authflow-cli 0.5.0 → 0.7.0

package/dist/commands/register.js

@@ -1,7 +1,7 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { apiJson, bearer, requireAdminKey, requireIssuer } from "../config.js";
 import { parsePublicHost, parsePublicPath } from "../custom-domain.js";
-import { secretTargets, writeOriginApiKey } from "../secrets.js";
+import { deliverIssuedKey, prepareLegacyOriginApiKey, secretTargets } from "../secrets.js";
 import { formatCursorMcpConfig, formatReadiness, resourceReadiness } from "../status.js";
 export function registerCommand(program) {
     program
@@ -11,8 +11,8 @@ export function registerCommand(program) {
         .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
         .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
         .option("-o, --out <path>", "Receipt output path", "receipt.json")
-        .option("--write-secrets <target>", `Store the origin API key and redact it from the receipt (${secretTargets.join(" | ")})`)
-        .option("--secret-destination <value>", "user-secrets: project dir (default .) · env-file: path (default .env.local) · keyvault: vault name")
+        .option("--write-secrets <target>", "Store the origin API key and redact it from the receipt (user-secrets | env-file); checked before registering")
+        .option("--secret-destination <value>", "user-secrets: project dir (default .) · env-file: path (default .env.local)")
         .option("--keep-secret-in-receipt", "Leave the origin API key in the receipt file as plaintext (not recommended)")
         .option("--public-host <host>", "Serve the resource on your own hostname (a subdomain) instead of the gateway's slug URL. Sent as public_host; the receipt then lists the DNS records to add")
         .option("--public-path <path>", "Public MCP path on that host (default /mcp). Sent as public_path")
@@ -29,6 +29,9 @@ export function registerCommand(program) {
             throw new Error(`--file ${opts.file} is not valid JSON.`);
         }
         const draft = withPublicHost(parsed, opts);
+        // The key is issued once by the POST below. Check the destination first, so an unusable one
+        // stops the command before anything exists that could be lost.
+        const prepared = target ? await prepareLegacyOriginApiKey(target, opts.secretDestination) : undefined;
         const { body, status } = await apiJson(`${issuer}/admin/resources`, {
             method: "POST",
             headers: {
@@ -40,18 +43,21 @@ export function registerCommand(program) {
             expectedStatuses: [201],
         });
         const originApiKey = typeof body.origin_api_key === "string" ? body.origin_api_key : undefined;
-        // Store the secret before the receipt is written: if this fails, the run stops with the key
-        // still only in memory rather than leaving a plaintext credential on disk.
+        // Store the secret before the receipt is written. If that fails, the key is shown once in the
+        // terminal below: the resource exists now, and a key that is neither stored nor shown is lost.
         let storedAt;
-        if (target && originApiKey) {
-            storedAt = await writeOriginApiKey({
-                target,
-                value: originApiKey,
-                destination: opts.secretDestination,
-            });
-            body.origin_api_key = `<stored in ${storedAt}>`;
+        let deliveryFailure;
+        if (prepared && originApiKey) {
+            const delivery = await deliverIssuedKey(prepared, originApiKey);
+            if (delivery.stored) {
+                storedAt = delivery.description;
+                body.origin_api_key = `<stored in ${storedAt}>`;
+            }
+            else {
+                deliveryFailure = delivery.reason;
+            }
         }
-        else if (originApiKey && !opts.keepSecretInReceipt) {
+        if (!storedAt && originApiKey && (deliveryFailure !== undefined || !opts.keepSecretInReceipt)) {
             // Redacted by default. The receipt is a file people commit, paste into issues, and hand to
             // an agent, and the key it carried was a live bearer credential for the usage endpoint. It
             // is printed below instead, so nothing is lost by keeping it out of the file.
@@ -71,6 +77,12 @@ export function registerCommand(program) {
         if (storedAt) {
             console.log(`  origin_api_key: stored in ${storedAt} (redacted from the receipt)`);
         }
+        else if (originApiKey && deliveryFailure !== undefined) {
+            console.error(`Registered, but storing the origin API key failed: ${deliveryFailure}`);
+            console.error("It is shown once below instead. It is not in the receipt file.");
+            process.exitCode = 1;
+            console.log(`  origin_api_key: ${originApiKey}  (shown once — store it now)`);
+        }
         else if (originApiKey && !opts.keepSecretInReceipt) {
             console.log(`  origin_api_key: ${originApiKey}  (shown once — store it now)`);
             console.log("  Kept out of the receipt file. Use --write-secrets to store it automatically.");

package/dist/commands/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAczF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SAC9E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CACL,0BAA0B,EAC1B,4DAA4D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACzF;SACA,MAAM,CACL,8BAA8B,EAC9B,oGAAoG,CACrG;SACA,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E;SACA,MAAM,CACL,sBAAsB,EACtB,6JAA6J,CAC9J;SACA,MAAM,CAAC,sBAAsB,EAAE,kEAAkE,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAA0B,GAAG,MAAM,kBAAkB,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,4FAA4F;QAC5F,2EAA2E;QAC3E,IAAI,QAA4B,CAAC;QACjC,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QAClD,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,2FAA2F;YAC3F,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,cAAc,GAAG,oDAAoD,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,8BAA8B,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,+BAA+B,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,4BAA4B,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,WAAW,IAAI,CAAC,GAAG,+EAA+E,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAA2B,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAqB;IAC3D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,IAAI,4EAA4E,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,GAAI,KAAiC,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAA4B,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAqB,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAczF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SAC9E,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC;SACjE,MAAM,CACL,0BAA0B,EAC1B,+GAA+G,CAChH;SACA,MAAM,CACL,8BAA8B,EAC9B,6EAA6E,CAC9E;SACA,MAAM,CACL,0BAA0B,EAC1B,6EAA6E,CAC9E;SACA,MAAM,CACL,sBAAsB,EACtB,6JAA6J,CAC9J;SACA,MAAM,CAAC,sBAAsB,EAAE,kEAAkE,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE3C,4FAA4F;QAC5F,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAA0B,GAAG,MAAM,kBAAkB,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,gBAAgB,EAAE,CAAC,GAAG,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,8FAA8F;QAC9F,+FAA+F;QAC/F,IAAI,QAA4B,CAAC;QACjC,IAAI,eAAmC,CAAC;QACxC,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAChC,IAAI,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,YAAY,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9F,2FAA2F;YAC3F,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,cAAc,GAAG,oDAAoD,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,8BAA8B,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,sDAAsD,eAAe,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,+BAA+B,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,+BAA+B,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,4BAA4B,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,WAAW,IAAI,CAAC,GAAG,+EAA+E,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAA2B,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAqB;IAC3D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,IAAI,4EAA4E,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,GAAI,KAAiC,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/rotate-origin-key.js

@@ -1,6 +1,6 @@
 import { requireAdminKey, requireIssuer } from "../config.js";
 import { rotateOriginKey } from "../rail.js";
-import { secretTargets, writeOriginApiKey } from "../secrets.js";
+import { deliverIssuedKey, prepareLegacyOriginApiKey, secretTargets } from "../secrets.js";
 /**
  * The recovery path for a lost origin API key. It existed as an MCP tool but not as a command, so a
  * creator who lost the key — it is shown once — had no way back without an agent in the loop.
@@ -12,28 +12,33 @@ export function rotateOriginKeyCommand(program) {
         .requiredOption("--slug <slug>", "Resource slug")
         .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
         .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
-        .option("--write-secrets <target>", `Store the new key (${secretTargets.join(" | ")})`)
-        .option("--secret-destination <value>", "Project dir, env-file path, or Key Vault name")
+        .option("--write-secrets <target>", "Store the new key (user-secrets | env-file); checked before rotating")
+        .option("--secret-destination <value>", "user-secrets: project dir (default .) · env-file: path (default .env.local)")
         .action(async (opts) => {
         const auth = {
             issuer: requireIssuer(opts.issuer),
             adminKey: requireAdminKey(opts.adminKey),
         };
+        // Rotation revokes the previous key the moment it returns. Check the destination first, so
+        // an unusable one stops the command while the old key still works.
         const target = parseTarget(opts.writeSecrets);
+        const prepared = target ? await prepareLegacyOriginApiKey(target, opts.secretDestination) : undefined;
         const receipt = await rotateOriginKey(auth, opts.slug);
         const key = receipt.origin_api_key;
         if (!key) {
             throw new Error("The rail did not return a new origin API key.");
         }
-        if (target) {
-            const storedAt = await writeOriginApiKey({
-                target,
-                value: key,
-                destination: opts.secretDestination,
-            });
-            console.log(`Rotated ${opts.slug}. New key stored in ${storedAt}.`);
+        const delivery = prepared ? await deliverIssuedKey(prepared, key) : undefined;
+        if (delivery?.stored) {
+            console.log(`Rotated ${opts.slug}. New key stored in ${delivery.description}.`);
         }
         else {
+            if (delivery) {
+                // The old key is already revoked: losing this one would leave the origin with none.
+                console.error(`Rotated ${opts.slug}, but storing the new key failed: ${delivery.reason}`);
+                console.error("It is shown below instead. Running rotate-origin-key again would revoke it too.");
+                process.exitCode = 1;
+            }
             console.log(`Rotated ${opts.slug}. New origin API key (shown once):`);
             console.log("");
             console.log(`  ${key}`);

package/dist/commands/rotate-origin-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"rotate-origin-key.js","sourceRoot":"","sources":["../../src/commands/rotate-origin-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAqB,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEpF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,0BAA0B,EAAE,sBAAsB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;SACtF,MAAM,CAAC,8BAA8B,EAAE,+CAA+C,CAAC;SACvF,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzC,CAAC;QAEF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACvC,MAAM;gBACN,KAAK,EAAE,GAAG;gBACV,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,uBAAuB,QAAQ,GAAG,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"rotate-origin-key.js","sourceRoot":"","sources":["../../src/commands/rotate-origin-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAqB,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9G;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,0BAA0B,EAAE,sEAAsE,CAAC;SAC1G,MAAM,CAAC,8BAA8B,EAAE,6EAA6E,CAAC;SACrH,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzC,CAAC;QAEF,2FAA2F;QAC3F,mEAAmE;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,uBAAuB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,EAAE,CAAC;gBACb,oFAAoF;gBACpF,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1F,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBACjG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/scaffold.js

@@ -1,10 +1,10 @@
 import { writeFile } from "node:fs/promises";
-import { readReceipt } from "../config.js";
+import { readReceipt, saveReceiptHint } from "../config.js";
 export function scaffoldCommand(program) {
     program
         .command("scaffold")
         .description("Write .env + docker-compose snippet for authflow-origin-proxy in front of upstream")
-        .requiredOption("--receipt <path>", "Registration receipt JSON")
+        .requiredOption("--receipt <path>", "Receipt JSON, e.g. from authflow resource get <slug> > receipt.json")
         .option("--upstream <url>", "Upstream MCP base URI", "http://upstream:3000")
         .option("--env-out <path>", "Env file path", ".env")
         .option("--compose-out <path>", "Compose file path", "docker-compose.authflow.yml")
@@ -13,9 +13,12 @@ export function scaffoldCommand(program) {
         const receipt = await readReceipt(opts.receipt);
         const issuer = receipt.issuer?.trim();
         const resource = (receipt.resource ?? receipt.gateway_url)?.trim();
-        const originKey = receipt.origin_api_key?.trim();
+        // Receipts carry "<stored in …>" or "<not written to the receipt …>" in place of a key that
+        // was kept out of the file. That marker is not a credential and must not become one in .env.
+        const recordedKey = receipt.origin_api_key?.trim();
+        const originKey = recordedKey && !recordedKey.startsWith("<") ? recordedKey : undefined;
         if (!issuer || !resource) {
-            throw new Error("Receipt must include issuer and resource (or gateway_url). Re-run authflow register.");
+            throw new Error(`Receipt must include issuer and resource (or gateway_url). ${saveReceiptHint}`);
         }
         const envLines = [
             `# Generated by authflow scaffold from ${opts.receipt}`,

package/dist/commands/scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;SAC/D,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;SAC3E,MAAM,CAAC,kBAAkB,EAAE,eAAe,EAAE,MAAM,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,6BAA6B,CAAC;SAClF,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QAEjD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,yCAAyC,IAAI,CAAC,OAAO,EAAE;YACvD,mBAAmB,MAAM,EAAE;YAC3B,qBAAqB,QAAQ,EAAE;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,8BAA8B,IAAI,CAAC,QAAQ,EAAE;YAC7C,EAAE;SACH,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,yCAAyC,IAAI,CAAC,OAAO;;;;;;;;;;;;;WAalE,IAAI,CAAC,SAAS;;;;;;;UAOf,IAAI,CAAC,MAAM;;;;;;;;;;;CAWpB,CAAC;QAEM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,UAAU,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,kBAAkB,EAAE,qEAAqE,CAAC;SACzG,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;SAC3E,MAAM,CAAC,kBAAkB,EAAE,eAAe,EAAE,MAAM,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,6BAA6B,CAAC;SAClF,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QACnE,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,eAAe,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,yCAAyC,IAAI,CAAC,OAAO,EAAE;YACvD,mBAAmB,MAAM,EAAE;YAC3B,qBAAqB,QAAQ,EAAE;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,8BAA8B,IAAI,CAAC,QAAQ,EAAE;YAC7C,EAAE;SACH,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,yCAAyC,IAAI,CAAC,OAAO;;;;;;;;;;;;;WAalE,IAAI,CAAC,SAAS;;;;;;;UAOf,IAAI,CAAC,MAAM;;;;;;;;;;;CAWpB,CAAC;QAEM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,UAAU,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/set-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"set-domain.js","sourceRoot":"","sources":["../../src/commands/set-domain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoBrD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAA4B,EAAE;IAC/E,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,wJAAwJ,CACzJ;SACA,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CACL,eAAe,EACf,uIAAuI,CACxI;SACA,MAAM,CACL,eAAe,EACf,0IAA0I,CAC3I;SACA,MAAM,CAAC,QAAQ,EAAE,yEAAyE,CAAC;SAC3F,MAAM,CACL,qBAAqB,EACrB,mEAAmE,yBAAyB,GAAG,CAChG;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,MAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,6FAA6F;IAC7F,6EAA6E;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE9F,yEAAyE;IACzE,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,8FAA8F;QAC9F,mDAAmD;QACnD,QAAQ,GAAG,qBAAqB,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzD,MAAM,GAAG,GACP,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,QAAQ;QAChB,WAAW,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC3E,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,WAAW,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CACD,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,sDAAsD,cAAc,CAAC,cAAc,CAAC,gBAAgB;YACtG,CAAC,CAAC,oEAAoE,cAAc,CAAC,cAAc,CAAC,gBAAgB,CACvH,CAAC;QACF,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QACjD,SAAS;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,yBAAyB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC1F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,cAAc,4BAA4B,CAAC,CAAC;IAErG,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC5F,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,wBAAwB,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,GAAG,CAAC,eAAe,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,2BAA2B,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+BAA+B,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CACpB,OAA4B,EAC5B,IAAY,EACZ,SAAiB,EACjB,GAA2B;IAE3B,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACnE,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"set-domain.js","sourceRoot":"","sources":["../../src/commands/set-domain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoBrD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,GAAG,GAAyB,EAAE;IAC/E,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,wJAAwJ,CACzJ;SACA,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CACL,eAAe,EACf,uIAAuI,CACxI;SACA,MAAM,CACL,eAAe,EACf,0IAA0I,CAC3I;SACA,MAAM,CAAC,QAAQ,EAAE,yEAAyE,CAAC;SAC3F,MAAM,CACL,qBAAqB,EACrB,mEAAmE,yBAAyB,GAAG,CAChG;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAG,GAAyB,EAAE;IAE9B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,6FAA6F;IAC7F,6EAA6E;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE9F,yEAAyE;IACzE,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,8FAA8F;QAC9F,mDAAmD;QACnD,QAAQ,GAAG,qBAAqB,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzD,MAAM,GAAG,GACP,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,QAAQ;QAChB,WAAW,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC3E,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,WAAW,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CACD,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,sDAAsD,cAAc,CAAC,cAAc,CAAC,gBAAgB;YACtG,CAAC,CAAC,oEAAoE,cAAc,CAAC,cAAc,CAAC,gBAAgB,CACvH,CAAC;QACF,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QACjD,SAAS;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,yBAAyB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC1F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,cAAc,4BAA4B,CAAC,CAAC;IAErG,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC5F,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,wBAAwB,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,GAAG,CAAC,eAAe,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,2BAA2B,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+BAA+B,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CACpB,OAA4B,EAC5B,IAAY,EACZ,SAAiB,EACjB,GAA2B;IAE3B,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACnE,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/signup.d.ts

@@ -1,2 +1,3 @@
 import type { Command } from "commander";
+/** Compatibility command: an email address is not proof of account ownership. */
 export declare function signupCommand(program: Command): void;

package/dist/commands/signup.js

@@ -1,53 +1,7 @@
-import { requireIssuer } from "../config.js";
-import { signupTenant } from "../rail.js";
-import { writeAdminApiKey } from "../secrets.js";
+/** Compatibility command: an email address is not proof of account ownership. */
 export function signupCommand(program) {
-    program
-        .command("signup")
-        .description("Mint a per-tenant admin API key (shown once)")
-        .requiredOption("--email <address>", "Email that owns the tenant")
-        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
-        .option("--write-secrets", "Write the key to an env file (default: .env.local)", true)
-        .option("--no-write-secrets", "Print the key only; do not write it to disk")
-        .option("--secret-destination <path>", "Env-file path for --write-secrets")
-        .addHelpText("after", [
-        "",
-        "The key is scoped to slugs you register with it. Paste it into Cursor as",
-        "AUTHFLOW_ADMIN_API_KEY, then run `authflow mcp` or `authflow init`.",
-    ].join("\n"))
-        .action(async (opts) => {
-        const issuer = requireIssuer(opts.issuer);
-        const receipt = await signupTenant(issuer, opts.email);
-        let storedAt;
-        if (opts.writeSecrets !== false) {
-            storedAt = await writeAdminApiKey({
-                value: receipt.admin_api_key,
-                destination: opts.secretDestination,
-            });
-        }
-        const mcpConfig = {
-            mcpServers: {
-                authflow: {
-                    command: "npx",
-                    args: ["-y", "-p", "authflow-cli", "authflow", "mcp"],
-                    env: {
-                        AUTHFLOW_ISSUER: receipt.issuer,
-                        AUTHFLOW_ADMIN_API_KEY: storedAt ? `<from ${storedAt}>` : receipt.admin_api_key,
-                    },
-                },
-            },
-        };
-        process.stdout.write(JSON.stringify({
-            ...receipt,
-            admin_api_key: storedAt ? `<stored in ${storedAt}>` : receipt.admin_api_key,
-            mcp_config: mcpConfig,
-            next_steps: [
-                storedAt
-                    ? `Load ${storedAt} (or copy the key into Cursor's MCP env) and run: npx -y -p authflow-cli authflow init --slug <your-slug>`
-                    : "Store the admin_api_key, then: npx -y -p authflow-cli authflow init --slug <your-slug>",
-                "Or paste mcp_config into Cursor and let the agent finish onboarding.",
-            ],
-        }, null, 2) + "\n");
-    });
+    program.command("signup").description("Moved: use verified browser sign-in with authflow login")
+        .option("--email <address>").option("--issuer <url>").option("--write-secrets").option("--no-write-secrets").option("--secret-destination <path>")
+        .action(() => { throw new Error("Email-only signup has been retired. Run authflow login --issuer <issuer>: its first browser authorization creates your workspace. Existing tenant owners can claim their workspace in the portal with their current admin credential."); });
 }
 //# sourceMappingURL=signup.js.map

package/dist/commands/signup.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/commands/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AASjD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,cAAc,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;SACjE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,EAAE,IAAI,CAAC;SACrF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,6BAA6B,EAAE,mCAAmC,CAAC;SAC1E,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,EAAE,IAAmB,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,QAA4B,CAAC;QACjC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAChC,QAAQ,GAAG,MAAM,gBAAgB,CAAC;gBAChC,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,WAAW,EAAE,IAAI,CAAC,iBAAiB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC;oBACrD,GAAG,EAAE;wBACH,eAAe,EAAE,OAAO,CAAC,MAAM;wBAC/B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;qBAChF;iBACF;aACF;SACF,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CACZ;YACE,GAAG,OAAO;YACV,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;YAC3E,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE;gBACV,QAAQ;oBACN,CAAC,CAAC,QAAQ,QAAQ,2GAA2G;oBAC7H,CAAC,CAAC,wFAAwF;gBAC5F,sEAAsE;aACvE;SACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/commands/signup.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,yDAAyD,CAAC;SAC7F,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC;SACjJ,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,uOAAuO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjR,CAAC"}

package/dist/config.d.ts

@@ -54,20 +54,36 @@ export type RegistrationReceipt = {
     origin_api_key?: string;
     gateway_egress_cidrs?: string[];
     status?: string;
+    access_mode?: "free" | "paid";
     metering_mode?: string;
+    metering_default_units?: number;
+    tool_units?: Record<string, number>;
     /**
      * What still blocks go-live: origin_base_uri, connected_account_id, stripe_onboarding_complete,
      * and custom_domain_dns while a custom host is set but not yet ready.
      */
     pending_requirements?: string[];
+    allowed_actions?: string[];
     last_probe_at_utc?: string | null;
     last_probe_passed?: boolean | null;
 };
+export declare const saveReceiptHint = "Save it with: authflow resource get <slug> > receipt.json";
+/**
+ * Reads a receipt saved by `authflow resource get <slug> > receipt.json`, which prints
+ * `{ "result": receipt }`, or the bare receipt legacy `authflow register` writes. Windows
+ * PowerShell 5.1 redirects as UTF-16LE with a byte-order mark, so that encoding is accepted too.
+ */
 export declare function readReceipt(path: string): Promise<RegistrationReceipt>;
 export declare function resolveGatewayUrl(opts: {
     gatewayUrl?: string;
     receipt?: RegistrationReceipt;
 }): string | undefined;
+export declare const apiTimeoutMs = 30000;
+/**
+ * The legacy admin and Origin Protocol calls. They carry admin or origin bearer keys, so a redirect
+ * is refused rather than followed (the management path does the same), a hung rail cannot hang the
+ * CLI, and a network failure names the host and the cause instead of a bare "fetch failed".
+ */
 export declare function apiJson<T>(url: string, init?: RequestInit & {
     expectedStatuses?: number[];
 }): Promise<{

package/dist/config.js

@@ -9,7 +9,7 @@ export function requireIssuer(flag) {
 export function requireAdminKey(flag) {
     const key = (flag ?? process.env.AUTHFLOW_ADMIN_API_KEY ?? "").trim();
     if (!key) {
-        throw new Error("Set AUTHFLOW_ADMIN_API_KEY or pass --admin-key.");
+        throw new Error("This legacy operator command requires AUTHFLOW_ADMIN_API_KEY or --admin-key. For creator onboarding, run authflow login and use authflow resource commands. Claim an existing workspace in the portal with its current tenant key.");
     }
     return key;
 }
@@ -20,9 +20,32 @@ export function requireOriginKey(flag) {
     }
     return key;
 }
+export const saveReceiptHint = "Save it with: authflow resource get <slug> > receipt.json";
+/**
+ * Reads a receipt saved by `authflow resource get <slug> > receipt.json`, which prints
+ * `{ "result": receipt }`, or the bare receipt legacy `authflow register` writes. Windows
+ * PowerShell 5.1 redirects as UTF-16LE with a byte-order mark, so that encoding is accepted too.
+ */
 export async function readReceipt(path) {
-    const raw = (await readFile(path, "utf8")).replace(/^\uFEFF/, "");
-    return JSON.parse(raw);
+    const bytes = await readFile(path);
+    const raw = bytes[0] === 0xff && bytes[1] === 0xfe
+        ? bytes.subarray(2).toString("utf16le")
+        : bytes.toString("utf8").replace(/^\uFEFF/, "");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${path} is not a JSON receipt. ${saveReceiptHint}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${path} is not a JSON receipt. ${saveReceiptHint}`);
+    }
+    const wrapped = parsed.result;
+    if (wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) && !("issuer" in parsed)) {
+        return wrapped;
+    }
+    return parsed;
 }
 export function resolveGatewayUrl(opts) {
     return (opts.gatewayUrl?.trim() ||
@@ -32,9 +55,21 @@ export function resolveGatewayUrl(opts) {
         opts.receipt?.resource?.trim() ||
         undefined);
 }
+export const apiTimeoutMs = 30_000;
+/**
+ * The legacy admin and Origin Protocol calls. They carry admin or origin bearer keys, so a redirect
+ * is refused rather than followed (the management path does the same), a hung rail cannot hang the
+ * CLI, and a network failure names the host and the cause instead of a bare "fetch failed".
+ */
 export async function apiJson(url, init = {}) {
     const { expectedStatuses, ...fetchInit } = init;
-    const response = await fetch(url, fetchInit);
+    let response;
+    try {
+        response = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(apiTimeoutMs), ...fetchInit });
+    }
+    catch (error) {
+        throw new Error(`Request to ${hostOf(url)} failed: ${networkFailure(error)}. Check the issuer URL and your network.`, { cause: error });
+    }
     const raw = await response.text();
     let body;
     try {
@@ -50,6 +85,25 @@ export async function apiJson(url, init = {}) {
     }
     return { status: response.status, body, raw };
 }
+function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return url;
+    }
+}
+function networkFailure(error) {
+    if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) {
+        return `no response within ${apiTimeoutMs / 1000} seconds`;
+    }
+    const cause = error instanceof Error ? error.cause : undefined;
+    const detail = [cause?.code, cause?.message].find((value) => typeof value === "string" && value.length > 0)
+        ?? (error instanceof Error ? error.message : String(error));
+    return /redirect/i.test(detail)
+        ? "the server answered with a redirect, which is never followed while sending a key; use the canonical issuer URL"
+        : detail;
+}
 export function bearer(token) {
     return { Authorization: `Bearer ${token}` };
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA4DD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAAsD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oOAAoO,CAAC,CAAC;IACxP,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAgED,MAAM,CAAC,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAI,MAA+B,CAAC,MAAM,CAAC;IACxD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;QAC/F,OAAO,OAA8B,CAAC;IACxC,CAAC;IACD,OAAO,MAA6B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAI,GAAkD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,GAAG,CAAC,YAAY,cAAc,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1I,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,sBAAsB,YAAY,GAAG,IAAI,UAAU,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,KAA2D,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;WACvH,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,gHAAgH;QAClH,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,31 @@
+export type LoginCredential = {
+    issuer: string;
+    client_id: string;
+    access_token: string;
+    refresh_token?: string;
+    expires_at: number;
+    workspace_id: string;
+};
+export type KeyringEntry = {
+    getPassword(): string | null;
+    setPassword(value: string): void;
+    deletePassword(): boolean;
+};
+/** The native OS keyring. One object so tests can replace it without touching the real store. */
+export declare const keyring: {
+    open(account: string): Promise<KeyringEntry>;
+};
+/** Credentials never enter the checkout, environment files, or tool results. */
+export declare function credentialEntry(issuer: string, suffix?: string): Promise<KeyringEntry>;
+export declare function readCredential(issuer: string): Promise<LoginCredential | undefined>;
+export declare function saveCredential(credential: LoginCredential): Promise<void>;
+export declare function deleteCredential(issuer: string): Promise<void>;
+/** Serialize refresh-token rotation across CLI/MCP processes. The lock contains no secrets. */
+export declare function withCredentialLock<T>(issuer: string, action: () => Promise<T>, directory?: string): Promise<T>;
+/** One storage boundary also lets protocol tests use an isolated in-memory credential store. */
+export declare const credentialStore: {
+    read: typeof readCredential;
+    save: typeof saveCredential;
+    delete: typeof deleteCredential;
+    withLock: typeof withCredentialLock;
+};