authflow-cli 0.4.1 → 0.6.0

package/dist/config.d.ts

@@ -8,13 +8,39 @@ export type CliConfig = {
 export declare function requireIssuer(flag?: string): string;
 export declare function requireAdminKey(flag?: string): string;
 export declare function requireOriginKey(flag?: string): string;
+/** One DNS record a tenant must create for a custom domain (`purpose`: ownership, traffic, certificate). */
+export type CustomDomainRecord = {
+    type: string;
+    name: string;
+    value: string;
+    purpose: string;
+};
+/**
+ * The claim on a tenant-owned hostname. `state` is one of awaiting_ownership, provisioning,
+ * awaiting_traffic, ready, moved, blocked, removed; it stays a plain string so a state a newer rail
+ * adds is shown rather than rejected.
+ */
+export type CustomDomainStatus = {
+    state: string;
+    cname_target?: string | null;
+    records?: CustomDomainRecord[];
+    last_error?: string | null;
+    checked_at?: string | null;
+};
 /** Registration receipt fields (snake_case) from RegistryAdminEndpoints. */
 export type RegistrationReceipt = {
     slug?: string;
     display_name?: string;
+    /** Canonical resource URI. `https://{public_host}{public_path}` once a custom host is set. */
     resource?: string;
     gateway_url?: string;
     prm_url?: string;
+    /** Tenant hostname when the resource is served on its own host (omitted otherwise). */
+    public_host?: string;
+    /** Public MCP path on that host, `/mcp` unless the tenant chose another. */
+    public_path?: string;
+    /** DNS records and claim state for the custom host (omitted when there is no host). */
+    custom_domain?: CustomDomainStatus;
     issuer?: string;
     keys_url?: string;
     usage_url?: string;
@@ -28,9 +54,18 @@ export type RegistrationReceipt = {
     origin_api_key?: string;
     gateway_egress_cidrs?: string[];
     status?: string;
+    access_mode?: "free" | "paid";
     metering_mode?: string;
-    /** What still blocks go-live: origin_base_uri, connected_account_id, stripe_onboarding_complete. */
+    metering_default_units?: number;
+    tool_units?: Record<string, number>;
+    /**
+     * What still blocks go-live: origin_base_uri, connected_account_id, stripe_onboarding_complete,
+     * and custom_domain_dns while a custom host is set but not yet ready.
+     */
     pending_requirements?: string[];
+    allowed_actions?: string[];
+    last_probe_at_utc?: string | null;
+    last_probe_passed?: boolean | null;
 };
 export declare function readReceipt(path: string): Promise<RegistrationReceipt>;
 export declare function resolveGatewayUrl(opts: {

package/dist/config.js

@@ -9,7 +9,7 @@ export function requireIssuer(flag) {
 export function requireAdminKey(flag) {
     const key = (flag ?? process.env.AUTHFLOW_ADMIN_API_KEY ?? "").trim();
     if (!key) {
-        throw new Error("Set AUTHFLOW_ADMIN_API_KEY or pass --admin-key.");
+        throw new Error("This legacy operator command requires AUTHFLOW_ADMIN_API_KEY or --admin-key. For creator onboarding, run authflow login and use authflow resource commands. Claim an existing workspace in the portal with its current tenant key.");
     }
     return key;
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAAsD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oOAAoO,CAAC,CAAC;IACxP,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAgED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAAsD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,22 @@
+export type LoginCredential = {
+    issuer: string;
+    client_id: string;
+    access_token: string;
+    refresh_token?: string;
+    expires_at: number;
+    workspace_id: string;
+};
+/** Credentials never enter the checkout, environment files, or tool results. */
+export declare function credentialEntry(issuer: string, suffix?: string): Promise<import("@napi-rs/keyring").Entry>;
+export declare function readCredential(issuer: string): Promise<LoginCredential | undefined>;
+export declare function saveCredential(credential: LoginCredential): Promise<void>;
+export declare function deleteCredential(issuer: string): Promise<void>;
+/** Serialize refresh-token rotation across CLI/MCP processes. The lock contains no secrets. */
+export declare function withCredentialLock<T>(issuer: string, action: () => Promise<T>): Promise<T>;
+/** One storage boundary also lets protocol tests use an isolated in-memory credential store. */
+export declare const credentialStore: {
+    read: typeof readCredential;
+    save: typeof saveCredential;
+    delete: typeof deleteCredential;
+    withLock: typeof withCredentialLock;
+};

package/dist/credentials.js

@@ -0,0 +1,206 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, rmdir, stat, unlink, utimes, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+/** Credentials never enter the checkout, environment files, or tool results. */
+export async function credentialEntry(issuer, suffix = "") {
+    try {
+        const { Entry } = await import("@napi-rs/keyring");
+        return new Entry("authflow-cli", issuer + suffix, { linux: { store: "secret-service" } });
+    }
+    catch {
+        throw new Error("The operating system credential store is unavailable. Enable your desktop keyring and retry; Authflow does not fall back to plaintext credentials.");
+    }
+}
+export async function readCredential(issuer) {
+    const entry = await credentialEntry(issuer);
+    let value;
+    try {
+        value = entry.getPassword();
+    }
+    catch {
+        throw new Error("Unable to read the OS credential store. Unlock it and retry authflow login.");
+    }
+    if (!value)
+        return undefined;
+    const manifest = parseManifest(value);
+    const chunks = [];
+    for (let i = 0; i < manifest.count; i++) {
+        const chunk = (await credentialEntry(issuer, `:${manifest.generation}:${i}`)).getPassword();
+        if (chunk === null)
+            throw new Error("Stored Authflow login is incomplete; run authflow login again.");
+        chunks.push(chunk);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(chunks.join(""));
+    }
+    catch {
+        throw new Error("Stored Authflow login is invalid; run authflow login again.");
+    }
+    if (!parsed || typeof parsed !== "object")
+        throw new Error("Stored Authflow login is invalid; run authflow login again.");
+    const credential = parsed;
+    if (credential.issuer !== issuer || typeof credential.client_id !== "string" || !credential.client_id
+        || typeof credential.access_token !== "string" || !credential.access_token || typeof credential.workspace_id !== "string" || !credential.workspace_id
+        || credential.refresh_token !== undefined && typeof credential.refresh_token !== "string" || !Number.isFinite(credential.expires_at)) {
+        throw new Error("Stored Authflow login is invalid; run authflow login again.");
+    }
+    return credential;
+}
+export async function saveCredential(credential) {
+    // Windows limits each credential blob. Publish one small manifest only after every
+    // protected chunk is written; interrupted writes leave the previous login readable.
+    const entry = await credentialEntry(credential.issuer);
+    const previous = entry.getPassword();
+    const serialized = JSON.stringify(credential);
+    const generation = randomBytes(16).toString("hex");
+    const count = Math.ceil(serialized.length / 1000);
+    if (count > 64)
+        throw new Error("The issuer returned an unexpectedly large login credential.");
+    let written = 0;
+    try {
+        for (; written < count; written++) {
+            (await credentialEntry(credential.issuer, `:${generation}:${written}`)).setPassword(serialized.slice(written * 1000, (written + 1) * 1000));
+        }
+        entry.setPassword(JSON.stringify({ generation, count }));
+    }
+    catch {
+        await removeChunks(credential.issuer, { generation, count: written });
+        throw new Error("Unable to save the login in your OS credential store. Unlock it and retry authflow login.");
+    }
+    if (previous) {
+        try {
+            await removeChunks(credential.issuer, parseManifest(previous));
+        }
+        catch { /* Replacing an invalid manifest still successfully repairs the login. */ }
+    }
+}
+export async function deleteCredential(issuer) {
+    const entry = await credentialEntry(issuer);
+    const previous = entry.getPassword();
+    entry.deletePassword();
+    if (previous) {
+        try {
+            await removeChunks(issuer, parseManifest(previous));
+        }
+        catch { /* An invalid old manifest cannot make removal of the login fail. */ }
+    }
+}
+function parseManifest(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("Stored Authflow login is invalid; run authflow login again.");
+    }
+    if (!parsed || typeof parsed !== "object" || !/^[a-f0-9]{32}$/.test(parsed.generation) || !Number.isInteger(parsed.count) || parsed.count < 1 || parsed.count > 64) {
+        throw new Error("Stored Authflow login is invalid; run authflow login again.");
+    }
+    return parsed;
+}
+async function removeChunks(issuer, manifest) {
+    for (let i = 0; i < manifest.count; i++) {
+        try {
+            (await credentialEntry(issuer, `:${manifest.generation}:${i}`)).deletePassword();
+        }
+        catch { /* A revoked orphan remains OS-protected. */ }
+    }
+}
+/** Serialize refresh-token rotation across CLI/MCP processes. The lock contains no secrets. */
+export async function withCredentialLock(issuer, action) {
+    const directory = join(homedir(), ".authflow", "locks");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lock = join(directory, createHash("sha256").update(issuer).digest("hex"));
+    const ownerPath = join(lock, "owner.json");
+    const owner = { pid: process.pid, id: randomBytes(16).toString("hex") };
+    const deadline = Date.now() + 45_000;
+    while (true) {
+        try {
+            await mkdir(lock, { mode: 0o700 });
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const info = await stat(lock).catch(() => undefined);
+            // A suspended process can miss its heartbeat while still holding a rotating refresh
+            // token. Never steal its lock merely because a timer elapsed.
+            if (info && Date.now() - info.mtimeMs > 60_000) {
+                await recoverAbandonedLock(lock, ownerPath);
+            }
+            if (Date.now() >= deadline)
+                throw new Error("Another Authflow login is busy. Retry shortly.");
+            await delay(200);
+        }
+    }
+    try {
+        await writeFile(ownerPath, JSON.stringify(owner), { mode: 0o600 });
+    }
+    catch (error) {
+        await rmdir(lock).catch(() => undefined);
+        throw error;
+    }
+    const heartbeat = setInterval(() => { const now = new Date(); void utimes(lock, now, now).catch(() => undefined); }, 10_000);
+    heartbeat.unref();
+    try {
+        return await action();
+    }
+    finally {
+        clearInterval(heartbeat);
+        if ((await lockOwner(ownerPath))?.id === owner.id) {
+            await unlink(ownerPath);
+            await rmdir(lock);
+        }
+    }
+}
+async function lockOwner(path) {
+    try {
+        const owner = JSON.parse(await readFile(path, "utf8"));
+        if (owner && typeof owner === "object" && "pid" in owner && "id" in owner
+            && Number.isInteger(owner.pid) && Number(owner.pid) > 0 && typeof owner.id === "string")
+            return owner;
+    }
+    catch { /* An interrupted acquisition can leave an empty legacy lock. */ }
+    return undefined;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+async function recoverAbandonedLock(lock, ownerPath) {
+    // Serialize stale cleanup. Recheck the owner after acquiring this marker: another
+    // waiter may already have recovered the directory and acquired a fresh login lock.
+    const recovery = join(lock, "recovering");
+    try {
+        await mkdir(recovery, { mode: 0o700 });
+    }
+    catch {
+        return;
+    }
+    let abandoned = false;
+    try {
+        const previous = await lockOwner(ownerPath);
+        if (previous && processIsAlive(previous.pid))
+            return;
+        abandoned = true;
+        await unlink(ownerPath).catch(() => undefined);
+    }
+    finally {
+        await rmdir(recovery).catch(() => undefined);
+    }
+    // A new owner writes owner.json before entering its action, so a delayed cleanup
+    // cannot delete an acquired lock: rmdir refuses any nonempty directory.
+    if (abandoned)
+        await rmdir(lock).catch(() => undefined);
+}
+/** One storage boundary also lets protocol tests use an isolated in-memory credential store. */
+export const credentialStore = { read: readCredential, save: saveCredential, delete: deleteCredential, withLock: withCredentialLock };
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAW3D,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAM,GAAG,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oJAAoJ,CAAC,CAAC;IACxK,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IACpC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAAC,CAAC;IACzG,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5F,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACtG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7C,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC1H,MAAM,UAAU,GAAG,MAAyB,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS;WAChG,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,YAAY;WAClJ,UAAU,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACvI,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAA2B;IAC9D,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/F,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAClC,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC9I,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,MAAM,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,CAAC;QACvE,MAAM,CAAC,CAAC,yEAAyE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,CAAC,cAAc,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAGD,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAa,CAAC;IAAC,CAAC;IAC/C,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;QACnK,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,QAAkB;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;IAClJ,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAI,MAAc,EAAE,MAAwB;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QAClD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,oFAAoF;YACpF,8DAA8D;YAC9D,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;gBAC/C,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC9F,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAC3E,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACxE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7H,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,OAAO,MAAM,MAAM,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QACtC,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK;eACpE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YACvF,OAAO,KAAoC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC,CAAC,gEAAgE,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,CAAC;QAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IACjE,kFAAkF;IAClF,mFAAmF;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACjE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QACrD,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC3D,iFAAiF;IACjF,wEAAwE;IACxE,IAAI,SAAS;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/custom-domain.d.ts

@@ -0,0 +1,96 @@
+import type { CustomDomainRecord, RegistrationReceipt } from "./config.js";
+/**
+ * Everything about a tenant-owned hostname that more than one front end needs: validating what the
+ * user typed, showing the DNS records they have to create, and waiting for the rail to confirm them.
+ * `set-domain`, the `authflow_set_custom_domain` tool, `status`, and `register` all render the same
+ * records, so they render them from here; a table that differs between the CLI and the agent path is
+ * how a tenant ends up adding the wrong record.
+ */
+/** The public MCP path when a tenant does not choose one. */
+export declare const defaultPublicPath = "/mcp";
+/** How often verification is re-checked while waiting. Each call makes the rail do real DNS lookups. */
+export declare const waitIntervalMs = 15000;
+/** Default `set-domain --wait` budget: DNS propagation plus certificate issuance. */
+export declare const defaultWaitTimeoutSeconds = 1800;
+/**
+ * How long the MCP tool waits. A tool call that outlives the client's request timeout (60 s is the
+ * SDK default and common in hosts) is dropped along with its result, so the tool waits less than
+ * that, reports where things stand, and tells the agent to call again. The client's clock also
+ * covers the request that sets the host and the last verification still in flight when the wait
+ * ends, which is why this is well short of 60 s rather than just under it.
+ */
+export declare const mcpWaitTimeoutMs = 45000;
+/**
+ * Normalises a hostname the user typed and rejects the things that are not one. The rail validates
+ * too; this exists because the likeliest mistake is pasting the MCP URL, and the rail's 400 does not
+ * say that.
+ */
+export declare function parsePublicHost(input: string, flag?: string, 
+/** Where the path goes, for the error. Null when the caller has no path to offer. */
+pathFlag?: string | null): string;
+export declare function parsePublicPath(input: string, flag?: string): string;
+/**
+ * A 200 from the rail that carries no `custom_domain` has nothing to show or wait on. It means the
+ * rail predates custom domains or something upstream dropped the object; either way, say so rather
+ * than print an empty table and report success.
+ */
+export declare function assertCustomDomainReturned(receipt: RegistrationReceipt, host: string, slug: string): void;
+/**
+ * Re-verifying means re-checking a host that is already there. A resource with none has nothing to
+ * verify, and the bare error from asking the rail anyway would not say how to fix it, so say that
+ * plainly and name the argument that sets one. Returns the host the resource is registered on.
+ */
+export declare function assertCustomDomainSet(receipt: RegistrationReceipt, slug: string, hostFlag?: string): string;
+export declare function customDomainState(receipt: RegistrationReceipt): string | undefined;
+export declare function isCustomDomainFailure(state: string | undefined): boolean;
+/** One line on what a state means, for the person staring at it. */
+export declare function describeCustomDomainState(state: string | undefined): string;
+/** `awaiting_traffic (waiting for the traffic and certificate CNAMEs)`, plus the rail's last error. */
+export declare function summarizeCustomDomain(receipt: RegistrationReceipt): string;
+/** The records as an aligned TYPE / NAME / VALUE / PURPOSE table, in the order the rail listed them. */
+export declare function formatDnsRecords(records: readonly CustomDomainRecord[]): string[];
+/**
+ * Registrars disagree about the Name column. GoDaddy and several others append the domain
+ * themselves, so a full name there produces `mcp.example.com.example.com` and a record that
+ * silently never matches.
+ */
+export declare function registrarNameHint(host: string): string[];
+/** The "add these records" block shared by every front end. Empty when the rail listed none. */
+export declare function dnsInstructions(receipt: RegistrationReceipt): string[];
+/**
+ * The command that re-checks the host already set on a resource. It names no host and no path: the
+ * rail keeps both, so there is nothing to retype and nothing to get wrong on a re-run.
+ */
+export declare function setDomainCommandLine(slug: string): string;
+export type WaitOutcome = "ready" | "failed" | "timeout";
+export type WaitResult = {
+    outcome: WaitOutcome;
+    /** The last receipt seen: the one that settled it, or the last one before giving up. */
+    receipt: RegistrationReceipt;
+    /** Verification calls that returned a receipt. */
+    polls: number;
+    elapsedMs: number;
+    /** The lines that were reported, in order, for callers that cannot stream them. */
+    progress: string[];
+};
+export type WaitOptions = {
+    /** Re-checks the domain now and returns the fresh receipt. */
+    verify: () => Promise<RegistrationReceipt>;
+    timeoutMs: number;
+    intervalMs?: number;
+    /** Injectable so tests do not wait in real time. */
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    onProgress?: (line: string) => void;
+};
+/**
+ * Polls verification until the domain is ready, fails, or the budget runs out. Verifies straight
+ * away and then every interval: a tenant who re-runs after adding their records should not wait a
+ * full interval to hear it worked.
+ *
+ * `ready` and the failure states settle it. Anything else, including a state this CLI has never
+ * heard of, keeps waiting, so a rail that adds a state does not break an old CLI.
+ */
+export declare function waitForCustomDomain(initial: RegistrationReceipt, options: WaitOptions): Promise<WaitResult>;
+/** `15s`, `50s`, `30m`. */
+export declare function formatDuration(ms: number): string;