authflow-cli 0.1.1 → 0.3.0

package/dist/status.js

@@ -0,0 +1,124 @@
+/**
+ * Turning a receipt into "what is done, what is left, and what do I type next".
+ *
+ * Onboarding is several commands that each half-configure a resource, and the state lived nowhere a
+ * tenant could see it: a half-configured resource answers 403 exactly like a broken one. The first
+ * tenant through deployed an origin, never ran set-origin, and spent the afternoon reading gateway
+ * errors that could not have told them which step was missing.
+ */
+/** MCP client config for the gateway URL — what a subscriber pastes to reach the paid server. */
+export function cursorMcpConfig(receipt) {
+    const url = receipt.gateway_url?.trim() || receipt.resource?.trim();
+    if (!url) {
+        return undefined;
+    }
+    return { mcpServers: { [receipt.slug || "authflow-resource"]: { url } } };
+}
+/**
+ * The single output that would have prevented the worst failure of the first onboarding: the client
+ * was pointed at the origin's own hostname, which worked right up until the paywall went live and
+ * then failed as an unsigned request. The gateway URL is known the moment registration returns, so
+ * there is no reason to make anyone assemble it.
+ */
+export function formatCursorMcpConfig(receipt) {
+    const config = cursorMcpConfig(receipt);
+    if (!config) {
+        return [];
+    }
+    return [
+        "Connect an MCP client to the gateway, never to the origin hostname:",
+        "",
+        ...JSON.stringify(config, null, 2)
+            .split("\n")
+            .map((line) => `  ${line}`),
+        "",
+        "The origin only accepts requests signed by the gateway. Pointing a client straight at the",
+        "origin returns 403 invalid_origin_identity, which looks like an auth bug and is not one.",
+    ];
+}
+export function resourceReadiness(receipt) {
+    const slug = receipt.slug ?? "<slug>";
+    const pending = receipt.pending_requirements ?? [];
+    const blocked = (requirement) => pending.includes(requirement);
+    const steps = [
+        {
+            name: "resource registered",
+            done: Boolean(receipt.slug),
+            detail: receipt.resource ?? "not registered",
+        },
+        {
+            name: "origin URI set",
+            done: Boolean(receipt.origin_base_uri) && !blocked("origin_base_uri"),
+            detail: receipt.origin_base_uri ?? "no origin — the gateway has nowhere to forward to",
+            command: receipt.origin_base_uri
+                ? undefined
+                : `authflow set-origin --slug ${slug} --origin-url https://your-origin.example`,
+        },
+        {
+            name: "Stripe connected",
+            done: Boolean(receipt.connected_account_id) && !blocked("connected_account_id"),
+            detail: receipt.connected_account_id ?? "no connected account — nothing can be charged",
+            command: receipt.connected_account_id ? undefined : attachStripeCommand(slug),
+        },
+        {
+            name: "Stripe onboarding complete",
+            done: Boolean(receipt.connected_account_id) &&
+                !blocked("connected_account_id") &&
+                !blocked("stripe_onboarding_complete"),
+            detail: !receipt.connected_account_id
+                ? "no connected account — attach one before Stripe can confirm charges"
+                : blocked("stripe_onboarding_complete")
+                    ? "Stripe has not confirmed charges_enabled yet"
+                    : "charges enabled",
+            command: !receipt.connected_account_id
+                ? attachStripeCommand(slug)
+                : blocked("stripe_onboarding_complete")
+                    ? `authflow connect --slug ${slug}`
+                    : undefined,
+        },
+    ];
+    // Conformance is not a receipt field: the rail records registration state, not whether the origin
+    // has been exercised. Prompt for it whenever the origin exists so it is not silently skipped.
+    if (receipt.origin_base_uri) {
+        steps.push({
+            name: "conformance probed",
+            done: false,
+            detail: "run the probe to confirm the origin fails closed on a bad identity header",
+            command: "authflow probe",
+        });
+    }
+    return {
+        slug,
+        status: receipt.status ?? (pending.length === 0 ? "live" : "draft"),
+        ready: pending.length === 0 && receipt.status === "live",
+        gatewayUrl: receipt.gateway_url ?? receipt.resource,
+        steps,
+    };
+}
+function attachStripeCommand(slug) {
+    return (`authflow connect --slug ${slug}` +
+        `  (or authflow set-connected-account --slug ${slug} --account acct_…)`);
+}
+export function formatReadiness(readiness) {
+    const lines = [
+        `resource: ${readiness.slug}`,
+        `status:   ${readiness.status}`,
+    ];
+    if (readiness.gatewayUrl) {
+        lines.push(`gateway:  ${readiness.gatewayUrl}`);
+    }
+    lines.push("");
+    for (const step of readiness.steps) {
+        lines.push(`  ${step.done ? "[x]" : "[ ]"} ${step.name}`);
+        lines.push(`      ${step.detail}`);
+        if (step.command) {
+            lines.push(`      next: ${step.command}`);
+        }
+    }
+    lines.push("");
+    lines.push(readiness.ready
+        ? "The resource is live. Subscribers can reach it through the gateway URL."
+        : "The resource is not taking paid traffic yet. Clear the unchecked steps above.");
+    return lines.join("\n");
+}
+//# sourceMappingURL=status.js.map

package/dist/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,kGAAkG;IAClG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,2EAA2E;YACnF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/surface.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The MCP onboarding server and the CLI are two fronts of one surface. When a tool exists on one
+ * and not the other, tenants following docs hit a dead end (tenant #1, set-connected-account).
+ *
+ * This map is the contract the surface-parity test enforces.
+ */
+export declare const mcpToolToCliCommand: {
+    readonly authflow_signup: "signup";
+    readonly authflow_doctor: "doctor";
+    readonly authflow_register_resource: "register";
+    readonly authflow_get_resource: "get";
+    readonly authflow_list_resources: "list";
+    readonly authflow_status: "status";
+    readonly authflow_integration_plan: "plan";
+    readonly authflow_start_stripe_connect: "connect";
+    readonly authflow_set_connected_account: "set-connected-account";
+    readonly authflow_set_origin: "set-origin";
+    readonly authflow_probe: "probe";
+    readonly authflow_mint_test_header: "mint-header";
+    readonly authflow_rotate_origin_key: "rotate-origin-key";
+};
+export type McpOnboardingTool = keyof typeof mcpToolToCliCommand;

package/dist/surface.js

@@ -0,0 +1,22 @@
+/**
+ * The MCP onboarding server and the CLI are two fronts of one surface. When a tool exists on one
+ * and not the other, tenants following docs hit a dead end (tenant #1, set-connected-account).
+ *
+ * This map is the contract the surface-parity test enforces.
+ */
+export const mcpToolToCliCommand = {
+    authflow_signup: "signup",
+    authflow_doctor: "doctor",
+    authflow_register_resource: "register",
+    authflow_get_resource: "get",
+    authflow_list_resources: "list",
+    authflow_status: "status",
+    authflow_integration_plan: "plan",
+    authflow_start_stripe_connect: "connect",
+    authflow_set_connected_account: "set-connected-account",
+    authflow_set_origin: "set-origin",
+    authflow_probe: "probe",
+    authflow_mint_test_header: "mint-header",
+    authflow_rotate_origin_key: "rotate-origin-key",
+};
+//# sourceMappingURL=surface.js.map

package/dist/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}

package/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "authflow-cli",
-  "version": "0.1.1",
-  "description": "Authflow Rail onboarding CLI — register, mint-header, probe, scaffold",
-  "type": "module",
-  "bin": {
-    "authflow": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "LICENSE",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/cli.js",
-    "authflow": "tsx src/cli.ts",
-    "test": "node --import tsx --test \"test/**/*.test.ts\"",
-    "typecheck": "tsc -p tsconfig.test.json",
-    "prepublishOnly": "npm run build"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "commander": "^13.1.0",
-    "zod": "^4.5.4"
-  },
-  "devDependencies": {
-    "@types/node": "^22.13.10",
-    "tsx": "^4.19.3",
-    "typescript": "^5.8.2"
-  },
-  "homepage": "https://docs.authflow.ai/docs/tools/cli",
-  "bugs": {
-    "url": "https://github.com/Snyder-Technology-LLC/Authflow.Rail/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Snyder-Technology-LLC/Authflow.Rail.git",
-    "directory": "sdk/cli"
-  },
-  "keywords": [
-    "mcp",
-    "authflow",
-    "oauth",
-    "cli",
-    "monetization"
-  ],
-  "author": "Authflow LLC",
-  "license": "Apache-2.0",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "authflow-cli",
+  "version": "0.3.0",
+  "description": "Authflow Rail onboarding CLI — register, mint-header, probe, scaffold",
+  "type": "module",
+  "bin": {
+    "authflow": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/cli.js",
+    "authflow": "tsx src/cli.ts",
+    "test": "node --import tsx --test \"test/**/*.test.ts\"",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "commander": "^13.1.0",
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "tsx": "^4.19.3",
+    "typescript": "^5.8.2"
+  },
+  "homepage": "https://docs.authflow.ai/docs/tools/cli",
+  "bugs": {
+    "url": "https://github.com/Snyder-Technology-LLC/Authflow.Rail/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Snyder-Technology-LLC/Authflow.Rail.git",
+    "directory": "sdk/cli"
+  },
+  "keywords": [
+    "mcp",
+    "authflow",
+    "oauth",
+    "cli",
+    "monetization"
+  ],
+  "author": "Authflow LLC",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  }
+}