authflow-cli 0.4.1 → 0.6.0

package/dist/commands/account.js

@@ -0,0 +1,105 @@
+import { readFile } from "node:fs/promises";
+import { requireIssuer } from "../config.js";
+import { login, logout } from "../login.js";
+import { currentWorkspacePath, managementRequest, managementResourceActions, redactToolSecrets } from "../management.js";
+import { secretDelivery, secretTargets } from "../secrets.js";
+const print = (value) => { process.stdout.write(`${JSON.stringify(value, null, 2)}\n`); };
+export function accountCommands(program) {
+    program.command("login").description("Sign in in the browser and store a workspace login in your OS credential store")
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--workspace <id>", "Workspace to authorize; otherwise choose in the browser")
+        .option("--no-browser", "Print the login URL without opening a browser")
+        .action(async (options) => print(await login(requireIssuer(options.issuer), options.workspace, options.browser !== false)));
+    program.command("logout").description("Revoke and remove the saved Authflow login")
+        .option("--issuer <url>", "Authflow issuer")
+        .option("--local-only", "Clear this device only; server authorization is not revoked")
+        .action(async (options) => { await logout(requireIssuer(options.issuer), { localOnly: options.localOnly }); print({ signed_out: true, authorization_revoked: !options.localOnly }); });
+    const workspace = program.command("workspace").description("Manage your verified workspace");
+    workspace.command("list").option("--issuer <url>").action(async (options) => print(await managementRequest(requireIssuer(options.issuer), "/workspaces")));
+    for (const operation of ["overview", "usage", "earnings"])
+        workspace.command(operation).option("--issuer <url>").option("--workspace <id>").action(async (options) => {
+            const issuer = requireIssuer(options.issuer);
+            print(await managementRequest(issuer, `${await currentWorkspacePath(issuer, options.workspace)}/${operation}`));
+        });
+    workspace.command("rename <name>").option("--issuer <url>").option("--workspace <id>").action(async (name, options) => {
+        const issuer = requireIssuer(options.issuer);
+        print(await managementRequest(issuer, await currentWorkspacePath(issuer, options.workspace), "PATCH", { name }));
+    });
+    const docs = program.command("docs").description("Search and read Authflow's indexed public documentation");
+    docs.command("search <query>").option("--issuer <url>").action(async (query, options) => {
+        print(await managementRequest(requireIssuer(options.issuer), "/docs/search", "GET", undefined, { q: query }));
+    });
+    docs.command("get <path>").option("--issuer <url>").action(async (path, options) => {
+        print(await managementRequest(requireIssuer(options.issuer), "/docs/page", "GET", undefined, { path }));
+    });
+    const resource = program.command("resource").description("Create, configure, verify, and explicitly publish an MCP");
+    for (const operation of ["list", "get", "create", "update", "origin", "domain", ...managementResourceActions, "rotate-key"]) {
+        const command = resource.command(operation.replace("/", "-"));
+        if (!["list", "create"].includes(operation))
+            command.argument("<slug>");
+        command.option("--issuer <url>").option("--workspace <id>");
+        if (["create", "update", "origin", "domain"].includes(operation))
+            command.requiredOption("--file <path>", "Resource input JSON");
+        if (["create", "rotate-key"].includes(operation))
+            command.option("--write-secrets <target>", secretTargets.join(" | ")).option("--secret-destination <value>", "Explicit project, env-file path, or vault for origin-reported usage");
+        command.action(async (...args) => {
+            const hasSlug = !["list", "create"].includes(operation);
+            const slug = hasSlug ? String(args[0]) : undefined;
+            const options = args[hasSlug ? 1 : 0];
+            const issuer = requireIssuer(options.issuer);
+            const workspacePath = await currentWorkspacePath(issuer, options.workspace);
+            const path = `${workspacePath}/resources${slug ? `/${encodeURIComponent(slug)}` : ""}`;
+            const body = options.file ? JSON.parse((await readFile(options.file, "utf8")).replace(/^\uFEFF/, "")) : undefined;
+            let prepared;
+            if (operation === "create" || operation === "rotate-key") {
+                // Resolve ownership and the actual metering policy before rotating or touching a destination.
+                const resource = operation === "rotate-key" ? await managementRequest(issuer, path) : body;
+                if (requiresOriginCredential(resource)) {
+                    if (operation === "rotate-key" || options.writeSecrets || options.secretDestination) {
+                        if (!options.writeSecrets || !secretTargets.includes(options.writeSecrets) || !options.secretDestination?.trim())
+                            throw new Error("Choose both --write-secrets <target> and --secret-destination <destination>. The origin key is never printed.");
+                        const resourceSlug = slug ?? resource.slug;
+                        prepared = await secretDelivery.prepare({ target: options.writeSecrets, destination: options.secretDestination,
+                            resource: { issuer, workspaceId: decodeURIComponent(workspacePath.split("/")[2]), slug: resourceSlug } });
+                    }
+                }
+                else if (operation === "rotate-key") {
+                    print({ result: redactToolSecrets(resource), origin_key_delivery: { status: "not_required" } });
+                    return;
+                }
+            }
+            const method = ["get", "list"].includes(operation) ? "GET" : operation === "update" ? "PATCH" : "POST";
+            const suffix = ["get", "list", "create", "update"].includes(operation) ? "" : `/${operation}`;
+            const result = await managementRequest(issuer, path + suffix, method, body);
+            let storedAt;
+            if (prepared) {
+                if (!result || typeof result !== "object" || !("origin_api_key" in result) || typeof result.origin_api_key !== "string")
+                    throw new Error("The resource operation completed without a deliverable origin key. Inspect the resource before explicitly requesting another rotation.");
+                try {
+                    await prepared.write(result.origin_api_key);
+                    storedAt = prepared.description;
+                }
+                catch {
+                    throw new Error("The resource operation completed, but origin-key delivery failed. The previous key may already be revoked. Check the destination and explicitly run resource rotate-key when ready; no mutation was retried.");
+                }
+            }
+            print({ result: redactToolSecrets(result), ...(storedAt ? { origin_key_stored_at: storedAt, deployment_updated: false } : {}),
+                ...(operation === "create" && !storedAt ? { origin_key_delivery: { status: requiresOriginCredential(result) ? "required" : "not_required" } } : {}) });
+        });
+    }
+    const stripe = program.command("stripe").description("Inspect payout readiness or open signed-in Stripe setup");
+    for (const operation of ["status", "onboard", "connect-existing"]) {
+        stripe.command(operation).option("--issuer <url>").option("--workspace <id>").action(async (options) => {
+            const issuer = requireIssuer(options.issuer);
+            const path = `${await currentWorkspacePath(issuer, options.workspace)}/stripe`;
+            print(await managementRequest(issuer, operation === "status" ? path : `${path}/actions`, operation === "status" ? "GET" : "POST", operation === "status" ? undefined : { kind: operation === "onboard" ? "onboard" : "connect_existing" }));
+        });
+    }
+}
+function requiresOriginCredential(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const resource = value;
+    return resource.access_mode === "paid" && resource.metering_mode === "origin_reported";
+}
+//# sourceMappingURL=account.js.map

package/dist/commands/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/commands/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAqD,MAAM,eAAe,CAAC;AAGjH,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzG,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,gFAAgF,CAAC;SACnH,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;SACrF,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IACvI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC;SAChF,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;SAC3C,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClM,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC7F,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACpK,KAAK,MAAM,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAU;QAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YACrL,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAChK,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAAgB,EAAE,EAAE;QACrI,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,yDAAyD,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,OAAgB,EAAE,EAAE;QACvG,KAAK,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAAgB,EAAE,EAAE;QAClG,KAAK,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,0DAA0D,CAAC,CAAC;IACrH,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,YAAY,CAAU,EAAE,CAAC;QACrI,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACjI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,qEAAqE,CAAC,CAAC;QACtO,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAY,CAAC;YACjD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,GAAG,aAAa,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACvF,MAAM,IAAI,GAAY,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3H,IAAI,QAA+C,CAAC;YACpD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBACzD,8FAA8F;gBAC9F,MAAM,QAAQ,GAAG,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3F,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvC,IAAI,SAAS,KAAK,YAAY,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;wBACpF,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,YAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE;4BAC9H,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;wBACnI,MAAM,YAAY,GAAG,IAAI,IAAK,QAA6B,CAAC,IAAI,CAAC;wBACjE,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,YAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,iBAAiB;4BAC5H,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC;qBAAM,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;oBACtC,KAAK,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;oBAChG,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACvG,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,QAA4B,CAAC;YACjC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;oBACrH,MAAM,IAAI,KAAK,CAAC,wIAAwI,CAAC,CAAC;gBAC5J,IAAI,CAAC;oBAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;oBAAC,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAAC,CAAC;gBACrF,MAAM,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,8MAA8M,CAAC,CAAC;gBAAC,CAAC;YAC5O,CAAC;YACD,KAAK,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3H,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3J,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,yDAAyD,CAAC,CAAC;IAChH,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,kBAAkB,CAAU,EAAE,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YAC9G,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/E,KAAK,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAC9O,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAyD,CAAC;IAC3E,OAAO,QAAQ,CAAC,WAAW,KAAK,MAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,iBAAiB,CAAC;AACzF,CAAC"}

package/dist/commands/doctor.js

@@ -6,7 +6,9 @@ export function doctorCommand(program) {
         .command("doctor")
         .description("Check that the rail is reachable, serving a consistent Origin Protocol surface, and (with --client) accepts real MCP client OAuth registration. With --client and --slug (not --dry-run), also drive authorize through login and ask Google whether the rail's redirect_uri is registered")
         .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
-        .option("--slug <slug>", "Also check this resource's PRM document and gateway 401 challenge")
+        .option("--slug <slug>", "Also check this resource's PRM document and gateway 401 challenge (read from the receipt when an admin key is available, so a resource on its own hostname is probed there)")
+        .option("--host <host>", "Also verify a tenant's own hostname end to end: the three DNS records, TLS certificate issuer and expiry, http to https redirect, PRM at both well-known paths, and the 401's resource_metadata. With an admin key, DNS is compared against the receipt (found by --slug, or by the host)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY). Distinguishes a draft 404 from an unknown slug, and catches a stale key after a sandbox reset.")
         .option("--client <name>", "Replay MCP client OAuth registration: cursor, claude, chatgpt, or all")
         .option("--dry-run", "With --client: discovery only, do not POST DCR registrations")
         .option("--json", "Emit the report as JSON")
@@ -16,8 +18,10 @@ export function doctorCommand(program) {
         }
         const report = await runDoctorAndConnect(requireIssuer(opts.issuer), {
             slug: opts.slug,
+            host: opts.host,
             client: opts.client,
             dryRun: opts.dryRun,
+            adminKey: opts.adminKey,
         });
         console.log(opts.json ? JSON.stringify(report, null, 2) : formatDoctorReport(report));
         process.exitCode = report.pass ? 0 : 1;

package/dist/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,2RAA2R,CAC5R;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,WAAW,EAAE,8DAA8D,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,2RAA2R,CAC5R;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CACL,eAAe,EACf,6KAA6K,CAC9K;SACA,MAAM,CACL,eAAe,EACf,2RAA2R,CAC5R;SACA,MAAM,CAAC,mBAAmB,EAAE,iJAAiJ,CAAC;SAC9K,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,WAAW,EAAE,8DAA8D,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CACL,KAAK,EAAE,IAQN,EAAE,EAAE;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/mcp.js

@@ -1,8 +1,10 @@
 import { runStdioServer } from "../mcp/server.js";
+import { runManagementStdioServer } from "../mcp/management-server.js";
 export function mcpCommand(program) {
     program
         .command("mcp")
-        .description("Run the Authflow onboarding MCP server on stdio")
+        .description("Run workspace-scoped Authflow management using your OS-stored login")
+        .option("--legacy-admin", "Use the legacy operator-admin adapter for migration and recovery")
         .addHelpText("after", [
         "",
         "Add to an MCP client (Cursor, Claude Desktop) so a coding agent can onboard a server",
@@ -10,15 +12,18 @@ export function mcpCommand(program) {
         "",
         '  { "mcpServers": { "authflow": {',
         '      "command": "npx", "args": ["-y", "-p", "authflow-cli", "authflow", "mcp"],',
-        '      "env": { "AUTHFLOW_ISSUER": "https://…", "AUTHFLOW_ADMIN_API_KEY": "…" } } } }',
+        '      "env": { "AUTHFLOW_ISSUER": "https://…" } } } }',
         "",
-        "Mint AUTHFLOW_ADMIN_API_KEY with `authflow signup --email you@example.com` if you do not",
-        "already have one. The onboarding server can also mint it via authflow_signup.",
+        "Run authflow login first. The credential stays in your operating system's keyring.",
+        "You can also connect a remote MCP client directly to <issuer>/management/mcp.",
         "",
         "stdout is the MCP transport, so this command writes nothing else to it.",
     ].join("\n"))
-        .action(async () => {
-        await runStdioServer();
+        .action(async (options) => {
+        if (options.legacyAdmin)
+            await runStdioServer();
+        else
+            await runManagementStdioServer();
     });
 }
 //# sourceMappingURL=mcp.js.map

package/dist/commands/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,iDAAiD,CAAC;SAC9D,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,sFAAsF;QACtF,2CAA2C;QAC3C,EAAE;QACF,mCAAmC;QACnC,kFAAkF;QAClF,sFAAsF;QACtF,EAAE;QACF,0FAA0F;QAC1F,+EAA+E;QAC/E,EAAE;QACF,yEAAyE;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,gBAAgB,EAAE,kEAAkE,CAAC;SAC5F,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,sFAAsF;QACtF,2CAA2C;QAC3C,EAAE;QACF,mCAAmC;QACnC,kFAAkF;QAClF,uDAAuD;QACvD,EAAE;QACF,oFAAoF;QACpF,+EAA+E;QAC/E,EAAE;QACF,yEAAyE;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,EAAE,OAAkC,EAAE,EAAE;QACnD,IAAI,OAAO,CAAC,WAAW;YAAE,MAAM,cAAc,EAAE,CAAC;;YAC3C,MAAM,wBAAwB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/plan.js

@@ -1,6 +1,6 @@
-import { requireAdminKey, requireIssuer } from "../config.js";
-import { buildIntegrationPlan, integrationFrameworks, isIntegrationFramework, } from "../integration.js";
-import { getResource } from "../rail.js";
+import { requireIssuer } from "../config.js";
+import { integrationFrameworks, isIntegrationFramework, } from "../integration.js";
+import { currentWorkspacePath, managementRequest } from "../management.js";
 /**
  * CLI twin of `authflow_integration_plan`. The MCP tool is how an agent usually gets this; the
  * command exists so the two surfaces stay the same size.
@@ -12,14 +12,14 @@ export function planCommand(program) {
         .requiredOption("--slug <slug>", "Resource slug")
         .requiredOption("--framework <kind>", `Origin implementation (${integrationFrameworks.join(" | ")})`)
         .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
-        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .option("--workspace <id>", "Workspace selected by authflow login")
         .action(async (opts) => {
         if (!isIntegrationFramework(opts.framework)) {
             throw new Error(`--framework must be one of: ${integrationFrameworks.join(", ")}. Got '${opts.framework}'.`);
         }
-        const auth = { issuer: requireIssuer(opts.issuer), adminKey: requireAdminKey(opts.adminKey) };
-        const receipt = await getResource(auth, opts.slug);
-        const plan = buildIntegrationPlan(opts.framework, receipt);
+        const issuer = requireIssuer(opts.issuer);
+        const workspace = await currentWorkspacePath(issuer, opts.workspace);
+        const plan = await managementRequest(issuer, `${workspace}/resources/${encodeURIComponent(opts.slug)}/integration-plan`, "GET", undefined, { framework: opts.framework });
         console.log(JSON.stringify(plan, null, 2));
     });
 }

package/dist/commands/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qEAAqE,CAAC;SAClF,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,cAAc,CACb,oBAAoB,EACpB,0BAA0B,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/D;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAA6E,EAAE,EAAE;QAC9F,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,+BAA+B,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/commands/plan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qEAAqE,CAAC;SAClF,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,cAAc,CACb,oBAAoB,EACpB,0BAA0B,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/D;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,IAA8E,EAAE,EAAE;QAC/F,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,+BAA+B,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,GAAG,SAAS,cAAc,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1K,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/register.js

@@ -1,5 +1,6 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { apiJson, bearer, requireAdminKey, requireIssuer } from "../config.js";
+import { parsePublicHost, parsePublicPath } from "../custom-domain.js";
 import { secretTargets, writeOriginApiKey } from "../secrets.js";
 import { formatCursorMcpConfig, formatReadiness, resourceReadiness } from "../status.js";
 export function registerCommand(program) {
@@ -13,18 +14,21 @@ export function registerCommand(program) {
         .option("--write-secrets <target>", `Store the origin API key and redact it from the receipt (${secretTargets.join(" | ")})`)
         .option("--secret-destination <value>", "user-secrets: project dir (default .) · env-file: path (default .env.local) · keyvault: vault name")
         .option("--keep-secret-in-receipt", "Leave the origin API key in the receipt file as plaintext (not recommended)")
+        .option("--public-host <host>", "Serve the resource on your own hostname (a subdomain) instead of the gateway's slug URL. Sent as public_host; the receipt then lists the DNS records to add")
+        .option("--public-path <path>", "Public MCP path on that host (default /mcp). Sent as public_path")
         .action(async (opts) => {
         const issuer = requireIssuer(opts.issuer);
         const adminKey = requireAdminKey(opts.adminKey);
         const target = parseTarget(opts.writeSecrets);
         const draftRaw = (await readFile(opts.file, "utf8")).replace(/^\uFEFF/, "");
-        let draft;
+        let parsed;
         try {
-            draft = JSON.parse(draftRaw);
+            parsed = JSON.parse(draftRaw);
         }
         catch {
             throw new Error(`--file ${opts.file} is not valid JSON.`);
         }
+        const draft = withPublicHost(parsed, opts);
         const { body, status } = await apiJson(`${issuer}/admin/resources`, {
             method: "POST",
             headers: {
@@ -89,6 +93,30 @@ export function registerCommand(program) {
         }
     });
 }
+/**
+ * --public-host and --public-path are shorthand for the same two fields in the file, and win over
+ * it. A path with no host is refused here: the rail would have nothing to apply it to, and the
+ * silent outcome is a resource on the slug URL that the tenant believes is on their own.
+ */
+function withPublicHost(draft, opts) {
+    if (opts.publicHost === undefined && opts.publicPath === undefined) {
+        return draft;
+    }
+    if (draft === null || typeof draft !== "object" || Array.isArray(draft)) {
+        throw new Error(`--file ${opts.file} must hold a JSON object to combine it with --public-host / --public-path.`);
+    }
+    const merged = { ...draft };
+    if (opts.publicHost !== undefined) {
+        merged.public_host = parsePublicHost(opts.publicHost, "--public-host", "--public-path");
+    }
+    if (opts.publicPath !== undefined) {
+        merged.public_path = parsePublicPath(opts.publicPath, "--public-path");
+    }
+    if (merged.public_path !== undefined && merged.public_host === undefined) {
+        throw new Error("--public-path needs a host: pass --public-host (or set public_host in the file).");
+    }
+    return merged;
+}
 function parseTarget(raw) {
     if (raw === undefined) {
         return undefined;

package/dist/commands/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAYzF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SAC9E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CACL,0BAA0B,EAC1B,4DAA4D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACzF;SACA,MAAM,CACL,8BAA8B,EAC9B,oGAAoG,CACrG;SACA,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E;SACA,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAA0B,GAAG,MAAM,kBAAkB,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,4FAA4F;QAC5F,2EAA2E;QAC3E,IAAI,QAA4B,CAAC;QACjC,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QAClD,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,2FAA2F;YAC3F,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,cAAc,GAAG,oDAAoD,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,8BAA8B,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,+BAA+B,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,4BAA4B,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,WAAW,IAAI,CAAC,GAAG,+EAA+E,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAA2B,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAczF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SAC9E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CACL,0BAA0B,EAC1B,4DAA4D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACzF;SACA,MAAM,CACL,8BAA8B,EAC9B,oGAAoG,CACrG;SACA,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E;SACA,MAAM,CACL,sBAAsB,EACtB,6JAA6J,CAC9J;SACA,MAAM,CAAC,sBAAsB,EAAE,kEAAkE,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAA0B,GAAG,MAAM,kBAAkB,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,4FAA4F;QAC5F,2EAA2E;QAC3E,IAAI,QAA4B,CAAC;QACjC,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QAClD,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,2FAA2F;YAC3F,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,cAAc,GAAG,oDAAoD,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,8BAA8B,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,+BAA+B,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,4BAA4B,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,WAAW,IAAI,CAAC,GAAG,+EAA+E,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAA2B,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAqB;IAC3D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,IAAI,4EAA4E,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,GAAI,KAAiC,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/set-domain.d.ts

@@ -0,0 +1,34 @@
+import type { Command } from "commander";
+export type SetDomainOptions = {
+    slug: string;
+    /** Omit to re-verify the host already set on the resource. */
+    host?: string;
+    path?: string;
+    wait?: boolean;
+    timeout?: string;
+    issuer?: string;
+    adminKey?: string;
+};
+/** Injectable so tests can drive the wait without real time or a real terminal. */
+export type SetDomainEnvironment = {
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    log?: (line: string) => void;
+};
+/**
+ * Serve a resource on the tenant's own hostname: the "bring your existing MCP URL" step.
+ *
+ * Setting the host is the easy half. The rail answers with the DNS records the tenant has to create
+ * at a registrar this CLI cannot reach, so the command's job is to put those records on screen
+ * exactly as the rail issued them and then, with --wait, to confirm they took.
+ *
+ * There is no separate verify command, so this is also how a tenant re-checks after adding the
+ * records: with no --host it verifies the host already set on the resource instead of setting one.
+ */
+export declare function setDomainCommand(program: Command, env?: SetDomainEnvironment): void;
+/**
+ * Returns the exit code instead of setting it: 0 when the domain is ready (or, without --wait,
+ * when it was set or re-checked and is not in a failure state), 1 when it timed out or is blocked,
+ * moved, or removed.
+ */
+export declare function runSetDomain(opts: SetDomainOptions, env?: SetDomainEnvironment): Promise<number>;

package/dist/commands/set-domain.js

@@ -0,0 +1,162 @@
+import { requireAdminKey, requireIssuer } from "../config.js";
+import { assertCustomDomainReturned, assertCustomDomainSet, customDomainState, defaultPublicPath, defaultWaitTimeoutSeconds, describeCustomDomainState, dnsInstructions, formatDuration, isCustomDomainFailure, parsePublicHost, parsePublicPath, setDomainCommandLine, summarizeCustomDomain, waitForCustomDomain, waitIntervalMs, } from "../custom-domain.js";
+import { describePending, getResource, setCustomDomain, verifyCustomDomain } from "../rail.js";
+import { formatCursorMcpConfig } from "../status.js";
+/**
+ * Serve a resource on the tenant's own hostname: the "bring your existing MCP URL" step.
+ *
+ * Setting the host is the easy half. The rail answers with the DNS records the tenant has to create
+ * at a registrar this CLI cannot reach, so the command's job is to put those records on screen
+ * exactly as the rail issued them and then, with --wait, to confirm they took.
+ *
+ * There is no separate verify command, so this is also how a tenant re-checks after adding the
+ * records: with no --host it verifies the host already set on the resource instead of setting one.
+ */
+export function setDomainCommand(program, env = {}) {
+    program
+        .command("set-domain")
+        .description("Serve a resource on your own hostname, or re-verify the one already set: print the DNS records to add and, with --wait, poll until the domain is ready")
+        .requiredOption("--slug <slug>", "Resource slug")
+        .option("--host <host>", "Your hostname, e.g. mcp.example.com (a subdomain; no scheme, path or port). Omit it to re-verify the host already set on the resource")
+        .option("--path <path>", "Public MCP path on that host. Sent only when given: the rail uses /mcp the first time and keeps the stored path afterwards. Needs --host")
+        .option("--wait", "Poll verification until the domain is ready, fails, or --timeout passes")
+        .option("--timeout <seconds>", `With --wait: how long to keep polling before giving up (default ${defaultWaitTimeoutSeconds})`)
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .action(async (opts) => {
+        process.exitCode = await runSetDomain(opts, env);
+    });
+}
+/**
+ * Returns the exit code instead of setting it: 0 when the domain is ready (or, without --wait,
+ * when it was set or re-checked and is not in a failure state), 1 when it timed out or is blocked,
+ * moved, or removed.
+ */
+export async function runSetDomain(opts, env = {}) {
+    const log = env.log ?? ((line) => console.log(line));
+    const timeoutMs = resolveTimeoutMs(opts);
+    // A path belongs to a host being set. Re-verifying sends nothing, so a --path there would be
+    // silently ignored, and someone who typed it believes they changed the path.
+    if (opts.host === undefined && opts.path !== undefined) {
+        throw new Error("--path only applies with --host. Without a host this re-verifies the one already set, and the " +
+            "rail keeps its stored path.");
+    }
+    const host = opts.host === undefined ? undefined : parsePublicHost(opts.host);
+    const path = opts.path === undefined ? undefined : parsePublicPath(opts.path);
+    const auth = { issuer: requireIssuer(opts.issuer), adminKey: requireAdminKey(opts.adminKey) };
+    // Both routes end with a receipt to show and, with --wait, to poll from.
+    let receipt;
+    let hostName;
+    if (host !== undefined) {
+        receipt = await setCustomDomain(auth, opts.slug, host, path);
+        hostName = host;
+    }
+    else {
+        // Ask the receipt first. Verifying a resource with no host would fail with an error that does
+        // not say how to fix it; this says to pass --host.
+        hostName = assertCustomDomainSet(await getResource(auth, opts.slug), opts.slug);
+        receipt = await verifyCustomDomain(auth, opts.slug);
+    }
+    assertCustomDomainReturned(receipt, hostName, opts.slug);
+    const url = receipt.gateway_url ??
+        receipt.resource ??
+        `https://${hostName}${receipt.public_path ?? path ?? defaultPublicPath}`;
+    log(`${receipt.slug ?? opts.slug} -> ${url}`);
+    log(`state:  ${summarizeCustomDomain(receipt)}`);
+    const instructions = dnsInstructions(receipt);
+    if (instructions.length > 0) {
+        log("");
+        for (const line of instructions) {
+            log(line);
+        }
+    }
+    const state = customDomainState(receipt);
+    if (state === "ready") {
+        return reportReady(receipt, opts.slug, log);
+    }
+    if (isCustomDomainFailure(state)) {
+        return reportFailure(receipt, opts.slug, log);
+    }
+    if (!opts.wait) {
+        log("");
+        log(host === undefined
+            ? `Still not ready. To keep checking (now, then every ${formatDuration(waitIntervalMs)} until ready):`
+            : `Once the records are in place, verify (re-checks now, then every ${formatDuration(waitIntervalMs)} until ready):`);
+        log(`  ${setDomainCommandLine(opts.slug)}`);
+        return 0;
+    }
+    log("");
+    log("Add the records above. This keeps checking and says when the domain is ready.");
+    const result = await waitForCustomDomain(receipt, {
+        verify: () => verifyCustomDomain(auth, opts.slug),
+        timeoutMs,
+        sleep: env.sleep,
+        now: env.now,
+        onProgress: (line) => log(`  ${line}`),
+    });
+    switch (result.outcome) {
+        case "ready":
+            return reportReady(result.receipt, opts.slug, log);
+        case "failed":
+            return reportFailure(result.receipt, opts.slug, log);
+        case "timeout":
+            return reportTimeout(result.receipt, opts.slug, timeoutMs, log);
+    }
+}
+function resolveTimeoutMs(opts) {
+    if (opts.timeout === undefined) {
+        return defaultWaitTimeoutSeconds * 1000;
+    }
+    if (!opts.wait) {
+        throw new Error("--timeout only applies with --wait.");
+    }
+    const seconds = Number(opts.timeout);
+    if (!Number.isFinite(seconds) || seconds <= 0) {
+        throw new Error(`--timeout must be a positive number of seconds (got '${opts.timeout}').`);
+    }
+    return seconds * 1000;
+}
+function reportReady(receipt, slug, log) {
+    log("");
+    log(`Ready. ${receipt.gateway_url ?? receipt.resource ?? "The hostname"} is serving this resource.`);
+    const config = formatCursorMcpConfig(receipt);
+    if (config.length > 0) {
+        log("");
+        for (const line of config) {
+            log(line);
+        }
+    }
+    // A ready hostname is one requirement, not the whole go-live. Say what is left rather than let
+    // "Ready" read as "live".
+    const pending = receipt.pending_requirements ?? [];
+    if (pending.length > 0) {
+        log("");
+        log("Still pending before go-live:");
+        for (const requirement of pending) {
+            log(`  ${requirement}`);
+            log(`    ${describePending(requirement, slug)}`);
+        }
+    }
+    return 0;
+}
+function reportFailure(receipt, slug, log) {
+    const state = customDomainState(receipt);
+    log("");
+    log(`The custom domain is ${state}: ${describeCustomDomainState(state)}.`);
+    log(`last error: ${receipt.custom_domain?.last_error?.trim() || "(the rail gave no detail)"}`);
+    log("");
+    log(`Fix the cause, then re-run: ${setDomainCommandLine(slug)}`);
+    return 1;
+}
+function reportTimeout(receipt, slug, timeoutMs, log) {
+    log("");
+    log(`Still ${customDomainState(receipt) ?? "unknown"} after ${formatDuration(timeoutMs)}.`);
+    const error = receipt.custom_domain?.last_error?.trim();
+    if (error) {
+        log(`last error: ${error}`);
+    }
+    log("Nothing is lost. Add or fix the records above, then re-run:");
+    log(`  ${setDomainCommandLine(slug)}`);
+    return 1;
+}
+//# sourceMappingURL=set-domain.js.map

package/dist/commands/set-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-domain.js","sourceRoot":"","sources":["../../src/commands/set-domain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoBrD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAA4B,EAAE;IAC/E,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,wJAAwJ,CACzJ;SACA,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CACL,eAAe,EACf,uIAAuI,CACxI;SACA,MAAM,CACL,eAAe,EACf,0IAA0I,CAC3I;SACA,MAAM,CAAC,QAAQ,EAAE,yEAAyE,CAAC;SAC3F,MAAM,CACL,qBAAqB,EACrB,mEAAmE,yBAAyB,GAAG,CAChG;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,MAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,6FAA6F;IAC7F,6EAA6E;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE9F,yEAAyE;IACzE,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,8FAA8F;QAC9F,mDAAmD;QACnD,QAAQ,GAAG,qBAAqB,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzD,MAAM,GAAG,GACP,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,QAAQ;QAChB,WAAW,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC3E,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,WAAW,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CACD,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,sDAAsD,cAAc,CAAC,cAAc,CAAC,gBAAgB;YACtG,CAAC,CAAC,oEAAoE,cAAc,CAAC,cAAc,CAAC,gBAAgB,CACvH,CAAC;QACF,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QACjD,SAAS;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,yBAAyB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC1F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,cAAc,4BAA4B,CAAC,CAAC;IAErG,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC5F,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,wBAAwB,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,GAAG,CAAC,eAAe,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,2BAA2B,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+BAA+B,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CACpB,OAA4B,EAC5B,IAAY,EACZ,SAAiB,EACjB,GAA2B;IAE3B,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACnE,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/signup.d.ts

@@ -1,2 +1,3 @@
 import type { Command } from "commander";
+/** Compatibility command: an email address is not proof of account ownership. */
 export declare function signupCommand(program: Command): void;

package/dist/commands/signup.js

@@ -1,53 +1,7 @@
-import { requireIssuer } from "../config.js";
-import { signupTenant } from "../rail.js";
-import { writeAdminApiKey } from "../secrets.js";
+/** Compatibility command: an email address is not proof of account ownership. */
 export function signupCommand(program) {
-    program
-        .command("signup")
-        .description("Mint a per-tenant admin API key (shown once)")
-        .requiredOption("--email <address>", "Email that owns the tenant")
-        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
-        .option("--write-secrets", "Write the key to an env file (default: .env.local)", true)
-        .option("--no-write-secrets", "Print the key only; do not write it to disk")
-        .option("--secret-destination <path>", "Env-file path for --write-secrets")
-        .addHelpText("after", [
-        "",
-        "The key is scoped to slugs you register with it. Paste it into Cursor as",
-        "AUTHFLOW_ADMIN_API_KEY, then run `authflow mcp` or `authflow init`.",
-    ].join("\n"))
-        .action(async (opts) => {
-        const issuer = requireIssuer(opts.issuer);
-        const receipt = await signupTenant(issuer, opts.email);
-        let storedAt;
-        if (opts.writeSecrets !== false) {
-            storedAt = await writeAdminApiKey({
-                value: receipt.admin_api_key,
-                destination: opts.secretDestination,
-            });
-        }
-        const mcpConfig = {
-            mcpServers: {
-                authflow: {
-                    command: "npx",
-                    args: ["-y", "-p", "authflow-cli", "authflow", "mcp"],
-                    env: {
-                        AUTHFLOW_ISSUER: receipt.issuer,
-                        AUTHFLOW_ADMIN_API_KEY: storedAt ? `<from ${storedAt}>` : receipt.admin_api_key,
-                    },
-                },
-            },
-        };
-        process.stdout.write(JSON.stringify({
-            ...receipt,
-            admin_api_key: storedAt ? `<stored in ${storedAt}>` : receipt.admin_api_key,
-            mcp_config: mcpConfig,
-            next_steps: [
-                storedAt
-                    ? `Load ${storedAt} (or copy the key into Cursor's MCP env) and run: npx -y -p authflow-cli authflow init --slug <your-slug>`
-                    : "Store the admin_api_key, then: npx -y -p authflow-cli authflow init --slug <your-slug>",
-                "Or paste mcp_config into Cursor and let the agent finish onboarding.",
-            ],
-        }, null, 2) + "\n");
-    });
+    program.command("signup").description("Moved: use verified browser sign-in with authflow login")
+        .option("--email <address>").option("--issuer <url>").option("--write-secrets").option("--no-write-secrets").option("--secret-destination <path>")
+        .action(() => { throw new Error("Email-only signup has been retired. Create a workspace in the Authflow portal, then run authflow login --issuer <issuer>. Existing tenant owners can claim their workspace in the portal with their current admin credential."); });
 }
 //# sourceMappingURL=signup.js.map

package/dist/commands/signup.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/commands/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AASjD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,cAAc,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;SACjE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,EAAE,IAAI,CAAC;SACrF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,6BAA6B,EAAE,mCAAmC,CAAC;SAC1E,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,EAAE,IAAmB,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,QAA4B,CAAC;QACjC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAChC,QAAQ,GAAG,MAAM,gBAAgB,CAAC;gBAChC,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC;oBACrD,GAAG,EAAE;wBACH,eAAe,EAAE,OAAO,CAAC,MAAM;wBAC/B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;qBAChF;iBACF;aACF;SACF,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CACZ;YACE,GAAG,OAAO;YACV,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;YAC3E,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE;gBACV,QAAQ;oBACN,CAAC,CAAC,QAAQ,QAAQ,2GAA2G;oBAC7H,CAAC,CAAC,wFAAwF;gBAC5F,sEAAsE;aACvE;SACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/commands/signup.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,yDAAyD,CAAC;SAC7F,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC;SACjJ,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,+NAA+N,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzQ,CAAC"}