authflow-cli 0.1.0

package/dist/commands/init.js

@@ -0,0 +1,182 @@
+import { writeFile } from "node:fs/promises";
+import { apiJson, bearer, requireAdminKey, requireIssuer } from "../config.js";
+import { describePending, startConnect } from "../rail.js";
+import { originApiKeyConfigKey, secretTargets, writeOriginApiKey } from "../secrets.js";
+/**
+ * One command from nothing to a registered, configured origin.
+ *
+ * The individual steps already existed as `register`, `scaffold`, and `probe`. They are wrapped here
+ * because the gaps between them were where onboarding actually stalled: neither the origin URL nor a
+ * Stripe account is usually available at registration time, and requiring either one forced a stop
+ * at the very first command. Both are now deferrable, so a creator can register, price, take the
+ * receipt, and build against it before they have a company bank account — and the receipt's
+ * `pending_requirements` is what tells them what is still outstanding.
+ */
+export function initCommand(program) {
+    program
+        .command("init")
+        .description("Register a resource, store its secret, and print ready-to-paste origin config")
+        .requiredOption("--slug <slug>", "URL segment for the resource, e.g. video")
+        .option("--connected-account <acct>", "Your Stripe Standard account id (acct_...). Omit to connect Stripe later")
+        .option("--connect", "Immediately start Stripe onboarding and print the hosted link")
+        .option("--display-name <name>", "Human-readable name shown to subscribers")
+        .option("--currency <code>", "ISO currency code", "usd")
+        .option("--price <minor>", "Subscription price in minor units, e.g. 900 for $9.00", "900")
+        .option("--credits <n>", "Credits granted per billing period", "12")
+        .option("--origin-url <url>", "Origin base URI, if you already know it. Omit to register a draft")
+        .option("--integration <kind>", "Config to print: dotnet | proxy", "dotnet")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .option("-o, --out <path>", "Receipt output path", "receipt.json")
+        .option("--write-secrets <target>", `Secret store (${secretTargets.join(" | ")})`, "user-secrets")
+        .option("--secret-destination <value>", "Project dir, env-file path, or Key Vault name")
+        .option("--no-probe", "Skip the conformance probe even when the origin URL is known")
+        .action(async (opts) => {
+        const issuer = requireIssuer(opts.issuer);
+        const adminKey = requireAdminKey(opts.adminKey);
+        const target = parseTarget(opts.writeSecrets);
+        const draft = {
+            slug: opts.slug,
+            display_name: opts.displayName ?? opts.slug,
+            origin_base_uri: opts.originUrl ?? null,
+            connected_account_id: opts.connectedAccount ?? null,
+            currency: opts.currency,
+            price_amount_minor: Number(opts.price),
+            credits_per_period: Number(opts.credits),
+        };
+        const { body: receipt } = await apiJson(`${issuer}/admin/resources`, {
+            method: "POST",
+            headers: {
+                ...bearer(adminKey),
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify(draft),
+            expectedStatuses: [201],
+        });
+        const originApiKey = receipt.origin_api_key;
+        let storedAt;
+        if (originApiKey) {
+            storedAt = await writeOriginApiKey({
+                target,
+                value: originApiKey,
+                destination: opts.secretDestination,
+            });
+            receipt.origin_api_key = `<stored in ${storedAt}>`;
+        }
+        await writeFile(opts.out, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
+        // Readiness is the rail's call, not something to re-derive from which flags were passed:
+        // a resource with both an origin and a Stripe account is still a draft until Stripe reports
+        // charges_enabled, and only the receipt knows that.
+        const pending = receipt.pending_requirements ?? [];
+        const status = receipt.status ?? (pending.length === 0 ? "live" : "draft");
+        console.log(`Registered ${receipt.slug} (${status}).`);
+        console.log(`  gateway URL:  ${receipt.gateway_url ?? "-"}`);
+        console.log(`  receipt:      ${opts.out}`);
+        if (storedAt) {
+            console.log(`  secret:       ${storedAt}`);
+        }
+        console.log("");
+        printOriginConfig(opts.integration, receipt, storedAt !== undefined);
+        if (opts.connect && !opts.connectedAccount) {
+            console.log("");
+            await printConnectLink(issuer, adminKey, opts.slug);
+        }
+        if (pending.length > 0) {
+            console.log("");
+            console.log("The resource is a draft: registered and priced, but not yet routable.");
+            console.log("Outstanding before go-live:");
+            console.log("");
+            for (const requirement of pending) {
+                console.log(`  ${requirement}`);
+                console.log(`    ${describePending(requirement, opts.slug)}`);
+            }
+            console.log("");
+            console.log("Order does not matter. The resource goes live once nothing is left.");
+            return;
+        }
+        if (opts.probe === false || !originApiKey) {
+            console.log("");
+            console.log("Verify fail-closed behaviour once the origin is up: authflow probe");
+            return;
+        }
+        console.log("");
+        console.log("Running the conformance probe against the origin...");
+        await runProbe(issuer, originApiKey);
+    });
+}
+/**
+ * Kicks off Connect during init so a creator who has no Stripe account yet still leaves the first
+ * command holding the one link they need, rather than a note to run another command later.
+ */
+async function printConnectLink(issuer, adminKey, slug) {
+    const result = await startConnect({ issuer, adminKey }, slug);
+    if (result.charges_enabled) {
+        console.log(`Stripe is already connected (${result.connected_account_id}) and can take charges.`);
+        return;
+    }
+    console.log(`Stripe onboarding (${result.connected_account_id}) — open this and complete the form:`);
+    console.log("");
+    console.log(`  ${result.onboarding_url}`);
+    console.log("");
+    console.log(`The link is single-use. For a fresh one: authflow connect --slug ${slug}`);
+}
+function printOriginConfig(integration, receipt, secretStored) {
+    const issuer = receipt.issuer ?? "";
+    const resource = receipt.resource ?? receipt.gateway_url ?? "";
+    if (integration === "proxy") {
+        console.log("Origin proxy sidecar config:");
+        console.log("");
+        console.log(`  Authflow__Issuer=${issuer}`);
+        console.log(`  Authflow__Resource=${resource}`);
+        console.log("  Authflow__UpstreamBaseUri=<your MCP server>");
+        console.log("");
+        console.log("  # Required before running more than one replica:");
+        console.log("  # Authflow__NonceCacheRedis=<redis connection string>");
+        return;
+    }
+    console.log("Add the package and configuration to your MCP server:");
+    console.log("");
+    console.log("  dotnet add package Authflow.Origin");
+    console.log("");
+    console.log("  builder.Services.AddAuthflowOrigin(builder.Configuration);");
+    console.log("  await app.WarmAuthflowOriginKeysAsync();");
+    console.log("  app.UseAuthflowOrigin();");
+    console.log("");
+    console.log("  // appsettings.json");
+    console.log(`  "Authflow": { "Issuer": "${issuer}", "Resource": "${resource}" }`);
+    if (secretStored) {
+        console.log("");
+        console.log(`  ${originApiKeyConfigKey} is already in your secret store.`);
+    }
+}
+// The probe authenticates with the origin API key, which is bound to exactly one resource — so it
+// needs no slug, and it cannot be pointed at someone else's origin.
+async function runProbe(issuer, originApiKey) {
+    const { body } = await apiJson(`${issuer}/origin/v1/conformance`, {
+        method: "POST",
+        headers: { ...bearer(originApiKey), Accept: "application/json" },
+        expectedStatuses: [200],
+    });
+    for (const check of body.checks) {
+        console.log(`  ${check.pass ? "PASS" : "FAIL"}  ${check.name}`);
+        if (!check.pass) {
+            console.log(`        expected ${check.expected}, got ${check.observed}`);
+        }
+    }
+    console.log("");
+    if (body.pass) {
+        console.log("Conformance: PASS. The origin is ready for paid traffic.");
+        return;
+    }
+    console.log("Conformance: FAIL. The origin is registered but should not take paid traffic yet.");
+    process.exitCode = 1;
+}
+function parseTarget(raw) {
+    const value = raw.trim();
+    if (!secretTargets.includes(value)) {
+        throw new Error(`--write-secrets must be one of: ${secretTargets.join(", ")}`);
+    }
+    return value;
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAoB3G;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+EAA+E,CAAC;SAC5F,cAAc,CAAC,eAAe,EAAE,0CAA0C,CAAC;SAC3E,MAAM,CACL,4BAA4B,EAC5B,0EAA0E,CAC3E;SACA,MAAM,CAAC,WAAW,EAAE,+DAA+D,CAAC;SACpF,MAAM,CAAC,uBAAuB,EAAE,0CAA0C,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,CAAC;SACvD,MAAM,CAAC,iBAAiB,EAAE,uDAAuD,EAAE,KAAK,CAAC;SACzF,MAAM,CAAC,eAAe,EAAE,oCAAoC,EAAE,IAAI,CAAC;SACnE,MAAM,CAAC,oBAAoB,EAAE,mEAAmE,CAAC;SACjG,MAAM,CAAC,sBAAsB,EAAE,iCAAiC,EAAE,QAAQ,CAAC;SAC3E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CAAC,0BAA0B,EAAE,iBAAiB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;SACjG,MAAM,CAAC,8BAA8B,EAAE,+CAA+C,CAAC;SACvF,MAAM,CAAC,YAAY,EAAE,8DAA8D,CAAC;SACpF,MAAM,CAAC,KAAK,EAAE,IAAiB,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;YAC3C,eAAe,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACvC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;YACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACtC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACzC,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CACrC,GAAG,MAAM,kBAAkB,EAC3B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CACF,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,IAAI,QAA4B,CAAC;QACjC,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE3E,yFAAyF;QACzF,4FAA4F;QAC5F,oDAAoD;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAE3E,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,MAAM,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAY;IAC5E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,oBAAoB,yBAAyB,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,oBAAoB,sCAAsC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oEAAoE,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,OAA4B,EAC5B,YAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAE/D,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,mBAAmB,QAAQ,KAAK,CAAC,CAAC;IAElF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAqB,mCAAmC,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,oEAAoE;AACpE,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,YAAoB;IAI1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAS,GAAG,MAAM,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAChE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function mcpCommand(program: Command): void;

package/dist/commands/mcp.js

@@ -0,0 +1,24 @@
+import { runStdioServer } from "../mcp/server.js";
+export function mcpCommand(program) {
+    program
+        .command("mcp")
+        .description("Run the Authflow onboarding MCP server on stdio")
+        .addHelpText("after", [
+        "",
+        "Add to an MCP client (Cursor, Claude Desktop) so a coding agent can onboard a server",
+        "against the codebase it already has open:",
+        "",
+        '  { "mcpServers": { "authflow": {',
+        '      "command": "npx", "args": ["-y", "authflow-cli", "mcp"],',
+        '      "env": { "AUTHFLOW_ISSUER": "https://…", "AUTHFLOW_ADMIN_API_KEY": "…" } } } }',
+        "",
+        "Mint AUTHFLOW_ADMIN_API_KEY with `authflow signup --email you@example.com` if you do not",
+        "already have one. The onboarding server can also mint it via authflow_signup.",
+        "",
+        "stdout is the MCP transport, so this command writes nothing else to it.",
+    ].join("\n"))
+        .action(async () => {
+        await runStdioServer();
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,iDAAiD,CAAC;SAC9D,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,sFAAsF;QACtF,2CAA2C;QAC3C,EAAE;QACF,mCAAmC;QACnC,gEAAgE;QAChE,sFAAsF;QACtF,EAAE;QACF,0FAA0F;QAC1F,+EAA+E;QAC/E,EAAE;QACF,yEAAyE;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/mint-header.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function mintHeaderCommand(program: Command): void;

package/dist/commands/mint-header.js

@@ -0,0 +1,69 @@
+import { apiJson, bearer, readReceipt, requireIssuer, requireOriginKey, resolveGatewayUrl, } from "../config.js";
+export function mintHeaderCommand(program) {
+    program
+        .command("mint-header")
+        .description("POST /origin/v1/dev/mint-header (dev/staging only)")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--origin-key <key>", "Origin API key (default: AUTHFLOW_ORIGIN_API_KEY)")
+        .option("--subject <userId>", "Rail user id; omit to let the rail mint one")
+        .option("--tier <tier>", "Entitlement tier claim", "standard")
+        .option("--ttl <seconds>", "Header TTL in seconds (1–300)", (v) => Number.parseInt(v, 10))
+        .option("--grant-credits <n>", "Optional credit grant for the minted subject", (v) => Number.parseInt(v, 10))
+        .option("--receipt <path>", "Receipt JSON to resolve gateway_url for the curl hint")
+        .option("--gateway-url <url>", "Override gateway URL for the curl hint")
+        .action(async (opts) => {
+        const issuer = requireIssuer(opts.issuer);
+        const originKey = requireOriginKey(opts.originKey);
+        const body = {};
+        if (opts.subject)
+            body.subject = opts.subject;
+        if (opts.tier)
+            body.tier = opts.tier;
+        if (opts.ttl !== undefined) {
+            if (!Number.isFinite(opts.ttl))
+                throw new Error("--ttl must be an integer.");
+            body.ttl_seconds = opts.ttl;
+        }
+        if (opts.grantCredits !== undefined) {
+            if (!Number.isFinite(opts.grantCredits)) {
+                throw new Error("--grant-credits must be an integer.");
+            }
+            body.grant_credits = opts.grantCredits;
+        }
+        const { body: mint } = await apiJson(`${issuer}/origin/v1/dev/mint-header`, {
+            method: "POST",
+            headers: {
+                ...bearer(originKey),
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify(body),
+            expectedStatuses: [200],
+        });
+        console.log(`${mint.header_name}: ${mint.header}`);
+        console.log(`subject:     ${mint.subject}`);
+        console.log(`nonce:       ${mint.nonce}`);
+        console.log(`expires_at:  ${mint.expires_at}`);
+        const receipt = opts.receipt ? await readReceipt(opts.receipt) : undefined;
+        const gatewayUrl = resolveGatewayUrl({ gatewayUrl: opts.gatewayUrl, receipt });
+        if (gatewayUrl) {
+            console.log("");
+            console.log("# Ready-to-paste curl (identity hop only — not a substitute for OAuth):");
+            console.log(`curl -sS -X POST ${shellQuote(gatewayUrl)} \\\n` +
+                `  -H ${shellQuote(`${mint.header_name}: ${mint.header}`)} \\\n` +
+                `  -H 'Content-Type: application/json' \\\n` +
+                `  -d '{"jsonrpc":"2.0","id":1,"method":"ping"}'`);
+        }
+        else {
+            console.log("");
+            console.log("(No gateway URL known — set AUTHFLOW_RESOURCE / --gateway-url / --receipt for a curl hint.)");
+        }
+    });
+}
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_/:.-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=mint-header.js.map

package/dist/commands/mint-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-header.js","sourceRoot":"","sources":["../../src/commands/mint-header.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,MAAM,EACN,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAUtB,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,oBAAoB,EAAE,mDAAmD,CAAC;SACjF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,eAAe,EAAE,wBAAwB,EAAE,UAAU,CAAC;SAC7D,MAAM,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACzF,MAAM,CACL,qBAAqB,EACrB,8CAA8C,EAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAC9B;SACA,MAAM,CAAC,kBAAkB,EAAE,uDAAuD,CAAC;SACnF,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACvE,MAAM,CACL,KAAK,EAAE,IASN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QACzC,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,4BAA4B,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,SAAS,CAAC;gBACpB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CACT,oBAAoB,UAAU,CAAC,UAAU,CAAC,OAAO;gBAC/C,QAAQ,UAAU,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO;gBAChE,4CAA4C;gBAC5C,iDAAiD,CACpD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,6FAA6F,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC"}

package/dist/commands/probe.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function probeCommand(program: Command): void;

package/dist/commands/probe.js

@@ -0,0 +1,49 @@
+import { apiJson, bearer, requireIssuer, requireOriginKey } from "../config.js";
+export function probeCommand(program) {
+    program
+        .command("probe")
+        .description("POST /origin/v1/conformance and print a pass/fail table")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--origin-key <key>", "Origin API key (default: AUTHFLOW_ORIGIN_API_KEY)")
+        .action(async (opts) => {
+        const issuer = requireIssuer(opts.issuer);
+        const originKey = requireOriginKey(opts.originKey);
+        const { body } = await apiJson(`${issuer}/origin/v1/conformance`, {
+            method: "POST",
+            headers: {
+                ...bearer(originKey),
+                Accept: "application/json",
+            },
+            expectedStatuses: [200],
+        });
+        console.log(`origin: ${body.origin}`);
+        if (body.error) {
+            console.log(`error:  ${body.error}`);
+        }
+        console.log("");
+        const nameWidth = Math.max(4, ...body.checks.map((c) => c.name.length));
+        const header = `${pad("NAME", nameWidth)}  RESULT  OBSERVED`;
+        console.log(header);
+        console.log("-".repeat(header.length + 20));
+        for (const check of body.checks) {
+            const result = check.pass ? "PASS" : "FAIL";
+            console.log(`${pad(check.name, nameWidth)}  ${pad(result, 6)}  ${check.observed}`);
+            if (!check.pass) {
+                console.log(`${"".padEnd(nameWidth)}          expected: ${check.expected}`);
+            }
+        }
+        console.log("");
+        if (body.pass) {
+            console.log("Overall: PASS");
+            process.exitCode = 0;
+        }
+        else {
+            console.log("Overall: FAIL");
+            process.exitCode = 1;
+        }
+    });
+}
+function pad(value, width) {
+    return value.length >= width ? value : value + " ".repeat(width - value.length);
+}
+//# sourceMappingURL=probe.js.map

package/dist/commands/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/commands/probe.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgBhF,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,oBAAoB,EAAE,mDAAmD,CAAC;SACjF,MAAM,CAAC,KAAK,EAAE,IAA6C,EAAE,EAAE;QAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,MAAM,wBAAwB,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,kBAAkB;aAC3B;YACD,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,oBAAoB,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QAE5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa;IACvC,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;AAClF,CAAC"}

package/dist/commands/register.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerCommand(program: Command): void;

package/dist/commands/register.js

@@ -0,0 +1,78 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { apiJson, bearer, requireAdminKey, requireIssuer } from "../config.js";
+import { secretTargets, writeOriginApiKey } from "../secrets.js";
+export function registerCommand(program) {
+    program
+        .command("register")
+        .description("POST /admin/resources and write the registration receipt to disk")
+        .requiredOption("-f, --file <path>", "Resource draft JSON (snake_case fields)")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .option("-o, --out <path>", "Receipt output path", "receipt.json")
+        .option("--write-secrets <target>", `Store the origin API key and redact it from the receipt (${secretTargets.join(" | ")})`)
+        .option("--secret-destination <value>", "user-secrets: project dir (default .) · env-file: path (default .env.local) · keyvault: vault name")
+        .action(async (opts) => {
+        const issuer = requireIssuer(opts.issuer);
+        const adminKey = requireAdminKey(opts.adminKey);
+        const target = parseTarget(opts.writeSecrets);
+        const draftRaw = (await readFile(opts.file, "utf8")).replace(/^\uFEFF/, "");
+        let draft;
+        try {
+            draft = JSON.parse(draftRaw);
+        }
+        catch {
+            throw new Error(`--file ${opts.file} is not valid JSON.`);
+        }
+        const { body, status } = await apiJson(`${issuer}/admin/resources`, {
+            method: "POST",
+            headers: {
+                ...bearer(adminKey),
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify(draft),
+            expectedStatuses: [201],
+        });
+        const originApiKey = typeof body.origin_api_key === "string" ? body.origin_api_key : undefined;
+        // Store the secret before the receipt is written: if this fails, the run stops with the key
+        // still only in memory rather than leaving a plaintext credential on disk.
+        let storedAt;
+        if (target && originApiKey) {
+            storedAt = await writeOriginApiKey({
+                target,
+                value: originApiKey,
+                destination: opts.secretDestination,
+            });
+            body.origin_api_key = `<stored in ${storedAt}>`;
+        }
+        await writeFile(opts.out, `${JSON.stringify(body, null, 2)}\n`, "utf8");
+        console.log(`Registered (${status}). Receipt written to ${opts.out}`);
+        if (typeof body.slug === "string") {
+            console.log(`  slug:          ${body.slug}`);
+        }
+        if (typeof body.gateway_url === "string") {
+            console.log(`  gateway_url:   ${body.gateway_url}`);
+        }
+        if (typeof body.status === "string") {
+            console.log(`  status:        ${body.status}`);
+        }
+        if (storedAt) {
+            console.log(`  origin_api_key: stored in ${storedAt} (redacted from the receipt)`);
+        }
+        else if (originApiKey) {
+            console.log(`  origin_api_key: ${originApiKey}  (store now — shown once)`);
+            console.log(`  Note: ${opts.out} now holds a plaintext credential. Re-run with --write-secrets to avoid that.`);
+        }
+    });
+}
+function parseTarget(raw) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const value = raw.trim();
+    if (!secretTargets.includes(value)) {
+        throw new Error(`--write-secrets must be one of: ${secretTargets.join(", ")}`);
+    }
+    return value;
+}
+//# sourceMappingURL=register.js.map

package/dist/commands/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAWpF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SAC9E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CACL,0BAA0B,EAC1B,4DAA4D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACzF;SACA,MAAM,CACL,8BAA8B,EAC9B,oGAAoG,CACrG;SACA,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAA0B,GAAG,MAAM,kBAAkB,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,4FAA4F;QAC5F,2EAA2E;QAC3E,IAAI,QAA4B,CAAC;QACjC,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,8BAA8B,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,4BAA4B,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,WAAW,IAAI,CAAC,GAAG,+EAA+E,CACnG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/scaffold.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function scaffoldCommand(program: Command): void;

package/dist/commands/scaffold.js

@@ -0,0 +1,72 @@
+import { writeFile } from "node:fs/promises";
+import { readReceipt } from "../config.js";
+export function scaffoldCommand(program) {
+    program
+        .command("scaffold")
+        .description("Write .env + docker-compose snippet for authflow-origin-proxy in front of upstream")
+        .requiredOption("--receipt <path>", "Registration receipt JSON")
+        .option("--upstream <url>", "Upstream MCP base URI", "http://upstream:3000")
+        .option("--env-out <path>", "Env file path", ".env")
+        .option("--compose-out <path>", "Compose file path", "docker-compose.authflow.yml")
+        .option("--proxy-port <port>", "Published proxy port", "8080")
+        .action(async (opts) => {
+        const receipt = await readReceipt(opts.receipt);
+        const issuer = receipt.issuer?.trim();
+        const resource = (receipt.resource ?? receipt.gateway_url)?.trim();
+        const originKey = receipt.origin_api_key?.trim();
+        if (!issuer || !resource) {
+            throw new Error("Receipt must include issuer and resource (or gateway_url). Re-run authflow register.");
+        }
+        const envLines = [
+            `# Generated by authflow scaffold from ${opts.receipt}`,
+            `AUTHFLOW_ISSUER=${issuer}`,
+            `AUTHFLOW_RESOURCE=${resource}`,
+            ...(originKey ? [`AUTHFLOW_ORIGIN_API_KEY=${originKey}`] : []),
+            `AUTHFLOW_UPSTREAM_BASE_URI=${opts.upstream}`,
+            "",
+        ];
+        await writeFile(opts.envOut, envLines.join("\n"), "utf8");
+        const compose = `# Generated by authflow scaffold from ${opts.receipt}
+# Put authflow-origin-proxy in front of your MCP upstream.
+# Build the image from the Authflow.Rail repo:
+#   docker build -f src/Rail.OriginProxy/Dockerfile -t authflow-origin-proxy .
+#
+# Replay protection is process-local until you set Authflow__NonceCacheRedis.
+# Set it before raising replicas above 1.
+# See docs/onboarding/origin-proxy.md
+
+services:
+  authflow-origin-proxy:
+    image: authflow-origin-proxy
+    ports:
+      - "${opts.proxyPort}:8080"
+    environment:
+      Authflow__Issuer: \${AUTHFLOW_ISSUER}
+      Authflow__Resource: \${AUTHFLOW_RESOURCE}
+      Authflow__UpstreamBaseUri: \${AUTHFLOW_UPSTREAM_BASE_URI}
+      # Authflow__NonceCacheRedis: \${AUTHFLOW_NONCE_CACHE_REDIS}
+    env_file:
+      - ${opts.envOut}
+    # Safe to raise once Authflow__NonceCacheRedis is set.
+    deploy:
+      replicas: 1
+
+  # Replace with your MCP origin, or point Authflow__UpstreamBaseUri at an
+  # existing host and drop this service.
+  upstream:
+    image: your-mcp-origin:latest
+    expose:
+      - "3000"
+`;
+        await writeFile(opts.composeOut, compose, "utf8");
+        console.log(`Wrote ${opts.envOut}`);
+        console.log(`Wrote ${opts.composeOut}`);
+        console.log("");
+        console.log("Next:");
+        console.log(`  docker build -f src/Rail.OriginProxy/Dockerfile -t authflow-origin-proxy <Authflow.Rail>`);
+        console.log(`  docker compose -f ${opts.composeOut} --env-file ${opts.envOut} up`);
+        console.log("");
+        console.log("Upstream receives X-Authflow-User / X-Authflow-Tier / X-Authflow-Nonce after verification.");
+    });
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/commands/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;SAC/D,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;SAC3E,MAAM,CAAC,kBAAkB,EAAE,eAAe,EAAE,MAAM,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,6BAA6B,CAAC;SAClF,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QAEjD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,yCAAyC,IAAI,CAAC,OAAO,EAAE;YACvD,mBAAmB,MAAM,EAAE;YAC3B,qBAAqB,QAAQ,EAAE;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,8BAA8B,IAAI,CAAC,QAAQ,EAAE;YAC7C,EAAE;SACH,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,yCAAyC,IAAI,CAAC,OAAO;;;;;;;;;;;;;WAalE,IAAI,CAAC,SAAS;;;;;;;UAOf,IAAI,CAAC,MAAM;;;;;;;;;;;CAWpB,CAAC;QAEM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,UAAU,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/set-origin.d.ts

@@ -0,0 +1,6 @@
+import type { Command } from "commander";
+/**
+ * Second half of the register-now / deploy-later flow: point a draft resource at its origin, which
+ * promotes it to live and makes it routable.
+ */
+export declare function setOriginCommand(program: Command): void;

package/dist/commands/set-origin.js

@@ -0,0 +1,38 @@
+import { apiJson, bearer, requireAdminKey, requireIssuer } from "../config.js";
+/**
+ * Second half of the register-now / deploy-later flow: point a draft resource at its origin, which
+ * promotes it to live and makes it routable.
+ */
+export function setOriginCommand(program) {
+    program
+        .command("set-origin")
+        .description("Set a resource's origin base URI, promoting a draft to live")
+        .requiredOption("--slug <slug>", "Resource slug")
+        .requiredOption("--origin-url <url>", "Origin base URI (no /mcp suffix — the gateway appends it)")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .action(async (opts) => {
+        const issuer = requireIssuer(opts.issuer);
+        const adminKey = requireAdminKey(opts.adminKey);
+        // A receipt-configured origin serves MCP at {origin}/mcp, so a URL that already ends in /mcp
+        // would be called at /mcp/mcp. Cheap to catch here, confusing to debug later.
+        if (/\/mcp\/?$/i.test(opts.originUrl)) {
+            throw new Error(`--origin-url must not end in /mcp. The gateway appends it, so ${opts.originUrl} would be called at ${opts.originUrl.replace(/\/$/, "")}/mcp.`);
+        }
+        const { body } = await apiJson(`${issuer}/admin/resources/${encodeURIComponent(opts.slug)}/origin`, {
+            method: "PUT",
+            headers: {
+                ...bearer(adminKey),
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify({ origin_base_uri: opts.originUrl }),
+            expectedStatuses: [200],
+        });
+        console.log(`${body.slug ?? opts.slug} -> ${body.origin_base_uri ?? opts.originUrl}`);
+        console.log(`status: ${body.status ?? "live"}`);
+        console.log("");
+        console.log("Verify fail-closed behaviour before sending real traffic: authflow probe");
+    });
+}
+//# sourceMappingURL=set-origin.js.map

package/dist/commands/set-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-origin.js","sourceRoot":"","sources":["../../src/commands/set-origin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE/E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,cAAc,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;SACjG,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAA6E,EAAE,EAAE;QAC9F,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhD,6FAA6F;QAC7F,8EAA8E;QAC9E,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,SAAS,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAC/I,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EACnE;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/signup.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function signupCommand(program: Command): void;