@obov/mext 0.0.0-stage → 0.2.0

package/dist/cli/login.js

@@ -0,0 +1,284 @@
+import { browserDecision, systemBrowserOpener } from "../remote/browser.js";
+import { createRemoteClient, RemoteUnauthorizedError } from "../remote/client.js";
+import { canonicalServerUrl, credentialStore, envPrefix } from "../remote/credentials.js";
+import { authorizationCodeLogin, deviceLogin, discoverLoginTarget, OAuthFlowError, parseRedirectUrl, } from "../remote/oauth.js";
+import { table } from "./help.js";
+import { createLineReader } from "./io.js";
+import { CliInterrupted, EXIT, formatJson } from "./output.js";
+/**
+ * <bin> login — MCP authorization (OAuth 2.1 · PKCE) 로 토큰 발급 · 저장. 서버 URL 별 (키체인 · credentials.json).
+ * redirect = loopback (127.0.0.1) 또는 붙여넣은 redirect URL (TTY). device flow = 인가 서버가 지원할 때 (--device,
+ * 브라우저를 열지 않는 환경이면 자동). --with-token = stdin 한 줄을 API key 로 저장.
+ */
+export function loginCommand(options) {
+    return (argv, io) => runLoginWith(options, argv, io);
+}
+/** mext login */
+export const runLogin = loginCommand({ bin: "mext" });
+async function runLoginWith(options, argv, io) {
+    const opts = { browser: true, withToken: false, json: false };
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        const eq = tok.indexOf("=");
+        const name = tok.startsWith("--") && eq > 0 ? tok.slice(0, eq) : tok;
+        const value = () => (eq > 0 && tok.startsWith("--") ? tok.slice(eq + 1) : argv[++i]);
+        if (name === "-h" || name === "--help") {
+            io.stdout.write(loginHelp(options));
+            return EXIT.ok;
+        }
+        else if (name === "--json")
+            opts.json = true;
+        else if (name === "--no-browser")
+            opts.browser = false;
+        else if (name === "--device")
+            opts.device = true;
+        else if (name === "--no-device")
+            opts.device = false;
+        else if (name === "--with-token")
+            opts.withToken = true;
+        else if (name === "--url")
+            opts.url = value();
+        else if (name === "--client-id")
+            opts.clientId = value();
+        else if (name === "--scope")
+            opts.scope = value();
+        else if (name === "--port") {
+            const raw = value();
+            const port = Number(raw);
+            if (!Number.isInteger(port) || port < 0 || port > 65_535) {
+                return usage(io, options, `--port must be a port number (got "${raw}")`);
+            }
+            opts.port = port;
+        }
+        else
+            return usage(io, options, `unknown argument ${tok}`);
+    }
+    const url = resolveServerUrl(options, opts.url, io);
+    if (typeof url !== "string")
+        return usage(io, options, url.error);
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(new CliInterrupted());
+    if (io.signal?.aborted)
+        onAbort();
+    io.signal?.addEventListener("abort", onAbort, { once: true });
+    const reader = createLineReader(io);
+    try {
+        const store = credentialStore({ env: io.env, bin: options.bin });
+        const server = canonicalServerUrl(url);
+        if (opts.withToken) {
+            const line = await reader.question(io.isTTY ? "Paste the token and press Enter: " : "", controller.signal);
+            if (controller.signal.aborted)
+                throw new CliInterrupted();
+            const token = line?.trim() ?? "";
+            if (token === "")
+                return usage(io, options, "--with-token reads the token from stdin (got nothing)");
+            // 저장 전에 확인 (거부된 토큰은 저장하지 않는다)
+            await createRemoteClient({ url, token: () => token }).listTools({ signal: controller.signal });
+            await store.set(url, { access_token: token, token_type: "Bearer" });
+            if (opts.json)
+                io.stdout.write(formatJson({ url: server, storage: store.location, flow: "token" }));
+            else
+                io.stderr.write(`Token saved for ${server} to ${store.location}.\n`);
+            return EXIT.ok;
+        }
+        // 토큰 없는 요청의 401 → WWW-Authenticate (resource_metadata · scope). 401 이 아니면 well-known 탐색
+        let challenge;
+        try {
+            await createRemoteClient({ url }).listTools({ signal: controller.signal });
+        }
+        catch (error) {
+            if (error instanceof RemoteUnauthorizedError)
+                challenge = error.challenge;
+            else if (controller.signal.aborted)
+                throw new CliInterrupted();
+            else
+                throw error;
+        }
+        const doFetch = options.fetch ?? fetch;
+        const target = await discoverLoginTarget({
+            serverUrl: url,
+            ...(challenge ? { challenge } : {}),
+            ...(opts.scope !== undefined ? { scope: opts.scope } : {}),
+            fetch: doFetch,
+        });
+        const decision = opts.browser
+            ? browserDecision(io.env, options.platform ?? process.platform)
+            : { open: false };
+        const open = options.openBrowser ?? systemBrowserOpener(io.env, options.platform ?? process.platform);
+        const hasDevice = typeof target.as.device_authorization_endpoint === "string";
+        if (opts.device === true && !hasDevice) {
+            throw new OAuthFlowError(`${target.as.issuer} does not support the device authorization grant (no device_authorization_endpoint). ` +
+                "Run login without --device.");
+        }
+        // D5: 자동 device flow = 인가 서버 지원 + 환경 때문에 브라우저를 열지 않음 (SSH · display 없음) + --port · --no-device 없음.
+        // --no-browser 는 사용자 선택이라 loopback · 붙여넣기 유지
+        const useDevice = opts.device === true ||
+            (opts.device === undefined && hasDevice && decision.reason !== undefined && opts.port === undefined);
+        const common = {
+            clientName: options.bin,
+            signal: controller.signal,
+            fetch: doFetch,
+            ...(opts.clientId !== undefined ? { clientId: opts.clientId } : {}),
+        };
+        let credentials;
+        if (useDevice) {
+            credentials = await deviceLogin(target, {
+                ...common,
+                ...(options.sleep ? { sleep: options.sleep } : {}),
+                onDeviceCode(device) {
+                    printDeviceCode(io, opts.json, url, device, decision);
+                    if (decision.open)
+                        open(device.verification_uri_complete ?? device.verification_uri);
+                },
+            });
+        }
+        else {
+            credentials = await authorizationCodeLogin(target, {
+                ...common,
+                ...(opts.port !== undefined ? { port: opts.port } : {}),
+                onAuthorizationUrl(authorizeUrl, loopback) {
+                    io.stderr.write([
+                        decision.open
+                            ? `Opening a browser to log in to ${url}. If it does not open, visit:`
+                            : `Open this URL in a browser to log in to ${url}:`,
+                        "",
+                        `  ${authorizeUrl}`,
+                        "",
+                        `Waiting for the redirect to ${loopback.redirectUri}`,
+                        `(browser on another machine: ${io.isTTY ? "paste the redirect URL from its address bar below, or " : ""}` +
+                            `ssh -L ${loopback.port}:127.0.0.1:${loopback.port} <this host> with --port)`,
+                        "",
+                    ].join("\n"));
+                    if (decision.open)
+                        open(authorizeUrl);
+                },
+                // 붙여넣기는 TTY 에서만 (파이프 stdin 은 다른 용도일 수 있음)
+                ...(io.isTTY
+                    ? {
+                        async readRedirect(signal) {
+                            for (;;) {
+                                const line = await reader.question("Redirect URL: ", signal);
+                                if (line === undefined) {
+                                    if (signal.aborted)
+                                        io.stderr.write("\n"); // loopback 이 먼저: 프롬프트 줄 닫기
+                                    return undefined;
+                                }
+                                const query = parseRedirectUrl(line);
+                                if (query)
+                                    return query;
+                                if (line.trim() !== "")
+                                    io.stderr.write("Not a redirect URL. Paste the full URL from the browser address bar.\n");
+                            }
+                        },
+                    }
+                    : {}),
+            });
+        }
+        await store.set(url, credentials);
+        // 발급 토큰으로 확인 요청
+        await createRemoteClient({ url, token: () => credentials.access_token }).listTools({ signal: controller.signal });
+        if (opts.json) {
+            const out = {
+                url: server,
+                storage: store.location,
+                issuer: credentials.issuer,
+                flow: useDevice ? "device" : "authorization_code",
+            };
+            if (credentials.scope !== undefined)
+                out.scope = credentials.scope;
+            if (credentials.expires_at !== undefined)
+                out.expires_at = new Date(credentials.expires_at).toISOString();
+            io.stdout.write(formatJson(out));
+        }
+        else {
+            io.stderr.write(`Logged in to ${server}. Token saved to ${store.location}.\n`);
+        }
+        return EXIT.ok;
+    }
+    catch (error) {
+        if (controller.signal.aborted || error instanceof CliInterrupted) {
+            io.stderr.write(opts.json ? formatJson({ code: "INTERRUPTED", message: "Interrupted." }) : "error: Interrupted.\n");
+            return EXIT.interrupted;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        const unauthorized = error instanceof RemoteUnauthorizedError;
+        const code = error instanceof OAuthFlowError || unauthorized ? "LOGIN_FAILED" : "REMOTE_ERROR";
+        const text = unauthorized && opts.withToken ? `The server rejected the token (${message})` : message;
+        io.stderr.write(opts.json ? formatJson({ code, message: text }) : `error: login failed: ${text}\n`);
+        return unauthorized ? EXIT.auth : EXIT.error;
+    }
+    finally {
+        reader.close();
+        io.signal?.removeEventListener("abort", onAbort);
+    }
+}
+/**
+ * device flow 안내 (D5). TTY 이고 --json 아님 = 사람용 텍스트, 그 외 = JSON 한 줄
+ * { verification_uri, verification_uri_complete?, user_code, expires_in } (stderr, stdout 은 결과 전용). 이후 polling 계속
+ */
+function printDeviceCode(io, json, url, device, decision) {
+    if (json || !io.isTTY) {
+        const line = { verification_uri: device.verification_uri };
+        if (device.verification_uri_complete !== undefined)
+            line.verification_uri_complete = device.verification_uri_complete;
+        line.user_code = device.user_code;
+        line.expires_in = device.expires_in;
+        io.stderr.write(`${JSON.stringify(line)}\n`);
+        return;
+    }
+    const minutes = Math.max(1, Math.round(device.expires_in / 60));
+    io.stderr.write([
+        `${decision.open ? "Opening a browser" : "Open this URL in a browser"} to log in to ${url}:`,
+        "",
+        `  ${device.verification_uri_complete ?? device.verification_uri}`,
+        "",
+        `and confirm the code: ${device.user_code}  (expires in ${minutes} min)`,
+        "Waiting for authorization...",
+        "",
+    ].join("\n"));
+}
+/** 서버 URL = --url → 고정 URL (고객 CLI) → <BIN>_URL */
+export function resolveServerUrl(options, flag, io) {
+    const envName = `${envPrefix(options.bin)}_URL`;
+    const url = flag ?? options.url ?? (io.env[envName] || undefined);
+    if (url === undefined || url === "")
+        return { error: `--url <url> is required (or set ${envName})` };
+    if (!/^https?:\/\//i.test(url))
+        return { error: `--url must be an http(s) URL (got "${url}")` };
+    return url;
+}
+function usage(io, options, message) {
+    io.stderr.write(`error: ${message}\n\n${loginHelp(options)}`);
+    return EXIT.usage;
+}
+function loginHelp(options) {
+    const { bin } = options;
+    const prefix = envPrefix(bin);
+    const rows = [
+        ["--url <url>", options.url ? `MCP endpoint (default: ${options.url})` : `MCP endpoint (default: ${prefix}_URL)`],
+        ["--client-id <id>", "Pre-registered OAuth client ID or Client ID Metadata Document URL (default: dynamic registration)"],
+        ["--scope <scopes>", "Space-separated scopes (default: server challenge or scopes_supported)"],
+        ["--port <port>", "Loopback redirect port on 127.0.0.1 (default: random)"],
+        ["--no-browser", "Print the authorization URL without opening a browser"],
+        ["--device", "Use the device authorization grant (if the authorization server supports it)"],
+        ["--no-device", "Never switch to the device authorization grant automatically"],
+        ["--with-token", "Read a token (API key) from stdin and store it"],
+        ["--json", "Print the result as JSON"],
+        ["-h, --help", "Show help"],
+    ];
+    return [
+        "Log in to a remote server (OAuth 2.1 authorization code + PKCE, loopback redirect).",
+        `The token is stored per server URL (OS keychain, or ~/.config/${bin}/credentials.json; ${prefix}_NO_KEYRING=1 = file only).`,
+        "Over SSH or without a display the browser is not opened: paste the redirect URL, or the device flow is used",
+        "when the authorization server supports it.",
+        "",
+        "Usage:",
+        `  ${bin} login${options.url ? "" : " --url <url>"} [flags]`,
+        `  echo "$TOKEN" | ${bin} login${options.url ? "" : " --url <url>"} --with-token`,
+        "",
+        "Flags:",
+        ...table(rows).map((l) => `  ${l}`),
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/cli/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAA4C,MAAM,sBAAsB,CAAA;AACrH,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAwB,MAAM,qBAAqB,CAAA;AACvG,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAA0B,MAAM,0BAA0B,CAAA;AACjH,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GAEjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAc,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAiC9D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA2B;IACtD,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,iBAAiB;AACjB,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;AAErD,KAAK,UAAU,YAAY,CAAC,OAA2B,EAAE,IAAuB,EAAE,EAAS;IACzF,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACpE,MAAM,KAAK,GAAG,GAAuB,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACxG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;YACnC,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;aACzC,IAAI,IAAI,KAAK,cAAc;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;aACjD,IAAI,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;aAC3C,IAAI,IAAI,KAAK,aAAa;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;aAC/C,IAAI,IAAI,KAAK,cAAc;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;aAClD,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,CAAA;aACxC,IAAI,IAAI,KAAK,aAAa;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAA;aACnD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,CAAA;aAC5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBACzD,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,sCAAsC,GAAG,IAAI,CAAC,CAAA;YAC1E,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAClB,CAAC;;YAAM,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAEjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC,CAAA;IAClE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAA;IACjC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;YAC1G,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,EAAE,CAAA;YACzD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YAChC,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,uDAAuD,CAAC,CAAA;YACpG,8BAA8B;YAC9B,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9F,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnE,IAAI,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;;gBAC9F,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,OAAO,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAA;YACzE,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,CAAC;QAED,wFAAwF;QACxF,IAAI,SAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;iBACpE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,EAAE,CAAA;;gBACzD,MAAM,KAAK,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,MAAM,QAAQ,GAAoB,IAAI,CAAC,OAAO;YAC5C,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;QACrG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,EAAE,CAAC,6BAA6B,KAAK,QAAQ,CAAA;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,cAAc,CACtB,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,uFAAuF;gBACxG,6BAA6B,CAChC,CAAA;QACH,CAAC;QACD,mGAAmG;QACnG,6CAA6C;QAC7C,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,KAAK,IAAI;YACpB,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QACtG,MAAM,MAAM,GAAG;YACb,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,KAAK,EAAE,OAAO;YACd,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAA;QAED,IAAI,WAA8B,CAAA;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;gBACtC,GAAG,MAAM;gBACT,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,YAAY,CAAC,MAAM;oBACjB,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBACrD,IAAI,QAAQ,CAAC,IAAI;wBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAA;gBACtF,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE;gBACjD,GAAG,MAAM;gBACT,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,kBAAkB,CAAC,YAAY,EAAE,QAAQ;oBACvC,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;wBACE,QAAQ,CAAC,IAAI;4BACX,CAAC,CAAC,kCAAkC,GAAG,+BAA+B;4BACtE,CAAC,CAAC,2CAA2C,GAAG,GAAG;wBACrD,EAAE;wBACF,KAAK,YAAY,EAAE;wBACnB,EAAE;wBACF,+BAA+B,QAAQ,CAAC,WAAW,EAAE;wBACrD,gCAAgC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,EAAE;4BACxG,UAAU,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,IAAI,2BAA2B;wBAC/E,EAAE;qBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;oBACD,IAAI,QAAQ,CAAC,IAAI;wBAAE,IAAI,CAAC,YAAY,CAAC,CAAA;gBACvC,CAAC;gBACD,0CAA0C;gBAC1C,GAAG,CAAC,EAAE,CAAC,KAAK;oBACV,CAAC,CAAC;wBACE,KAAK,CAAC,YAAY,CAAC,MAAmB;4BACpC,SAAS,CAAC;gCACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;gCAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oCACvB,IAAI,MAAM,CAAC,OAAO;wCAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA,CAAC,2BAA2B;oCACrE,OAAO,SAAS,CAAA;gCAClB,CAAC;gCACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;gCACpC,IAAI,KAAK;oCAAE,OAAO,KAAK,CAAA;gCACvB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oCAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAA;4BACnH,CAAC;wBACH,CAAC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjC,gBAAgB;QAChB,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACjH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,GAA4B;gBACnC,GAAG,EAAE,MAAM;gBACX,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB;aAClD,CAAA;YACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAA;YAClE,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;YACzG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,oBAAoB,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACjE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAA;YACnH,OAAO,IAAI,CAAC,WAAW,CAAA;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,YAAY,GAAG,KAAK,YAAY,uBAAuB,CAAA;QAC7D,MAAM,IAAI,GAAG,KAAK,YAAY,cAAc,IAAI,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAA;QAC9F,MAAM,IAAI,GAAG,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAA;QACpG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,wBAAwB,IAAI,IAAI,CAAC,CAAA;QACnG,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,EAAS,EAAE,IAAa,EAAE,GAAW,EAAE,MAA2B,EAAE,QAAyB;IACpH,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAA4B,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAA;QACnF,IAAI,MAAM,CAAC,yBAAyB,KAAK,SAAS;YAAE,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAA;QACrH,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QACnC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAA;IAC/D,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,4BAA4B,iBAAiB,GAAG,GAAG;QAC5F,EAAE;QACF,KAAK,MAAM,CAAC,yBAAyB,IAAI,MAAM,CAAC,gBAAgB,EAAE;QAClE,EAAE;QACF,yBAAyB,MAAM,CAAC,SAAS,iBAAiB,OAAO,OAAO;QACxE,8BAA8B;QAC9B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAC9B,OAA2B,EAC3B,IAAwB,EACxB,EAAS;IAET,MAAM,OAAO,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAA;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC,OAAO,GAAG,EAAE,CAAA;IACpG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sCAAsC,GAAG,IAAI,EAAE,CAAA;IAC/F,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,KAAK,CAAC,EAAS,EAAE,OAA2B,EAAE,OAAe;IACpE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG;QACX,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,0BAA0B,MAAM,OAAO,CAAC;QACjH,CAAC,kBAAkB,EAAE,mGAAmG,CAAC;QACzH,CAAC,kBAAkB,EAAE,wEAAwE,CAAC;QAC9F,CAAC,eAAe,EAAE,uDAAuD,CAAC;QAC1E,CAAC,cAAc,EAAE,uDAAuD,CAAC;QACzE,CAAC,UAAU,EAAE,8EAA8E,CAAC;QAC5F,CAAC,aAAa,EAAE,8DAA8D,CAAC;QAC/E,CAAC,cAAc,EAAE,gDAAgD,CAAC;QAClE,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACtC,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5B,CAAA;IACD,OAAO;QACL,qFAAqF;QACrF,iEAAiE,GAAG,sBAAsB,MAAM,6BAA6B;QAC7H,6GAA6G;QAC7G,4CAA4C;QAC5C,EAAE;QACF,QAAQ;QACR,KAAK,GAAG,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,UAAU;QAC5D,qBAAqB,GAAG,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,eAAe;QACjF,EAAE;QACF,QAAQ;QACR,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC","sourcesContent":["import { browserDecision, systemBrowserOpener, type BrowserDecision, type BrowserOpener } from \"../remote/browser.ts\"\nimport { createRemoteClient, RemoteUnauthorizedError, type BearerChallenge } from \"../remote/client.ts\"\nimport { canonicalServerUrl, credentialStore, envPrefix, type StoredCredentials } from \"../remote/credentials.ts\"\nimport {\n  authorizationCodeLogin,\n  deviceLogin,\n  discoverLoginTarget,\n  OAuthFlowError,\n  parseRedirectUrl,\n  type DeviceAuthorization,\n} from \"../remote/oauth.ts\"\nimport { table } from \"./help.ts\"\nimport { createLineReader, type CliIo } from \"./io.ts\"\nimport { CliInterrupted, EXIT, formatJson } from \"./output.ts\"\n\n/**\n * login · logout 명령 공통 설정. mext CLI = { bin: \"mext\" }, 고객 CLI = { bin, url } (설정의 cli.bin · cli.url).\n * bin = 안내 문구의 실행 파일 이름 · 환경변수 접두 (<BIN>_URL · <BIN>_CREDENTIALS_FILE · <BIN>_NO_KEYRING) ·\n * 자격 증명 위치 (~/.config/<bin> · 키체인 service \"<bin> credentials\") · 동적 등록 client_name.\n */\nexport interface AuthCommandOptions {\n  bin: string\n  /** 고정 서버 URL (고객 CLI). --url 로 덮어쓸 수 있다. 없으면 --url 또는 <BIN>_URL 필수 */\n  url?: string\n  /** 브라우저 열기 (테스트 주입). 기본 = BROWSER · open · xdg-open */\n  openBrowser?: BrowserOpener\n  /** 브라우저 판정용 (테스트 주입). 기본 process.platform */\n  platform?: NodeJS.Platform\n  /** 인가 서버 요청 (테스트 주입) */\n  fetch?: typeof fetch\n  /** device flow polling 대기 (테스트 주입) */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>\n}\n\ninterface LoginFlags {\n  url?: string\n  clientId?: string\n  scope?: string\n  port?: number\n  browser: boolean\n  /** true = 강제, false = 끔, undefined = 자동 */\n  device?: boolean\n  withToken: boolean\n  json: boolean\n}\n\n/**\n * <bin> login — MCP authorization (OAuth 2.1 · PKCE) 로 토큰 발급 · 저장. 서버 URL 별 (키체인 · credentials.json).\n * redirect = loopback (127.0.0.1) 또는 붙여넣은 redirect URL (TTY). device flow = 인가 서버가 지원할 때 (--device,\n * 브라우저를 열지 않는 환경이면 자동). --with-token = stdin 한 줄을 API key 로 저장.\n */\nexport function loginCommand(options: AuthCommandOptions): (argv: readonly string[], io: CliIo) => Promise<number> {\n  return (argv, io) => runLoginWith(options, argv, io)\n}\n\n/** mext login */\nexport const runLogin = loginCommand({ bin: \"mext\" })\n\nasync function runLoginWith(options: AuthCommandOptions, argv: readonly string[], io: CliIo): Promise<number> {\n  const opts: LoginFlags = { browser: true, withToken: false, json: false }\n  for (let i = 0; i < argv.length; i++) {\n    const tok = argv[i]!\n    const eq = tok.indexOf(\"=\")\n    const name = tok.startsWith(\"--\") && eq > 0 ? tok.slice(0, eq) : tok\n    const value = (): string | undefined => (eq > 0 && tok.startsWith(\"--\") ? tok.slice(eq + 1) : argv[++i])\n    if (name === \"-h\" || name === \"--help\") {\n      io.stdout.write(loginHelp(options))\n      return EXIT.ok\n    } else if (name === \"--json\") opts.json = true\n    else if (name === \"--no-browser\") opts.browser = false\n    else if (name === \"--device\") opts.device = true\n    else if (name === \"--no-device\") opts.device = false\n    else if (name === \"--with-token\") opts.withToken = true\n    else if (name === \"--url\") opts.url = value()\n    else if (name === \"--client-id\") opts.clientId = value()\n    else if (name === \"--scope\") opts.scope = value()\n    else if (name === \"--port\") {\n      const raw = value()\n      const port = Number(raw)\n      if (!Number.isInteger(port) || port < 0 || port > 65_535) {\n        return usage(io, options, `--port must be a port number (got \"${raw}\")`)\n      }\n      opts.port = port\n    } else return usage(io, options, `unknown argument ${tok}`)\n  }\n  const url = resolveServerUrl(options, opts.url, io)\n  if (typeof url !== \"string\") return usage(io, options, url.error)\n\n  const controller = new AbortController()\n  const onAbort = (): void => controller.abort(new CliInterrupted())\n  if (io.signal?.aborted) onAbort()\n  io.signal?.addEventListener(\"abort\", onAbort, { once: true })\n  const reader = createLineReader(io)\n  try {\n    const store = credentialStore({ env: io.env, bin: options.bin })\n    const server = canonicalServerUrl(url)\n    if (opts.withToken) {\n      const line = await reader.question(io.isTTY ? \"Paste the token and press Enter: \" : \"\", controller.signal)\n      if (controller.signal.aborted) throw new CliInterrupted()\n      const token = line?.trim() ?? \"\"\n      if (token === \"\") return usage(io, options, \"--with-token reads the token from stdin (got nothing)\")\n      // 저장 전에 확인 (거부된 토큰은 저장하지 않는다)\n      await createRemoteClient({ url, token: () => token }).listTools({ signal: controller.signal })\n      await store.set(url, { access_token: token, token_type: \"Bearer\" })\n      if (opts.json) io.stdout.write(formatJson({ url: server, storage: store.location, flow: \"token\" }))\n      else io.stderr.write(`Token saved for ${server} to ${store.location}.\\n`)\n      return EXIT.ok\n    }\n\n    // 토큰 없는 요청의 401 → WWW-Authenticate (resource_metadata · scope). 401 이 아니면 well-known 탐색\n    let challenge: BearerChallenge | undefined\n    try {\n      await createRemoteClient({ url }).listTools({ signal: controller.signal })\n    } catch (error) {\n      if (error instanceof RemoteUnauthorizedError) challenge = error.challenge\n      else if (controller.signal.aborted) throw new CliInterrupted()\n      else throw error\n    }\n    const doFetch = options.fetch ?? fetch\n    const target = await discoverLoginTarget({\n      serverUrl: url,\n      ...(challenge ? { challenge } : {}),\n      ...(opts.scope !== undefined ? { scope: opts.scope } : {}),\n      fetch: doFetch,\n    })\n    const decision: BrowserDecision = opts.browser\n      ? browserDecision(io.env, options.platform ?? process.platform)\n      : { open: false }\n    const open = options.openBrowser ?? systemBrowserOpener(io.env, options.platform ?? process.platform)\n    const hasDevice = typeof target.as.device_authorization_endpoint === \"string\"\n    if (opts.device === true && !hasDevice) {\n      throw new OAuthFlowError(\n        `${target.as.issuer} does not support the device authorization grant (no device_authorization_endpoint). ` +\n          \"Run login without --device.\",\n      )\n    }\n    // D5: 자동 device flow = 인가 서버 지원 + 환경 때문에 브라우저를 열지 않음 (SSH · display 없음) + --port · --no-device 없음.\n    // --no-browser 는 사용자 선택이라 loopback · 붙여넣기 유지\n    const useDevice =\n      opts.device === true ||\n      (opts.device === undefined && hasDevice && decision.reason !== undefined && opts.port === undefined)\n    const common = {\n      clientName: options.bin,\n      signal: controller.signal,\n      fetch: doFetch,\n      ...(opts.clientId !== undefined ? { clientId: opts.clientId } : {}),\n    }\n\n    let credentials: StoredCredentials\n    if (useDevice) {\n      credentials = await deviceLogin(target, {\n        ...common,\n        ...(options.sleep ? { sleep: options.sleep } : {}),\n        onDeviceCode(device) {\n          printDeviceCode(io, opts.json, url, device, decision)\n          if (decision.open) open(device.verification_uri_complete ?? device.verification_uri)\n        },\n      })\n    } else {\n      credentials = await authorizationCodeLogin(target, {\n        ...common,\n        ...(opts.port !== undefined ? { port: opts.port } : {}),\n        onAuthorizationUrl(authorizeUrl, loopback) {\n          io.stderr.write(\n            [\n              decision.open\n                ? `Opening a browser to log in to ${url}. If it does not open, visit:`\n                : `Open this URL in a browser to log in to ${url}:`,\n              \"\",\n              `  ${authorizeUrl}`,\n              \"\",\n              `Waiting for the redirect to ${loopback.redirectUri}`,\n              `(browser on another machine: ${io.isTTY ? \"paste the redirect URL from its address bar below, or \" : \"\"}` +\n                `ssh -L ${loopback.port}:127.0.0.1:${loopback.port} <this host> with --port)`,\n              \"\",\n            ].join(\"\\n\"),\n          )\n          if (decision.open) open(authorizeUrl)\n        },\n        // 붙여넣기는 TTY 에서만 (파이프 stdin 은 다른 용도일 수 있음)\n        ...(io.isTTY\n          ? {\n              async readRedirect(signal: AbortSignal) {\n                for (;;) {\n                  const line = await reader.question(\"Redirect URL: \", signal)\n                  if (line === undefined) {\n                    if (signal.aborted) io.stderr.write(\"\\n\") // loopback 이 먼저: 프롬프트 줄 닫기\n                    return undefined\n                  }\n                  const query = parseRedirectUrl(line)\n                  if (query) return query\n                  if (line.trim() !== \"\") io.stderr.write(\"Not a redirect URL. Paste the full URL from the browser address bar.\\n\")\n                }\n              },\n            }\n          : {}),\n      })\n    }\n    await store.set(url, credentials)\n    // 발급 토큰으로 확인 요청\n    await createRemoteClient({ url, token: () => credentials.access_token }).listTools({ signal: controller.signal })\n    if (opts.json) {\n      const out: Record<string, unknown> = {\n        url: server,\n        storage: store.location,\n        issuer: credentials.issuer,\n        flow: useDevice ? \"device\" : \"authorization_code\",\n      }\n      if (credentials.scope !== undefined) out.scope = credentials.scope\n      if (credentials.expires_at !== undefined) out.expires_at = new Date(credentials.expires_at).toISOString()\n      io.stdout.write(formatJson(out))\n    } else {\n      io.stderr.write(`Logged in to ${server}. Token saved to ${store.location}.\\n`)\n    }\n    return EXIT.ok\n  } catch (error) {\n    if (controller.signal.aborted || error instanceof CliInterrupted) {\n      io.stderr.write(opts.json ? formatJson({ code: \"INTERRUPTED\", message: \"Interrupted.\" }) : \"error: Interrupted.\\n\")\n      return EXIT.interrupted\n    }\n    const message = error instanceof Error ? error.message : String(error)\n    const unauthorized = error instanceof RemoteUnauthorizedError\n    const code = error instanceof OAuthFlowError || unauthorized ? \"LOGIN_FAILED\" : \"REMOTE_ERROR\"\n    const text = unauthorized && opts.withToken ? `The server rejected the token (${message})` : message\n    io.stderr.write(opts.json ? formatJson({ code, message: text }) : `error: login failed: ${text}\\n`)\n    return unauthorized ? EXIT.auth : EXIT.error\n  } finally {\n    reader.close()\n    io.signal?.removeEventListener(\"abort\", onAbort)\n  }\n}\n\n/**\n * device flow 안내 (D5). TTY 이고 --json 아님 = 사람용 텍스트, 그 외 = JSON 한 줄\n * { verification_uri, verification_uri_complete?, user_code, expires_in } (stderr, stdout 은 결과 전용). 이후 polling 계속\n */\nfunction printDeviceCode(io: CliIo, json: boolean, url: string, device: DeviceAuthorization, decision: BrowserDecision): void {\n  if (json || !io.isTTY) {\n    const line: Record<string, unknown> = { verification_uri: device.verification_uri }\n    if (device.verification_uri_complete !== undefined) line.verification_uri_complete = device.verification_uri_complete\n    line.user_code = device.user_code\n    line.expires_in = device.expires_in\n    io.stderr.write(`${JSON.stringify(line)}\\n`)\n    return\n  }\n  const minutes = Math.max(1, Math.round(device.expires_in / 60))\n  io.stderr.write(\n    [\n      `${decision.open ? \"Opening a browser\" : \"Open this URL in a browser\"} to log in to ${url}:`,\n      \"\",\n      `  ${device.verification_uri_complete ?? device.verification_uri}`,\n      \"\",\n      `and confirm the code: ${device.user_code}  (expires in ${minutes} min)`,\n      \"Waiting for authorization...\",\n      \"\",\n    ].join(\"\\n\"),\n  )\n}\n\n/** 서버 URL = --url → 고정 URL (고객 CLI) → <BIN>_URL */\nexport function resolveServerUrl(\n  options: AuthCommandOptions,\n  flag: string | undefined,\n  io: CliIo,\n): string | { error: string } {\n  const envName = `${envPrefix(options.bin)}_URL`\n  const url = flag ?? options.url ?? (io.env[envName] || undefined)\n  if (url === undefined || url === \"\") return { error: `--url <url> is required (or set ${envName})` }\n  if (!/^https?:\\/\\//i.test(url)) return { error: `--url must be an http(s) URL (got \"${url}\")` }\n  return url\n}\n\nfunction usage(io: CliIo, options: AuthCommandOptions, message: string): number {\n  io.stderr.write(`error: ${message}\\n\\n${loginHelp(options)}`)\n  return EXIT.usage\n}\n\nfunction loginHelp(options: AuthCommandOptions): string {\n  const { bin } = options\n  const prefix = envPrefix(bin)\n  const rows = [\n    [\"--url <url>\", options.url ? `MCP endpoint (default: ${options.url})` : `MCP endpoint (default: ${prefix}_URL)`],\n    [\"--client-id <id>\", \"Pre-registered OAuth client ID or Client ID Metadata Document URL (default: dynamic registration)\"],\n    [\"--scope <scopes>\", \"Space-separated scopes (default: server challenge or scopes_supported)\"],\n    [\"--port <port>\", \"Loopback redirect port on 127.0.0.1 (default: random)\"],\n    [\"--no-browser\", \"Print the authorization URL without opening a browser\"],\n    [\"--device\", \"Use the device authorization grant (if the authorization server supports it)\"],\n    [\"--no-device\", \"Never switch to the device authorization grant automatically\"],\n    [\"--with-token\", \"Read a token (API key) from stdin and store it\"],\n    [\"--json\", \"Print the result as JSON\"],\n    [\"-h, --help\", \"Show help\"],\n  ]\n  return [\n    \"Log in to a remote server (OAuth 2.1 authorization code + PKCE, loopback redirect).\",\n    `The token is stored per server URL (OS keychain, or ~/.config/${bin}/credentials.json; ${prefix}_NO_KEYRING=1 = file only).`,\n    \"Over SSH or without a display the browser is not opened: paste the redirect URL, or the device flow is used\",\n    \"when the authorization server supports it.\",\n    \"\",\n    \"Usage:\",\n    `  ${bin} login${options.url ? \"\" : \" --url <url>\"} [flags]`,\n    `  echo \"$TOKEN\" | ${bin} login${options.url ? \"\" : \" --url <url>\"} --with-token`,\n    \"\",\n    \"Flags:\",\n    ...table(rows).map((l) => `  ${l}`),\n    \"\",\n  ].join(\"\\n\")\n}\n"]}

package/dist/cli/logout.d.ts

@@ -0,0 +1,9 @@
+import type { CliIo } from "./io.ts";
+import { type AuthCommandOptions } from "./login.ts";
+/**
+ * <bin> logout — 저장된 토큰 폐기 · 삭제. 인가 서버 메타데이터에 revocation_endpoint (RFC 7009) 가 있으면
+ * refresh token → access token 순서로 폐기 요청 (best effort: 실패는 경고, 삭제는 계속), 그다음 키체인 · 파일에서 삭제.
+ */
+export declare function logoutCommand(options: AuthCommandOptions): (argv: readonly string[], io: CliIo) => Promise<number>;
+/** mext logout */
+export declare const runLogout: (argv: readonly string[], io: CliIo) => Promise<number>;

package/dist/cli/logout.js

@@ -0,0 +1,105 @@
+import { canonicalServerUrl, credentialStore, envPrefix } from "../remote/credentials.js";
+import { revokeCredentials } from "../remote/oauth.js";
+import { table } from "./help.js";
+import { resolveServerUrl } from "./login.js";
+import { EXIT, formatJson } from "./output.js";
+/**
+ * <bin> logout — 저장된 토큰 폐기 · 삭제. 인가 서버 메타데이터에 revocation_endpoint (RFC 7009) 가 있으면
+ * refresh token → access token 순서로 폐기 요청 (best effort: 실패는 경고, 삭제는 계속), 그다음 키체인 · 파일에서 삭제.
+ */
+export function logoutCommand(options) {
+    return (argv, io) => runLogoutWith(options, argv, io);
+}
+/** mext logout */
+export const runLogout = logoutCommand({ bin: "mext" });
+async function runLogoutWith(options, argv, io) {
+    let flag;
+    let json = false;
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        const eq = tok.indexOf("=");
+        const name = tok.startsWith("--") && eq > 0 ? tok.slice(0, eq) : tok;
+        if (name === "-h" || name === "--help") {
+            io.stdout.write(logoutHelp(options));
+            return EXIT.ok;
+        }
+        else if (name === "--json")
+            json = true;
+        else if (name === "--url")
+            flag = eq > 0 ? tok.slice(eq + 1) : argv[++i];
+        else
+            return usage(io, options, `unknown argument ${tok}`);
+    }
+    const url = resolveServerUrl(options, flag, io);
+    if (typeof url !== "string")
+        return usage(io, options, url.error);
+    const server = canonicalServerUrl(url);
+    const store = credentialStore({ env: io.env, bin: options.bin });
+    let stored;
+    let readError;
+    try {
+        stored = await store.get(url);
+    }
+    catch (error) {
+        readError = error instanceof Error ? error.message : String(error);
+    }
+    const revocation = stored
+        ? await revokeCredentials(stored, options.fetch ? { fetch: options.fetch } : {})
+        : { supported: false, revoked: [], errors: [] };
+    if (readError !== undefined)
+        revocation.errors.push(`Cannot read stored credentials: ${readError}`);
+    try {
+        await store.delete(url);
+    }
+    catch (error) {
+        const message = `Cannot remove stored credentials from ${store.location}: ${error instanceof Error ? error.message : String(error)}`;
+        io.stderr.write(json ? formatJson({ code: "LOGOUT_FAILED", message }) : `error: ${message}\n`);
+        return EXIT.error;
+    }
+    if (json) {
+        const out = {
+            url: server,
+            loggedIn: stored !== undefined,
+            storage: store.location,
+            revoked: revocation.revoked,
+        };
+        if (revocation.errors.length > 0)
+            out.errors = revocation.errors;
+        io.stdout.write(formatJson(out));
+        return EXIT.ok;
+    }
+    for (const e of revocation.errors)
+        io.stderr.write(`warning: ${e}\n`);
+    if (stored === undefined) {
+        io.stderr.write(`Not logged in to ${server}.\n`);
+        return EXIT.ok;
+    }
+    if (revocation.revoked.length > 0)
+        io.stderr.write(`Revoked ${revocation.revoked.join(" and ").replace(/_/g, " ")} at ${stored.issuer}.\n`);
+    io.stderr.write(`Logged out of ${server}. Removed credentials from ${store.location}.\n`);
+    return EXIT.ok;
+}
+function usage(io, options, message) {
+    io.stderr.write(`error: ${message}\n\n${logoutHelp(options)}`);
+    return EXIT.usage;
+}
+function logoutHelp(options) {
+    const { bin } = options;
+    const rows = [
+        ["--url <url>", options.url ? `MCP endpoint (default: ${options.url})` : `MCP endpoint (default: ${envPrefix(bin)}_URL)`],
+        ["--json", "Print the result as JSON"],
+        ["-h, --help", "Show help"],
+    ];
+    return [
+        "Log out of a remote server: revoke the stored tokens (if the authorization server supports RFC 7009)",
+        "and remove them from the OS keychain and credentials file.",
+        "",
+        "Usage:",
+        `  ${bin} logout${options.url ? "" : " --url <url>"} [flags]`,
+        "",
+        "Flags:",
+        ...table(rows).map((l) => `  ${l}`),
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=logout.js.map

package/dist/cli/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/cli/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAA0B,MAAM,0BAA0B,CAAA;AACjH,OAAO,EAAE,iBAAiB,EAAqB,MAAM,oBAAoB,CAAA;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAEjC,OAAO,EAAE,gBAAgB,EAA2B,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE9C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAA2B;IACvD,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,kBAAkB;AAClB,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;AAEvD,KAAK,UAAU,aAAa,CAAC,OAA2B,EAAE,IAAuB,EAAE,EAAS;IAC1F,IAAI,IAAwB,CAAA;IAC5B,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACpE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;YACpC,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAA;aACpC,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;;YACnE,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEhE,IAAI,MAAqC,CAAA;IACzC,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,UAAU,GAAiB,MAAM;QACrC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACjD,IAAI,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAA;IACnG,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,yCAAyC,KAAK,CAAC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;QACpI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,OAAO,IAAI,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAA4B;YACnC,GAAG,EAAE,MAAM;YACX,QAAQ,EAAE,MAAM,KAAK,SAAS;YAC9B,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;QAChE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAChC,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM;QAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,KAAK,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC3I,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,8BAA8B,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAA;IACzF,OAAO,IAAI,CAAC,EAAE,CAAA;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,EAAS,EAAE,OAA2B,EAAE,OAAe;IACpE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAA2B;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACvB,MAAM,IAAI,GAAG;QACX,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,0BAA0B,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;QACzH,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACtC,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5B,CAAA;IACD,OAAO;QACL,sGAAsG;QACtG,4DAA4D;QAC5D,EAAE;QACF,QAAQ;QACR,KAAK,GAAG,UAAU,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,UAAU;QAC7D,EAAE;QACF,QAAQ;QACR,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC","sourcesContent":["import { canonicalServerUrl, credentialStore, envPrefix, type StoredCredentials } from \"../remote/credentials.ts\"\nimport { revokeCredentials, type RevokeResult } from \"../remote/oauth.ts\"\nimport { table } from \"./help.ts\"\nimport type { CliIo } from \"./io.ts\"\nimport { resolveServerUrl, type AuthCommandOptions } from \"./login.ts\"\nimport { EXIT, formatJson } from \"./output.ts\"\n\n/**\n * <bin> logout — 저장된 토큰 폐기 · 삭제. 인가 서버 메타데이터에 revocation_endpoint (RFC 7009) 가 있으면\n * refresh token → access token 순서로 폐기 요청 (best effort: 실패는 경고, 삭제는 계속), 그다음 키체인 · 파일에서 삭제.\n */\nexport function logoutCommand(options: AuthCommandOptions): (argv: readonly string[], io: CliIo) => Promise<number> {\n  return (argv, io) => runLogoutWith(options, argv, io)\n}\n\n/** mext logout */\nexport const runLogout = logoutCommand({ bin: \"mext\" })\n\nasync function runLogoutWith(options: AuthCommandOptions, argv: readonly string[], io: CliIo): Promise<number> {\n  let flag: string | undefined\n  let json = false\n  for (let i = 0; i < argv.length; i++) {\n    const tok = argv[i]!\n    const eq = tok.indexOf(\"=\")\n    const name = tok.startsWith(\"--\") && eq > 0 ? tok.slice(0, eq) : tok\n    if (name === \"-h\" || name === \"--help\") {\n      io.stdout.write(logoutHelp(options))\n      return EXIT.ok\n    } else if (name === \"--json\") json = true\n    else if (name === \"--url\") flag = eq > 0 ? tok.slice(eq + 1) : argv[++i]\n    else return usage(io, options, `unknown argument ${tok}`)\n  }\n  const url = resolveServerUrl(options, flag, io)\n  if (typeof url !== \"string\") return usage(io, options, url.error)\n  const server = canonicalServerUrl(url)\n  const store = credentialStore({ env: io.env, bin: options.bin })\n\n  let stored: StoredCredentials | undefined\n  let readError: string | undefined\n  try {\n    stored = await store.get(url)\n  } catch (error) {\n    readError = error instanceof Error ? error.message : String(error)\n  }\n  const revocation: RevokeResult = stored\n    ? await revokeCredentials(stored, options.fetch ? { fetch: options.fetch } : {})\n    : { supported: false, revoked: [], errors: [] }\n  if (readError !== undefined) revocation.errors.push(`Cannot read stored credentials: ${readError}`)\n  try {\n    await store.delete(url)\n  } catch (error) {\n    const message = `Cannot remove stored credentials from ${store.location}: ${error instanceof Error ? error.message : String(error)}`\n    io.stderr.write(json ? formatJson({ code: \"LOGOUT_FAILED\", message }) : `error: ${message}\\n`)\n    return EXIT.error\n  }\n\n  if (json) {\n    const out: Record<string, unknown> = {\n      url: server,\n      loggedIn: stored !== undefined,\n      storage: store.location,\n      revoked: revocation.revoked,\n    }\n    if (revocation.errors.length > 0) out.errors = revocation.errors\n    io.stdout.write(formatJson(out))\n    return EXIT.ok\n  }\n  for (const e of revocation.errors) io.stderr.write(`warning: ${e}\\n`)\n  if (stored === undefined) {\n    io.stderr.write(`Not logged in to ${server}.\\n`)\n    return EXIT.ok\n  }\n  if (revocation.revoked.length > 0) io.stderr.write(`Revoked ${revocation.revoked.join(\" and \").replace(/_/g, \" \")} at ${stored.issuer}.\\n`)\n  io.stderr.write(`Logged out of ${server}. Removed credentials from ${store.location}.\\n`)\n  return EXIT.ok\n}\n\nfunction usage(io: CliIo, options: AuthCommandOptions, message: string): number {\n  io.stderr.write(`error: ${message}\\n\\n${logoutHelp(options)}`)\n  return EXIT.usage\n}\n\nfunction logoutHelp(options: AuthCommandOptions): string {\n  const { bin } = options\n  const rows = [\n    [\"--url <url>\", options.url ? `MCP endpoint (default: ${options.url})` : `MCP endpoint (default: ${envPrefix(bin)}_URL)`],\n    [\"--json\", \"Print the result as JSON\"],\n    [\"-h, --help\", \"Show help\"],\n  ]\n  return [\n    \"Log out of a remote server: revoke the stored tokens (if the authorization server supports RFC 7009)\",\n    \"and remove them from the OS keychain and credentials file.\",\n    \"\",\n    \"Usage:\",\n    `  ${bin} logout${options.url ? \"\" : \" --url <url>\"} [flags]`,\n    \"\",\n    \"Flags:\",\n    ...table(rows).map((l) => `  ${l}`),\n    \"\",\n  ].join(\"\\n\")\n}\n"]}

package/dist/cli/main.d.ts

@@ -0,0 +1,19 @@
+import { type CliIo } from "./io.ts";
+/** mext 의 하위 명령 (run · dev · mcp install · login · logout · build · start) */
+export interface CliSubcommand {
+    name: string;
+    /** mext help 한 줄 설명 */
+    summary: string;
+    /** 하위 명령 이름 뒤의 argv. 반환 = exit code */
+    run(argv: readonly string[], io: CliIo): Promise<number>;
+}
+/**
+ * 하위 명령 표. 이후 단계가 항목을 추가한다 (mcp · mcp --stdio · mcp install · login · build · run --url).
+ * 순서 = help 표시 순서.
+ */
+export declare const SUBCOMMANDS: CliSubcommand[];
+/**
+ * mext CLI 진입점. argv = 실행 파일 뒤 인자 (process.argv.slice(2)). 반환 = exit code.
+ * io 는 테스트용 주입 (stdin · stdout · stderr · isTTY · env · cwd · signal), 생략 = process.
+ */
+export declare function runCli(argv: readonly string[], io?: Partial<CliIo>): Promise<number>;

package/dist/cli/main.js

@@ -0,0 +1,77 @@
+import { readFileSync } from "node:fs";
+import { closest } from "../suggest.js";
+import { table } from "./help.js";
+import { resolveIo } from "./io.js";
+import { EXIT } from "./output.js";
+import { runBuild } from "./build.js";
+import { runLogin } from "./login.js";
+import { devCommand } from "./dev.js";
+import { runLogout } from "./logout.js";
+import { mcpCommand } from "./mcp.js";
+import { runCommand } from "./run.js";
+import { startCommand } from "./start.js";
+/**
+ * 하위 명령 표. 이후 단계가 항목을 추가한다 (mcp · mcp --stdio · mcp install · login · build · run --url).
+ * 순서 = help 표시 순서.
+ */
+export const SUBCOMMANDS = [
+    { name: "run", summary: "Run a command locally, or remotely with --url (mext run help)", run: runCommand },
+    { name: "dev", summary: "Development MCP server with file watching (mext dev, mext dev --stdio)", run: devCommand },
+    { name: "mcp", summary: "Print MCP client registration commands (mext mcp install)", run: mcpCommand },
+    { name: "login", summary: "Log in to a remote server (mext login --url <url>)", run: runLogin },
+    { name: "logout", summary: "Revoke and remove stored credentials (mext logout --url <url>)", run: runLogout },
+    { name: "build", summary: "Build .mext/ for production: bundle, manifest, server.js (mext build --help)", run: (argv, io) => runBuild(argv, io) },
+    { name: "start", summary: "Production MCP server from .mext/ (mext start, mext start --stdio)", run: startCommand },
+];
+/**
+ * mext CLI 진입점. argv = 실행 파일 뒤 인자 (process.argv.slice(2)). 반환 = exit code.
+ * io 는 테스트용 주입 (stdin · stdout · stderr · isTTY · env · cwd · signal), 생략 = process.
+ */
+export async function runCli(argv, io = {}) {
+    const resolved = resolveIo(io);
+    const subcommands = SUBCOMMANDS;
+    const [first, ...rest] = argv;
+    if (first === undefined) {
+        resolved.stderr.write(rootHelp(subcommands));
+        return EXIT.usage;
+    }
+    if (first === "help" || first === "--help" || first === "-h") {
+        resolved.stdout.write(rootHelp(subcommands));
+        return EXIT.ok;
+    }
+    if (first === "--version" || first === "-v") {
+        resolved.stdout.write(`${packageVersion()}\n`);
+        return EXIT.ok;
+    }
+    const sub = subcommands.find((s) => s.name === first);
+    if (!sub) {
+        const suggested = closest(first, subcommands.map((s) => [s.name, s.name]));
+        const hint = suggested.length > 0 ? ` Did you mean "mext ${suggested[0]}"?` : "";
+        resolved.stderr.write(`error: unknown command "${first}".${hint}\nRun "mext help" for available commands.\n`);
+        return EXIT.usage;
+    }
+    return sub.run(rest, resolved);
+}
+function rootHelp(subcommands) {
+    const lines = [
+        "mext — file-based commands as a CLI and an MCP server",
+        "",
+        "Usage:",
+        "  mext <command> [args]",
+        "",
+        "Commands:",
+        ...table(subcommands.map((s) => [s.name, s.summary])).map((l) => `  ${l}`),
+        "",
+        "Flags:",
+        ...table([
+            ["-h, --help", "Show help"],
+            ["-v, --version", "Print the version"],
+        ]).map((l) => `  ${l}`),
+    ];
+    return `${lines.join("\n")}\n`;
+}
+function packageVersion() {
+    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    return pkg.version ?? "0.0.0";
+}
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAWzC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,+DAA+D,EAAE,GAAG,EAAE,UAAU,EAAE;IAC1G,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,wEAAwE,EAAE,GAAG,EAAE,UAAU,EAAE;IACnH,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2DAA2D,EAAE,GAAG,EAAE,UAAU,EAAE;IACtG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oDAAoD,EAAE,GAAG,EAAE,QAAQ,EAAE;IAC/F,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,GAAG,EAAE,SAAS,EAAE;IAC7G,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8EAA8E,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;IACjJ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE,GAAG,EAAE,YAAY,EAAE;CACpH,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAuB,EAAE,EAAE,GAAmB,EAAE;IAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC9B,MAAM,WAAW,GAAG,WAAW,CAAA;IAC/B,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC7D,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC5C,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,IAAI,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAChF,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,KAAK,KAAK,IAAI,6CAA6C,CAAC,CAAA;QAC7G,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,WAAqC;IACrD,MAAM,KAAK,GAAG;QACZ,uDAAuD;QACvD,EAAE;QACF,QAAQ;QACR,yBAAyB;QACzB,EAAE;QACF,WAAW;QACX,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,EAAE;QACF,QAAQ;QACR,GAAG,KAAK,CAAC;YACP,CAAC,YAAY,EAAE,WAAW,CAAC;YAC3B,CAAC,eAAe,EAAE,mBAAmB,CAAC;SACvC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACxB,CAAA;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAChC,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAA;IACpH,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAA;AAC/B,CAAC","sourcesContent":["import { readFileSync } from \"node:fs\"\nimport { closest } from \"../suggest.ts\"\nimport { table } from \"./help.ts\"\nimport { resolveIo, type CliIo } from \"./io.ts\"\nimport { EXIT } from \"./output.ts\"\nimport { runBuild } from \"./build.ts\"\nimport { runLogin } from \"./login.ts\"\nimport { devCommand } from \"./dev.ts\"\nimport { runLogout } from \"./logout.ts\"\nimport { mcpCommand } from \"./mcp.ts\"\nimport { runCommand } from \"./run.ts\"\nimport { startCommand } from \"./start.ts\"\n\n/** mext 의 하위 명령 (run · dev · mcp install · login · logout · build · start) */\nexport interface CliSubcommand {\n  name: string\n  /** mext help 한 줄 설명 */\n  summary: string\n  /** 하위 명령 이름 뒤의 argv. 반환 = exit code */\n  run(argv: readonly string[], io: CliIo): Promise<number>\n}\n\n/**\n * 하위 명령 표. 이후 단계가 항목을 추가한다 (mcp · mcp --stdio · mcp install · login · build · run --url).\n * 순서 = help 표시 순서.\n */\nexport const SUBCOMMANDS: CliSubcommand[] = [\n  { name: \"run\", summary: \"Run a command locally, or remotely with --url (mext run help)\", run: runCommand },\n  { name: \"dev\", summary: \"Development MCP server with file watching (mext dev, mext dev --stdio)\", run: devCommand },\n  { name: \"mcp\", summary: \"Print MCP client registration commands (mext mcp install)\", run: mcpCommand },\n  { name: \"login\", summary: \"Log in to a remote server (mext login --url <url>)\", run: runLogin },\n  { name: \"logout\", summary: \"Revoke and remove stored credentials (mext logout --url <url>)\", run: runLogout },\n  { name: \"build\", summary: \"Build .mext/ for production: bundle, manifest, server.js (mext build --help)\", run: (argv, io) => runBuild(argv, io) },\n  { name: \"start\", summary: \"Production MCP server from .mext/ (mext start, mext start --stdio)\", run: startCommand },\n]\n\n/**\n * mext CLI 진입점. argv = 실행 파일 뒤 인자 (process.argv.slice(2)). 반환 = exit code.\n * io 는 테스트용 주입 (stdin · stdout · stderr · isTTY · env · cwd · signal), 생략 = process.\n */\nexport async function runCli(argv: readonly string[], io: Partial<CliIo> = {}): Promise<number> {\n  const resolved = resolveIo(io)\n  const subcommands = SUBCOMMANDS\n  const [first, ...rest] = argv\n  if (first === undefined) {\n    resolved.stderr.write(rootHelp(subcommands))\n    return EXIT.usage\n  }\n  if (first === \"help\" || first === \"--help\" || first === \"-h\") {\n    resolved.stdout.write(rootHelp(subcommands))\n    return EXIT.ok\n  }\n  if (first === \"--version\" || first === \"-v\") {\n    resolved.stdout.write(`${packageVersion()}\\n`)\n    return EXIT.ok\n  }\n  const sub = subcommands.find((s) => s.name === first)\n  if (!sub) {\n    const suggested = closest(first, subcommands.map((s): [string, string] => [s.name, s.name]))\n    const hint = suggested.length > 0 ? ` Did you mean \"mext ${suggested[0]}\"?` : \"\"\n    resolved.stderr.write(`error: unknown command \"${first}\".${hint}\\nRun \"mext help\" for available commands.\\n`)\n    return EXIT.usage\n  }\n  return sub.run(rest, resolved)\n}\n\nfunction rootHelp(subcommands: readonly CliSubcommand[]): string {\n  const lines = [\n    \"mext — file-based commands as a CLI and an MCP server\",\n    \"\",\n    \"Usage:\",\n    \"  mext <command> [args]\",\n    \"\",\n    \"Commands:\",\n    ...table(subcommands.map((s) => [s.name, s.summary])).map((l) => `  ${l}`),\n    \"\",\n    \"Flags:\",\n    ...table([\n      [\"-h, --help\", \"Show help\"],\n      [\"-v, --version\", \"Print the version\"],\n    ]).map((l) => `  ${l}`),\n  ]\n  return `${lines.join(\"\\n\")}\\n`\n}\n\nfunction packageVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../../package.json\", import.meta.url), \"utf8\")) as { version?: string }\n  return pkg.version ?? \"0.0.0\"\n}\n"]}

package/dist/cli/mcp.d.ts

@@ -0,0 +1,16 @@
+import type { CliIo } from "./io.ts";
+export declare const MCP_PROG = "mext mcp";
+/**
+ * mext mcp install [--name] [--url]  MCP 클라이언트 등록 안내 출력 (설정 파일은 쓰지 않음)
+ * 서버 형태 (mext mcp · mext mcp --stdio) 는 제거: mext dev · mext dev --stdio (운영 = mext start)
+ */
+export declare function mcpCommand(argv: readonly string[], io: CliIo): Promise<number>;
+interface McpArgs {
+    help: boolean;
+    name?: string;
+    url?: string;
+}
+/** 반환 문자열 = 사용법 오류 메시지 */
+export declare function parseMcpArgs(argv: readonly string[]): McpArgs | string;
+export declare function mcpHelp(): string;
+export {};