authflow-cli 0.5.0 → 0.6.0

package/README.md

@@ -1,539 +1,108 @@
 # Authflow CLI
 
-Minimal TypeScript CLI for Authflow Rail onboarding. Wraps the public admin and Origin Protocol surfaces so a tenant can register a resource, connect Stripe, serve it on their own hostname, mint a local identity header, run the conformance probe, and scaffold the origin sidecar — without reading rail source.
+Browser-authorized creator management and an optional local MCP adapter. The primary entry point is the hosted management MCP at `https://staging.rails.authflow.ai/management/mcp`. It includes onboarding, resource management, integration guidance, and documentation. See [Onboard with your agent](../../docs/onboarding/agent.md).
 
-License: Apache-2.0. See [LICENSE](LICENSE).
-
-`authflow mcp` exposes the same operations as an MCP server, so a coding agent can onboard a server against the codebase it already has open. The tenant-facing walkthrough is [Onboard with your agent](../../docs/onboarding/agent.md). Command reference: [`authflow mcp`](#authflow-mcp).
-
-## Install
-
-The command is `authflow`. The npm package is [`authflow-cli`](https://www.npmjs.com/package/authflow-cli) (npm blocked the unscoped name `authflow`). No repo checkout is required:
-
-```bash
-npx -y -p authflow-cli authflow --help
-npx -y -p authflow-cli authflow init --slug video --price 900 --credits 12
-```
-
-Or install globally and drop the `npx` prefix:
-
-```bash
-npm install -g authflow-cli
-authflow --help
-```
-
-## From this repo (development)
-
-```bash
-cd sdk/cli
-npm install
-npm run build
-node dist/cli.js --help
-```
-
-During development (no build step):
-
-```bash
-npx tsx src/cli.ts --help
-npm run authflow -- --help
-```
-
-## Config
-
-| Env | Flag | Used by |
-| --- | --- | --- |
-| `AUTHFLOW_ISSUER` | `--issuer` | all HTTP commands |
-| `AUTHFLOW_ADMIN_API_KEY` | `--admin-key` | `init`, `register`, `connect`, `set-connected-account`, `set-origin`, `set-domain`, `status`, `get`, `list`, `plan`, `rotate-origin-key`, and `doctor` when it should read the receipt (mint with `authflow signup`) |
-| `AUTHFLOW_ORIGIN_API_KEY` | `--origin-key` | `mint-header`, `probe`, `set-origin` (for its probe) |
-| `AUTHFLOW_RESOURCE` / `AUTHFLOW_GATEWAY_URL` | `--gateway-url` / `--receipt` | curl hint on `mint-header` |
-
-Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7062`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
-
-## Commands
-
-### `authflow signup`
-
-Mints a per-tenant admin API key. This is how a creator gets `AUTHFLOW_ADMIN_API_KEY` without the rail operator handing them one.
-
-```bash
-export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-npx -y -p authflow-cli authflow signup --email you@example.com
-```
-
-The key (`afa_test_` on staging, `afa_live_` in production) is shown once and written to `.env.local` by default. It can only register and manage slugs created with that key. The operator bearer still exists as a super-admin.
-
-### `authflow init`
-
-The whole onboarding path in one command: register the resource, put the origin API key in a secret
-store, print the config to paste into your MCP server, and probe the origin if it is already up.
-
-```bash
-export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-export AUTHFLOW_ADMIN_API_KEY=…
-
-authflow init --slug video --price 900 --credits 12
-```
-
-Neither a Stripe account nor a deployed origin is required. Both are deferrable, in any order, and
-omitting either registers a **draft**: priced and registered, with a receipt you can build against,
-but not routable. That is the normal case — you rarely have a connected Stripe account or an origin
-URL before you have built anything.
-
-The receipt's `pending_requirements` lists what is still outstanding:
-
-| Requirement | Clear it with |
-| --- | --- |
-| `origin_base_uri` | `authflow set-origin --slug video --origin-url https://…` |
-| `connected_account_id` | `authflow connect --slug video` (hosted KYC) or `authflow set-connected-account --slug video --account acct_…` (you already have the id) |
-| `stripe_onboarding_complete` | finish Stripe's form, then `authflow connect --slug video` again |
-
-Re-running `init` against a slug this admin key already owns resumes it: `409 slug_owned_by_caller`
-is not a dead end. `--connected-account` and `--origin-url` then attach instead of failing. A slug
-owned by someone else still returns `slug_taken`.
-
-The resource goes live once the list is empty. Add `--connect` to `init` to get the Stripe
-onboarding link from the first command instead of running `connect` separately.
-
-Useful flags:
-
-| Flag | Default | Meaning |
-| --- | --- | --- |
-| `--integration <dotnet\|proxy>` | `dotnet` | Which origin config to print |
-| `--write-secrets <target>` | `user-secrets` | `user-secrets`, `env-file`, or `keyvault` |
-| `--secret-destination <value>` | — | Project dir, env-file path, or vault name |
-| `--connected-account <acct>` | — | Attach a Stripe account you already have |
-| `--connect` | — | Start Stripe onboarding and print the hosted link |
-| `--origin-url <url>` | — | Supply the origin now instead of later |
-| `--no-probe` | — | Skip the conformance probe |
-
-### `authflow connect`
-
-Starts or resumes Stripe Connect Standard onboarding and prints the hosted link the creator opens to
-complete KYC.
-
-```bash
-authflow connect --slug video
-authflow connect --slug video --wait   # poll until Stripe reports the account can take charges
-authflow connect --slug video --connected-account acct_…   # attach an account you already have
-```
-
-Account links are single-use and expire in minutes. Re-running is the expected way to get a fresh
-one: it resumes the same Stripe account rather than creating another, so retrying never leaves
-abandoned accounts behind. Run it again after the form is submitted to confirm `charges_enabled` and
-promote the resource.
-
-`--connected-account` skips hosted KYC and is the same PUT as `authflow set-connected-account`.
-
-### `authflow set-connected-account`
-
-Attach a Stripe Standard account id the platform already has. This is the CLI twin of
-`authflow_set_connected_account` and of `PUT /admin/resources/{slug}/connected-account`. Use it when
-`connect` would otherwise start a new hosted onboarding you do not need.
-
-```bash
-authflow set-connected-account --slug video --account acct_…
-```
-
-### `authflow set-origin`
-
-Points a draft at its origin, promoting it to live if nothing else is pending, then runs the
-conformance probe.
-
-```bash
-authflow set-origin --slug video --origin-url https://video-xyz.azurecontainerapps.io
-```
-
-Pass the base URI without `/mcp`; the gateway appends it.
-
-The probe runs automatically because this is the moment the resource starts accepting traffic, and a
-closing "remember to verify" is a step that gets skipped. It needs `AUTHFLOW_ORIGIN_API_KEY` (or
-`--origin-key`) — the admin key cannot stand in, because the probe authenticates as the origin. If
-the key is not available the command says so and completes; `--no-probe` skips it deliberately.
-
-The command also prints the client MCP config for the gateway URL. Use it verbatim: an MCP client
-pointed at the origin's own hostname gets `403 invalid_origin_identity`, which is the origin
-correctly refusing an unsigned request, not an auth bug.
-
-### `authflow set-domain`
-
-Serves a resource on your own hostname, so an MCP URL your clients already use keeps working. Run it
-**before the resource has ever gone live**. The canonical URL is stamped on entitlements and Stripe
-objects, so the rail refuses to change it afterwards (`409 resource_already_live`) and a resource
-that is already live needs a new registration instead. Subdomains only: `mcp.example.com`, not
-`example.com`.
-
-```bash
-authflow set-domain --slug video --host mcp.example.com
-authflow set-domain --slug video --host mcp.example.com --path /api/mcp --wait
-authflow set-domain --slug video --wait
-```
-
-The first two set the host. The third has no `--host`, which means **re-verify the host already set
-on this resource**. There is no separate verify command, so that is how you re-check after adding
-the DNS records. It reads the resource's receipt and stops with this error if there is no host to
-check:
-
-```
-no custom domain set on video; pass --host
-```
-
-Otherwise it asks the rail to verify the host, and with `--wait` it keeps polling exactly as
-described below. Every "run this next" line the CLI prints is this form, because it needs no host or
-path to retype.
-
-`--host` is the bare hostname, with no scheme, path or port. `--path` is the public MCP path on that
-host, and goes with `--host`; on its own it is an error. It is sent only when you pass it: the rail
-uses `/mcp` the first time a host is set and keeps the stored path afterwards, so setting the host
-again without `--path` never resets a path you chose.
-
-The rail answers with the DNS records to create at your registrar, and the command prints them:
-
-```
-TYPE   NAME                              VALUE                       PURPOSE
-TXT    _authflow-verify.mcp.example.com  authflow-verify=…           ownership
-CNAME  mcp.example.com                   customers.example-edge.net  traffic
-CNAME  _acme-challenge.mcp.example.com   mcp.example.com.….dcv.…     certificate
-```
-
-| Record | Purpose |
-| --- | --- |
-| `_authflow-verify` TXT | Proves you own the host. The rail checks it before it provisions anything. |
-| Traffic CNAME | Points the host at Authflow's edge. |
-| `_acme-challenge` CNAME | Lets the certificate be issued and renewed with no further action from you. |
-
-The certificate record is listed only once provisioning has begun, which is after ownership is
-verified, so a first run shows two records. It appears on a later check.
-
-Registrars such as GoDaddy usually want only the host part of the name, not the full name: for
-`mcp.example.com` enter `mcp`, and for `_authflow-verify.mcp.example.com` enter
-`_authflow-verify.mcp`. The command prints that hint with your own host in it.
-
-`--wait` polls the rail's verify endpoint, straight away and then every 15 seconds, until the domain
-is ready. It gives up after 1800 seconds unless `--timeout <seconds>` says otherwise. If the
-certificate record appears while it waits, it prints it as a new record to add.
+## Verified workspace onboarding
 
-| Exit | When |
-| --- | --- |
-| `0` | The state is `ready`. Without `--wait`: the host was set, or re-checked, and the state is not a failure. |
-| `1` | `--wait` timed out, or the state is `blocked`, `moved` or `removed`. The rail's `last_error` is printed. |
-
-| State | Meaning |
-| --- | --- |
-| `awaiting_ownership` | Waiting for the ownership TXT record. |
-| `provisioning` | Ownership verified. The hostname and certificate are being provisioned. |
-| `awaiting_traffic` | Waiting for the traffic and certificate CNAMEs. |
-| `ready` | Serving. |
-| `moved` | DNS no longer points at Authflow. |
-| `blocked` | The hostname is blocked. |
-| `removed` | The hostname was removed. |
-
-Once it is ready the resource's URL is `https://{host}{path}`, and the client config the command
-prints names that URL. Hand that to your users, not the slug URL. To check the result from the
-outside, run `authflow doctor --host mcp.example.com`.
-
-You can also set the host at registration with `authflow register --public-host`. Afterwards,
-`set-domain` with `--host` changes it, and `set-domain` without `--host` re-checks it.
-
-### `authflow status`
-
-Where onboarding actually got to, and the command that clears each remaining step.
-
-```bash
-authflow status --slug video
-```
-
-```
-resource: video
-status:   draft
-gateway:  https://staging.rails.authflow.ai/video/mcp
-
-  [x] resource registered
-  [ ] origin URI set
-      no origin — the gateway has nowhere to forward to
-      next: authflow set-origin --slug video --origin-url https://your-origin.example
-  [ ] Stripe connected
-      no connected account — nothing can be charged
-      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
-  [ ] Stripe onboarding complete
-      no connected account — attach one before Stripe can confirm charges
-      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
-```
-
-"Stripe onboarding complete" is ticked only when this resource has an account attached **and** Stripe
-has not listed `stripe_onboarding_complete` as pending. No account is not "charges enabled."
-
-A resource on its own hostname gets one more step, which stays unticked while the receipt lists
-`custom_domain_dns` as pending. It shows the state, the DNS records to add, and the command that
-re-checks them:
-
-```
-  [ ] custom domain DNS
-      mcp.example.com: awaiting_traffic (waiting for the traffic and certificate CNAMEs)
-
-      TYPE   NAME                              VALUE                       PURPOSE
-      TXT    _authflow-verify.mcp.example.com  authflow-verify=…           ownership
-      CNAME  mcp.example.com                   customers.example-edge.net  traffic
-      CNAME  _acme-challenge.mcp.example.com   mcp.example.com.….dcv.…     certificate
-
-      next: authflow set-domain --slug video --wait
-```
-
-Once the domain is ready the step is ticked, the records stay listed as what to leave in place, and
-the client config names your URL. `--json` adds a structured `customDomain` object with the host,
-path, state, CNAME target and records. Resources on the gateway host are unchanged.
-
-Use it to resume an onboarding whose earlier steps may or may not have finished — a deploy that got
-backgrounded, a terminal that was closed. `doctor` answers "is the rail up", which is a different
-question: the rail can be perfectly healthy while a resource sits half-configured and rejects every
-request. Exit code is non-zero until the resource can take paid traffic, so it works as a deploy
-gate. `--json` emits the report for scripting.
-
-### `authflow plan`
-
-Prints the same framework-specific origin integration plan as `authflow_integration_plan`.
-
-```bash
-authflow plan --slug video --framework dotnet
-```
-
-`--framework` is one of `dotnet`, `typescript`, `python`, or `proxy`. The generic, credential-free form of those plans is [Integration plans](../../docs/onboarding/integration-plans.md).
-
-### `authflow get` / `authflow list`
-
-```bash
-authflow get --slug video          # one receipt, plus the client MCP config
-authflow list                      # every resource this admin key owns
-```
-
-`list` is the recovery path for a forgotten slug, which `get` cannot be — it needs the slug you are
-trying to remember. If a registration reported the slug was taken and it is not in `list`, another
-tenant owns it and you need a different name; slugs are global because they are the gateway path
-segment.
-
-### `authflow rotate-origin-key`
-
-```bash
-authflow rotate-origin-key --slug video --write-secrets user-secrets
-```
-
-The recovery path for a lost origin API key, which is shown only once. The previous key stops working
-the moment the command returns, so update the origin's secret store immediately or its usage reports
-and probes will start failing.
-
-### `authflow doctor`
-
-Preflights a rail deployment before you spend time debugging your own origin.
-
-```bash
-authflow doctor --issuer https://staging.rails.authflow.ai --slug video
-```
-
-Checks that the issuer is reachable, that the Origin Protocol keys document is served and
-self-consistent (issuer byte-match, protocol version, a usable Ed25519 key, no private key
-material), and — with `--slug` — that the resource's PRM document resolves and the gateway answers
-an unauthenticated connect with a `401` carrying `resource_metadata`.
-
-Run this first when anything looks broken. It separates the two failures that are indistinguishable
-from the outside: a hostname that is not bound to the rail returns `404` on every path including
-`/healthz`, which reads exactly like a broken endpoint. Exit code is non-zero on any failure.
-
-`--client cursor|claude|chatgpt|all` additionally replays that MCP client's real OAuth registration
-against the authorization server (the failure that presents as "this server does not work in
-Cursor"). `--dry-run` is discovery only and does not POST DCR. Live DCR registrations are stamped
-`authflow-cli doctor-connect` so a cleanup sweep can reclaim them.
-
-A `400` from the rail's DCR endpoint is the interesting result: paste `error=` and
-`error_description=` verbatim into a rail bug. Do not work around it client-side.
-
-```bash
-authflow doctor --issuer https://staging.rails.authflow.ai --slug video --client cursor
-authflow doctor --client all --dry-run
-```
-
-With an admin key, `--slug` reads the resource's receipt and probes the PRM and the 401 challenge
-where the receipt says they are. For a resource on its own hostname that is the tenant's host, and a
-PRM whose `resource` is not the receipt's `resource` fails.
-
-`--host` verifies a tenant's own hostname from the outside, the way a client would see it:
-
-```bash
-authflow doctor --issuer https://staging.rails.authflow.ai --host mcp.example.com
-authflow doctor --issuer https://staging.rails.authflow.ai --host mcp.example.com --slug video
-```
-
-Like the rest of `doctor`, it needs the issuer (`--issuer` or `AUTHFLOW_ISSUER`).
-
-| Check | Passes when |
-| --- | --- |
-| `host custom domain` | The rail reports the domain `ready`. Skipped, with the reason, when doctor has no receipt to read. |
-| `host DNS: traffic CNAME` | The host is a CNAME to the receipt's `cname_target`. |
-| `host DNS: _acme-challenge CNAME` | The certificate CNAME is there and matches the receipt. Skipped while the rail has not issued one yet. |
-| `host DNS: _authflow-verify TXT` | The ownership TXT is there and matches the receipt. |
-| `host TLS certificate` | The certificate is trusted for the host and has at least 7 days left. The issuer and expiry are printed. |
-| `host http redirects to https` | Plain `http://` answers with a redirect to `https://` on the same host. |
-| `host PRM (path)` | The PRM is served at the well-known path followed by the resource's path, and names the tenant's URL as its `resource`. |
-| `host PRM (root)` | The same document is served at the bare well-known path, which Claude Code probes. |
-| `host 401 challenge` | An unauthenticated MCP request gets a 401 whose `resource_metadata` is an https URL on the host. |
-
-With an admin key the receipt is found by `--slug`, or by the host among the resources the key owns.
-Without one, the DNS checks only confirm that each record exists and report `SKIP` rather than
-claiming they were compared. A DNS lookup that fails (a resolver timeout, say) is reported as a
-lookup failure, not as a missing record. If the TLS check fails, the PRM and 401 checks are skipped
-because every https request would fail with the same misleading error. With `--host`, the PRM and
-401 checks of `--slug` are replaced by these, which probe the same URLs.
-
-### `authflow register`
+Install the pinned adapter and sign in. First-time authorization creates your personal workspace when you approve consent; no portal setup or admin key is required.
 
 ```bash
+npm install -g authflow-cli@0.6.0
 export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-export AUTHFLOW_ADMIN_API_KEY=…
-authflow register --file resource.json --out receipt.json
+authflow login
+authflow workspace list
+authflow resource create --file resource.json
+authflow plan --slug my-mcp --framework typescript
+authflow resource origin my-mcp --file origin.json
+authflow resource verify my-mcp
+authflow resource publish my-mcp
 ```
 
-`resource.json` uses the same snake_case fields as `POST /admin/resources` (see [tenant quickstart](../../docs/onboarding/tenant-quickstart.md) §3):
+`resource.json` for free authenticated access:
 
 ```json
-{
-  "slug": "video",
-  "origin_base_uri": "https://video-xyz.azurecontainerapps.io",
-  "display_name": "Snyder Video",
-  "connected_account_id": "acct_…",
-  "currency": "usd",
-  "price_amount_minor": 900,
-  "credits_per_period": 12,
-  "price_version": 1
-}
-```
-
-`origin_base_uri` may be `null` or omitted, which registers a draft — see `authflow set-origin`.
-
-To serve the resource on your own hostname from the start, add `--public-host` (and, if it is not
-`/mcp`, `--public-path`). They are shorthand for `public_host` and `public_path` in the file, and
-override it. The receipt then lists the DNS records to add; see `authflow set-domain`.
-
-```bash
-authflow register --file resource.json --public-host mcp.example.com --public-path /api/mcp
+{ "slug": "my-mcp", "display_name": "My MCP", "access_mode": "free" }
 ```
 
-Writes the registration receipt to `--out` (default `receipt.json`). The one-time `origin_api_key` is
-**not** written to that file: receipts get committed, pasted into issues, and handed to agents, and
-the key is a live bearer credential for the usage endpoint. It is printed to the terminal instead, so
-nothing is lost. `--keep-secret-in-receipt` restores the old behaviour if you really need it.
-
-Better still, have the CLI store it for you:
+`origin.json`:
 
-```bash
-authflow register --file resource.json --write-secrets user-secrets --secret-destination ./src/MyMcpServer
+```json
+{ "origin_base_uri": "https://my-origin.example.com" }
 ```
 
-`env-file` writes `.env.local` (and adds it to `.gitignore`); `keyvault` calls
-`az keyvault secret set` and needs `--secret-destination <vault>`.
-
-Lost the key? `authflow rotate-origin-key --slug <slug>`.
-
-Registration also prints the client MCP config and, for a draft, the remaining steps — a registered
-resource is not yet a reachable one, and from the outside the two are indistinguishable.
+Free and gateway-metered origins verify signed identity with public keys. They do not require an origin credential. Every resource starts as a draft and requires conformance verification and explicit publication.
 
-### `authflow mint-header`
+For paid access, include `access_mode: "paid"`, `currency: "usd"`, `price_amount_minor: 900`, and `credits_per_period: 12`. Gateway metering is the default, with `metering_default_units: 1` and `tool_units: {}`. Configure per-tool costs by supplying a replacement map such as `{ "preview": 0, "generate": 3 }`. Use `metering_mode: "origin_reported"` when your origin must determine completion or report variable costs. Never charge one call through both mechanisms.
 
-Dev/staging only (`OriginProtocol:EnableDevEndpoints`). Mints a signed `X-Authflow-Identity` without OAuth.
+Connect Stripe with `authflow stripe onboard` or `authflow stripe connect-existing`. These return authenticated Authflow links for the owner's browser. Then refresh status; returning from Stripe alone does not prove readiness. Authflow charges a 9% fee on paid sales; monthly platform plans are not implemented.
 
-```bash
-export AUTHFLOW_ORIGIN_API_KEY=afo_test_…
-authflow mint-header --tier standard --ttl 90 --grant-credits 3 --receipt receipt.json
-```
+## Creator commands
 
-Prints the header and, when a gateway URL is known, a ready-to-paste `curl` against it.
-
-### `authflow probe`
-
-Asks the rail to probe the registered origin with valid and deliberately broken identity headers.
+| Command | Purpose |
+| --- | --- |
+| `login [--workspace <id>] [--no-browser]` | Browser authorization with PKCE and workspace consent |
+| `logout` | Revoke authorization and remove the OS-stored credential |
+| `logout --local-only` | Clear this device only |
+| `workspace list`, `workspace overview` | Workspace and recent activity |
+| `resource list`, `resource get <slug>` | Receipts, status, and requirements |
+| `resource create --file <json>` | Create a draft; keys are never printed |
+| `resource update <slug> --file <json>` | Patch supplied name, offer, and metering fields |
+| `resource origin <slug> --file <json>` | Set the private origin base URL without `/mcp` |
+| `resource domain <slug> --file <json>` | Set `public_host` and `public_path` before first publication |
+| `resource domain-refresh <slug>` | Refresh DNS/certificate readiness |
+| `resource verify <slug>` | Probe the exact current configuration |
+| `resource publish <slug>`, `resource disable <slug>` | Explicitly change traffic availability |
+| `resource rotate-key <slug> --write-secrets <target> --secret-destination <value>` | Deliver an origin-reported usage credential |
+| `stripe status`, `stripe onboard`, `stripe connect-existing` | Readiness and authenticated owner actions |
+| `plan --slug <slug> --framework <framework>` | Resource-specific plan from Rail's canonical templates |
+| `mcp` | Local management MCP with the protected CLI login |
 
-```bash
-authflow probe
-authflow probe --slug video
-```
+Management commands accept `--issuer`; workspace operations also accept `--workspace`. Omitted PATCH fields preserve values. A supplied `tool_units` map replaces the old map. Actual offer/access/metering changes invalidate verification and publication; re-verify and explicitly publish. A name-only update preserves the policy.
 
-The origin API key is bound to one resource, so `--slug` is optional and ignored. It exists so a
-documented `authflow probe --slug …` does not fail. Renders a pass/fail table. Exit code is
-non-zero when any check fails or the origin is unreachable.
+## Direct secret delivery
 
-### `authflow scaffold`
+Paid origin-reported resources need a credential for the usage endpoint. Choose an explicit destination before issuance:
 
 ```bash
-authflow scaffold --receipt receipt.json --upstream http://upstream:3000
+authflow resource rotate-key my-mcp --write-secrets keyvault --secret-destination my-vault
+authflow resource rotate-key my-mcp --write-secrets user-secrets --secret-destination ./MyOrigin.csproj
+authflow resource rotate-key my-mcp --write-secrets env-file --secret-destination ./.env.local
 ```
 
-Writes:
+Use only the command for your destination. Key Vault secret names include the resource identity, avoiding collisions across workspaces/resources/environments. Destination preflight happens before rotation. Free/gateway resources return `not_required` without rotating. For origin-reported creation, the same destination flags can store the one-time key directly.
 
-- `.env` — `AUTHFLOW_ISSUER`, `AUTHFLOW_RESOURCE`, `AUTHFLOW_ORIGIN_API_KEY`, `AUTHFLOW_UPSTREAM_BASE_URI`
-- `docker-compose.authflow.yml` — `authflow-origin-proxy` in front of an upstream placeholder
+Key values stay out of normal output and errors. Secret writers avoid process arguments containing values where supported. Env files are plaintext development storage: exclude them from source control. Azure delivery uses the signed-in Azure CLI identity. A bounded metadata check confirms destination reachability and catches known authentication/network failures before rotation. It cannot prove `secrets/set` permission without writing: identities with write-only permission remain supported, and actual delivery determines write access.
 
-See [origin-proxy.md](../../docs/onboarding/origin-proxy.md) for the forwarded-header contract and the
-nonce-cache options.
+`origin_key_stored_at` confirms storage only, and `deployment_updated: false` means application bindings and deployment still need work. If delivery fails after issuance, the old key may already be revoked. Repair access, inspect state, and explicitly rotate again; the command never retries that mutation silently.
 
-### `authflow mcp`
+## Authflow MCP
 
-Runs the onboarding operations as an MCP server on stdio, so a coding agent can do the onboarding
-instead of a human running commands. The agent already has the creator's codebase; what it lacks is
-a way to talk to the rail. This supplies exactly that, and nothing more — the server never reads or
-writes source files. It hands back an integration plan and the agent applies it.
-
-Add it to Cursor or Claude Desktop:
+For a remote client, add `https://staging.rails.authflow.ai/management/mcp` and complete browser consent. For a local adapter, run `authflow login` first, then configure:
 
 ```json
 {
   "mcpServers": {
     "authflow": {
       "command": "npx",
-      "args": ["-y", "-p", "authflow-cli", "authflow", "mcp"],
-      "env": {
-        "AUTHFLOW_ISSUER": "https://staging.rails.authflow.ai",
-        "AUTHFLOW_ADMIN_API_KEY": "…"
-      }
+      "args": ["-y", "-p", "authflow-cli@0.6.0", "authflow", "mcp"],
+      "env": { "AUTHFLOW_ISSUER": "https://staging.rails.authflow.ai" }
     }
   }
 }
 ```
 
-Tools:
+Both expose workspace overview/rename, resource lifecycle, usage, earnings, Stripe actions, integration plans, and docs search/read. Tools require their authorized workspace and scope; read-only consent cannot write. Personal identity/security and consumer billing are outside this creator tool surface. Tool results never include origin keys or OAuth credentials.
 
-| Tool | Does |
-| --- | --- |
-| `authflow_signup` | Mint a per-tenant admin API key (no existing credential) |
-| `authflow_doctor` | Preflight the rail; distinguishes a bad hostname from an outage |
-| `authflow_register_resource` | Register and price a resource; optionally store the key in a secret store |
-| `authflow_get_resource` | Current receipt, `status`, and `pending_requirements` |
-| `authflow_list_resources` | Every resource this key owns — how an agent recovers an unknown slug |
-| `authflow_status` | Per-step readiness with the command that clears each one; use it to resume |
-| `authflow_integration_plan` | Config, snippets, verification steps, and invariants for `dotnet`, `typescript`, `python`, or `proxy` |
-| `authflow_start_stripe_connect` | Hosted Stripe onboarding link; resumable |
-| `authflow_set_connected_account` | Attach an existing `acct_…` |
-| `authflow_set_origin` | Supply the origin and promote to live |
-| `authflow_set_custom_domain` | Serve a resource on the tenant's own hostname, or, with no `host`, re-verify the one already set: returns the DNS records to add and the state. With `wait` it re-verifies every 15 seconds for under a minute and returns the progress |
-| `authflow_probe` | Conformance probe against the origin |
-| `authflow_mint_test_header` | Signed identity header for local verifier testing |
-| `authflow_rotate_origin_key` | Rotate the origin API key (invalidates the old one immediately) |
+Integration templates are versioned in `rail/docs/onboarding/integration-plans.json`. Rail's resource-specific endpoint, hosted/local MCP, and modern `plan` consume this source; generic documentation is generated from it.
+
+## Runtime and verification
 
-Every tool takes `issuer` and `admin_key` optionally, falling back to the environment, so credentials
-stay in the MCP client config rather than in the conversation. `write_secrets` is available on both
-tools that issue a key; prefer it, because a key returned in a tool result is a credential in a chat
-transcript.
+Credentials use Windows Credential Manager, macOS Keychain, or an available unlocked Linux secret service. There is no plaintext login fallback. Browser login uses a local callback. Refresh is serialized across processes; writes are not automatically retried. Read resource/Stripe state after interruptions.
 
-`authflow_set_custom_domain` is the twin of `authflow set-domain`, and returns the receipt plus the
-DNS records as text for the agent to hand to the user, since only they can create them at their
-registrar. `host` is optional with the same meaning as `--host`: leave it out and the tool
-re-verifies the host already set, so the second call, once the user has added the records, is just
-the slug and `wait`. `path` is sent only when given, and needs `host`. Its wait is deliberately short: a tool call that outlives the client's request timeout is
-dropped together with its result, and DNS and certificate issuance usually take longer than a
-minute. If the state is not `ready`, the agent tells the user to finish the records and calls again
-with `wait`. A domain that is `blocked`, `moved` or `removed` comes back as a tool error.
-`authflow_doctor` takes `host` for the same checks as `authflow doctor --host`, and
-`authflow_register_resource` takes `public_host` and `public_path` like `authflow register`.
+Staging issuer: `https://staging.rails.authflow.ai`. Local Compose defaults to `http://127.0.0.1:8080` (respect a configured `RAIL_PORT`). Production Rail provisioning is separate from this release.
 
-Every receipt a tool returns carries `client_mcp_config` — the config for reaching the resource
-through the gateway. Hand the user that, never the origin's hostname, which rejects unsigned requests
-by design.
+Origin diagnostics such as `doctor`, `probe`, `mint-header`, and `scaffold` remain available via command help for operators. They are not prerequisites for normal creator onboarding. Use `resource verify` with your scoped login; never ask a new creator for a tenant admin credential.
 
-Authentication is a per-tenant `afa_` admin API key from `authflow signup` (or `authflow_signup`).
-The operator bearer still works as a super-admin. Per-creator OAuth is not required for onboarding.
+Gateway metering cannot infer all failures after a streamed response begins. Use origin-reported debit/compensation when provider completion determines the charge. The [tenant quickstart](../../docs/onboarding/tenant-quickstart.md) and [Origin Protocol v1](../../docs/origin-protocol/v1.md) define the integration contract.
+
+License: Apache-2.0. See [LICENSE](LICENSE).

package/dist/commands/account.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function accountCommands(program: Command): void;