Get your service listed

You are working inside my product's repository. Goal: make my product discoverable on integrations.sh by publishing standard discovery files on my own domain. Derive every value from THIS repo and its docs. Never invent endpoints, specs, or auth. Leave out any surface my product does not actually have.

# 1. Inventory the integration surfaces

Read the codebase, README, and docs to find each way an agent could integrate with my product, and how each authenticates:
- HTTP/REST API — base URL, and whether an OpenAPI/Swagger spec exists in the repo or is served somewhere.
- MCP server — the connect URL and transport (streamable-http or sse), if one ships.
- GraphQL API — the endpoint URL, and SDL/introspection availability.
- CLI — the command name and how it installs (npm/pypi/oci/brew).
For each surface, determine the auth: none (public), or the credential(s) needed and exactly how they ride the request (header name + scheme, or query/body param, or a CLI login/env var).

# 2. Author /.well-known/integrations.json

Write ONE file at /.well-known/integrations.json on my production domain with EVERYTHING inline — there is no index/reference layout. The file holds version + summary + a shared credentials map + a "surfaces" list of full surface objects. Credentials are defined once in the top-level "credentials" map and referenced from each surface's auth by id.

Serve it as application/json, publicly cacheable (e.g. Cache-Control: public, max-age=3600).

File shape (v3):
  { "version": 3, "summary"?: string, "credentials"?: { [id]: Credential },
    "surfaces"?: Surface[] }

Credential (defined once in "credentials", keyed by id, referenced from a surface's auth):
  { "type": "api_key"|"bearer"|"basic"|"oauth2"|"oauth2_cc"|"jwt"|"custom"|...,
    "label": string,                 // human name, e.g. "Acme API key"
    "generateUrl"?: string,          // where the user mints it
    "setup": string,                 // markdown: how to get it, gotchas
    "fields"?: { [name]: { "secret"?: boolean, "description"?: string } } }  // only for multi-part secrets

Surface (discriminated on "type"). Common fields on every surface:
  "slug": string,                    // stable url segment, e.g. "acme-api"
  "name": string,                    // display name
  "docs"?: string,                   // human docs URL
  "basis": { "via": "declared", "source": "https://MY_DOMAIN/.well-known/integrations.json" },
  "auth": AuthStatus
Per-type extra fields:
  http:    "spec"? (OpenAPI doc URL), "url"? (base URL)
  graphql: "url"? (endpoint), "spec"? ("introspection" or SDL URL)
  mcp:     "url"? (connect endpoint), "transports"?: ["streamable-http"] | ["sse"]
  cli:     "command"?: string, "packages"?: [{ "registryType": "npm"|"pypi"|..., "identifier": string, "runtimeHint"?: "npx"|"uvx" }]

AuthStatus is one of:
  { "status": "none",    "basis": { "via": "declared", "source": "https://MY_DOMAIN/.well-known/integrations.json" } }   // confirmed public
  { "status": "unknown" }                                                                                               // not determined
  { "status": "required", "entries": [ AuthEntry ] }  // entries are OR alternatives; at least one works
AuthEntry:
  { "use": [ { "id": "<credential id>", "mechanics": Mechanics } ],   // multiple uses are AND'd (sent together)
    "basis": { "via": "declared", "source": "https://MY_DOMAIN/.well-known/integrations.json" } }
Mechanics (how ONE credential binds), pick the matching shape:
  { "source": "http", "in": "header", "headerName": "Authorization", "scheme": "Bearer" }
  { "source": "http", "in": "query",  "paramName": "api_key" }
  { "source": "cli",  "command"?: "acme login", "env"?: ["ACME_API_TOKEN"] }
  { "source": "spec", "scheme": "<securityScheme name from the OpenAPI doc>" }
  { "source": "well-known" }   // MCP OAuth resolvable from the surface url via RFC 9728/8414
  { "source": "unknown" }

Rules:
- Replace MY_DOMAIN with my real production host everywhere.
- Every surface's basis.source and every auth basis.source must be my integrations.json URL (https://MY_DOMAIN/.well-known/integrations.json).
- Only include surfaces that exist. Omit "credentials" / "surfaces" entirely if there are none.
- The file must parse as strict JSON and validate against the v3 shape above, or integrations.sh silently ignores it.

# 3. Also publish, if applicable

- If my product has an HTTP API and an OpenAPI/Swagger spec exists (or can be generated from the code), serve it at /openapi.json (integrations.sh also probes /swagger.json, /api/openapi.json, /v1/openapi.json, /api/schema/ — /openapi.json is the canonical one). Serve as application/json, publicly cacheable. If a spec route already exists, just make sure one of those paths resolves to it.
- If my product ships an MCP server, also serve /.well-known/mcp/server-card.json with at least { "url": "<mcp connect endpoint>" } and, if the server needs auth, "authentication": { "type": "oauth2", "authorization_server"?: "<as url>" }. application/json, publicly cacheable.

# 4. Verify

Print copy-paste curl commands to confirm each published file resolves on my live domain with a JSON content-type, e.g.:
  curl -sS -D- -o/dev/null https://MY_DOMAIN/.well-known/integrations.json
  curl -sS https://MY_DOMAIN/.well-known/integrations.json | jq .
  curl -sS -D- -o/dev/null https://MY_DOMAIN/openapi.json                 # if you published one
  curl -sS https://MY_DOMAIN/.well-known/mcp/server-card.json | jq .      # if you published one

Then tell me: open https://integrations.sh/MY_DOMAIN/ and click "Map integration surface" to publish the listing.