authflow-cli 0.5.0 → 0.6.0

package/dist/login.js

@@ -0,0 +1,181 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { z } from "zod";
+import { credentialStore } from "./credentials.js";
+const metadataSchema = z.object({
+    issuer: z.string(), authorization_endpoint: z.string().url(), token_endpoint: z.string().url(),
+    registration_endpoint: z.string().url(), revocation_endpoint: z.string().url().optional(),
+});
+const tokenSchema = z.object({ access_token: z.string().min(1), refresh_token: z.string().optional(), expires_in: z.number().positive(), token_type: z.string() });
+export function validatedIssuer(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))) {
+        throw new Error("The issuer must be an HTTPS URL (HTTP loopback is allowed locally).");
+    }
+    return url.href.replace(/\/+$/, "");
+}
+async function metadata(issuer) {
+    const response = await fetch(`${issuer}/.well-known/oauth-authorization-server`, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+    if (!response.ok)
+        throw new Error(`Issuer discovery failed (${response.status}).`);
+    const result = metadataSchema.parse(await response.json());
+    if (result.issuer.replace(/\/+$/, "") !== issuer)
+        throw new Error("Discovery issuer does not match the selected issuer.");
+    for (const endpoint of [result.authorization_endpoint, result.token_endpoint, result.registration_endpoint, result.revocation_endpoint].filter(Boolean)) {
+        const url = new URL(endpoint);
+        if (url.origin !== new URL(issuer).origin || url.username || url.password || url.hash)
+            throw new Error("An OAuth endpoint is not a safe URL on the selected issuer origin.");
+    }
+    return result;
+}
+export function matchesOAuthState(actual, expected) {
+    return actual !== null && Buffer.byteLength(actual) === Buffer.byteLength(expected) && timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
+}
+export async function login(issuerValue, workspaceId, open = true) {
+    const issuer = validatedIssuer(issuerValue);
+    return credentialStore.withLock(issuer, async () => {
+        const discovery = await metadata(issuer);
+        const verifier = randomBytes(48).toString("base64url");
+        const state = randomBytes(32).toString("base64url");
+        const callback = createServer();
+        callback.listen(0, "127.0.0.1");
+        await once(callback, "listening");
+        const address = callback.address();
+        if (!address || typeof address === "string")
+            throw new Error("Cannot open the loopback callback.");
+        const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+        try {
+            const registration = await fetch(discovery.registration_endpoint, {
+                method: "POST", headers: { "Content-Type": "application/json" }, redirect: "error", signal: AbortSignal.timeout(15_000),
+                body: JSON.stringify({ client_name: "Authflow CLI", application_type: "native", redirect_uris: [redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" }),
+            });
+            if (!registration.ok)
+                throw new Error(`CLI registration failed (${registration.status}).`);
+            const { client_id } = z.object({ client_id: z.string() }).parse(await registration.json());
+            const authorize = new URL(discovery.authorization_endpoint);
+            authorize.search = new URLSearchParams({ client_id, redirect_uri: redirectUri, response_type: "code", scope: "management:read management:write offline_access", resource: `${issuer}/management/mcp`, code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state, ...(workspaceId ? { workspace_id: workspaceId } : {}) }).toString();
+            const code = new Promise((resolve, reject) => {
+                const timeout = setTimeout(() => reject(new Error("Sign-in timed out. Run authflow login again.")), 300_000);
+                let completed = false;
+                callback.on("request", (request, response) => {
+                    let url;
+                    try {
+                        url = new URL(request.url ?? "/", redirectUri);
+                    }
+                    catch {
+                        response.writeHead(400).end("Invalid login callback.");
+                        return;
+                    }
+                    if (completed || request.method !== "GET" || url.origin !== new URL(redirectUri).origin || url.pathname !== "/callback"
+                        || request.headers.host !== `127.0.0.1:${address.port}` || url.searchParams.getAll("state").length !== 1
+                        || !matchesOAuthState(url.searchParams.get("state"), state)) {
+                        response.writeHead(400).end("Invalid login callback.");
+                        return;
+                    }
+                    completed = true;
+                    clearTimeout(timeout);
+                    const codeValue = url.searchParams.getAll("code").length === 1 && !url.searchParams.has("error") ? url.searchParams.get("code") : null;
+                    if (url.searchParams.getAll("iss").length > 1 || url.searchParams.get("iss") && url.searchParams.get("iss").replace(/\/+$/, "") !== issuer) {
+                        response.writeHead(400).end("Invalid issuer.");
+                        reject(new Error("Login issuer mismatch."));
+                        return;
+                    }
+                    response.writeHead(codeValue ? 200 : 400, { "Content-Type": "text/plain", "Cache-Control": "no-store" }).end(codeValue ? "Authflow sign-in finished. Return to your terminal." : "Sign-in was not completed. Return to your terminal.");
+                    if (codeValue)
+                        resolve(codeValue);
+                    else
+                        reject(new Error("Sign-in was declined or could not be completed."));
+                });
+                callback.on("close", () => clearTimeout(timeout));
+            });
+            process.stderr.write(`Complete sign-in in your browser:\n${authorize.href}\n`);
+            if (open)
+                openBrowser(authorize.href);
+            const authorizationCode = await code;
+            const tokenResponse = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "authorization_code", client_id, redirect_uri: redirectUri, code: authorizationCode, code_verifier: verifier, resource: `${issuer}/management/mcp` }) });
+            if (!tokenResponse.ok)
+                throw new Error(`Sign-in token exchange failed (${tokenResponse.status}).`);
+            const token = tokenSchema.parse(await tokenResponse.json());
+            if (token.token_type.toLowerCase() !== "bearer")
+                throw new Error("Unsupported token type.");
+            // Ask Rail which workspace this credential can access; never trust an unverified JWT decode.
+            const workspaceResponse = await fetch(`${issuer}/management/v1/workspaces`, { redirect: "error", headers: { Authorization: `Bearer ${token.access_token}` }, signal: AbortSignal.timeout(15_000) });
+            if (!workspaceResponse.ok)
+                throw new Error("The management credential has no accessible workspace.");
+            const workspaces = z.array(z.object({ id: z.string() })).parse(await workspaceResponse.json());
+            const workspace = workspaces.find(w => !workspaceId || w.id === workspaceId);
+            if (!workspace)
+                throw new Error("Create a workspace in the portal and run authflow login again.");
+            await credentialStore.save({ issuer, client_id, access_token: token.access_token, refresh_token: token.refresh_token, expires_at: Date.now() + token.expires_in * 1000, workspace_id: workspace.id });
+            return { issuer, workspace_id: workspace.id };
+        }
+        finally {
+            callback.close();
+            callback.closeAllConnections();
+        }
+    });
+}
+export async function managementCredential(issuerValue) {
+    const issuer = validatedIssuer(issuerValue);
+    return credentialStore.withLock(issuer, async () => {
+        const credential = await credentialStore.read(issuer);
+        if (!credential)
+            throw new Error("Sign in first: authflow login --issuer <issuer>.");
+        return renewCredential(issuer, credential);
+    });
+}
+async function renewCredential(issuer, credential) {
+    if (credential.expires_at > Date.now() + 60_000)
+        return credential;
+    if (!credential.refresh_token)
+        throw new Error("Your login expired. Run authflow login again.");
+    const discovery = await metadata(issuer);
+    const response = await fetch(discovery.token_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ grant_type: "refresh_token", client_id: credential.client_id, refresh_token: credential.refresh_token, resource: `${issuer}/management/mcp` }) });
+    if (!response.ok)
+        throw new Error(`Login renewal failed (${response.status}). Run authflow login again.`);
+    const token = tokenSchema.parse(await response.json());
+    if (token.token_type.toLowerCase() !== "bearer")
+        throw new Error("Unsupported token type.");
+    const next = { ...credential, access_token: token.access_token, refresh_token: token.refresh_token ?? credential.refresh_token, expires_at: Date.now() + token.expires_in * 1000 };
+    await credentialStore.save(next);
+    return next;
+}
+export async function logout(issuerValue, options = {}) {
+    const issuer = validatedIssuer(issuerValue);
+    await credentialStore.withLock(issuer, async () => {
+        if (options.localOnly) {
+            await credentialStore.delete(issuer);
+            return;
+        }
+        const stored = await credentialStore.read(issuer);
+        if (!stored)
+            return;
+        // A fresh access token is necessary to revoke the durable workspace grant,
+        // including other still-valid access tokens from this login.
+        const credential = await renewCredential(issuer, stored).catch(() => stored);
+        const discovery = await metadata(issuer);
+        if (!discovery.revocation_endpoint)
+            throw new Error("This issuer does not advertise revocation. Revoke the CLI in portal account settings before removing its login.");
+        const grantRevocation = await fetch(`${issuer}/management/v1/authorization/revoke`, {
+            method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), headers: { Authorization: `Bearer ${credential.access_token}` },
+        });
+        if (!grantRevocation.ok)
+            throw new Error("Rail could not confirm workspace authorization revocation. Retry logout, or revoke this CLI in portal account settings and then use authflow logout --local-only to clear this device.");
+        for (const token of [credential.refresh_token, credential.access_token].filter(Boolean)) {
+            const response = await fetch(discovery.revocation_endpoint, { method: "POST", redirect: "error", signal: AbortSignal.timeout(15_000), body: new URLSearchParams({ client_id: credential.client_id, token: token }) });
+            if (!response.ok)
+                throw new Error("Rail could not revoke this login. Retry logout or revoke the CLI from portal account settings.");
+        }
+        await credentialStore.delete(issuer);
+    });
+}
+function openBrowser(url) {
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    const executable = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open";
+    const child = spawn(executable, args, { stdio: "ignore", detached: true, windowsHide: true, shell: false });
+    child.on("error", () => process.stderr.write("Open the sign-in URL above in your browser.\n"));
+    child.unref();
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AAEzE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC1F,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnK,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvL,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7I,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1H,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YACnF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,QAAgB;IACvE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,WAAmB,EAAE,WAAoB,EAAE,IAAI,GAAG,IAAI;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE;gBAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBACvH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC;aACpO,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3F,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAC5D,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3X,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC7G,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;oBAC3C,IAAI,GAAQ,CAAC;oBACb,IAAI,CAAC;wBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;oBAAC,CAAC;oBACvD,MAAM,CAAC;wBAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACzE,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;2BAClH,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;2BACrG,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC9D,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;wBAAC,OAAO;oBACjE,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;oBACjB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACvI,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;wBAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;wBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACrP,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;oBACxO,IAAI,SAAS;wBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;wBAAM,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;gBAC/G,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;YAC/E,IAAI,IAAI;gBAAE,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC;YACrC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;YACvU,IAAI,CAAC,aAAa,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;YACnG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5F,6FAA6F;YAC7F,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpM,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACrG,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAClG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACtM,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC;gBAAS,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACrF,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAA2B;IACtE,IAAI,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,UAAU,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/S,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;IACnL,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,UAAmC,EAAE;IACrF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAChD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QACvK,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qCAAqC,EAAE;YAClF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE;SACxI,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;QACnO,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACvN,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACvH,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/management.d.ts

@@ -0,0 +1,17 @@
+export declare const managementResourceActions: readonly ["verify", "publish", "disable", "domain/refresh"];
+export type ManagementResourceAction = typeof managementResourceActions[number];
+/** Same owner-scoped API used by the portal and hosted MCP. Never retries a write. */
+export declare function managementRequest(issuer: string, path: string, method?: string, body?: unknown, query?: Record<string, string>): Promise<unknown>;
+/** Only machine-readable public fields may cross into an agent's error message. */
+export declare class ManagementOperationError extends Error {
+    readonly result: {
+        status: number;
+        error_code: string;
+        pending_requirements?: string[];
+        allowed_actions?: string[];
+        recovery: string;
+    };
+    constructor(status: number, body: unknown);
+}
+export declare function currentWorkspacePath(issuer: string, workspaceId?: string): Promise<string>;
+export declare function redactToolSecrets(value: unknown): unknown;

package/dist/management.js

@@ -0,0 +1,67 @@
+import { managementCredential } from "./login.js";
+export const managementResourceActions = ["verify", "publish", "disable", "domain/refresh"];
+/** Same owner-scoped API used by the portal and hosted MCP. Never retries a write. */
+export async function managementRequest(issuer, path, method = "GET", body, query) {
+    if (!path.startsWith("/") || path.includes("..") || /[?#\\]/.test(path))
+        throw new Error("Invalid management path.");
+    const credential = await managementCredential(issuer);
+    const suffix = query ? `?${new URLSearchParams(query)}` : "";
+    const response = await fetch(`${credential.issuer}/management/v1${path}${suffix}`, {
+        method, redirect: "error", signal: AbortSignal.timeout(60_000),
+        headers: { Authorization: `Bearer ${credential.access_token}`, Accept: "application/json", ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    // Handle empty authentication responses before parsing. A JSON parser can include
+    // response excerpts in its exception, which must never become a tool message.
+    if (response.status === 401)
+        throw new Error("Your Authflow login expired or was revoked. Run authflow login again.");
+    if (response.status === 403)
+        throw new Error("This login cannot perform the requested workspace operation. Reconnect with the appropriate workspace and scopes.");
+    let result = null;
+    if (response.status !== 204) {
+        try {
+            result = await response.json();
+        }
+        catch {
+            throw new Error(`Rail returned an unreadable management response (${response.status}). Read current resource status before explicitly retrying a mutation.`);
+        }
+    }
+    if (!response.ok) {
+        // Do not print arbitrary server bodies: error details may contain a sensitive return URL.
+        throw new ManagementOperationError(response.status, result);
+    }
+    return result;
+}
+/** Only machine-readable public fields may cross into an agent's error message. */
+export class ManagementOperationError extends Error {
+    result;
+    constructor(status, body) {
+        const details = body && typeof body === "object" ? body : {};
+        const identifier = (value) => typeof value === "string" && /^[a-z0-9_]{1,80}$/.test(value);
+        const code = details.error_code ?? details.error;
+        const recovery = status === 400
+            ? "Check the supplied arguments against the tool's documented constraints, correct invalid values, and explicitly retry. Writes are never automatically retried."
+            : "Read the resource's current readiness, resolve its pending requirements, and explicitly retry the intended action. Writes are never automatically retried.";
+        super(`Management operation failed (${status}${identifier(code) ? `: ${code}` : ""}). ${recovery}`);
+        this.result = { status, error_code: identifier(code) ? code : status === 400 ? "validation_failed" : "management_operation_failed", recovery };
+        for (const field of ["pending_requirements", "allowed_actions"]) {
+            if (Array.isArray(details[field]))
+                this.result[field] = details[field].filter(identifier).slice(0, 50);
+        }
+    }
+}
+export async function currentWorkspacePath(issuer, workspaceId) {
+    const credential = await managementCredential(issuer);
+    const workspace = workspaceId ?? credential.workspace_id;
+    if (workspace !== credential.workspace_id)
+        throw new Error("This login is bound to another workspace. Run authflow login --workspace <id> to select it.");
+    return `/workspaces/${encodeURIComponent(workspace)}`;
+}
+export function redactToolSecrets(value) {
+    if (Array.isArray(value))
+        return value.map(redactToolSecrets);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !/^(origin_api_key|admin_api_key|access_token|refresh_token|onboarding_url|stripe_url|client_secret)$/.test(key)).map(([key, item]) => [key, redactToolSecrets(item)]));
+}
+//# sourceMappingURL=management.js.map

package/dist/management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.js","sourceRoot":"","sources":["../src/management.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAGrG,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc,EAAE,KAA8B;IAClI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iBAAiB,IAAI,GAAG,MAAM,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;QAClK,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IAClK,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACvC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;QAAC,CAAC;IACzK,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0FAA0F;QAC1F,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAwH;IACvI,YAAY,MAAc,EAAE,IAAa;QACvC,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG;YAC7B,CAAC,CAAC,+JAA+J;YACjK,CAAC,CAAC,4JAA4J,CAAC;QACjK,KAAK,CAAC,gCAAgC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B,EAAE,QAAQ,EAAE,CAAC;QAC/I,KAAK,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAU,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAoB;IAC7E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,IAAI,UAAU,CAAC,YAAY,CAAC;IACzD,IAAI,SAAS,KAAK,UAAU,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAC1J,OAAO,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,qGAAqG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5O,CAAC"}

package/dist/mcp/management-server.d.ts

@@ -0,0 +1,4 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Local management uses the same owner/scoped HTTP operations as the hosted MCP and portal. */
+export declare function createManagementServer(): McpServer;
+export declare function runManagementStdioServer(): Promise<void>;

package/dist/mcp/management-server.js

@@ -0,0 +1,103 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { requireIssuer } from "../config.js";
+import { currentWorkspacePath, managementRequest, managementResourceActions, ManagementOperationError, redactToolSecrets } from "../management.js";
+import { integrationFrameworks } from "../integration.js";
+import { cliVersion } from "../version.js";
+const reply = (data) => ({ content: [{ type: "text", text: JSON.stringify(redactToolSecrets(data), null, 2) }] });
+async function attempt(operation) {
+    try {
+        return reply(await operation());
+    }
+    catch (error) {
+        if (error instanceof ManagementOperationError)
+            return { ...reply(error.result), structuredContent: error.result, isError: true };
+        return { content: [{ type: "text", text: error instanceof Error ? error.message : "The operation could not be completed." }], isError: true };
+    }
+}
+/** Local management uses the same owner/scoped HTTP operations as the hosted MCP and portal. */
+export function createManagementServer() {
+    const server = new McpServer({ name: "authflow-management", version: cliVersion }, {
+        instructions: "Use the workspace login stored by authflow login. Never request an admin key or OAuth token in chat. Create a draft, configure its origin and free or paid offer, retrieve its integration plan, verify, and explicitly publish. Free and gateway-metered MCPs need no origin key. Only paid origin_reported setup needs direct CLI secret-store delivery. Stripe requires the owner to complete a browser action. Use documentation search/get for details and return readiness requirements exactly as Rail reports them. Mutations are not automatically retried.",
+    });
+    const issuer = z.string().optional().describe("Authflow issuer; defaults to AUTHFLOW_ISSUER.");
+    const slug = z.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/);
+    const workspace_id = z.string().optional().describe("Workspace ID; must match the selected CLI login.");
+    const annotations = (readOnlyHint, destructiveHint = false) => ({ readOnlyHint, destructiveHint, openWorldHint: true });
+    server.registerTool("authflow_list_workspaces", { title: "List authorized workspaces", inputSchema: { issuer }, annotations: annotations(true) }, ({ issuer: value }) => attempt(() => managementRequest(requireIssuer(value), "/workspaces")));
+    for (const [name, title, path] of [
+        ["authflow_workspace_overview", "Read workspace overview and recent activity", "/overview"],
+        ["authflow_get_usage", "Read recorded credit usage and compensation", "/usage"],
+        ["authflow_get_earnings", "Read recent earnings by currency", "/earnings"],
+    ]) {
+        server.registerTool(name, { title, inputSchema: { issuer, workspace_id }, annotations: annotations(true) }, ({ issuer: value, workspace_id: workspace }) => attempt(async () => {
+            const base = requireIssuer(value);
+            return managementRequest(base, `${await currentWorkspacePath(base, workspace)}${path}`);
+        }));
+    }
+    server.registerTool("authflow_rename_workspace", { title: "Rename the authorized workspace", inputSchema: { issuer, workspace_id, name: z.string().min(1).max(100) }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, name }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, await currentWorkspacePath(base, workspace), "PATCH", { name });
+    }));
+    server.registerTool("authflow_list_resources", { title: "List workspace MCPs", inputSchema: { issuer, workspace_id }, annotations: annotations(true) }, ({ issuer: value, workspace_id: workspace }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources`);
+    }));
+    server.registerTool("authflow_get_resource", { title: "Inspect MCP readiness and setup", inputSchema: { issuer, workspace_id, slug }, annotations: annotations(true) }, ({ issuer: value, workspace_id: workspace, slug: resource }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}`);
+    }));
+    const meteringConstraints = " Metering costs must be integers from 0 through 1,000,000. tool_units accepts at most 64 nonblank tool names of 1 through 128 characters; the serialized policy must fit within 8,192 characters.";
+    const meteringUnits = z.number().int().min(0).max(1_000_000);
+    const metering = {
+        metering_mode: z.enum(["gateway_metered", "origin_reported"]).optional(),
+        metering_default_units: meteringUnits.optional(),
+        tool_units: z.record(z.string().min(1).max(128), meteringUnits)
+            .refine(value => Object.keys(value).length <= 64, "At most 64 tools may declare a cost.").optional(),
+    };
+    const draft = { slug, display_name: z.string().min(1).max(160), access_mode: z.enum(["free", "paid"]), currency: z.string().length(3).optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering };
+    server.registerTool("authflow_create_resource", { title: "Create an unpublished MCP draft", description: "Creates a free or paid draft, defaulting to gateway metering. Free and gateway-metered origins need no key. Paid origin_reported integrations require direct CLI secret-store delivery. Secrets are never returned in tool messages." + meteringConstraints, inputSchema: { issuer, workspace_id, ...draft }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, ...body }) => attempt(async () => {
+        const base = requireIssuer(value);
+        const path = await currentWorkspacePath(base, workspace);
+        const result = await managementRequest(base, `${path}/resources`, "POST", body);
+        return { ...result, integration_plan: { tool: "authflow_integration_plan", arguments: { workspace_id: decodeURIComponent(path.split("/")[2]), slug: body.slug }, frameworks: [...integrationFrameworks] } };
+    }));
+    server.registerTool("authflow_update_resource", { title: "Update MCP name, offer, or metering", description: "Omitted fields are preserved. A supplied tool_units map replaces all tool overrides. Policy changes invalidate verification and publication; verify and explicitly republish." + meteringConstraints, inputSchema: { issuer, workspace_id, slug, display_name: z.string().optional(), access_mode: z.enum(["free", "paid"]).optional(), currency: z.string().optional(), price_amount_minor: z.number().int().nonnegative().optional(), credits_per_period: z.number().int().positive().optional(), ...metering }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, ...body }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}`, "PATCH", body);
+    }));
+    server.registerTool("authflow_set_origin", { title: "Set the MCP origin", inputSchema: { issuer, workspace_id, slug, origin_base_uri: z.string().url() }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, origin_base_uri }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/origin`, "POST", { origin_base_uri });
+    }));
+    server.registerTool("authflow_set_custom_domain", { title: "Set the MCP custom hostname", inputSchema: { issuer, workspace_id, slug, public_host: z.string(), public_path: z.string().default("/mcp") }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, slug: resource, public_host, public_path }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/domain`, "POST", { public_host, public_path });
+    }));
+    for (const action of managementResourceActions) {
+        server.registerTool(action === "domain/refresh" ? "authflow_refresh_domain" : `authflow_${action}_resource`, { title: `${action === "publish" ? "Publish" : action === "disable" ? "Disable" : action === "verify" ? "Verify" : "Refresh domain for"} an MCP`, inputSchema: { issuer, workspace_id, slug }, annotations: annotations(false, action === "disable") }, ({ issuer: value, workspace_id: workspace, slug: resource }) => attempt(async () => {
+            const base = requireIssuer(value);
+            return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/${action}`, "POST");
+        }));
+    }
+    server.registerTool("authflow_stripe_status", { title: "Read Stripe connection readiness", inputSchema: { issuer, workspace_id }, annotations: annotations(true) }, ({ issuer: value, workspace_id: workspace }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/stripe`);
+    }));
+    server.registerTool("authflow_stripe_action", { title: "Prepare a signed-in Stripe connection step", description: "Returns a first-party browser link. The user must sign in and confirm before Stripe is opened.", inputSchema: { issuer, workspace_id, kind: z.enum(["onboard", "connect_existing"]) }, annotations: annotations(false) }, ({ issuer: value, workspace_id: workspace, kind }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/stripe/actions`, "POST", { kind });
+    }));
+    server.registerTool("authflow_integration_plan", { title: "Read resource-specific origin integration guidance", inputSchema: { issuer, workspace_id, framework: z.enum(integrationFrameworks), slug }, annotations: annotations(true) }, ({ issuer: value, workspace_id: workspace, framework, slug: resource }) => attempt(async () => {
+        const base = requireIssuer(value);
+        return managementRequest(base, `${await currentWorkspacePath(base, workspace)}/resources/${encodeURIComponent(resource)}/integration-plan`, "GET", undefined, { framework });
+    }));
+    server.registerTool("authflow_search_docs", { title: "Search Authflow documentation", inputSchema: { issuer, query: z.string().min(1).max(300), limit: z.number().int().min(1).max(25).default(8) }, annotations: annotations(true) }, ({ issuer: value, query, limit }) => attempt(() => managementRequest(requireIssuer(value), "/docs/search", "GET", undefined, { q: query, limit: String(limit) })));
+    server.registerTool("authflow_get_doc", { title: "Read an Authflow documentation page or section", description: "Use a path or documentation URL returned by search. Retrieval is limited to Authflow's indexed public documentation.", inputSchema: { issuer, path: z.string().min(1).max(2048), section: z.string().max(256).optional() }, annotations: annotations(true) }, ({ issuer: value, path, section }) => attempt(() => managementRequest(requireIssuer(value), "/docs/page", "GET", undefined, { path, ...(section ? { section } : {}) })));
+    return server;
+}
+export async function runManagementStdioServer() {
+    await createManagementServer().connect(new StdioServerTransport());
+}
+//# sourceMappingURL=management-server.js.map

package/dist/mcp/management-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-server.js","sourceRoot":"","sources":["../../src/mcp/management-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,MAAM,KAAK,GAAG,CAAC,IAAa,EAAa,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACtI,KAAK,UAAU,OAAO,CAAC,SAAiC;IACtD,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IACxC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,wBAAwB;YAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjI,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChJ,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;QACjF,YAAY,EAAE,siBAAsiB;KACrjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,CAAC,YAAqB,EAAE,eAAe,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjI,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAChP,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI;QAChC,CAAC,6BAA6B,EAAE,6CAA6C,EAAE,WAAW,CAAC;QAC3F,CAAC,oBAAoB,EAAE,6CAA6C,EAAE,QAAQ,CAAC;QAC/E,CAAC,uBAAuB,EAAE,kCAAkC,EAAE,WAAW,CAAC;KAClE,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7K,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,CAAC,YAAY,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QAChR,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzN,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzP,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,mBAAmB,GAAG,mMAAmM,CAAC;IAChO,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxE,sBAAsB,EAAE,aAAa,CAAC,QAAQ,EAAE;QAChD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;aAC5D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;KACvG,CAAC;IACF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3R,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,WAAW,EAAE,sOAAsO,GAAG,mBAAmB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACrgB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAChF,OAAO,EAAE,GAAI,MAAkC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,EAAE,CAAC;IAC3O,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,WAAW,EAAE,+KAA+K,GAAG,mBAAmB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QAC9tB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/K,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QAC/R,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IACpM,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACvV,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7M,CAAC,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC/C,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,MAAM,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACtb,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAClL,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACrO,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE,WAAW,EAAE,gGAAgG,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACpZ,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvJ,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACrU,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAClN,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,YAAY,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1Y,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,gDAAgD,EAAE,WAAW,EAAE,sHAAsH,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxhB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,sBAAsB,EAAE,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/program.js

@@ -17,6 +17,7 @@ import { probeCommand } from "./commands/probe.js";
 import { scaffoldCommand } from "./commands/scaffold.js";
 import { statusCommand } from "./commands/status.js";
 import { cliVersion } from "./version.js";
+import { accountCommands } from "./commands/account.js";
 /**
  * Commander program with every command registered. Split from the argv entrypoint so tests can
  * inspect the surface without parsing process.argv.
@@ -28,6 +29,7 @@ export function createProgram() {
         .description("Authflow Rail onboarding CLI")
         .version(cliVersion);
     signupCommand(program);
+    accountCommands(program);
     initCommand(program);
     registerCommand(program);
     connectCommand(program);

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,CAAC,OAAO,CAAC,CAAC;IACpB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,CAAC,OAAO,CAAC,CAAC;IACpB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rail.js

@@ -157,6 +157,10 @@ export function describePending(requirement, slug) {
                 `  (or, if you already have acct_…: authflow set-connected-account --slug ${slug} --account acct_…)`);
         case "stripe_onboarding_complete":
             return `Finish Stripe KYC in the browser, then re-run: authflow connect --slug ${slug}`;
+        case "origin_verification":
+            return `Verify the current origin configuration: authflow resource verify ${slug}`;
+        case "paid_offer":
+            return `Set a positive price and credit allowance: authflow resource update ${slug} --file offer.json`;
         case "custom_domain_dns":
             return (`Add the custom-domain DNS records (authflow status --slug ${slug} lists them), then verify: ` +
                 setDomainCommandLine(slug));

package/dist/rail.js.map

@@ -1 +1 @@
-{"version":3,"file":"rail.js","sourceRoot":"","sources":["../src/rail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmE1D,MAAM,WAAW,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE;QAC1F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,KAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,kBAAkB,EAChC;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAe,EAAE,IAAY;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC5D;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe;IACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,kBAAkB,EAChC;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,IAAY,EACZ,aAAqB;IAErB,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,SAAS,EACnE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;QACxD,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAY,EACZ,IAAY,EACZ,IAAa;IAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,EAC1E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC3G,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,uBAAuB,EACjF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,EAC1E;QACE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAe,EACf,IAAY,EACZ,kBAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;QAClE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAe,EACf,IAAY,EACZ,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACpE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,YAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,MAAM,wBAAwB,EAAE;QACnF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAChE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,YAAoB,EACpB,UAA2F,EAAE;IAE7F,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/E,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAErF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,4BAA4B,EAAE;QAClF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,uBAAuB,OAAO,OAAO,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,IAAY;IAC/D,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,iBAAiB;YACpB,OAAO,uDAAuD,IAAI,2CAA2C,CAAC;QAChH,KAAK,sBAAsB;YACzB,OAAO,CACL,2CAA2C,IAAI,EAAE;gBACjD,4EAA4E,IAAI,oBAAoB,CACrG,CAAC;QACJ,KAAK,4BAA4B;YAC/B,OAAO,0EAA0E,IAAI,EAAE,CAAC;QAC1F,KAAK,mBAAmB;YACtB,OAAO,CACL,6DAA6D,IAAI,6BAA6B;gBAC9F,oBAAoB,CAAC,IAAI,CAAC,CAC3B,CAAC;QACJ;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"rail.js","sourceRoot":"","sources":["../src/rail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmE1D,MAAM,WAAW,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE;QAC1F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,KAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,kBAAkB,EAChC;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAe,EAAE,IAAY;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC5D;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe;IACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,kBAAkB,EAChC;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,IAAY,EACZ,aAAqB;IAErB,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,SAAS,EACnE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;QACxD,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAY,EACZ,IAAY,EACZ,IAAa;IAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,EAC1E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC3G,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,uBAAuB,EACjF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,EAC1E;QACE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAe,EACf,IAAY,EACZ,kBAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;QAClE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAe,EACf,IAAY,EACZ,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACpE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,CAAC,MAAM,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAC9E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACjE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,YAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,MAAM,wBAAwB,EAAE;QACnF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAChE,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,YAAoB,EACpB,UAA2F,EAAE;IAE7F,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/E,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAErF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAe,GAAG,MAAM,4BAA4B,EAAE;QAClF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,uBAAuB,OAAO,OAAO,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,IAAY;IAC/D,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,iBAAiB;YACpB,OAAO,uDAAuD,IAAI,2CAA2C,CAAC;QAChH,KAAK,sBAAsB;YACzB,OAAO,CACL,2CAA2C,IAAI,EAAE;gBACjD,4EAA4E,IAAI,oBAAoB,CACrG,CAAC;QACJ,KAAK,4BAA4B;YAC/B,OAAO,0EAA0E,IAAI,EAAE,CAAC;QAC1F,KAAK,qBAAqB;YACxB,OAAO,qEAAqE,IAAI,EAAE,CAAC;QACrF,KAAK,YAAY;YACf,OAAO,uEAAuE,IAAI,oBAAoB,CAAC;QACzG,KAAK,mBAAmB;YACtB,OAAO,CACL,6DAA6D,IAAI,6BAA6B;gBAC9F,oBAAoB,CAAC,IAAI,CAAC,CAC3B,CAAC;QACJ;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/secrets.d.ts

@@ -1,28 +1,43 @@
-/**
- * Where `register --write-secrets` puts the origin API key.
- *
- * The key is shown exactly once, so the default path of "write the receipt to disk and sort the
- * secret out later" reliably ends with a plaintext credential in a JSON file next to the source —
- * and often in git. Each target below hands it to something built to hold it.
- */
 export type SecretTarget = "user-secrets" | "env-file" | "keyvault";
 export declare const secretTargets: readonly SecretTarget[];
-/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
 export declare const originApiKeyConfigKey = "Authflow:OriginApiKey";
-/** Environment variable form of the same setting, for non-.NET origins. */
 export declare const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
-/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
 export declare const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
+export type SecretResource = {
+    issuer: string;
+    workspaceId: string;
+    slug: string;
+};
 export type WriteSecretRequest = {
     target: SecretTarget;
     value: string;
-    /** Project directory for `user-secrets`, file path for `env-file`, vault name for `keyvault`. */
+    /** Project directory/file, env-file path, or Azure Key Vault name. */
     destination?: string;
+    resource?: SecretResource;
+};
+export type PreparedSecretDestination = {
+    description: string;
+    write: (value: string) => Promise<void>;
 };
-/** Human-readable description of where the secret landed, for the receipt and console. */
-/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
+/** Resolve the destination before a one-time key is issued. Never prints child output or secrets. */
+export declare function prepareOriginApiKey(request: Omit<WriteSecretRequest, "value">): Promise<PreparedSecretDestination>;
+/** Stable across retries; separates resources, workspaces and staging/production issuers. */
+export declare function originSecretName(resource: SecretResource): string;
+export declare function writeOriginApiKey(request: WriteSecretRequest): Promise<string>;
 export declare function writeAdminApiKey(request: {
     value: string;
     destination?: string;
 }): Promise<string>;
-export declare function writeOriginApiKey(request: WriteSecretRequest): Promise<string>;
+type ProcessResult = {
+    code: number | null;
+    stdout: string;
+};
+/** One subprocess boundary for destination preflight and stdin delivery; all diagnostics are sanitized. */
+declare function run(command: string, args: readonly string[], stdin?: string): Promise<ProcessResult>;
+export declare const secretProcess: {
+    run: typeof run;
+};
+export declare const secretDelivery: {
+    prepare: typeof prepareOriginApiKey;
+};
+export {};