly spending caps (budget protection)
 - Dashboard uses safe DOM methods (textContent/createElement) — no innerHTML
-- Red-teamed with 78 adversarial security tests across 9 passes
+- Webhook URLs masked in status output
+- Spending limits enforced with integer arithmetic (no float bypass)
+- Per-tool ACL enforcement (whitelist + blacklist, sanitized inputs)
+- Key expiry with fail-closed behavior (expired = denied)
+- Red-teamed with 101 adversarial security tests across 14 passes
 
 ## Current Limitations
 
@@ -315,8 +451,16 @@ const { port, adminKey } = await server.start();
 - [x] Client self-service balance check (`/balance`)
 - [x] Usage data export — JSON and CSV (`/usage`)
 - [x] Admin web dashboard (`/dashboard`)
-- [x] Per-key spending limits — daily/monthly budget caps
-- [ ] Multi-tenant mode
+- [x] Per-key spending limits (`/limits`)
+- [x] Webhook events (`--webhook-url`)
+- [x] Refund on failure (`--refund-on-failure`)
+- [x] Config file mode (`--config`)
+- [x] Per-tool ACL — whitelist/blacklist tools per key
+- [x] Per-tool rate limits — independent limits per tool
+- [x] Key expiry (TTL) — auto-expire API keys
+- [ ] Multi-server mode — wrap N MCP servers behind one PayGate
+- [ ] Client SDK — `@paygate-mcp/client` with auto 402 retry
+- [ ] OAuth 2.1 — MCP spec mandates it for production
 
 ## Requirements
 

package/dist/cli.d.ts

@@ -5,8 +5,7 @@
  * Usage:
  *   npx paygate-mcp wrap --server "npx my-mcp-server" --port 3402
  *   npx paygate-mcp wrap --server "python server.py" --price 2 --rate-limit 30
- *   npx paygate-mcp keys create --name "my-client" --credits 500
- *   npx paygate-mcp status
+ *   npx paygate-mcp wrap --config paygate.json
  */
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG"}

package/dist/cli.js

@@ -6,11 +6,21 @@
  * Usage:
  *   npx paygate-mcp wrap --server "npx my-mcp-server" --port 3402
  *   npx paygate-mcp wrap --server "python server.py" --price 2 --rate-limit 30
- *   npx paygate-mcp keys create --name "my-client" --credits 500
- *   npx paygate-mcp status
+ *   npx paygate-mcp wrap --config paygate.json
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const server_1 = require("./server");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const PKG_VERSION = (() => {
+    try {
+        const pkg = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'package.json'), 'utf-8'));
+        return pkg.version || '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function parseArgs(argv) {
     const command = argv[2] || 'help';
@@ -38,24 +48,26 @@ function printUsage() {
   USAGE:
     paygate-mcp wrap --server <command> [options]     # stdio transport
     paygate-mcp wrap --remote-url <url> [options]     # Streamable HTTP transport
+    paygate-mcp wrap --config <path> [options]        # load from config file
 
   OPTIONS:
-    --server <cmd>       MCP server command to wrap via stdio (required unless --remote-url)
-                         e.g. "npx @modelcontextprotocol/server-filesystem /"
-    --remote-url <url>   Remote MCP server URL (Streamable HTTP transport)
-                         e.g. "https://my-mcp-server.example.com/mcp"
-    --port <n>           HTTP port (default: 3402)
-    --price <n>          Default credits per tool call (default: 1)
-    --rate-limit <n>     Max calls/min per key (default: 60, 0=unlimited)
-    --name <s>           Server display name (default: "PayGate MCP Server")
-    --shadow             Shadow mode — log but don't enforce payment
-    --admin-key <s>      Set admin key (default: auto-generated)
-    --tool-price <t:n>   Per-tool price override (e.g. "search:5,generate:10")
-    --import-key <k:c>   Import an existing API key with credits (e.g. "pg_abc123:100")
-    --state-file <path>  Persist keys/credits to a JSON file (survives restarts)
-    --stripe-secret <s>  Stripe webhook signing secret (enables /stripe/webhook endpoint)
-    --daily-limit <n>    Default daily credit limit per key (0=unlimited)
-    --monthly-limit <n>  Default monthly credit limit per key (0=unlimited)
+    --server <cmd>         MCP server command to wrap via stdio (required unless --remote-url or --config)
+                           e.g. "npx @modelcontextprotocol/server-filesystem /"
+    --remote-url <url>     Remote MCP server URL (Streamable HTTP transport)
+                           e.g. "https://my-mcp-server.example.com/mcp"
+    --config <path>        Load all settings from a JSON file
+    --port <n>             HTTP port (default: 3402)
+    --price <n>            Default credits per tool call (default: 1)
+    --rate-limit <n>       Max calls/min per key (default: 60, 0=unlimited)
+    --name <s>             Server display name (default: "PayGate MCP Server")
+    --shadow               Shadow mode — log but don't enforce payment
+    --admin-key <s>        Set admin key (default: auto-generated)
+    --tool-price <t:n>     Per-tool price override (e.g. "search:5,generate:10")
+    --import-key <k:c>     Import an existing API key with credits (e.g. "pg_abc123:100")
+    --state-file <path>    Persist keys/credits to a JSON file (survives restarts)
+    --stripe-secret <s>    Stripe webhook signing secret (enables /stripe/webhook endpoint)
+    --webhook-url <url>    POST usage events to this URL (batched)
+    --refund-on-failure    Refund credits when downstream tool call fails
 
   EXAMPLES:
     # Wrap a local MCP server (stdio transport)
@@ -70,8 +82,8 @@ function printUsage() {
     # Shadow mode (observe without enforcing)
     paygate-mcp wrap --server "node server.js" --shadow
 
-    # Per-tool pricing
-    paygate-mcp wrap --server "node server.js" --tool-price "search:5,generate:10"
+    # Load config from file
+    paygate-mcp wrap --config paygate.json
   `);
 }
 function parseToolPricing(input) {
@@ -90,10 +102,22 @@ async function main() {
     const { command, flags } = parseArgs(process.argv);
     switch (command) {
         case 'wrap': {
-            const serverCmd = flags['server'];
-            const remoteUrl = flags['remote-url'];
+            // Load config file if specified
+            let fileConfig = {};
+            if (flags['config']) {
+                try {
+                    const raw = (0, fs_1.readFileSync)(flags['config'], 'utf-8');
+                    fileConfig = JSON.parse(raw);
+                }
+                catch (err) {
+                    console.error(`Error loading config file: ${err.message}`);
+                    process.exit(1);
+                }
+            }
+            const serverCmd = flags['server'] || (fileConfig.serverCommand ? [fileConfig.serverCommand, ...(fileConfig.serverArgs || [])].join(' ') : '');
+            const remoteUrl = flags['remote-url'] || fileConfig.remoteUrl;
             if (!serverCmd && !remoteUrl) {
-                console.error('Error: --server or --remote-url is required.\n');
+                console.error('Error: --server, --remote-url, or --config is required.\n');
                 printUsage();
                 process.exit(1);
             }
@@ -102,22 +126,24 @@ async function main() {
                 process.exit(1);
             }
             // Parse server command into command + args (stdio mode)
-            let serverCommand = '';
-            let serverArgs = [];
-            if (serverCmd) {
-                const parts = serverCmd.split(/\s+/);
+            let serverCommand = fileConfig.serverCommand || '';
+            let serverArgs = fileConfig.serverArgs || [];
+            if (flags['server']) {
+                const parts = flags['server'].split(/\s+/);
                 serverCommand = parts[0];
                 serverArgs = parts.slice(1);
             }
-            const port = parseInt(flags['port'] || '3402', 10);
-            const price = parseInt(flags['price'] || '1', 10);
-            const rateLimit = parseInt(flags['rate-limit'] || '60', 10);
-            const name = flags['name'] || 'PayGate MCP Server';
-            const shadowMode = flags['shadow'] === 'true' || flags['shadow'] === undefined && 'shadow' in flags;
-            const adminKey = flags['admin-key'];
-            const toolPricing = flags['tool-price'] ? parseToolPricing(flags['tool-price']) : {};
-            const stateFile = flags['state-file'];
-            const stripeSecret = flags['stripe-secret'];
+            const port = parseInt(flags['port'] || String(fileConfig.port || 3402), 10);
+            const price = parseInt(flags['price'] || String(fileConfig.defaultCreditsPerCall || 1), 10);
+            const rateLimit = parseInt(flags['rate-limit'] || String(fileConfig.globalRateLimitPerMin || 60), 10);
+            const name = flags['name'] || fileConfig.serverCommand && 'PayGate MCP Server' || 'PayGate MCP Server';
+            const shadowMode = flags['shadow'] === 'true' || ('shadow' in flags && flags['shadow'] === undefined) || fileConfig.shadowMode || false;
+            const adminKey = flags['admin-key'] || fileConfig.adminKey;
+            const toolPricing = flags['tool-price'] ? parseToolPricing(flags['tool-price']) : (fileConfig.toolPricing || {});
+            const stateFile = flags['state-file'] || fileConfig.stateFile;
+            const stripeSecret = flags['stripe-secret'] || fileConfig.stripeWebhookSecret;
+            const webhookUrl = flags['webhook-url'] || fileConfig.webhookUrl || null;
+            const refundOnFailure = flags['refund-on-failure'] === 'true' || 'refund-on-failure' in flags || fileConfig.refundOnFailure || false;
             const server = new server_1.PayGateServer({
                 serverCommand,
                 serverArgs,
@@ -127,8 +153,10 @@ async function main() {
                 name,
                 shadowMode: !!shadowMode,
                 toolPricing,
+                webhookUrl,
+                refundOnFailure: !!refundOnFailure,
             }, adminKey, stateFile, remoteUrl, stripeSecret);
-            // Import keys if specified
+            // Import keys from CLI flags
             if (flags['import-key']) {
                 const pairs = flags['import-key'].split(',');
                 for (const pair of pairs) {
@@ -138,6 +166,12 @@ async function main() {
                     }
                 }
             }
+            // Import keys from config file
+            if (fileConfig.importKeys) {
+                for (const [key, credits] of Object.entries(fileConfig.importKeys)) {
+                    server.gate.store.importKey(key, 'imported', credits);
+                }
+            }
             // Handle graceful shutdown
             const shutdown = async () => {
                 console.log('\nShutting down...');
@@ -155,13 +189,15 @@ async function main() {
   ║                                                  ║
   ║  Endpoint:   http://localhost:${String(result.port).padEnd(5)}              ║
   ║  Admin Key:  ${result.adminKey.slice(0, 20)}...       ║
-  ║  Backend:    ${(remoteUrl ? 'HTTP → ' + remoteUrl.slice(0, 28) : 'stdio → ' + (serverCmd || '').slice(0, 27)).padEnd(35)}║
+  ║  Backend:    ${(remoteUrl ? 'HTTP → ' + remoteUrl.slice(0, 28) : 'stdio → ' + (serverCmd || serverCommand).slice(0, 27)).padEnd(35)}║
   ║                                                  ║
   ║  Pricing:    ${String(price).padEnd(3)} credit(s) per tool call       ║
   ║  Rate Limit: ${String(rateLimit).padEnd(3)} calls/min per key          ║
   ║  Shadow:     ${String(!!shadowMode).padEnd(5)}                            ║
   ║  Persist:    ${(stateFile ? stateFile.slice(0, 33) : 'off (in-memory)').padEnd(35)}║
   ║  Stripe:     ${(stripeSecret ? 'enabled (/stripe/webhook)' : 'off').padEnd(35)}║
+  ║  Refund:     ${String(!!refundOnFailure).padEnd(35)}║
+  ║  Webhook:    ${(webhookUrl ? webhookUrl.slice(0, 33) : 'off').padEnd(35)}║
   ║                                                  ║
   ╠══════════════════════════════════════════════════╣
   ║  POST /mcp       — JSON-RPC (X-API-Key header)  ║
@@ -169,6 +205,7 @@ async function main() {
   ║  GET  /balance   — Client balance (X-API-Key)    ║
   ║  POST /keys      — Create key (X-Admin-Key)      ║
   ║  POST /topup     — Add credits (X-Admin-Key)     ║
+  ║  POST /limits    — Set spending limit (Admin)     ║
   ╚══════════════════════════════════════════════════╝
 `);
                 console.log(`  Admin key (save this): ${result.adminKey}\n`);
@@ -187,7 +224,7 @@ async function main() {
         case 'version':
         case '--version':
         case '-v':
-            console.log('paygate-mcp v0.6.0');
+            console.log(`paygate-mcp v${PKG_VERSION}`);
             break;
         default:
             console.error(`Unknown command: ${command}\n`);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AACA;;;;;;;;GAQG;;AAEH,qCAAyC;AAGzC,gFAAgF;AAEhF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;YAEtC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAChE,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,wDAAwD;YACxD,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,UAAU,GAAa,EAAE,CAAC;YAC9B,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC;YACnD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,QAAQ,IAAI,KAAK,CAAC;YACpG,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC;gBAC/B,aAAa;gBACb,UAAU;gBACV,IAAI;gBACJ,qBAAqB,EAAE,KAAK;gBAC5B,qBAAqB,EAAE,SAAS;gBAChC,IAAI;gBACJ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,WAAW;aACZ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAEjD,2BAA2B;YAC3B,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1C,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACvF,CAAC;gBACH,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;gBAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC;;;;;oCAKgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC9C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;mBAC5B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;;mBAEzG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBACvB,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC3B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC9B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;mBACnE,CAAC,YAAY,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;;;;;;;;;CASjF,CAAC,CAAC;gBACK,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,UAAU,EAAE,CAAC;YACb,MAAM;QAER,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAClC,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;YAC/C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AACA;;;;;;;GAOG;;AAEH,qCAAyC;AAEzC,2BAAkC;AAClC,+BAA4B;AAE5B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC;IAAC,CAAC;AAC7B,CAAC,CAAC,EAAE,CAAC;AAEL,gFAAgF;AAEhF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAmBD,gFAAgF;AAEhF,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,gCAAgC;YAChC,IAAI,UAAU,GAAe,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;oBACnD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9I,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;YAE9D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,wDAAwD;YACxD,IAAI,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;YACnD,IAAI,UAAU,GAAa,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3C,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,qBAAqB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,aAAa,IAAI,oBAAoB,IAAI,oBAAoB,CAAC;YACvG,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC;YACxI,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACjH,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC;YAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC;YACzE,MAAM,eAAe,GAAG,KAAK,CAAC,mBAAmB,CAAC,KAAK,MAAM,IAAI,mBAAmB,IAAI,KAAK,IAAI,UAAU,CAAC,eAAe,IAAI,KAAK,CAAC;YAErI,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC;gBAC/B,aAAa;gBACb,UAAU;gBACV,IAAI;gBACJ,qBAAqB,EAAE,KAAK;gBAC5B,qBAAqB,EAAE,SAAS;gBAChC,IAAI;gBACJ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,WAAW;gBACX,UAAU;gBACV,eAAe,EAAE,CAAC,CAAC,eAAe;aACnC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAEjD,6BAA6B;YAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1C,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACvF,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;gBAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC;;;;;oCAKgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC9C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;mBAC5B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;;mBAEpH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBACvB,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC3B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;mBAC9B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;mBACnE,CAAC,YAAY,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;mBAC/D,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;mBACpC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;;;;;;;;;;CAU3E,CAAC,CAAC;gBACK,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,UAAU,EAAE,CAAC;YACb,MAAM;QAER,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;YAC3C,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;YAC/C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/gate.d.ts

@@ -5,24 +5,42 @@
  *   1. API key validity
  *   2. Credit balance
  *   3. Rate limit
+ *   4. Spending limit
  *
  * Fail-closed: any check failure => DENY.
  * Shadow mode: log but don't enforce (always ALLOW).
  */
-import { PayGateConfig, GateDecision, ToolCallParams } from './types';
+import { PayGateConfig, GateDecision, ToolCallParams, ApiKeyRecord } from './types';
 import { KeyStore } from './store';
 import { RateLimiter } from './rate-limiter';
 import { UsageMeter } from './meter';
+import { WebhookEmitter } from './webhook';
 export declare class Gate {
     readonly store: KeyStore;
     readonly rateLimiter: RateLimiter;
     readonly meter: UsageMeter;
+    readonly webhook: WebhookEmitter | null;
     private readonly config;
     constructor(config: PayGateConfig, statePath?: string);
     /**
      * Evaluate a tool call request.
      */
     evaluate(apiKey: string | null, toolCall: ToolCallParams): GateDecision;
+    /**
+     * Check if a tool call is allowed by the key's ACL.
+     */
+    private checkToolAcl;
+    /**
+     * Filter a tools list based on a key's ACL. Used by proxies for tools/list filtering.
+     * Returns null if no filtering needed (no API key or no ACL configured).
+     */
+    filterToolsForKey(apiKey: string | null, tools: Array<{
+        name: string;
+        [k: string]: unknown;
+    }>): Array<{
+        name: string;
+        [k: string]: unknown;
+    }> | null;
     /**
      * Check if a method is free (no auth required).
      */
@@ -38,8 +56,9 @@ export declare class Gate {
         name: string;
         shadowMode: boolean;
         activeKeys: number;
-        keys: (Omit<import("./types").ApiKeyRecord, "key"> & {
+        keys: (Omit<ApiKeyRecord, "key"> & {
             keyPrefix: string;
+            expired: boolean;
         })[];
         usage: import("./types").UsageSummary;
         eventCount: number;
@@ -47,8 +66,17 @@ export declare class Gate {
             defaultCreditsPerCall: number;
             globalRateLimitPerMin: number;
             toolPricing: Record<string, import("./types").ToolPricing>;
+            refundOnFailure: boolean;
+            webhookUrl: string | null;
         };
     };
+    /**
+     * Refund credits for a failed tool call.
+     * Only used when refundOnFailure is enabled.
+     */
+    refund(apiKey: string, toolName: string, credits: number): void;
+    /** Whether refund-on-failure is enabled */
+    get refundOnFailure(): boolean;
     destroy(): void;
     private recordEvent;
 }

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAc,cAAc,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM;IAOrD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,GAAG,YAAY;IAmEvE;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIrC;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMtC;;OAEG;IACH,SAAS;;;;;;;;;;;;;;;IAgBT,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,WAAW;CAcpB"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAc,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM;IAQrD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,GAAG,YAAY;IAyGvE;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI;IAmBpJ;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIrC;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMtC;;OAEG;IACH,SAAS;;;;;;;;;;;;;;;;;;IAkBT;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAW/D,2CAA2C;IAC3C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,WAAW;CAgBpB"}