@mx-space/cli 0.1.1 → 0.2.0

package/README.md

@@ -24,17 +24,18 @@ When the CLI cannot resolve an API URL, it starts an interactive onboarding prom
 
 ## Global Flags
 
-| Flag              | Effect                                                                        |
-| ----------------- | ----------------------------------------------------------------------------- |
-| `--json`          | Emit `{ ok: true, data }` on stdout. Takes precedence over `--output`.        |
-| `--output <mode>` | Output mode. Supported: `pretty-json`, `json`, `readable`, `llm`, `envelope`. |
-| `--api-url <url>` | Override the configured mx-core API origin.                                   |
-| `--token <token>` | Override the stored access token.                                             |
-| `--api-key <key>` | Authenticate with an API key through the `x-api-key` header.                  |
-| `--lang <code>`   | Request translated data for read commands, such as `ja` or `en`.              |
-| `--quiet`, `-q`   | Suppress non-error stderr messages.                                           |
-| `--verbose`       | Print HTTP method, URL, status, and duration to stderr.                       |
-| `--dry-run`       | Resolve payloads without mutating the server where supported.                 |
+| Flag               | Effect                                                                        |
+| ------------------ | ----------------------------------------------------------------------------- |
+| `--json`           | Emit `{ ok: true, data }` on stdout. Takes precedence over `--output`.        |
+| `--output <mode>`  | Output mode. Supported: `pretty-json`, `json`, `readable`, `llm`, `envelope`. |
+| `--api-url <url>`  | Override the configured mx-core API origin.                                   |
+| `--token <token>`  | Override the stored access token.                                             |
+| `--api-key <key>`  | Authenticate with an API key through the `x-api-key` header.                  |
+| `--lang <code>`    | Request translated data for read commands, such as `ja` or `en`.              |
+| `--quiet`, `-q`    | Suppress non-error stderr messages.                                           |
+| `--verbose`        | Print HTTP method, URL, status, and duration to stderr.                       |
+| `--dry-run`        | Resolve payloads without mutating the server where supported.                 |
+| `--profile <name>` | Profile to use (overrides `MXS_PROFILE` and the active pointer).              |
 
 `readable`, `llm`, and `envelope` are document output modes for `post get`, `note get`, and `page get`. `post list` additionally supports `readable` and `llm` for concise list summaries. Other commands keep their existing JSON-oriented output.
 
@@ -92,6 +93,73 @@ Better Auth session token instead; for that path the CLI calls Better Auth
 `/get-session`, accepts the refreshed `set-auth-token` header, and updates the
 local expiry from the refreshed session.
 
+### Auth and profiles
+
+`mxs auth login [--profile <name>] [--production]` writes credentials to the named profile. If `--profile` is omitted and a current profile is active, it refreshes that profile. If no current profile exists (fresh install), it creates and selects the `default` profile. Passing `--production` sets the production flag on the target profile after login succeeds.
+
+`mxs auth logout [--profile <name>]` clears credentials for the target profile; the profile directory and the `current` pointer are preserved.
+
+`mxs auth whoami` and `mxs auth status` scope to the active profile as resolved by the standard chain (see §Profiles below).
+
+## Profiles
+
+A profile is a named bundle of `(api_url, credentials)` stored under `~/.config/mxs/profiles/<name>/`. Switching profile switches both the URL and the credentials atomically, so a production token can never accidentally reach a development backend and vice versa.
+
+### Active profile
+
+The file `~/.config/mxs/current` contains the name of the default profile. This is the profile used when no override is present. You can override it per-invocation with `--profile <name>` or by setting `MXS_PROFILE=<name>` in the environment. The full resolution chain is: `--profile` flag → `MXS_PROFILE` env → `current` file. If none of these resolves to a valid profile and the command is not `profile`, `auth login --profile <name>`, or `--help`, the CLI exits with a `profile.none_active` error.
+
+### Profile commands
+
+| Command | Description |
+| --- | --- |
+| `mxs profile ls` | List profiles; current is marked with `*`; shows the production flag. |
+| `mxs profile show [<name>]` | Show api_url, authenticated user, production flag, and token expiry for the named profile (or the active one). Never prints the token. |
+| `mxs profile use <name>` | Set the active profile by writing `<name>` to `~/.config/mxs/current`. |
+| `mxs profile mark <name> --production` / `--no-production` | Toggle the production flag on a profile. |
+| `mxs profile rm <name>` | Delete a profile directory. Prompts for confirmation in TTY contexts; requires `--force` in non-TTY. |
+
+### Production-profile safety
+
+When a profile has `production: true`, the CLI prevents silent writes that occur only because the profile was inherited through the `current` pointer. A write command (`POST`, `PUT`, `PATCH`, `DELETE`) is blocked when: (1) the resolved profile is marked production, (2) the profile was selected only via the `current` file — not via `--profile` or `MXS_PROFILE`, and (3) the URL was not overridden with `--api-url` or `MXS_API_URL`. In that case the CLI refuses the request and emits:
+
+```json
+{ "ok": false, "error": "profile.write_requires_explicit",
+  "profile": "prod", "api_url": "https://blog.example.com",
+  "hint": "active profile 'prod' is production; retry with --profile prod or MXS_PROFILE=prod" }
+```
+
+Exit code is `4`. To proceed, supply an explicit signal of intent:
+
+```bash
+# Any of these bypasses the gate:
+mxs --profile prod post publish my-slug
+MXS_PROFILE=prod mxs post publish my-slug
+mxs --api-url https://blog.example.com post publish my-slug
+```
+
+Running `mxs profile use prod` and then issuing a write is **not** sufficient — the gate measures per-invocation explicitness, not session state.
+
+`mxs auth login` and `mxs auth logout` are exempt from the gate; they are not content writes.
+
+### Active-profile banner
+
+When the resolved profile is marked `production: true`, the CLI emits a single line to stderr before executing the command:
+
+```
+mxs: profile=prod (production) → https://blog.example.com
+```
+
+This banner is suppressed by `--quiet` / `-q` and never appears on stdout.
+
+### Profile name rules
+
+Profile names must match `^[a-z0-9_-]+$` and be 1–32 characters long. The name `current` is reserved and cannot be used.
+
+### Migration from the single-profile layout
+
+Existing installations that use the legacy flat files (`~/.config/mxs/config.json` and `~/.config/mxs/credentials.json`) are automatically migrated on the first run of the new CLI version. The legacy files are moved into `~/.config/mxs/profiles/default/` and `default` is written to `~/.config/mxs/current`. In TTY contexts, the CLI prompts once: `Is "<api_url>" a production environment? [y/N]` — answering yes sets `production: true` on the migrated profile. Non-TTY contexts skip the prompt and leave the flag unset. Migration runs at most once; subsequent invocations skip the check.
+
 ## Posts
 
 | Command                         | Description                                                                                             |
@@ -322,14 +390,15 @@ Use `--file -` to read an envelope from stdin.
 
 ## Configuration Files
 
-| File                             | Mode   | Purpose                                                         |
-| -------------------------------- | ------ | --------------------------------------------------------------- |
-| `~/.config/mxs/config.json`      | `0644` | API URL, API base, auth base, API version, and client id.       |
-| `~/.config/mxs/credentials.json` | `0600` | Access token, refresh token, expiry, and optional user profile. |
+| File                                       | Mode   | Purpose                                                                    |
+| ------------------------------------------ | ------ | -------------------------------------------------------------------------- |
+| `~/.config/mxs/current`                    | `0644` | Active profile name (single line).                                         |
+| `~/.config/mxs/profiles/<name>/config.json`      | `0644` | API URL, API base, auth base, API version, client id, and production flag. |
+| `~/.config/mxs/profiles/<name>/credentials.json` | `0600` | Access token, refresh token, expiry, and optional user profile.            |
 
-`XDG_CONFIG_HOME` changes the base directory. Credentials with wider permissions are automatically changed to `0600`.
+`XDG_CONFIG_HOME` changes the base directory. Profile directories are created with mode `0700`. Credentials files with wider permissions are automatically changed to `0600`.
 
-Example config:
+Example profile config:
 
 ```json
 {
@@ -337,7 +406,8 @@ Example config:
   "api_base": "https://blog.example.com/api/v2",
   "auth_base": "https://blog.example.com/api/v2/auth",
   "api_version": 2,
-  "client_id": "mxs-cli"
+  "client_id": "mxs-cli",
+  "production": true
 }
 ```
 
@@ -348,22 +418,23 @@ Example config:
 | `MXS_API_URL`     | API origin override.                                                     |
 | `MXS_TOKEN`       | Better Auth access token override; sent as `Authorization: Bearer`.      |
 | `MXS_API_KEY`     | API key override; sent as `x-api-key`.                                   |
+| `MXS_PROFILE`     | Profile to use; overrides the `current` pointer.                         |
 | `MXS_DEBUG=1`     | Enables verbose HTTP diagnostics in auth helpers.                        |
 | `EDITOR`          | Editor used by `post edit`, `note edit`, `page edit`, and `config edit`. |
 | `XDG_CONFIG_HOME` | Base directory for `mxs` config files.                                   |
 
 ## Exit Codes
 
-| Code | Meaning                                 |
-| ---- | --------------------------------------- |
-| `0`  | Success                                 |
-| `1`  | Generic failure                         |
-| `2`  | Argument parsing failure                |
-| `3`  | Authentication or authorization failure |
-| `4`  | Network failure                         |
-| `5`  | Validation or configuration failure     |
-| `6`  | Server 5xx failure                      |
-| `7`  | Resource not found                      |
+| Code | Meaning                                                                      |
+| ---- | ---------------------------------------------------------------------------- |
+| `0`  | Success                                                                      |
+| `1`  | Generic failure                                                              |
+| `2`  | Argument parsing failure                                                     |
+| `3`  | Authentication or authorization failure                                      |
+| `4`  | Network failure; also profile write gate (`profile.write_requires_explicit`) and no active profile (`profile.none_active`) |
+| `5`  | Validation or configuration failure                                          |
+| `6`  | Server 5xx failure                                                           |
+| `7`  | Resource not found                                                           |
 
 ## Troubleshooting
 
@@ -373,6 +444,8 @@ Example config:
 | `API URL is not configured`                        | Set `MXS_API_URL`, pass `--api-url`, or run `mxs auth login` in an interactive terminal.                                  |
 | `EDITOR is not set`                                | Set `EDITOR`, for example `EDITOR=vim`.                                                                                   |
 | API key no longer works in `Authorization: Bearer` | Use `--api-key` or `MXS_API_KEY` for API keys. Bearer auth is reserved for Better Auth session/OIDC access tokens.         |
+| `profile.write_requires_explicit` on a write command | The active profile is marked production. Retry with `--profile <name>` or `MXS_PROFILE=<name>` to confirm intent.        |
+| `profile.none_active`                              | No active profile set. Run `mxs auth login` to create one, or `mxs profile use <name>` to activate an existing profile.  |
 
 ## License
 

package/ROADMAP.md

@@ -1,5 +1,9 @@
 # `@mx-space/cli` Roadmap
 
+## Shipped in v0.2
+
+- Multi-environment profile system: named `(api_url, credentials)` bundles under `~/.config/mxs/profiles/<name>/`, `--profile` global flag, `MXS_PROFILE` env var, `mxs profile {ls,show,use,mark,rm}` subcommands, production write gate, and automatic migration from the legacy single-profile layout.
+
 ## v2
 
 - AI module commands
@@ -32,9 +36,6 @@
 - Export / import (content as files)
   - `mxs export <dir> [--type=post,note,page] [--format=markdown|litexml]`
   - `mxs import <dir> [--type=post] [--update-existing]`
-- Multi-profile
-  - `mxs use <name>`
-  - `~/.config/mxs/profiles.json`
 - Observability
   - `mxs logs tail`
   - `mxs metrics`

package/dist/{auth-OeKZZ_2x.mjs → auth-Duj8jJn9.mjs}

@@ -1,5 +1,5 @@
-import { s as MxsError } from "./output-BM7aBFwt.mjs";
-import { s as readCredentials, u as writeCredentials } from "./config-store-WL7dNMS6.mjs";
+import { C as MxsError } from "./output-Dg8PISJM.mjs";
+import { f as writeCredentials, l as readCredentials } from "./config-store-DmwX2iZU.mjs";
 //#region src/core/auth.ts
 const SUPPORTED_API_VERSIONS = [2];
 function defaultHttp() {
@@ -208,4 +208,4 @@ async function ensureFreshToken(authBase, clientId, http = defaultHttp()) {
 //#endregion
 export { loadCredentialsOrThrow as a, refreshAccessToken as c, isExpiringSoon as i, requestDeviceCode as l, defaultHttp as n, pollDeviceToken as o, ensureFreshToken as r, probeAuthEndpoint as s, SUPPORTED_API_VERSIONS as t, toCredentials as u };
 
-//# sourceMappingURL=auth-OeKZZ_2x.mjs.map
+//# sourceMappingURL=auth-Duj8jJn9.mjs.map

package/dist/{auth-OeKZZ_2x.mjs.map → auth-Duj8jJn9.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-OeKZZ_2x.mjs","names":[],"sources":["../src/core/auth.ts"],"sourcesContent":["import {\n  type CredentialsShape,\n  readCredentials,\n  writeCredentials,\n} from './config-store'\nimport { MxsError } from './errors'\n\nexport const SUPPORTED_API_VERSIONS = [2] as const\n\nexport interface DeviceCodeResponse {\n  device_code: string\n  user_code: string\n  verification_uri: string\n  verification_uri_complete?: string\n  expires_in: number\n  interval: number\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  refresh_token?: string\n  scope?: string\n  user?: {\n    id?: string\n    email?: string\n    name?: string\n  }\n}\n\nexport interface ProbeResult {\n  apiUrl: string\n  apiBase: string\n  authBase: string\n  apiVersion: number\n}\n\nexport interface AuthHttp {\n  fetch: typeof fetch\n}\n\nexport function defaultHttp(): AuthHttp {\n  return { fetch: globalThis.fetch.bind(globalThis) }\n}\n\nexport async function probeAuthEndpoint(\n  apiUrl: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<ProbeResult> {\n  const candidates: { prefix: string; version: number | null }[] = [\n    ...SUPPORTED_API_VERSIONS.map((v) => ({\n      prefix: `/api/v${v}/auth`,\n      version: v,\n    })),\n    { prefix: '/auth', version: null },\n  ]\n  for (const cand of candidates) {\n    const probeUrl = `${apiUrl}${cand.prefix}/ok`\n    let res: Response\n    try {\n      res = await http.fetch(probeUrl, { method: 'GET' })\n    } catch {\n      continue\n    }\n    if (res.ok) {\n      const apiVersion = cand.version ?? SUPPORTED_API_VERSIONS[0]\n      const apiBase =\n        cand.prefix === '/auth' ? apiUrl : `${apiUrl}/api/v${apiVersion}`\n      const authBase = `${apiUrl}${cand.prefix}`\n      return { apiUrl, apiBase, authBase, apiVersion }\n    }\n  }\n  throw new MxsError({\n    code: 'auth.probe',\n    message: 'cannot detect auth endpoint',\n    hint: 'verify the URL points at a running mx-core server',\n  })\n}\n\nexport async function requestDeviceCode(\n  authBase: string,\n  clientId: string,\n  scope = 'openid profile email',\n  http: AuthHttp = defaultHttp(),\n): Promise<DeviceCodeResponse> {\n  const res = await http.fetch(`${authBase}/device/code`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ client_id: clientId, scope }),\n  })\n  if (!res.ok) {\n    let body: unknown\n    try {\n      body = await res.json()\n    } catch {\n      body = await res.text()\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device code request failed (${res.status})`,\n      details: body,\n    })\n  }\n  return (await res.json()) as DeviceCodeResponse\n}\n\nexport interface PollOptions {\n  intervalSec: number\n  expiresInSec: number\n  signal?: AbortSignal\n  onTick?: (state: 'pending' | 'slow_down') => void\n  http?: AuthHttp\n}\n\nexport async function pollDeviceToken(\n  authBase: string,\n  clientId: string,\n  deviceCode: string,\n  opts: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const http = opts.http ?? defaultHttp()\n  const deadline = Date.now() + opts.expiresInSec * 1000\n  let intervalMs = Math.max(1, opts.intervalSec) * 1000\n  while (Date.now() < deadline) {\n    if (opts.signal?.aborted) {\n      throw new MxsError({ code: 'auth.denied', message: 'aborted by user' })\n    }\n    await sleep(intervalMs, opts.signal)\n    const res = await http.fetch(`${authBase}/device/token`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: deviceCode,\n        client_id: clientId,\n      }),\n    })\n    let body: any\n    try {\n      body = await res.json()\n    } catch {\n      body = null\n    }\n    if (res.ok && body?.access_token) {\n      return body as DeviceTokenResponse\n    }\n    const err = body?.error as string | undefined\n    if (err === 'authorization_pending') {\n      opts.onTick?.('pending')\n      continue\n    }\n    if (err === 'slow_down') {\n      intervalMs += 5000\n      opts.onTick?.('slow_down')\n      continue\n    }\n    if (err === 'access_denied') {\n      throw new MxsError({\n        code: 'auth.denied',\n        message: 'user denied the authorization request',\n      })\n    }\n    if (err === 'expired_token') {\n      throw new MxsError({\n        code: 'auth.expired',\n        message: 'device code expired before authorization completed',\n        hint: 'run `mxs auth login` again',\n      })\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device token request failed (${res.status})`,\n      details: body,\n    })\n  }\n  throw new MxsError({\n    code: 'auth.expired',\n    message: 'device authorization timed out',\n    hint: 'run `mxs auth login` again',\n  })\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) return reject(new Error('aborted'))\n    const timer = setTimeout(() => {\n      if (signal) signal.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    const onAbort = () => {\n      clearTimeout(timer)\n      reject(new Error('aborted'))\n    }\n    signal?.addEventListener('abort', onAbort, { once: true })\n  })\n}\n\nexport function toCredentials(resp: DeviceTokenResponse): CredentialsShape {\n  return {\n    access_token: resp.access_token,\n    refresh_token: resp.refresh_token,\n    expires_at: Date.now() + resp.expires_in * 1000,\n    user: resp.user,\n  }\n}\n\nexport function isExpiringSoon(\n  cred: CredentialsShape,\n  bufferMs = 60_000,\n): boolean {\n  return cred.expires_at < Date.now() + bufferMs\n}\n\nexport async function refreshAccessToken(\n  authBase: string,\n  clientId: string,\n  cred: CredentialsShape,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape | null> {\n  if (!cred.refresh_token) {\n    return refreshSessionToken(authBase, cred, http)\n  }\n  const res = await http.fetch(`${authBase}/token`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: cred.refresh_token,\n      client_id: clientId,\n    }),\n  })\n  if (!res.ok) return null\n  const body = (await res.json()) as DeviceTokenResponse\n  if (!body?.access_token) return null\n  return {\n    access_token: body.access_token,\n    refresh_token: body.refresh_token ?? cred.refresh_token,\n    expires_at: Date.now() + body.expires_in * 1000,\n    user: body.user ?? cred.user,\n  }\n}\n\nasync function refreshSessionToken(\n  authBase: string,\n  cred: CredentialsShape,\n  http: AuthHttp,\n): Promise<CredentialsShape | null> {\n  const res = await http.fetch(`${authBase}/get-session`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${cred.access_token}`,\n    },\n  })\n  if (!res.ok) return null\n  const body = (await res.json().catch(() => null)) as\n    | {\n        session?: { expiresAt?: string | Date | number }\n        user?: CredentialsShape['user']\n      }\n    | null\n  const expiresAt = normalizeExpiresAt(body?.session?.expiresAt)\n  if (!expiresAt || expiresAt <= cred.expires_at) return null\n  return {\n    access_token: res.headers.get('set-auth-token') ?? cred.access_token,\n    refresh_token: cred.refresh_token,\n    expires_at: expiresAt,\n    user: body?.user ?? cred.user,\n  }\n}\n\nfunction normalizeExpiresAt(value: string | Date | number | undefined) {\n  if (value === undefined) return null\n  const time =\n    value instanceof Date\n      ? value.getTime()\n      : typeof value === 'number'\n        ? value\n        : new Date(value).getTime()\n  return Number.isFinite(time) ? time : null\n}\n\nexport async function loadCredentialsOrThrow(): Promise<CredentialsShape> {\n  const cred = await readCredentials()\n  if (!cred) {\n    throw new MxsError({\n      code: 'auth.missing',\n      message: 'not authenticated',\n      hint: 'run `mxs auth login`',\n    })\n  }\n  return cred\n}\n\nexport async function ensureFreshToken(\n  authBase: string,\n  clientId: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape> {\n  const cred = await loadCredentialsOrThrow()\n  if (!isExpiringSoon(cred)) return cred\n  const refreshed = await refreshAccessToken(authBase, clientId, cred, http)\n  if (!refreshed) return cred\n  await writeCredentials(refreshed)\n  return refreshed\n}\n"],"mappings":";;;AAOA,MAAa,yBAAyB,CAAC,CAAC;AAmCxC,SAAgB,cAAwB;CACtC,OAAO,EAAE,OAAO,WAAW,MAAM,KAAK,UAAU,EAAE;AACpD;AAEA,eAAsB,kBACpB,QACA,OAAiB,YAAY,GACP;CACtB,MAAM,aAA2D,CAC/D,GAAG,uBAAuB,KAAK,OAAO;EACpC,QAAQ,SAAS,EAAE;EACnB,SAAS;CACX,EAAE,GACF;EAAE,QAAQ;EAAS,SAAS;CAAK,CACnC;CACA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,WAAW,GAAG,SAAS,KAAK,OAAO;EACzC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM,UAAU,EAAE,QAAQ,MAAM,CAAC;EACpD,QAAQ;GACN;EACF;EACA,IAAI,IAAI,IAAI;GACV,MAAM,aAAa,KAAK,WAAW,uBAAuB;GAI1D,OAAO;IAAE;IAAQ,SAFf,KAAK,WAAW,UAAU,SAAS,GAAG,OAAO,QAAQ;IAE7B,UAAA,GADN,SAAS,KAAK;IACE;GAAW;EACjD;CACF;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,eAAsB,kBACpB,UACA,UACA,QAAQ,wBACR,OAAiB,YAAY,GACA;CAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GAAE,WAAW;GAAU;EAAM,CAAC;CACrD,CAAC;CACD,IAAI,CAAC,IAAI,IAAI;EACX,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO,MAAM,IAAI,KAAK;EACxB;EACA,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,+BAA+B,IAAI,OAAO;GACnD,SAAS;EACX,CAAC;CACH;CACA,OAAQ,MAAM,IAAI,KAAK;AACzB;AAUA,eAAsB,gBACpB,UACA,UACA,YACA,MAC8B;CAC9B,MAAM,OAAO,KAAK,QAAQ,YAAY;CACtC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,eAAe;CAClD,IAAI,aAAa,KAAK,IAAI,GAAG,KAAK,WAAW,IAAI;CACjD,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,IAAI,KAAK,QAAQ,SACf,MAAM,IAAI,SAAS;GAAE,MAAM;GAAe,SAAS;EAAkB,CAAC;EAExE,MAAM,MAAM,YAAY,KAAK,MAAM;EACnC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,gBAAgB;GACvD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;GACb,CAAC;EACH,CAAC;EACD,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO;EACT;EACA,IAAI,IAAI,MAAM,MAAM,cAClB,OAAO;EAET,MAAM,MAAM,MAAM;EAClB,IAAI,QAAQ,yBAAyB;GACnC,KAAK,SAAS,SAAS;GACvB;EACF;EACA,IAAI,QAAQ,aAAa;GACvB,cAAc;GACd,KAAK,SAAS,WAAW;GACzB;EACF;EACA,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;EACX,CAAC;EAEH,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;GACT,MAAM;EACR,CAAC;EAEH,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,gCAAgC,IAAI,OAAO;GACpD,SAAS;EACX,CAAC;CACH;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,SAAS,MAAM,IAAY,QAAqC;CAC9D,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS,OAAO,uBAAO,IAAI,MAAM,SAAS,CAAC;EACvD,MAAM,QAAQ,iBAAiB;GAC7B,IAAI,QAAQ,OAAO,oBAAoB,SAAS,OAAO;GACvD,QAAQ;EACV,GAAG,EAAE;EACL,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,uBAAO,IAAI,MAAM,SAAS,CAAC;EAC7B;EACA,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;AAEA,SAAgB,cAAc,MAA6C;CACzE,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK;EACpB,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK;CACb;AACF;AAEA,SAAgB,eACd,MACA,WAAW,KACF;CACT,OAAO,KAAK,aAAa,KAAK,IAAI,IAAI;AACxC;AAEA,eAAsB,mBACpB,UACA,UACA,MACA,OAAiB,YAAY,GACK;CAClC,IAAI,CAAC,KAAK,eACR,OAAO,oBAAoB,UAAU,MAAM,IAAI;CAEjD,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,SAAS;EAChD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,eAAe,KAAK;GACpB,WAAW;EACb,CAAC;CACH,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,MAAM,cAAc,OAAO;CAChC,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK,iBAAiB,KAAK;EAC1C,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK,QAAQ,KAAK;CAC1B;AACF;AAEA,eAAe,oBACb,UACA,MACA,MACkC;CAClC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,KAAK;EAChC;CACF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,YAAY,IAAI;CAM/C,MAAM,YAAY,mBAAmB,MAAM,SAAS,SAAS;CAC7D,IAAI,CAAC,aAAa,aAAa,KAAK,YAAY,OAAO;CACvD,OAAO;EACL,cAAc,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK;EACxD,eAAe,KAAK;EACpB,YAAY;EACZ,MAAM,MAAM,QAAQ,KAAK;CAC3B;AACF;AAEA,SAAS,mBAAmB,OAA2C;CACrE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,OACJ,iBAAiB,OACb,MAAM,QAAQ,IACd,OAAO,UAAU,WACf,QACA,IAAI,KAAK,KAAK,EAAE,QAAQ;CAChC,OAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AACxC;AAEA,eAAsB,yBAAoD;CACxE,MAAM,OAAO,MAAM,gBAAgB;CACnC,IAAI,CAAC,MACH,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CAEH,OAAO;AACT;AAEA,eAAsB,iBACpB,UACA,UACA,OAAiB,YAAY,GACF;CAC3B,MAAM,OAAO,MAAM,uBAAuB;CAC1C,IAAI,CAAC,eAAe,IAAI,GAAG,OAAO;CAClC,MAAM,YAAY,MAAM,mBAAmB,UAAU,UAAU,MAAM,IAAI;CACzE,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,iBAAiB,SAAS;CAChC,OAAO;AACT"}
+{"version":3,"file":"auth-Duj8jJn9.mjs","names":[],"sources":["../src/core/auth.ts"],"sourcesContent":["import {\n  type CredentialsShape,\n  readCredentials,\n  writeCredentials,\n} from './config-store'\nimport { MxsError } from './errors'\n\nexport const SUPPORTED_API_VERSIONS = [2] as const\n\nexport interface DeviceCodeResponse {\n  device_code: string\n  user_code: string\n  verification_uri: string\n  verification_uri_complete?: string\n  expires_in: number\n  interval: number\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  refresh_token?: string\n  scope?: string\n  user?: {\n    id?: string\n    email?: string\n    name?: string\n  }\n}\n\nexport interface ProbeResult {\n  apiUrl: string\n  apiBase: string\n  authBase: string\n  apiVersion: number\n}\n\nexport interface AuthHttp {\n  fetch: typeof fetch\n}\n\nexport function defaultHttp(): AuthHttp {\n  return { fetch: globalThis.fetch.bind(globalThis) }\n}\n\nexport async function probeAuthEndpoint(\n  apiUrl: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<ProbeResult> {\n  const candidates: { prefix: string; version: number | null }[] = [\n    ...SUPPORTED_API_VERSIONS.map((v) => ({\n      prefix: `/api/v${v}/auth`,\n      version: v,\n    })),\n    { prefix: '/auth', version: null },\n  ]\n  for (const cand of candidates) {\n    const probeUrl = `${apiUrl}${cand.prefix}/ok`\n    let res: Response\n    try {\n      res = await http.fetch(probeUrl, { method: 'GET' })\n    } catch {\n      continue\n    }\n    if (res.ok) {\n      const apiVersion = cand.version ?? SUPPORTED_API_VERSIONS[0]\n      const apiBase =\n        cand.prefix === '/auth' ? apiUrl : `${apiUrl}/api/v${apiVersion}`\n      const authBase = `${apiUrl}${cand.prefix}`\n      return { apiUrl, apiBase, authBase, apiVersion }\n    }\n  }\n  throw new MxsError({\n    code: 'auth.probe',\n    message: 'cannot detect auth endpoint',\n    hint: 'verify the URL points at a running mx-core server',\n  })\n}\n\nexport async function requestDeviceCode(\n  authBase: string,\n  clientId: string,\n  scope = 'openid profile email',\n  http: AuthHttp = defaultHttp(),\n): Promise<DeviceCodeResponse> {\n  const res = await http.fetch(`${authBase}/device/code`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ client_id: clientId, scope }),\n  })\n  if (!res.ok) {\n    let body: unknown\n    try {\n      body = await res.json()\n    } catch {\n      body = await res.text()\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device code request failed (${res.status})`,\n      details: body,\n    })\n  }\n  return (await res.json()) as DeviceCodeResponse\n}\n\nexport interface PollOptions {\n  intervalSec: number\n  expiresInSec: number\n  signal?: AbortSignal\n  onTick?: (state: 'pending' | 'slow_down') => void\n  http?: AuthHttp\n}\n\nexport async function pollDeviceToken(\n  authBase: string,\n  clientId: string,\n  deviceCode: string,\n  opts: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const http = opts.http ?? defaultHttp()\n  const deadline = Date.now() + opts.expiresInSec * 1000\n  let intervalMs = Math.max(1, opts.intervalSec) * 1000\n  while (Date.now() < deadline) {\n    if (opts.signal?.aborted) {\n      throw new MxsError({ code: 'auth.denied', message: 'aborted by user' })\n    }\n    await sleep(intervalMs, opts.signal)\n    const res = await http.fetch(`${authBase}/device/token`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: deviceCode,\n        client_id: clientId,\n      }),\n    })\n    let body: any\n    try {\n      body = await res.json()\n    } catch {\n      body = null\n    }\n    if (res.ok && body?.access_token) {\n      return body as DeviceTokenResponse\n    }\n    const err = body?.error as string | undefined\n    if (err === 'authorization_pending') {\n      opts.onTick?.('pending')\n      continue\n    }\n    if (err === 'slow_down') {\n      intervalMs += 5000\n      opts.onTick?.('slow_down')\n      continue\n    }\n    if (err === 'access_denied') {\n      throw new MxsError({\n        code: 'auth.denied',\n        message: 'user denied the authorization request',\n      })\n    }\n    if (err === 'expired_token') {\n      throw new MxsError({\n        code: 'auth.expired',\n        message: 'device code expired before authorization completed',\n        hint: 'run `mxs auth login` again',\n      })\n    }\n    throw new MxsError({\n      code: 'auth.denied',\n      message: `device token request failed (${res.status})`,\n      details: body,\n    })\n  }\n  throw new MxsError({\n    code: 'auth.expired',\n    message: 'device authorization timed out',\n    hint: 'run `mxs auth login` again',\n  })\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) return reject(new Error('aborted'))\n    const timer = setTimeout(() => {\n      if (signal) signal.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    const onAbort = () => {\n      clearTimeout(timer)\n      reject(new Error('aborted'))\n    }\n    signal?.addEventListener('abort', onAbort, { once: true })\n  })\n}\n\nexport function toCredentials(resp: DeviceTokenResponse): CredentialsShape {\n  return {\n    access_token: resp.access_token,\n    refresh_token: resp.refresh_token,\n    expires_at: Date.now() + resp.expires_in * 1000,\n    user: resp.user,\n  }\n}\n\nexport function isExpiringSoon(\n  cred: CredentialsShape,\n  bufferMs = 60_000,\n): boolean {\n  return cred.expires_at < Date.now() + bufferMs\n}\n\nexport async function refreshAccessToken(\n  authBase: string,\n  clientId: string,\n  cred: CredentialsShape,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape | null> {\n  if (!cred.refresh_token) {\n    return refreshSessionToken(authBase, cred, http)\n  }\n  const res = await http.fetch(`${authBase}/token`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: cred.refresh_token,\n      client_id: clientId,\n    }),\n  })\n  if (!res.ok) return null\n  const body = (await res.json()) as DeviceTokenResponse\n  if (!body?.access_token) return null\n  return {\n    access_token: body.access_token,\n    refresh_token: body.refresh_token ?? cred.refresh_token,\n    expires_at: Date.now() + body.expires_in * 1000,\n    user: body.user ?? cred.user,\n  }\n}\n\nasync function refreshSessionToken(\n  authBase: string,\n  cred: CredentialsShape,\n  http: AuthHttp,\n): Promise<CredentialsShape | null> {\n  const res = await http.fetch(`${authBase}/get-session`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${cred.access_token}`,\n    },\n  })\n  if (!res.ok) return null\n  const body = (await res.json().catch(() => null)) as\n    | {\n        session?: { expiresAt?: string | Date | number }\n        user?: CredentialsShape['user']\n      }\n    | null\n  const expiresAt = normalizeExpiresAt(body?.session?.expiresAt)\n  if (!expiresAt || expiresAt <= cred.expires_at) return null\n  return {\n    access_token: res.headers.get('set-auth-token') ?? cred.access_token,\n    refresh_token: cred.refresh_token,\n    expires_at: expiresAt,\n    user: body?.user ?? cred.user,\n  }\n}\n\nfunction normalizeExpiresAt(value: string | Date | number | undefined) {\n  if (value === undefined) return null\n  const time =\n    value instanceof Date\n      ? value.getTime()\n      : typeof value === 'number'\n        ? value\n        : new Date(value).getTime()\n  return Number.isFinite(time) ? time : null\n}\n\nexport async function loadCredentialsOrThrow(): Promise<CredentialsShape> {\n  const cred = await readCredentials()\n  if (!cred) {\n    throw new MxsError({\n      code: 'auth.missing',\n      message: 'not authenticated',\n      hint: 'run `mxs auth login`',\n    })\n  }\n  return cred\n}\n\nexport async function ensureFreshToken(\n  authBase: string,\n  clientId: string,\n  http: AuthHttp = defaultHttp(),\n): Promise<CredentialsShape> {\n  const cred = await loadCredentialsOrThrow()\n  if (!isExpiringSoon(cred)) return cred\n  const refreshed = await refreshAccessToken(authBase, clientId, cred, http)\n  if (!refreshed) return cred\n  await writeCredentials(refreshed)\n  return refreshed\n}\n"],"mappings":";;;AAOA,MAAa,yBAAyB,CAAC,CAAC;AAmCxC,SAAgB,cAAwB;CACtC,OAAO,EAAE,OAAO,WAAW,MAAM,KAAK,UAAU,EAAE;AACpD;AAEA,eAAsB,kBACpB,QACA,OAAiB,YAAY,GACP;CACtB,MAAM,aAA2D,CAC/D,GAAG,uBAAuB,KAAK,OAAO;EACpC,QAAQ,SAAS,EAAE;EACnB,SAAS;CACX,EAAE,GACF;EAAE,QAAQ;EAAS,SAAS;CAAK,CACnC;CACA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,WAAW,GAAG,SAAS,KAAK,OAAO;EACzC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM,UAAU,EAAE,QAAQ,MAAM,CAAC;EACpD,QAAQ;GACN;EACF;EACA,IAAI,IAAI,IAAI;GACV,MAAM,aAAa,KAAK,WAAW,uBAAuB;GAI1D,OAAO;IAAE;IAAQ,SAFf,KAAK,WAAW,UAAU,SAAS,GAAG,OAAO,QAAQ;IAE7B,UAAA,GADN,SAAS,KAAK;IACE;GAAW;EACjD;CACF;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,eAAsB,kBACpB,UACA,UACA,QAAQ,wBACR,OAAiB,YAAY,GACA;CAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GAAE,WAAW;GAAU;EAAM,CAAC;CACrD,CAAC;CACD,IAAI,CAAC,IAAI,IAAI;EACX,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO,MAAM,IAAI,KAAK;EACxB;EACA,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,+BAA+B,IAAI,OAAO;GACnD,SAAS;EACX,CAAC;CACH;CACA,OAAQ,MAAM,IAAI,KAAK;AACzB;AAUA,eAAsB,gBACpB,UACA,UACA,YACA,MAC8B;CAC9B,MAAM,OAAO,KAAK,QAAQ,YAAY;CACtC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,eAAe;CAClD,IAAI,aAAa,KAAK,IAAI,GAAG,KAAK,WAAW,IAAI;CACjD,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,IAAI,KAAK,QAAQ,SACf,MAAM,IAAI,SAAS;GAAE,MAAM;GAAe,SAAS;EAAkB,CAAC;EAExE,MAAM,MAAM,YAAY,KAAK,MAAM;EACnC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,gBAAgB;GACvD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;GACb,CAAC;EACH,CAAC;EACD,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,KAAK;EACxB,QAAQ;GACN,OAAO;EACT;EACA,IAAI,IAAI,MAAM,MAAM,cAClB,OAAO;EAET,MAAM,MAAM,MAAM;EAClB,IAAI,QAAQ,yBAAyB;GACnC,KAAK,SAAS,SAAS;GACvB;EACF;EACA,IAAI,QAAQ,aAAa;GACvB,cAAc;GACd,KAAK,SAAS,WAAW;GACzB;EACF;EACA,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;EACX,CAAC;EAEH,IAAI,QAAQ,iBACV,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS;GACT,MAAM;EACR,CAAC;EAEH,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,SAAS,gCAAgC,IAAI,OAAO;GACpD,SAAS;EACX,CAAC;CACH;CACA,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH;AAEA,SAAS,MAAM,IAAY,QAAqC;CAC9D,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS,OAAO,uBAAO,IAAI,MAAM,SAAS,CAAC;EACvD,MAAM,QAAQ,iBAAiB;GAC7B,IAAI,QAAQ,OAAO,oBAAoB,SAAS,OAAO;GACvD,QAAQ;EACV,GAAG,EAAE;EACL,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,uBAAO,IAAI,MAAM,SAAS,CAAC;EAC7B;EACA,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;AAEA,SAAgB,cAAc,MAA6C;CACzE,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK;EACpB,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK;CACb;AACF;AAEA,SAAgB,eACd,MACA,WAAW,KACF;CACT,OAAO,KAAK,aAAa,KAAK,IAAI,IAAI;AACxC;AAEA,eAAsB,mBACpB,UACA,UACA,MACA,OAAiB,YAAY,GACK;CAClC,IAAI,CAAC,KAAK,eACR,OAAO,oBAAoB,UAAU,MAAM,IAAI;CAEjD,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,SAAS;EAChD,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,eAAe,KAAK;GACpB,WAAW;EACb,CAAC;CACH,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,MAAM,cAAc,OAAO;CAChC,OAAO;EACL,cAAc,KAAK;EACnB,eAAe,KAAK,iBAAiB,KAAK;EAC1C,YAAY,KAAK,IAAI,IAAI,KAAK,aAAa;EAC3C,MAAM,KAAK,QAAQ,KAAK;CAC1B;AACF;AAEA,eAAe,oBACb,UACA,MACA,MACkC;CAClC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,eAAe;EACtD,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,KAAK;EAChC;CACF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,MAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,YAAY,IAAI;CAM/C,MAAM,YAAY,mBAAmB,MAAM,SAAS,SAAS;CAC7D,IAAI,CAAC,aAAa,aAAa,KAAK,YAAY,OAAO;CACvD,OAAO;EACL,cAAc,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK;EACxD,eAAe,KAAK;EACpB,YAAY;EACZ,MAAM,MAAM,QAAQ,KAAK;CAC3B;AACF;AAEA,SAAS,mBAAmB,OAA2C;CACrE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,OACJ,iBAAiB,OACb,MAAM,QAAQ,IACd,OAAO,UAAU,WACf,QACA,IAAI,KAAK,KAAK,EAAE,QAAQ;CAChC,OAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AACxC;AAEA,eAAsB,yBAAoD;CACxE,MAAM,OAAO,MAAM,gBAAgB;CACnC,IAAI,CAAC,MACH,MAAM,IAAI,SAAS;EACjB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CAEH,OAAO;AACT;AAEA,eAAsB,iBACpB,UACA,UACA,OAAiB,YAAY,GACF;CAC3B,MAAM,OAAO,MAAM,uBAAuB;CAC1C,IAAI,CAAC,eAAe,IAAI,GAAG,OAAO;CAClC,MAAM,YAAY,MAAM,mBAAmB,UAAU,UAAU,MAAM,IAAI;CACzE,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,iBAAiB,SAAS;CAChC,OAAO;AACT"}

package/dist/bin/mxs.d.mts

@@ -1,4 +1,4 @@
-import { t as OutputOptions } from "../output-CTnO1lYt.mjs";
+import { t as OutputOptions } from "../output-DQMhacTo.mjs";
 
 //#region ../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/typings/index.d.ts
 // Type definitions for commander
@@ -920,6 +920,7 @@ interface GlobalOptions {
   quiet?: boolean;
   verbose?: boolean;
   dryRun?: boolean;
+  profile?: string;
 }
 declare function readGlobalOptions(cmd: Command): OutputOptions;
 declare function readGlobalFlags(cmd: Command): GlobalOptions;