@extrovert.dev/mcp 0.1.0-pre.3 → 0.1.0-pre.5

package/README.md

@@ -10,9 +10,10 @@ persistent inbox on a domain Extrovert owns: created in one tool call, sends and
 **scoped key that expires and revokes on its own**. The key is bound to a fixed org + project (call
 `whoami` to see them) — there is no project selector to manage.
 
-> **Prerelease status:** the package is published on npm under the `next` dist-tag. Extrovert does
-> not currently operate a hosted MCP endpoint; use the packaged stdio server or an HTTP deployment
-> you operate yourself.
+> **Prerelease status:** the package is published on npm under the `next` dist-tag. Extrovert also
+> operates `https://mcp.extrovert.dev/mcp` as a stateless Streamable HTTP endpoint with browser OAuth.
+> The same package installs `extrovert-mcp` for transports and `extrovert` for supported setup,
+> authentication, mailbox, review-status, and reviewed-send commands.
 
 The standout tool is **`wait_for_email`** — a blocking call that returns the next matching message
 with the **OTP code and verification link already extracted**. Trigger a sign-in elsewhere, then act
@@ -66,6 +67,21 @@ ever reaches the model host. Keep every model host on the narrowest scoped key i
 
 ---
 
+## Connect with hosted OAuth
+
+Give an OAuth-capable MCP client this URL:
+
+```text
+https://mcp.extrovert.dev/mcp
+```
+
+The endpoint publishes RFC 9728 protected-resource metadata and Clerk authorization-server
+discovery. Compatible clients open the browser sign-in and consent flow, then store and refresh the
+grant. Existing scoped `pk_agent_…` bearer keys also work when a client is configured explicitly.
+
+The hosted service runs MCP SDK v2's fresh-server-per-request handler: no process-local session map,
+sticky routing, or session teardown is required.
+
 ## Install and run the prerelease
 
 Use the explicit prerelease tag:
@@ -76,14 +92,39 @@ npx -y @extrovert.dev/mcp@next
 
 # inspect the packaged CLI
 npx -y @extrovert.dev/mcp@next --help
+
+# register the stdio server in Codex or Claude Code
+npx -y @extrovert.dev/mcp@next setup --host codex
+npx -y @extrovert.dev/mcp@next setup --host claude
+```
+
+Pin `@extrovert.dev/mcp@0.1.0-pre.5` for a reproducible dogfood environment. The package installs the
+`extrovert-mcp` and `extrovert` aliases over one entrypoint; there is no second package or transport
+implementation to keep in sync.
+
+### CLI fallback
+
+The CLI uses the same typed client as MCP and prints ordinary message text without a `curl | jq`
+pipeline:
+
+```bash
+extrovert signup --human-email you@example.com --username support
+extrovert verify                         # prompts for the emailed code
+extrovert whoami
+extrovert inbox list
+extrovert message list --inbox support@smtp.extrovert.dev
+extrovert message get msg_…
+extrovert review status rr_…
 ```
 
-Pin `@extrovert.dev/mcp@0.1.0-pre.3` for a reproducible dogfood environment. The package installs the
-`extrovert-mcp` binary; this is the only Extrovert CLI currently shipped.
+`signup` stores the limited key only in `pending-signup.json`. `verify` atomically writes the full
+replacement to `credentials.json` and deletes the pending file. On Unix the directory is mode `0700`
+and both files are mode `0600`. The default is `~/.config/extrovert/`; use
+`EXTROVERT_CONFIG_DIR` for an isolated or managed runtime. `EXTROVERT_API_KEY` always wins when set.
 
 ## Build and run from source
 
-Requires Node ≥ 18.18. From this directory:
+Requires Node ≥ 20. From this directory:
 
 ```bash
 pnpm install --frozen-lockfile
@@ -96,7 +137,7 @@ Two transports, one binary:
 # stdio — for local hosts (Claude Desktop, Claude Code, Cursor)
 node /absolute/path/to/extrovert/mcp/dist/bin.js
 
-# self-hosted Streamable HTTP at POST /mcp (default :8787)
+# self-hosted stateless Streamable HTTP at /mcp (default :8787)
 node /absolute/path/to/extrovert/mcp/dist/bin.js --http --port 8787
 ```
 
@@ -113,13 +154,18 @@ pnpm run dev -- --http  # tsx watch, HTTP
 |---|---|---|
 | `EXTROVERT_API_BASE_URL` | `https://api.extrovert.dev` | Base URL of the Extrovert REST API. |
 | `EXTROVERT_API_KEY` | *(empty)* | Scoped agent key (`pk_agent_…`) or enrollment key (`pk_enroll_…`). |
+| `EXTROVERT_CONFIG_DIR` | platform config directory | Override the local credential directory. |
 | `EXTROVERT_MOCK` | *(off)* | Set `1` to force offline fixtures. |
 | `EXTROVERT_REQUEST_TIMEOUT_MS` | `30000` | Per-request timeout for non-blocking calls. |
 | `EXTROVERT_MAX_WAIT_MS` | `300000` | Upper bound the server allows `wait_for_email` to block. |
+| `EXTROVERT_MCP_OAUTH_ENABLED` | *(off)* | Require Clerk OAuth or an introspected agent key on HTTP. |
+| `EXTROVERT_MCP_OAUTH_ISSUER` | `https://clerk.extrovert.dev` | Clerk OAuth authorization-server issuer. |
+| `EXTROVERT_MCP_PUBLIC_URL` | `https://mcp.extrovert.dev/mcp` | Public RFC 9728 resource identifier. |
 | `PORT` / `HOST` | `8787` / `0.0.0.0` | `--http` bind. |
 
 > **Offline fixtures are opt-in.** With no `EXTROVERT_API_KEY`, the server still talks to the live
-> API so an agent can start with `sign_up` and receive a limited key in-session. Set
+> API so an agent can start with `sign_up` and receive a short-lived limited key in-session. The
+> key expires with the OTP and is revoked when `verify_signup` returns its replacement. Set
 > `EXTROVERT_MOCK=1` to use deterministic in-memory fixtures; `create_inbox`, `send_email`, and
 > `wait_for_email` then operate on one coherent offline dataset.
 
@@ -134,23 +180,17 @@ Point any stdio-capable host at the prerelease package:
   "mcpServers": {
     "extrovert": {
       "command": "npx",
-      "args": ["-y", "@extrovert.dev/mcp@next"],
-      "env": {
-        "EXTROVERT_API_BASE_URL": "https://api.extrovert.dev",
-        "EXTROVERT_API_KEY": "pk_agent_…"
-      }
+      "args": ["-y", "@extrovert.dev/mcp@next"]
     }
   }
 }
 ```
 
-For Claude Code, register that same local entrypoint:
+For Codex or Claude Code, register that same local entrypoint:
 
 ```bash
-claude mcp add extrovert \
-  --env EXTROVERT_API_BASE_URL=https://api.extrovert.dev \
-  --env EXTROVERT_API_KEY=pk_agent_… \
-  -- npx -y @extrovert.dev/mcp@next
+npx -y @extrovert.dev/mcp@next setup --host codex
+npx -y @extrovert.dev/mcp@next setup --host claude
 ```
 
 > **Offline:** omit `EXTROVERT_API_KEY` and set `EXTROVERT_MOCK=1`; the packaged server uses
@@ -225,23 +265,23 @@ continue. No polling, no separate "check the inbox" round-trips.
 
 ---
 
-## Self-hosted HTTP notes
+## Stateless HTTP notes
 
 `extrovert-mcp --http` speaks MCP Streamable HTTP:
 
-- `POST /mcp` — client→server messages (the first must be `initialize`); the SDK assigns an
-  `mcp-session-id` returned on the response.
-- `GET /mcp` — server→client SSE stream for an established session.
-- `DELETE /mcp` — tear a session down.
-- `GET /healthz` — liveness + mode (`mock`/`live`) + active session count.
+- `POST /mcp` — one authenticated client→server request, served by a fresh MCP server instance.
+- `GET /mcp` and `DELETE /mcp` — legacy stateless compatibility responses; no session is retained.
+- `GET /healthz` — liveness, version, transport, and authentication mode.
+- `GET /.well-known/oauth-protected-resource/mcp` — RFC 9728 protected-resource metadata when
+  OAuth is enabled.
 
-Each session gets an isolated server + client. A **per-request scoped key** may be supplied via
-`Authorization: Bearer …` (or `x-extrovert-api-key`), so one hosted deployment can serve many agents,
-each with their own scoped key — falling back to `EXTROVERT_API_KEY` when no header is present. This
-is how a single hosted endpoint stays multi-tenant without ever holding an org-wide key.
+Each request gets an isolated server + client and emits no `mcp-session-id`, so requests can land on
+any cluster node. Production requires `Authorization: Bearer …` with either a Clerk OAuth access
+token or an existing scoped `pk_agent_…` key. The OAuth principal and its fixed safe capabilities
+are enforced again by the Extrovert API; the raw bearer token is never persisted by MCP or API.
 
-Extrovert does not operate this transport as a public hosted endpoint. These notes apply only to a
-deployment you control.
+`EXTROVERT_API_KEY` and unauthenticated fixture mode remain local/self-hosting conveniences only;
+the production service refuses to start without OAuth enabled.
 
 ---
 
@@ -250,9 +290,12 @@ deployment you control.
 ```text
 src/
   bin.ts        CLI entrypoint (--http | stdio)
+  cli.ts        setup/auth/signup/mailbox/review CLI using the typed client
+  credentials.ts permission-restricted, atomic local credential persistence
   server.ts     McpServer factory + instructions
   stdio.ts      stdio transport
-  http.ts       Streamable HTTP transport (Express, per-session, bearer key)
+  http.ts       stateless Streamable HTTP transport (Express, OAuth + scoped keys)
+  auth.ts       Clerk OAuth verification, RFC discovery, and agent-key introspection
   tools.ts      manifest-driven tools — zod schemas, annotations, handlers, registration
   client.ts     thin typed Extrovert REST client (one method per /v1 endpoint)
   config.ts     env-driven configuration

package/dist/auth.d.ts

@@ -0,0 +1,39 @@
+import { type AuthInfo, type OAuthMetadata, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+interface ClerkRequestState {
+    isAuthenticated: boolean;
+    toAuth(): unknown;
+}
+interface ClerkOAuthClient {
+    authenticateRequest(request: Request, options: {
+        acceptsToken: "oauth_token";
+    }): Promise<ClerkRequestState>;
+}
+export interface HostedAuthConfig {
+    issuer: URL;
+    resourceUrl: URL;
+    serviceDocumentationUrl: URL;
+    scopesSupported: string[];
+    clerkSecretKey: string;
+    clerkPublishableKey: string;
+}
+export interface ExtrovertTokenVerifierOptions {
+    clerk: ClerkOAuthClient;
+    resourceUrl: URL;
+    apiBaseUrl: string;
+    fetch?: typeof fetch;
+}
+/** Verify Clerk OAuth tokens and existing scoped Extrovert agent keys. */
+export declare class ExtrovertTokenVerifier implements OAuthTokenVerifier {
+    private readonly clerk;
+    private readonly resourceUrl;
+    private readonly apiBaseUrl;
+    private readonly doFetch;
+    constructor(options: ExtrovertTokenVerifierOptions);
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    private verifyAgentKey;
+}
+export declare function loadHostedAuthConfig(env?: NodeJS.ProcessEnv): HostedAuthConfig;
+export declare function createHostedTokenVerifier(config: HostedAuthConfig, apiBaseUrl: string): ExtrovertTokenVerifier;
+export declare function discoverOAuthMetadata(issuer: URL, doFetch?: typeof fetch): Promise<OAuthMetadata>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAkBtC,UAAU,iBAAiB;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,IAAI,OAAO,CAAC;CACnB;AAED,UAAU,gBAAgB;IACxB,mBAAmB,CACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,YAAY,EAAE,aAAa,CAAA;KAAE,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,GAAG,CAAC;IACjB,uBAAuB,EAAE,GAAG,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,GAAG,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,0EAA0E;AAC1E,qBAAa,sBAAuB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAM;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAE3B,OAAO,EAAE,6BAA6B;IAO5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YA0C3C,cAAc;CAiC7B;AAED,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA8B3F;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,GACjB,sBAAsB,CASxB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,GAAG,EACX,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/dist/auth.js

@@ -0,0 +1,201 @@
+import { createClerkClient } from "@clerk/backend";
+import { OAuthError, OAuthErrorCode, } from "@modelcontextprotocol/server";
+const DEFAULT_ISSUER = "https://clerk.extrovert.dev";
+const DEFAULT_PUBLIC_URL = "https://mcp.extrovert.dev/mcp";
+const DISCOVERY_TIMEOUT_MS = 10_000;
+const AGENT_KEY_ATTESTATION_SECONDS = 300;
+/** Verify Clerk OAuth tokens and existing scoped Extrovert agent keys. */
+export class ExtrovertTokenVerifier {
+    clerk;
+    resourceUrl;
+    apiBaseUrl;
+    doFetch;
+    constructor(options) {
+        this.clerk = options.clerk;
+        this.resourceUrl = options.resourceUrl;
+        this.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
+        this.doFetch = options.fetch ?? fetch;
+    }
+    async verifyAccessToken(token) {
+        if (token.startsWith("pk_agent_"))
+            return this.verifyAgentKey(token);
+        if (token.startsWith("pk_enroll_")) {
+            throw invalidToken("Enrollment tokens cannot authenticate the hosted MCP endpoint");
+        }
+        const request = new Request(this.resourceUrl, {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        let state;
+        try {
+            state = await this.clerk.authenticateRequest(request, {
+                acceptsToken: "oauth_token",
+            });
+        }
+        catch {
+            throw invalidToken("OAuth access token verification failed");
+        }
+        if (!state.isAuthenticated)
+            throw invalidToken("OAuth access token is invalid or expired");
+        const auth = state.toAuth();
+        if (!isClerkOAuthAuth(auth)) {
+            throw invalidToken("Bearer token is not a Clerk OAuth access token");
+        }
+        const expiresAt = jwtExpiry(token);
+        if (expiresAt === undefined) {
+            // Production is deliberately configured for Clerk JWT access tokens. The
+            // MCP bearer gate requires a concrete expiry and must not invent one.
+            throw invalidToken("OAuth access token has no verifiable expiration");
+        }
+        return {
+            token,
+            clientId: auth.oauth_token.clientId,
+            scopes: auth.scopes,
+            expiresAt,
+            resource: this.resourceUrl,
+            extra: {
+                tokenType: "oauth_token",
+                userId: auth.oauth_token.userId,
+                subject: auth.subject,
+            },
+        };
+    }
+    async verifyAgentKey(token) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+        try {
+            const response = await this.doFetch(`${this.apiBaseUrl}/v1/auth/me`, {
+                headers: { authorization: `Bearer ${token}` },
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                throw invalidToken("Extrovert agent key is invalid or revoked");
+            const body = (await response.json());
+            const keyId = requiredString(body.key_id);
+            const agentId = requiredString(body.agent_id);
+            const scopes = stringArray(body.scopes);
+            if (!keyId || !agentId) {
+                throw invalidToken("Extrovert agent-key introspection returned an invalid principal");
+            }
+            return {
+                token,
+                clientId: `extrovert-agent:${agentId}`,
+                scopes,
+                // This is the lifetime of the successful introspection result. Because
+                // HTTP is stateless, every later request validates the key again.
+                expiresAt: Math.floor(Date.now() / 1000) + AGENT_KEY_ATTESTATION_SECONDS,
+                resource: this.resourceUrl,
+                extra: { tokenType: "agent_key", keyId, agentId },
+            };
+        }
+        catch (error) {
+            if (OAuthError.isInstance(error))
+                throw error;
+            throw invalidToken("Extrovert agent-key verification failed");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+export function loadHostedAuthConfig(env = process.env) {
+    const issuer = new URL((env.EXTROVERT_MCP_OAUTH_ISSUER ?? DEFAULT_ISSUER).trim());
+    const resourceUrl = new URL((env.EXTROVERT_MCP_PUBLIC_URL ?? DEFAULT_PUBLIC_URL).trim());
+    const serviceDocumentationUrl = new URL((env.EXTROVERT_MCP_DOCUMENTATION_URL ?? "https://docs.extrovert.dev/mcp/overview/").trim());
+    const clerkSecretKey = (env.CLERK_SECRET_KEY ?? "").trim();
+    const clerkPublishableKey = (env.CLERK_PUBLISHABLE_KEY ??
+        env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY ??
+        "").trim();
+    if (!clerkSecretKey || !clerkPublishableKey) {
+        throw new Error("hosted MCP OAuth requires CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY");
+    }
+    if (issuer.protocol !== "https:" || resourceUrl.protocol !== "https:") {
+        throw new Error("hosted MCP OAuth issuer and resource URL must use HTTPS");
+    }
+    const scopesSupported = (env.EXTROVERT_MCP_OAUTH_SCOPES ?? "openid profile email")
+        .split(/[\s,]+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return {
+        issuer,
+        resourceUrl,
+        serviceDocumentationUrl,
+        scopesSupported,
+        clerkSecretKey,
+        clerkPublishableKey,
+    };
+}
+export function createHostedTokenVerifier(config, apiBaseUrl) {
+    return new ExtrovertTokenVerifier({
+        clerk: createClerkClient({
+            secretKey: config.clerkSecretKey,
+            publishableKey: config.clerkPublishableKey,
+        }),
+        resourceUrl: config.resourceUrl,
+        apiBaseUrl,
+    });
+}
+export async function discoverOAuthMetadata(issuer, doFetch = fetch) {
+    const url = new URL("/.well-known/oauth-authorization-server", issuer);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+    try {
+        const response = await doFetch(url, {
+            headers: { accept: "application/json" },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            throw new Error(`OAuth discovery returned HTTP ${response.status}`);
+        const metadata = (await response.json());
+        if (metadata.issuer !== issuer.toString().replace(/\/$/, "")) {
+            throw new Error("OAuth discovery issuer does not match EXTROVERT_MCP_OAUTH_ISSUER");
+        }
+        for (const field of ["authorization_endpoint", "token_endpoint"]) {
+            const value = metadata[field];
+            if (typeof value !== "string" || new URL(value).protocol !== "https:") {
+                throw new Error(`OAuth discovery is missing a secure ${field}`);
+            }
+        }
+        return metadata;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function isClerkOAuthAuth(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return (candidate.isAuthenticated === true &&
+        candidate.tokenType === "oauth_token" &&
+        typeof candidate.subject === "string" &&
+        Array.isArray(candidate.scopes) &&
+        !!candidate.oauth_token &&
+        typeof candidate.oauth_token.userId === "string" &&
+        typeof candidate.oauth_token.clientId === "string");
+}
+function jwtExpiry(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.exp === "number" && Number.isSafeInteger(decoded.exp)
+            ? decoded.exp
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function requiredString(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string" && item.trim() !== "")
+        : [];
+}
+function invalidToken(message) {
+    return new OAuthError(OAuthErrorCode.InvalidToken, message);
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AAEtC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAyC1C,0EAA0E;AAC1E,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAmB;IACxB,WAAW,CAAM;IACjB,UAAU,CAAS;IACnB,OAAO,CAAe;IAEvC,YAAY,OAAsC;QAChD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,YAAY,CAAC,+DAA+D,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,KAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;gBACpD,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,YAAY,CAAC,iDAAiD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,KAAK,EAAE;gBACL,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,aAAa,EAAE;gBACnE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,YAAY,CAAC,2CAA2C,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,YAAY,CAAC,iEAAiE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,mBAAmB,OAAO,EAAE;gBACtC,MAAM;gBACN,uEAAuE;gBACvE,kEAAkE;gBAClE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,6BAA6B;gBACxE,QAAQ,EAAE,IAAI,CAAC,WAAW;gBAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,0BAA0B,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,CAAC,GAAG,CAAC,+BAA+B,IAAI,0CAA0C,CAAC,CAAC,IAAI,EAAE,CAC3F,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,mBAAmB,GAAG,CAC1B,GAAG,CAAC,qBAAqB;QACzB,GAAG,CAAC,iCAAiC;QACrC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,0BAA0B,IAAI,sBAAsB,CAAC;SAC/E,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,MAAM;QACN,WAAW;QACX,uBAAuB;QACvB,eAAe;QACf,cAAc;QACd,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAwB,EACxB,UAAkB;IAElB,OAAO,IAAI,sBAAsB,CAAC;QAChC,KAAK,EAAE,iBAAiB,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC,cAAc;YAChC,cAAc,EAAE,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAW,EACX,UAAwB,KAAK;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,QAAyB,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,SAAS,CAAC,eAAe,KAAK,IAAI;QAClC,SAAS,CAAC,SAAS,KAAK,aAAa;QACrC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC,WAAW;QACvB,OAAO,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,WAAW,CAAC,QAAQ,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YACzE,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC"}

package/dist/bin.d.ts

@@ -1,13 +1,11 @@
 #!/usr/bin/env node
 /**
- * Extrovert MCP server CLI entrypoint.
+ * Extrovert MCP + CLI entrypoint.
  *
- *   extrovert-mcp            # stdio transport (default; for local MCP hosts)
- *   extrovert-mcp --http     # hosted Streamable HTTP transport
- *   extrovert-mcp --http --port 9000
- *
- * Configuration is read from the environment (see config.ts):
- *   EXTROVERT_API_BASE_URL, EXTROVERT_API_KEY, EXTROVERT_MOCK, ...
+ *   extrovert-mcp                         # stdio transport for MCP hosts
+ *   extrovert-mcp --http --port 9000      # hosted Streamable HTTP
+ *   extrovert setup --host codex          # register the packaged stdio server
+ *   extrovert signup / verify / message…  # supported CLI fallback
  */
 export {};
 //# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG"}

package/dist/bin.js

@@ -1,20 +1,43 @@
 #!/usr/bin/env node
 /**
- * Extrovert MCP server CLI entrypoint.
+ * Extrovert MCP + CLI entrypoint.
  *
- *   extrovert-mcp            # stdio transport (default; for local MCP hosts)
- *   extrovert-mcp --http     # hosted Streamable HTTP transport
- *   extrovert-mcp --http --port 9000
- *
- * Configuration is read from the environment (see config.ts):
- *   EXTROVERT_API_BASE_URL, EXTROVERT_API_KEY, EXTROVERT_MOCK, ...
+ *   extrovert-mcp                         # stdio transport for MCP hosts
+ *   extrovert-mcp --http --port 9000      # hosted Streamable HTTP
+ *   extrovert setup --host codex          # register the packaged stdio server
+ *   extrovert signup / verify / message…  # supported CLI fallback
  */
+import { CLI_HELP, runCli } from "./cli.js";
 import { runHttp } from "./http.js";
 import { runStdio } from "./stdio.js";
-function parseArgs(argv) {
-    const args = { http: false, help: false };
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
+const CLI_COMMANDS = new Set([
+    "setup",
+    "auth",
+    "signup",
+    "verify",
+    "whoami",
+    "inbox",
+    "message",
+    "review",
+    "send",
+    "help",
+]);
+const TRANSPORT_HELP = `
+MCP transports:
+  extrovert-mcp                  stdio (default for local hosts)
+  extrovert-mcp --http           Streamable HTTP at /mcp (default port 8787)
+  extrovert-mcp --http --port N  override the HTTP port
+
+Environment:
+  EXTROVERT_API_BASE_URL   API URL (default https://api.extrovert.dev)
+  EXTROVERT_API_KEY        scoped agent key; overrides the stored credential
+  EXTROVERT_CONFIG_DIR     override the permission-restricted credential directory
+  EXTROVERT_MOCK           set to 1 for offline fixtures
+`;
+function parseTransportArgs(argv) {
+    const args = { http: false };
+    for (let index = 0; index < argv.length; index++) {
+        const arg = argv[index];
         switch (arg) {
             case "--http":
             case "--hosted":
@@ -24,66 +47,54 @@ function parseArgs(argv) {
                 args.http = false;
                 break;
             case "--port": {
-                const next = argv[++i];
-                if (next)
-                    args.port = Number.parseInt(next, 10);
+                const next = argv[++index];
+                if (!next)
+                    throw new Error("--port requires a value");
+                const port = Number(next);
+                if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+                    throw new Error("--port must be from 1 to 65535");
+                args.port = port;
                 break;
             }
             case "--host": {
-                const next = argv[++i];
-                if (next)
-                    args.host = next;
+                const next = argv[++index];
+                if (!next)
+                    throw new Error("--host requires a value");
+                args.host = next;
                 break;
             }
-            case "-h":
-            case "--help":
-                args.help = true;
-                break;
             default:
-                // Ignore unknown flags so MCP hosts can pass extras harmlessly.
+                // Retain compatibility with MCP hosts that append harmless flags.
                 break;
         }
     }
     return args;
 }
-const HELP = `extrovert-mcp — MCP server for Extrovert (a real mailbox for your agent, in one call)
-
-Usage:
-  extrovert-mcp [--http] [--port <n>] [--host <addr>]
-
-Transports:
-  (default)     stdio — for Claude Desktop, Claude Code, Cursor, and other local hosts
-  --http        hosted Streamable HTTP transport at POST /mcp (default port 8787)
-
-Environment:
-  EXTROVERT_API_BASE_URL   Base URL of the Extrovert REST API (default https://api.extrovert.dev)
-  EXTROVERT_API_KEY        Scoped agent key (pk_agent_…) or enrollment key (pk_enroll_…)
-  EXTROVERT_MOCK           Set to 1 to force offline fixture mode
-  PORT / HOST            Override --http bind (also honored by hosting platforms)
-
-Tools: redeem_enrollment, create_inbox, list_inboxes, get_inbox, update_inbox, delete_inbox,
-       send_email, reply_email, read_messages, list_threads, search, wait_for_email
-`;
 async function main() {
-    const args = parseArgs(process.argv.slice(2));
-    if (args.help) {
-        process.stdout.write(HELP);
+    const argv = process.argv.slice(2);
+    const first = argv[0];
+    if (first === "--help" || first === "-h") {
+        process.stdout.write(`${CLI_HELP}${TRANSPORT_HELP}`);
         return;
     }
+    if (first && CLI_COMMANDS.has(first)) {
+        process.exitCode = await runCli(argv);
+        return;
+    }
+    const args = parseTransportArgs(argv);
     if (args.http) {
-        const opts = {};
+        const options = {};
         if (args.port !== undefined)
-            opts.port = args.port;
+            options.port = args.port;
         if (args.host !== undefined)
-            opts.host = args.host;
-        await runHttp(opts);
-    }
-    else {
-        await runStdio();
+            options.host = args.host;
+        await runHttp(options);
+        return;
     }
+    await runStdio();
 }
-main().catch((err) => {
-    process.stderr.write(`extrovert-mcp: fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+main().catch((error) => {
+    process.stderr.write(`extrovert: fatal: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
     process.exit(1);
 });
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAStC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR;gBACE,gEAAgE;gBAChE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;CAiBZ,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAqC,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAQtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG;;;;;;;;;;;CAWtB,CAAC;AAEF,SAAS,kBAAkB,CAAC,IAAc;IACxC,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC/G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD;gBACE,kEAAkE;gBAClE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtD,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,EAAE,CAAC;AACnB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+import { type SpawnSyncReturns } from "node:child_process";
+import type { Readable, Writable } from "node:stream";
+import { type CredentialStore } from "./credentials.js";
+export declare const CLI_HELP = "extrovert \u2014 setup, authenticate, and use Extrovert without custom transport code\n\nUsage:\n  extrovert setup [--host codex|claude]\n  extrovert auth login --with-token\n  extrovert auth status\n  extrovert auth logout\n  extrovert signup --human-email <email> [--username <name>]\n  extrovert verify [--otp <code>]\n  extrovert whoami [--json]\n  extrovert inbox list [--limit <n>] [--json]\n  extrovert message list --inbox <address> [--unread] [--limit <n>] [--json]\n  extrovert message get <message-id> [--source] [--json]\n  extrovert review list [--state <state>] [--limit <n>] [--json]\n  extrovert review status <review-id> [--json]\n  extrovert send --inbox <address> --to <email> --subject <text> --text <body>\n                 --summary <reviewer-intent> [--client-id <id>] [--rules-reviewed]\n\nAuthentication:\n  signup stores only a short-lived pending key; verify atomically replaces it with\n  the full key in a permission-restricted local credential file. EXTROVERT_API_KEY\n  always takes precedence over the stored credential.\n\nMCP transport:\n  Running extrovert-mcp with no command starts stdio. The official plugin and\n  'extrovert setup' configure that published server directly.\n";
+export interface CliOptions {
+    env?: NodeJS.ProcessEnv;
+    stdin?: NodeJS.ReadStream | Readable;
+    stdout?: NodeJS.WriteStream | Writable;
+    stderr?: NodeJS.WriteStream | Writable;
+    credentialStore?: CredentialStore;
+    runCommand?: (command: string, args: string[]) => SpawnSyncReturns<string>;
+}
+export declare function runCli(argv: string[], options?: CliOptions): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map