authflow-cli 0.1.0

package/dist/rail.d.ts

@@ -0,0 +1,80 @@
+import { type RegistrationReceipt } from "./config.js";
+/**
+ * One typed wrapper per rail admin/Origin-Protocol call, so the CLI commands and the MCP server
+ * drive the same code. They are two front ends onto one onboarding flow; when they drift, the
+ * agent-driven path silently stops matching the documented one.
+ */
+export type ConnectOnboarding = {
+    slug: string;
+    connected_account_id: string;
+    charges_enabled: boolean;
+    details_submitted: boolean;
+    payouts_enabled: boolean;
+    onboarding_url?: string | null;
+    onboarding_url_expires_at?: string | null;
+    status: string;
+    pending_requirements: string[];
+};
+export type ConformanceCheck = {
+    name: string;
+    pass: boolean;
+    expected: string;
+    observed: string;
+};
+export type ConformanceReport = {
+    pass: boolean;
+    origin: string;
+    checks: ConformanceCheck[];
+    error?: string | null;
+};
+export type MintedHeader = {
+    header?: string;
+    identity_header?: string;
+    [key: string]: unknown;
+};
+export type ResourceDraft = {
+    slug: string;
+    display_name?: string;
+    origin_base_uri?: string | null;
+    connected_account_id?: string | null;
+    currency?: string;
+    price_amount_minor?: number;
+    credits_per_period?: number;
+    metering_mode?: string;
+    metering_default_units?: number;
+    tool_units?: Record<string, number>;
+    documentation_uri?: string;
+    merchant_display_name?: string;
+};
+export type TenantSignup = {
+    tenant_id: string;
+    email: string;
+    admin_api_key: string;
+    issuer: string;
+};
+export type AdminAuth = {
+    issuer: string;
+    adminKey: string;
+};
+export declare function signupTenant(issuer: string, email: string): Promise<TenantSignup>;
+export declare function registerResource(auth: AdminAuth, draft: ResourceDraft): Promise<RegistrationReceipt & Record<string, unknown>>;
+export declare function getResource(auth: AdminAuth, slug: string): Promise<RegistrationReceipt>;
+export declare function setOrigin(auth: AdminAuth, slug: string, originBaseUri: string): Promise<RegistrationReceipt>;
+export declare function setConnectedAccount(auth: AdminAuth, slug: string, connectedAccountId: string): Promise<RegistrationReceipt>;
+export declare function startConnect(auth: AdminAuth, slug: string, email?: string): Promise<ConnectOnboarding>;
+export declare function rotateOriginKey(auth: AdminAuth, slug: string): Promise<RegistrationReceipt>;
+/** Authenticates with the origin API key, which is bound to exactly one resource. */
+export declare function probeConformance(issuer: string, originApiKey: string): Promise<ConformanceReport>;
+export declare function mintDevHeader(issuer: string, originApiKey: string, options?: {
+    subject?: string;
+    tier?: string;
+    ttlSeconds?: number;
+    grantCredits?: number;
+}): Promise<MintedHeader>;
+/**
+ * The gateway appends `/mcp` to the origin base URI, so an origin URL that already ends in `/mcp`
+ * gets called at `/mcp/mcp`. Cheap to catch here, confusing to debug once traffic is flowing.
+ */
+export declare function assertNotMcpSuffixed(originUrl: string): void;
+/** Human-readable next step for each `pending_requirements` entry the receipt can carry. */
+export declare function describePending(requirement: string, slug: string): string;

package/dist/rail.js

@@ -0,0 +1,115 @@
+import { apiJson, bearer } from "./config.js";
+const jsonHeaders = { "Content-Type": "application/json", Accept: "application/json" };
+export async function signupTenant(issuer, email) {
+    const { body } = await apiJson(`${issuer.replace(/\/+$/, "")}/admin/tenants`, {
+        method: "POST",
+        headers: jsonHeaders,
+        body: JSON.stringify({ email }),
+        expectedStatuses: [201],
+    });
+    return body;
+}
+export async function registerResource(auth, draft) {
+    const { body } = await apiJson(`${auth.issuer}/admin/resources`, {
+        method: "POST",
+        headers: { ...bearer(auth.adminKey), ...jsonHeaders },
+        body: JSON.stringify(draft),
+        expectedStatuses: [201],
+    });
+    return body;
+}
+export async function getResource(auth, slug) {
+    const { body } = await apiJson(`${auth.issuer}/admin/resources/${encodeURIComponent(slug)}`, {
+        method: "GET",
+        headers: { ...bearer(auth.adminKey), Accept: "application/json" },
+        expectedStatuses: [200],
+    });
+    return body;
+}
+export async function setOrigin(auth, slug, originBaseUri) {
+    assertNotMcpSuffixed(originBaseUri);
+    const { body } = await apiJson(`${auth.issuer}/admin/resources/${encodeURIComponent(slug)}/origin`, {
+        method: "PUT",
+        headers: { ...bearer(auth.adminKey), ...jsonHeaders },
+        body: JSON.stringify({ origin_base_uri: originBaseUri }),
+        expectedStatuses: [200],
+    });
+    return body;
+}
+export async function setConnectedAccount(auth, slug, connectedAccountId) {
+    const { body } = await apiJson(`${auth.issuer}/admin/resources/${encodeURIComponent(slug)}/connected-account`, {
+        method: "PUT",
+        headers: { ...bearer(auth.adminKey), ...jsonHeaders },
+        body: JSON.stringify({ connected_account_id: connectedAccountId }),
+        expectedStatuses: [200],
+    });
+    return body;
+}
+export async function startConnect(auth, slug, email) {
+    const { body } = await apiJson(`${auth.issuer}/admin/resources/${encodeURIComponent(slug)}/connect`, {
+        method: "POST",
+        headers: { ...bearer(auth.adminKey), ...jsonHeaders },
+        body: JSON.stringify(email ? { email } : {}),
+        expectedStatuses: [200],
+    });
+    return body;
+}
+export async function rotateOriginKey(auth, slug) {
+    const { body } = await apiJson(`${auth.issuer}/admin/resources/${encodeURIComponent(slug)}/rotate-origin-key`, {
+        method: "POST",
+        headers: { ...bearer(auth.adminKey), Accept: "application/json" },
+        expectedStatuses: [200],
+    });
+    return body;
+}
+/** Authenticates with the origin API key, which is bound to exactly one resource. */
+export async function probeConformance(issuer, originApiKey) {
+    const { body } = await apiJson(`${issuer}/origin/v1/conformance`, {
+        method: "POST",
+        headers: { ...bearer(originApiKey), Accept: "application/json" },
+        expectedStatuses: [200],
+    });
+    return body;
+}
+export async function mintDevHeader(issuer, originApiKey, options = {}) {
+    const payload = {};
+    if (options.subject)
+        payload.subject = options.subject;
+    if (options.tier)
+        payload.tier = options.tier;
+    if (options.ttlSeconds !== undefined)
+        payload.ttl_seconds = options.ttlSeconds;
+    if (options.grantCredits !== undefined)
+        payload.grant_credits = options.grantCredits;
+    const { body } = await apiJson(`${issuer}/origin/v1/dev/mint-header`, {
+        method: "POST",
+        headers: { ...bearer(originApiKey), ...jsonHeaders },
+        body: JSON.stringify(payload),
+        expectedStatuses: [200],
+    });
+    return body;
+}
+/**
+ * The gateway appends `/mcp` to the origin base URI, so an origin URL that already ends in `/mcp`
+ * gets called at `/mcp/mcp`. Cheap to catch here, confusing to debug once traffic is flowing.
+ */
+export function assertNotMcpSuffixed(originUrl) {
+    if (/\/mcp\/?$/i.test(originUrl)) {
+        const trimmed = originUrl.replace(/\/$/, "");
+        throw new Error(`Origin URL must not end in /mcp. The gateway appends it, so ${originUrl} would be called at ${trimmed}/mcp.`);
+    }
+}
+/** Human-readable next step for each `pending_requirements` entry the receipt can carry. */
+export function describePending(requirement, slug) {
+    switch (requirement) {
+        case "origin_base_uri":
+            return `Deploy the origin, then: authflow set-origin --slug ${slug} --origin-url https://your-origin.example`;
+        case "connected_account_id":
+            return `Connect Stripe: authflow connect --slug ${slug}`;
+        case "stripe_onboarding_complete":
+            return `Finish Stripe KYC in the browser, then re-run: authflow connect --slug ${slug}`;
+        default:
+            return requirement;
+    }
+}
+//# sourceMappingURL=rail.js.map

package/dist/rail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rail.js","sourceRoot":"","sources":["../src/rail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAC;AAgExE,MAAM,WAAW,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE;QAC1F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,KAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,kBAAkB,EAChC;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAe,EAAE,IAAY;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC5D;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,IAAY,EACZ,aAAqB;IAErB,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,SAAS,EACnE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;QACxD,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAe,EACf,IAAY,EACZ,kBAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;QAClE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAe,EACf,IAAY,EACZ,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACpE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,YAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,MAAM,wBAAwB,EAAE;QACnF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAChE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,YAAoB,EACpB,UAA2F,EAAE;IAE7F,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/E,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAErF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,4BAA4B,EAAE;QAClF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,uBAAuB,OAAO,OAAO,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,IAAY;IAC/D,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,iBAAiB;YACpB,OAAO,uDAAuD,IAAI,2CAA2C,CAAC;QAChH,KAAK,sBAAsB;YACzB,OAAO,2CAA2C,IAAI,EAAE,CAAC;QAC3D,KAAK,4BAA4B;YAC/B,OAAO,0EAA0E,IAAI,EAAE,CAAC;QAC1F;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Where `register --write-secrets` puts the origin API key.
+ *
+ * The key is shown exactly once, so the default path of "write the receipt to disk and sort the
+ * secret out later" reliably ends with a plaintext credential in a JSON file next to the source —
+ * and often in git. Each target below hands it to something built to hold it.
+ */
+export type SecretTarget = "user-secrets" | "env-file" | "keyvault";
+export declare const secretTargets: readonly SecretTarget[];
+/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
+export declare const originApiKeyConfigKey = "Authflow:OriginApiKey";
+/** Environment variable form of the same setting, for non-.NET origins. */
+export declare const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
+/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
+export declare const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
+export type WriteSecretRequest = {
+    target: SecretTarget;
+    value: string;
+    /** Project directory for `user-secrets`, file path for `env-file`, vault name for `keyvault`. */
+    destination?: string;
+};
+/** Human-readable description of where the secret landed, for the receipt and console. */
+/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
+export declare function writeAdminApiKey(request: {
+    value: string;
+    destination?: string;
+}): Promise<string>;
+export declare function writeOriginApiKey(request: WriteSecretRequest): Promise<string>;

package/dist/secrets.js

@@ -0,0 +1,117 @@
+import { spawn } from "node:child_process";
+import { appendFile, chmod, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export const secretTargets = ["user-secrets", "env-file", "keyvault"];
+/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
+export const originApiKeyConfigKey = "Authflow:OriginApiKey";
+/** Environment variable form of the same setting, for non-.NET origins. */
+export const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
+/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
+export const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
+/** Human-readable description of where the secret landed, for the receipt and console. */
+/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
+export async function writeAdminApiKey(request) {
+    return writeNamedEnvVar(adminApiKeyEnvVar, request.value, request.destination);
+}
+export async function writeOriginApiKey(request) {
+    switch (request.target) {
+        case "user-secrets":
+            return writeUserSecret(request);
+        case "env-file":
+            return writeEnvFile(request);
+        case "keyvault":
+            return writeKeyVault(request);
+    }
+}
+async function writeUserSecret(request) {
+    const project = request.destination ?? ".";
+    await run("dotnet", ["user-secrets", "set", originApiKeyConfigKey, request.value, "--project", project]);
+    return `dotnet user-secrets (${originApiKeyConfigKey}) in ${resolve(project)}`;
+}
+async function writeEnvFile(request) {
+    return writeNamedEnvVar(originApiKeyEnvVar, request.value, request.destination);
+}
+async function writeNamedEnvVar(name, value, destination) {
+    const path = resolve(destination ?? ".env.local");
+    const line = `${name}=${value}\n`;
+    const existing = await readFileOrEmpty(path);
+    const next = existing ? `${stripVar(existing, name)}${line}` : line;
+    await writeFile(path, next, "utf8");
+    // Best-effort: a no-op on Windows, which is exactly why this is not the recommended target.
+    await chmod(path, 0o600).catch(() => undefined);
+    await ensureGitIgnored(path);
+    return path;
+}
+async function writeKeyVault(request) {
+    const vault = request.destination;
+    if (!vault) {
+        throw new Error("--secret-destination <vault-name> is required for --write-secrets keyvault.");
+    }
+    // Key Vault names cannot contain ':'; keep the mapping mechanical so it is guessable from config.
+    const name = originApiKeyConfigKey.replace(/:/g, "--");
+    await run("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", request.value]);
+    return `Azure Key Vault ${vault}/${name}`;
+}
+/**
+ * Adds the secret file to .gitignore if it is not already covered.
+ *
+ * Deliberately conservative: it only appends when the exact pattern is absent, because a
+ * false-negative here costs one duplicate line and a false-positive leaks a credential.
+ */
+async function ensureGitIgnored(secretPath) {
+    const gitignore = resolve(dirname(secretPath), ".gitignore");
+    const pattern = secretPath.split(/[/\\]/).pop();
+    if (!pattern) {
+        return;
+    }
+    const existing = await readFileOrEmpty(gitignore);
+    if (existing.split(/\r?\n/).some((line) => line.trim() === pattern)) {
+        return;
+    }
+    const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+    await appendFile(gitignore, `${prefix}${pattern}\n`, "utf8");
+}
+async function readFileOrEmpty(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function stripVar(contents, name) {
+    const kept = contents
+        .split(/\r?\n/)
+        .filter((line) => !line.startsWith(`${name}=`))
+        .join("\n")
+        .replace(/\n+$/, "");
+    return kept ? `${kept}\n` : "";
+}
+/**
+ * Runs a tool with the secret in argv.
+ *
+ * `shell: false` matters: the secret is passed as a discrete argument, so no shell ever parses it
+ * and a value containing quotes or `$` cannot turn into a command.
+ */
+function run(command, args) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(command, [...args], { stdio: ["ignore", "ignore", "pipe"], shell: false });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            reject(err.code === "ENOENT"
+                ? new Error(`${command} was not found on PATH. Install it or use --write-secrets env-file.`)
+                : err);
+        });
+        child.on("close", (code) => {
+            if (code === 0) {
+                resolvePromise();
+                return;
+            }
+            reject(new Error(`${command} exited with ${code}: ${stderr.trim().slice(0, 400)}`));
+        });
+    });
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,CAAC,MAAM,aAAa,GAA4B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE/F,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAS1D,0FAA0F;AAC1F,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgD;IACrF,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B;IACjE,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC3C,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzG,OAAO,wBAAwB,qBAAqB,QAAQ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA2B;IACrD,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,WAAoB;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,4FAA4F;IAC5F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAA2B;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,kGAAkG;IAClG,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,OAAO,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAC,OAAe,EAAE,IAAuB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,MAAM,CACJ,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,qEAAqE,CAAC;gBAC5F,CAAC,CAAC,GAAG,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,gBAAgB,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "authflow-cli",
+  "version": "0.1.0",
+  "description": "Authflow Rail onboarding CLI — register, mint-header, probe, scaffold",
+  "type": "module",
+  "bin": {
+    "authflow": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/cli.js",
+    "authflow": "tsx src/cli.ts",
+    "test": "node --import tsx --test \"test/**/*.test.ts\"",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "commander": "^13.1.0",
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "tsx": "^4.19.3",
+    "typescript": "^5.8.2"
+  },
+  "homepage": "https://docs.authflow.ai/docs/tools/cli",
+  "bugs": {
+    "url": "https://github.com/Snyder-Technology-LLC/Authflow.Rail/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Snyder-Technology-LLC/Authflow.Rail.git",
+    "directory": "sdk/cli"
+  },
+  "keywords": [
+    "mcp",
+    "authflow",
+    "oauth",
+    "cli",
+    "monetization"
+  ],
+  "author": "Authflow LLC",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  }
+}