authflow-cli 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Authflow LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,260 @@
+# Authflow CLI
+
+License: Apache-2.0. See [LICENSE](LICENSE).
+
+Minimal TypeScript CLI for Authflow Rail onboarding. Wraps the public admin and Origin Protocol surfaces so a tenant can register a resource, connect Stripe, mint a local identity header, run the conformance probe, and scaffold the origin sidecar — without reading rail source.
+
+`authflow mcp` exposes the same operations as an MCP server, so a coding agent can onboard a server against the codebase it already has open. The tenant-facing walkthrough is [Onboard with your agent](../../docs/onboarding/agent.md). Command reference: [`authflow mcp`](#authflow-mcp).
+
+## Install
+
+Published on npm as [`authflow-cli`](https://www.npmjs.com/package/authflow-cli). No repo checkout is required:
+
+```bash
+npx -y authflow-cli --help
+npx -y authflow-cli init --slug video --price 900 --credits 12
+```
+
+Or install globally: `npm install -g authflow-cli`.
+
+## From this repo (development)
+
+```bash
+cd sdk/cli
+npm install
+npm run build
+npx authflow --help
+```
+
+During development (no build step):
+
+```bash
+npx tsx src/cli.ts --help
+npm run authflow -- --help
+```
+
+## Config
+
+| Env | Flag | Used by |
+| --- | --- | --- |
+| `AUTHFLOW_ISSUER` | `--issuer` | all HTTP commands |
+| `AUTHFLOW_ADMIN_API_KEY` | `--admin-key` | `init`, `register`, `connect`, `set-origin` (mint with `authflow signup`) |
+| `AUTHFLOW_ORIGIN_API_KEY` | `--origin-key` | `mint-header`, `probe` |
+| `AUTHFLOW_RESOURCE` / `AUTHFLOW_GATEWAY_URL` | `--gateway-url` / `--receipt` | curl hint on `mint-header` |
+
+Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net`, local is typically `https://localhost:7175`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
+
+## Commands
+
+### `authflow signup`
+
+Mints a per-tenant admin API key. This is how a creator gets `AUTHFLOW_ADMIN_API_KEY` without the rail operator handing them one.
+
+```bash
+export AUTHFLOW_ISSUER=https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net
+npx -y authflow-cli signup --email you@example.com
+```
+
+The key (`afa_test_` on staging, `afa_live_` in production) is shown once and written to `.env.local` by default. It can only register and manage slugs created with that key. The operator bearer still exists as a super-admin.
+
+### `authflow init`
+
+The whole onboarding path in one command: register the resource, put the origin API key in a secret
+store, print the config to paste into your MCP server, and probe the origin if it is already up.
+
+```bash
+export AUTHFLOW_ISSUER=https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net
+export AUTHFLOW_ADMIN_API_KEY=…
+
+authflow init --slug video --price 900 --credits 12
+```
+
+Neither a Stripe account nor a deployed origin is required. Both are deferrable, in any order, and
+omitting either registers a **draft**: priced and registered, with a receipt you can build against,
+but not routable. That is the normal case — you rarely have a connected Stripe account or an origin
+URL before you have built anything.
+
+The receipt's `pending_requirements` lists what is still outstanding:
+
+| Requirement | Clear it with |
+| --- | --- |
+| `origin_base_uri` | `authflow set-origin --slug video --origin-url https://…` |
+| `connected_account_id` | `authflow connect --slug video` |
+| `stripe_onboarding_complete` | finish Stripe's form, then `authflow connect --slug video` again |
+
+The resource goes live once the list is empty. Add `--connect` to `init` to get the Stripe
+onboarding link from the first command instead of running `connect` separately.
+
+Useful flags:
+
+| Flag | Default | Meaning |
+| --- | --- | --- |
+| `--integration <dotnet\|proxy>` | `dotnet` | Which origin config to print |
+| `--write-secrets <target>` | `user-secrets` | `user-secrets`, `env-file`, or `keyvault` |
+| `--secret-destination <value>` | — | Project dir, env-file path, or vault name |
+| `--connected-account <acct>` | — | Attach a Stripe account you already have |
+| `--connect` | — | Start Stripe onboarding and print the hosted link |
+| `--origin-url <url>` | — | Supply the origin now instead of later |
+| `--no-probe` | — | Skip the conformance probe |
+
+### `authflow connect`
+
+Starts or resumes Stripe Connect Standard onboarding and prints the hosted link the creator opens to
+complete KYC.
+
+```bash
+authflow connect --slug video
+authflow connect --slug video --wait   # poll until Stripe reports the account can take charges
+```
+
+Account links are single-use and expire in minutes. Re-running is the expected way to get a fresh
+one: it resumes the same Stripe account rather than creating another, so retrying never leaves
+abandoned accounts behind. Run it again after the form is submitted to confirm `charges_enabled` and
+promote the resource.
+
+### `authflow set-origin`
+
+Points a draft at its origin, promoting it to live if nothing else is pending.
+
+```bash
+authflow set-origin --slug video --origin-url https://video-xyz.azurecontainerapps.io
+```
+
+Pass the base URI without `/mcp`; the gateway appends it.
+
+### `authflow doctor`
+
+Preflights a rail deployment before you spend time debugging your own origin.
+
+```bash
+authflow doctor --issuer https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net --slug video
+```
+
+Checks that the issuer is reachable, that the Origin Protocol keys document is served and
+self-consistent (issuer byte-match, protocol version, a usable Ed25519 key, no private key
+material), and — with `--slug` — that the resource's PRM document resolves and the gateway answers
+an unauthenticated connect with a `401` carrying `resource_metadata`.
+
+Run this first when anything looks broken. It separates the two failures that are indistinguishable
+from the outside: a hostname that is not bound to the rail returns `404` on every path including
+`/healthz`, which reads exactly like a broken endpoint. Exit code is non-zero on any failure.
+
+### `authflow register`
+
+```bash
+export AUTHFLOW_ISSUER=https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net
+export AUTHFLOW_ADMIN_API_KEY=…
+authflow register --file resource.json --out receipt.json
+```
+
+`resource.json` uses the same snake_case fields as `POST /admin/resources` (see [tenant quickstart](../../docs/onboarding/tenant-quickstart.md) §3):
+
+```json
+{
+  "slug": "video",
+  "origin_base_uri": "https://video-xyz.azurecontainerapps.io",
+  "display_name": "Snyder Video",
+  "connected_account_id": "acct_…",
+  "currency": "usd",
+  "price_amount_minor": 900,
+  "credits_per_period": 12,
+  "price_version": 1
+}
+```
+
+`origin_base_uri` may be `null` or omitted, which registers a draft — see `authflow set-origin`.
+
+Writes the registration receipt to `--out` (default `receipt.json`). By default that file contains
+the one-time `origin_api_key` in plaintext, which is a credential you probably do not want on disk:
+
+```bash
+authflow register --file resource.json --write-secrets user-secrets --secret-destination ./src/MyMcpServer
+```
+
+That stores the key and redacts it from the receipt. `env-file` writes `.env.local` (and adds it to
+`.gitignore`); `keyvault` calls `az keyvault secret set` and needs `--secret-destination <vault>`.
+
+Rotate a key later with the admin API: `POST /admin/resources/{slug}/rotate-origin-key`.
+
+### `authflow mint-header`
+
+Dev/staging only (`OriginProtocol:EnableDevEndpoints`). Mints a signed `X-Authflow-Identity` without OAuth.
+
+```bash
+export AUTHFLOW_ORIGIN_API_KEY=afo_test_…
+authflow mint-header --tier standard --ttl 90 --grant-credits 3 --receipt receipt.json
+```
+
+Prints the header and, when a gateway URL is known, a ready-to-paste `curl` against it.
+
+### `authflow probe`
+
+Asks the rail to probe the registered origin with valid and deliberately broken identity headers.
+
+```bash
+authflow probe
+```
+
+Renders a pass/fail table. Exit code is non-zero when any check fails or the origin is unreachable.
+
+### `authflow scaffold`
+
+```bash
+authflow scaffold --receipt receipt.json --upstream http://upstream:3000
+```
+
+Writes:
+
+- `.env` — `AUTHFLOW_ISSUER`, `AUTHFLOW_RESOURCE`, `AUTHFLOW_ORIGIN_API_KEY`, `AUTHFLOW_UPSTREAM_BASE_URI`
+- `docker-compose.authflow.yml` — `authflow-origin-proxy` in front of an upstream placeholder
+
+See [origin-proxy.md](../../docs/onboarding/origin-proxy.md) for the forwarded-header contract and the
+nonce-cache options.
+
+### `authflow mcp`
+
+Runs the onboarding operations as an MCP server on stdio, so a coding agent can do the onboarding
+instead of a human running commands. The agent already has the creator's codebase; what it lacks is
+a way to talk to the rail. This supplies exactly that, and nothing more — the server never reads or
+writes source files. It hands back an integration plan and the agent applies it.
+
+Add it to Cursor or Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "authflow": {
+      "command": "npx",
+      "args": ["-y", "authflow-cli", "mcp"],
+      "env": {
+        "AUTHFLOW_ISSUER": "https://app-rail-railstg-4joi6asiofdcm.azurewebsites.net",
+        "AUTHFLOW_ADMIN_API_KEY": "…"
+      }
+    }
+  }
+}
+```
+
+Tools:
+
+| Tool | Does |
+| --- | --- |
+| `authflow_signup` | Mint a per-tenant admin API key (no existing credential) |
+| `authflow_doctor` | Preflight the rail; distinguishes a bad hostname from an outage |
+| `authflow_register_resource` | Register and price a resource; optionally store the key in a secret store |
+| `authflow_get_resource` | Current receipt, `status`, and `pending_requirements` |
+| `authflow_integration_plan` | Config, snippets, verification steps, and invariants for `dotnet`, `typescript`, `python`, or `proxy` |
+| `authflow_start_stripe_connect` | Hosted Stripe onboarding link; resumable |
+| `authflow_set_connected_account` | Attach an existing `acct_…` |
+| `authflow_set_origin` | Supply the origin and promote to live |
+| `authflow_probe` | Conformance probe against the origin |
+| `authflow_mint_test_header` | Signed identity header for local verifier testing |
+| `authflow_rotate_origin_key` | Rotate the origin API key (invalidates the old one immediately) |
+
+Every tool takes `issuer` and `admin_key` optionally, falling back to the environment, so credentials
+stay in the MCP client config rather than in the conversation. `write_secrets` is available on both
+tools that issue a key; prefer it, because a key returned in a tool result is a credential in a chat
+transcript.
+
+Authentication is a per-tenant `afa_` admin API key from `authflow signup` (or `authflow_signup`).
+The operator bearer still works as a super-admin. Per-creator OAuth is not required for onboarding.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { connectCommand } from "./commands/connect.js";
+import { doctorCommand } from "./commands/doctor.js";
+import { initCommand } from "./commands/init.js";
+import { mcpCommand } from "./commands/mcp.js";
+import { signupCommand } from "./commands/signup.js";
+import { registerCommand } from "./commands/register.js";
+import { setOriginCommand } from "./commands/set-origin.js";
+import { mintHeaderCommand } from "./commands/mint-header.js";
+import { probeCommand } from "./commands/probe.js";
+import { scaffoldCommand } from "./commands/scaffold.js";
+const program = new Command();
+program
+    .name("authflow")
+    .description("Authflow Rail onboarding CLI")
+    .version("0.1.0");
+signupCommand(program);
+initCommand(program);
+registerCommand(program);
+connectCommand(program);
+setOriginCommand(program);
+mintHeaderCommand(program);
+probeCommand(program);
+doctorCommand(program);
+scaffoldCommand(program);
+mcpCommand(program);
+program.parseAsync(process.argv).catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,UAAU,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/connect.d.ts

@@ -0,0 +1,7 @@
+import type { Command } from "commander";
+/**
+ * Stripe onboarding, which is the one step of the flow that genuinely cannot be automated: KYC is
+ * a hosted form the creator has to fill in themselves. So the command's job is to hand over a link
+ * and then confirm the outcome, rather than to pretend the wait is not happening.
+ */
+export declare function connectCommand(program: Command): void;

package/dist/commands/connect.js

@@ -0,0 +1,84 @@
+import { requireAdminKey, requireIssuer } from "../config.js";
+import { describePending, startConnect } from "../rail.js";
+/**
+ * Stripe onboarding, which is the one step of the flow that genuinely cannot be automated: KYC is
+ * a hosted form the creator has to fill in themselves. So the command's job is to hand over a link
+ * and then confirm the outcome, rather than to pretend the wait is not happening.
+ */
+export function connectCommand(program) {
+    program
+        .command("connect")
+        .description("Start or resume Stripe Connect onboarding for a resource")
+        .requiredOption("--slug <slug>", "Resource slug")
+        .option("--email <email>", "Pre-fill the Stripe onboarding form")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .option("--wait", "Poll until Stripe reports the account can take charges")
+        .option("--wait-timeout <seconds>", "How long --wait polls before giving up", "600")
+        .action(async (opts) => {
+        const auth = {
+            issuer: requireIssuer(opts.issuer),
+            adminKey: requireAdminKey(opts.adminKey),
+        };
+        let result = await startConnect(auth, opts.slug, opts.email);
+        if (result.charges_enabled) {
+            reportReady(result.slug, result.status, result.pending_requirements);
+            return;
+        }
+        console.log(`Stripe onboarding for ${result.slug} (${result.connected_account_id}).`);
+        console.log("");
+        console.log("Open this URL and complete Stripe's form:");
+        console.log("");
+        console.log(`  ${result.onboarding_url}`);
+        console.log("");
+        if (result.onboarding_url_expires_at) {
+            console.log(`The link expires at ${result.onboarding_url_expires_at}.`);
+        }
+        console.log("Links are single-use. Re-run this command for a fresh one — it resumes the");
+        console.log("same Stripe account rather than creating another.");
+        if (!opts.wait) {
+            console.log("");
+            console.log(`When Stripe is done: authflow connect --slug ${opts.slug}`);
+            return;
+        }
+        const timeoutMs = Number(opts.waitTimeout) * 1000;
+        const deadline = Date.now() + timeoutMs;
+        console.log("");
+        process.stdout.write("Waiting for Stripe to report the account is ready");
+        while (Date.now() < deadline) {
+            await sleep(5000);
+            process.stdout.write(".");
+            result = await startConnect(auth, opts.slug, opts.email);
+            if (result.charges_enabled) {
+                console.log("");
+                console.log("");
+                reportReady(result.slug, result.status, result.pending_requirements);
+                return;
+            }
+        }
+        console.log("");
+        console.log("");
+        console.log(`Still waiting on Stripe after ${opts.waitTimeout}s. Onboarding is not lost —`);
+        console.log(`finish the form and re-run: authflow connect --slug ${opts.slug}`);
+        process.exitCode = 1;
+    });
+}
+function reportReady(slug, status, pending) {
+    console.log(`Stripe is connected for ${slug} and can take charges.`);
+    console.log(`status: ${status}`);
+    if (pending.length === 0) {
+        console.log("");
+        console.log("Nothing else is pending. Verify before real traffic: authflow probe");
+        return;
+    }
+    console.log("");
+    console.log("Still pending before go-live:");
+    for (const requirement of pending) {
+        console.log(`  ${requirement}`);
+        console.log(`    ${describePending(requirement, slug)}`);
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=connect.js.map

package/dist/commands/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,0DAA0D,CAAC;SACvE,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,QAAQ,EAAE,wDAAwD,CAAC;SAC1E,MAAM,CAAC,0BAA0B,EAAE,wCAAwC,EAAE,KAAK,CAAC;SACnF,MAAM,CACL,KAAK,EAAE,IAON,EAAE,EAAE;QACH,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzC,CAAC;QAEF,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,oBAAoB,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAE1E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,WAAW,6BAA6B,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,uDAAuD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,OAAiB;IAClE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,wBAAwB,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function doctorCommand(program: Command): void;

package/dist/commands/doctor.js

@@ -0,0 +1,16 @@
+import { requireIssuer } from "../config.js";
+import { formatDoctorReport, runDoctor } from "../doctor.js";
+export function doctorCommand(program) {
+    program
+        .command("doctor")
+        .description("Check that the rail is reachable and serving a consistent Origin Protocol surface")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--slug <slug>", "Also check this resource's PRM document and gateway 401 challenge")
+        .option("--json", "Emit the report as JSON")
+        .action(async (opts) => {
+        const report = await runDoctor(requireIssuer(opts.issuer), opts.slug);
+        console.log(opts.json ? JSON.stringify(report, null, 2) : formatDoctorReport(report));
+        process.exitCode = report.pass ? 0 : 1;
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE7D,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAwD,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,12 @@
+import type { Command } from "commander";
+/**
+ * One command from nothing to a registered, configured origin.
+ *
+ * The individual steps already existed as `register`, `scaffold`, and `probe`. They are wrapped here
+ * because the gaps between them were where onboarding actually stalled: neither the origin URL nor a
+ * Stripe account is usually available at registration time, and requiring either one forced a stop
+ * at the very first command. Both are now deferrable, so a creator can register, price, take the
+ * receipt, and build against it before they have a company bank account — and the receipt's
+ * `pending_requirements` is what tells them what is still outstanding.
+ */
+export declare function initCommand(program: Command): void;