Bootstrap: drop /bootstrap POST, defer person binding to first authorized request

[rohanharikr]

Summary

• The PS-side /bootstrap endpoint was removed in hellocoop/Wallet#3937 (and bootstrap_endpoint was dropped from issuer's static metadata). npx @aauth/bootstrap --ps <url> was unconditionally throwing "PS metadata missing bootstrap_endpoint" against any current PS.
• Align the package with draft-hardt-aauth-bootstrap §Self-Hosted Enrollment: "publication of the JWKS is the enrollment — there is no separate enrollment step." Person binding now happens lazily on the agent's first /aauth/token call, per §Agent-Person Binding in the protocol spec.

What --ps <url> does now

Before: signed POST to /bootstrap, 202 + Location polling, browser open for consent, binding established at setup time.

After: fetch <ps>/.well-known/aauth-person.json, validate required fields (issuer, token_endpoint, jwks_uri) and that issuer matches the URL, write agentId + personServerUrl to ~/.aauth/config.json. No network POST. No browser. No interaction at setup time.

The first time the agent makes an authorized request (resource → 401 → PS /aauth/token), the PS sees a new (user, agent_id) tuple and surfaces the consent screen as enrollment + auth in one step.

Code changes

• bootstrap/src/bootstrap-ps.ts — collapsed ~204 → ~70 lines. Dropped ephemeral keypair, agent_token mint, signed POST, 202 polling, browser open.
• bootstrap/src/cli.ts — dropped onInteraction callback and --login-hint / --domain-hint / --provider-hint / --tenant flags from runBootstrapPS (these parameterized the now-removed POST; @aauth/fetch already has equivalent flags for the real /aauth/token call). Updated success message + help text. No default PS URL shown anywhere.
• bootstrap/package.json — dropped @aauth/mcp-agent, @hellocoop/httpsig, open from dependencies (no longer used).
• local-keys/src/create-agent-token.ts — tweaked error message ("register" → "configure one").
• local-keys/src/index.ts — exported writeConfig so other packages / tests can reset config state.

Docs

• Removed "default PS is https://person.hello-beta.net" claim and the beta-data-reset warning from README.md, bootstrap/README.md, bootstrap/skills/setup.md, fetch/README.md, fetch/skills/fetch.md, local-keys/README.md.
• Reframed --ps everywhere from "register" → "configure"; placeholder <your-ps-url> in examples.

Tests

bootstrap/src/bootstrap-ps.test.ts (new, 12 cases):

• Happy path — fetches correct well-known URL, writes agentId + personServerUrl
• local override propagates into agentId
• Existing key entries preserved when writing the agent config
• Validation errors — missing issuer / token_endpoint / jwks_uri
• Issuer mismatch — throws
• HTTP non-OK metadata response — throws
• Trailing-slash normalization on issuer/URL and metadata URL
• Regression guard — asserts exactly one fetch call (metadata GET) so we don't accidentally reintroduce the /bootstrap POST

Verification

End-to-end verified locally against person.hello-beta.net:

node bootstrap/dist/cli.js --agent https://rohanharikr.github.io --ps https://person.hello-beta.net
# → "Person server configured. Person binding will happen on the agent's first authorized request."
# → ~/.aauth/config.json updated with agentId + personServerUrl
# → no browser, no POST, no errors

node fetch/dist/cli.js "https://whoami.aauth.dev?scope=openid+profile"
# → resource returns 401 + resource_token
# → fetch hits PS /aauth/token → 202 + interaction URL
# → browser opens for consent
# → PS writes binding, issues auth_token
# → fetch retries and prints a real identity response

All 218 prior tests + 12 new tests pass. (1 pre-existing test failure in agent-token-hardware.test.ts is environment-dependent and unaffected by this PR.)

Test plan

• Re-run node bootstrap/dist/cli.js --agent <url> --ps <ps-url> against a current PS — should succeed without throwing
• Inspect ~/.aauth/config.json — agentId and personServerUrl correctly written, existing keys map preserved
• No new npx @aauth/local-keys references in docs (already cleaned up in Docs: fix stale CLI references and broken links across READMEs #6)
• All 13 package.json files line up post-merge for the version bump (separate commit)

🤖 Generated with Claude Code