@sendmux/cli 1.5.0 → 1.6.0

package/README.md

@@ -19,9 +19,9 @@ Agent-drivable command line interface for Sendmux.
 
 - No existing Sendmux account or API key is required to register an agent inbox.
 - npm global installs, `npx`, or a downloaded release tarball.
-- A root `smx_root_*` key for Management commands.
-- A send-capable `smx_mbx_*` key or owner-approved agent profile for Sending commands.
-- A mailbox-scoped `smx_mbx_*` key or registered agent profile for Mailbox commands.
+- Management commands require an OAuth profile with the requested permissions or a root `smx_root_*` key.
+- Sending commands require an OAuth profile with `email.send`, a send-capable `smx_mbx_*` key, or an owner-approved agent profile.
+- Mailbox commands require an OAuth profile with the requested mailbox permissions, a mailbox-scoped `smx_mbx_*` key, or a registered agent profile.
 
 ## Installation
 
@@ -31,6 +31,29 @@ npm install -g @sendmux/cli
 
 The package exposes the `sendmux` binary.
 
+## Sign in with OAuth
+
+Sign in through your browser and request only the permissions your workflow needs:
+
+```sh
+sendmux auth:login work --scope mailbox.read
+sendmux mailbox:get-connection --profile work --json
+```
+
+Repeat `--scope` for additional permissions, such as `email.send` or `domain.read`. The consent screen lets you choose the team and mailboxes. A login creates a new profile; it cannot overwrite an existing profile. Use `--no-browser` to print the authorization URL without opening it automatically; open that URL on the same computer so the loopback callback reaches the CLI.
+
+The CLI uses an authorization code with S256 PKCE and validates the callback state and issuer. Access and refresh tokens are saved in the protected local configuration file; command results and profile listings do not reveal them. API commands refresh tokens when needed. Concurrent commands share one refresh operation. If a refresh response is lost, the CLI requires a new login instead of replaying the old refresh token.
+
+Revoke the connection and remove its profile:
+
+```sh
+sendmux auth:logout work
+```
+
+If revocation fails, the profile stays available for another logout attempt. Revocation affects the connection associated with that profile.
+
+For a headless workflow that already has an access token, supply it through `SENDMUX_ACCESS_TOKEN`. Do not also set `SENDMUX_API_KEY` or pass `--api-key`. The CLI does not refresh an environment-supplied token; its issuer or your credential provider must renew it.
+
 ## Usage
 
 Register an agent inbox and save its durable read credential in a local profile:

package/dist/base-command.d.ts

@@ -5,12 +5,18 @@ export interface AuthFlags {
     "base-url"?: string;
     profile?: string;
 }
-export interface ResolvedAuth {
-    apiKey: string;
-    apiKeyKind: ApiKeyKind;
+export type ResolvedAuth = {
     baseUrl?: string;
     source: string;
-}
+} & ({
+    apiKey: string;
+    apiKeyKind: ApiKeyKind;
+    accessToken?: never;
+} | {
+    accessToken: string | (() => Promise<string>);
+    apiKey?: never;
+    apiKeyKind: "oauth";
+});
 export declare const authFlags: {
     "api-key": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     "base-url": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -20,6 +26,7 @@ export declare abstract class SendmuxCommand extends Command {
     static enableJsonFlag: boolean;
     resolveAuth(flags: AuthFlags, expectedKind: RequiredApiKeyKind): Promise<ResolvedAuth>;
     renderResult(value: unknown): unknown;
+    protected toErrorJson(error: unknown): unknown;
     renderTextResult(value: string): unknown;
     renderBinaryResult(value: ArrayBuffer | ArrayBufferView | string): unknown;
     private assertKeyKind;

package/dist/base-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAQvB,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,SAAS;;;;CAcrB,CAAC;AAEF,8BAAsB,cAAe,SAAQ,OAAO;IAClD,MAAM,CAAC,cAAc,UAAQ;IAEvB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiF5F,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASrC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IASxC,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,OAAO;IAa1E,OAAO,CAAC,aAAa;CA4BtB"}
+{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAUvB,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,CACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/D;IAAE,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CACzF,CAAC;AAEF,eAAO,MAAM,SAAS;;;;CAcrB,CAAC;AAEF,8BAAsB,cAAe,SAAQ,OAAO;IAClD,MAAM,CAAC,cAAc,UAAQ;IAEvB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoG5F,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASrC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAM9C,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IASxC,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,OAAO;IAa1E,OAAO,CAAC,aAAa;CA4BtB"}

package/dist/base-command.js

@@ -1,7 +1,8 @@
 import { Command, Flags } from "@oclif/core";
 import { apiKeyKindLabel, inferApiKeyKind, isApiKeyCompatibleWithKind, } from "./key-kind.js";
 import { resolveAgentSendingToken } from "./agent-auth.js";
-import { isActiveAgentProfile, isAgentProfile, readCliConfig, } from "./profiles.js";
+import { resolveOAuthToken } from "./oauth-profile.js";
+import { isActiveAgentProfile, isAgentProfile, isOAuthProfile, readCliConfig, } from "./profiles.js";
 export const authFlags = {
     "api-key": Flags.string({
         description: "Sendmux API key. Defaults to SENDMUX_API_KEY.",
@@ -21,8 +22,21 @@ export class SendmuxCommand extends Command {
     static enableJsonFlag = true;
     async resolveAuth(flags, expectedKind) {
         const envApiKey = process.env.SENDMUX_API_KEY || undefined;
+        const accessToken = process.env.SENDMUX_ACCESS_TOKEN || undefined;
         const envBaseUrl = process.env.SENDMUX_BASE_URL || undefined;
         const envProfile = process.env.SENDMUX_PROFILE || undefined;
+        if (accessToken && (flags["api-key"] || envApiKey)) {
+            this.error("Provide exactly one of an API key or SENDMUX_ACCESS_TOKEN.", { exit: 2 });
+        }
+        if (accessToken) {
+            const baseUrl = flags["base-url"] ?? envBaseUrl;
+            return {
+                accessToken,
+                apiKeyKind: "oauth",
+                source: "SENDMUX_ACCESS_TOKEN",
+                ...(baseUrl ? { baseUrl } : {}),
+            };
+        }
         if (flags["api-key"] || envApiKey) {
             const apiKey = flags["api-key"] ?? envApiKey;
             if (!apiKey) {
@@ -52,6 +66,10 @@ export class SendmuxCommand extends Command {
                 exit: 2,
             });
         }
+        if (isOAuthProfile(profile)) {
+            const baseUrl = flags["base-url"] ?? envBaseUrl;
+            return { accessToken: () => resolveOAuthToken(this.config.configDir, profileName), apiKeyKind: "oauth", source: `OAuth profile "${profileName}"`, ...(baseUrl ? { baseUrl } : {}) };
+        }
         if (isAgentProfile(profile)) {
             if (!isActiveAgentProfile(profile)) {
                 this.error(`Sendmux agent profile "${profileName}" has not finished registration. Re-run \`sendmux agent:register ${profileName}\`.`, {
@@ -96,6 +114,11 @@ export class SendmuxCommand extends Command {
         this.log(JSON.stringify(value, null, 2));
         return value;
     }
+    toErrorJson(error) {
+        return {
+            error: error instanceof Error ? { ...error, message: error.message, name: error.name } : error,
+        };
+    }
     renderTextResult(value) {
         if (this.jsonEnabled()) {
             return { text: value };

package/dist/commands/auth/login.d.ts

@@ -0,0 +1,14 @@
+import { SendmuxCommand } from "../../base-command.js";
+export default class AuthLogin extends SendmuxCommand {
+    static description: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        issuer: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        scope: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        "no-browser": import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,cAAc;IACnD,MAAM,CAAC,WAAW,SAA4D;IAC9E,MAAM,CAAC,IAAI;;MAET;IACF,MAAM,CAAC,KAAK;;;;MAaV;IAEI,GAAG;CAYV"}

package/dist/commands/auth/login.js

@@ -0,0 +1,36 @@
+import { Args, Flags } from "@oclif/core";
+import { SendmuxCommand } from "../../base-command.js";
+import { DEFAULT_OAUTH_ISSUER } from "../../oauth-http.js";
+import { loginOAuth } from "../../oauth-login.js";
+export default class AuthLogin extends SendmuxCommand {
+    static description = "Sign in through the browser and save an OAuth profile.";
+    static args = {
+        name: Args.string({ required: true, description: "New profile name." }),
+    };
+    static flags = {
+        issuer: Flags.string({
+            default: DEFAULT_OAUTH_ISSUER,
+            description: "Sendmux authorization-server issuer.",
+        }),
+        scope: Flags.string({
+            multiple: true,
+            required: true,
+            description: "Permission to request. Repeat for multiple scopes.",
+        }),
+        "no-browser": Flags.boolean({
+            description: "Print the authorization URL without opening a browser.",
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AuthLogin);
+        const data = await loginOAuth({
+            configDir: this.config.configDir,
+            name: args.name,
+            issuer: flags.issuer,
+            scopes: flags.scope,
+            noBrowser: flags["no-browser"] ?? false,
+            report: (message) => process.stderr.write(`${message}\n`),
+        });
+        return this.renderResult({ ok: true, data, meta: {} });
+    }
+}

package/dist/commands/auth/logout.d.ts

@@ -0,0 +1,9 @@
+import { SendmuxCommand } from "../../base-command.js";
+export default class AuthLogout extends SendmuxCommand {
+    static description: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=logout.d.ts.map

package/dist/commands/auth/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,cAAc;IACpD,MAAM,CAAC,WAAW,SAC2C;IAC7D,MAAM,CAAC,IAAI;;MAIT;IAEI,GAAG;CAUV"}

package/dist/commands/auth/logout.js

@@ -0,0 +1,22 @@
+import { Args } from "@oclif/core";
+import { SendmuxCommand } from "../../base-command.js";
+import { logoutOAuth } from "../../oauth-profile.js";
+import { readCliConfig } from "../../profiles.js";
+export default class AuthLogout extends SendmuxCommand {
+    static description = "Revoke an OAuth connection and remove its local profile.";
+    static args = {
+        name: Args.string({
+            description: "OAuth profile name. Defaults to the configured profile.",
+        }),
+    };
+    async run() {
+        const { args } = await this.parse(AuthLogout);
+        const name = args.name ??
+            process.env.SENDMUX_PROFILE ??
+            (await readCliConfig(this.config.configDir)).defaultProfile;
+        if (!name)
+            this.error("Choose an OAuth profile to log out.", { exit: 2 });
+        const data = await logoutOAuth(this.config.configDir, name);
+        return this.renderResult({ ok: true, data, meta: {} });
+    }
+}

package/dist/commands/mailbox/stream-events.d.ts

@@ -35,6 +35,12 @@ export default class MailboxStreamEventsCommand extends OperationCommand {
         readonly path: "/mailbox/events";
         readonly pathParams: readonly [];
         readonly queryParams: readonly [{
+            readonly name: "mailbox_id";
+            readonly required: false;
+            readonly schema: {
+                readonly type: "string";
+            };
+        }, {
             readonly name: "event_types";
             readonly required: false;
             readonly schema: {
@@ -62,12 +68,6 @@ export default class MailboxStreamEventsCommand extends OperationCommand {
                 readonly minimum: 30;
                 readonly maximum: 3600;
             };
-        }, {
-            readonly name: "mailbox_id";
-            readonly required: false;
-            readonly schema: {
-                readonly type: "string";
-            };
         }];
         readonly responseKind: "json";
         readonly requestBodyRequired: false;

package/dist/commands/profiles/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAWvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,WAAW,SAAsC;IACxD,MAAM,CAAC,KAAK;;MAIV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAoC9B"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,WAAW,SAAsC;IACxD,MAAM,CAAC,KAAK;;MAIV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAqC9B"}

package/dist/commands/profiles/list.js

@@ -1,7 +1,7 @@
 import { Flags } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind, maskApiKey, } from "../../key-kind.js";
-import { isActiveAgentProfile, isApiKeyProfile, readCliConfig, } from "../../profiles.js";
+import { isActiveAgentProfile, isApiKeyProfile, isOAuthProfile, readCliConfig, } from "../../profiles.js";
 export default class ProfilesList extends SendmuxCommand {
     static description = "List local Sendmux CLI profiles.";
     static flags = {
@@ -13,6 +13,8 @@ export default class ProfilesList extends SendmuxCommand {
         const { flags } = await this.parse(ProfilesList);
         const config = await readCliConfig(this.config.configDir);
         const profiles = Object.entries(config.profiles).map(([name, profile]) => {
+            if (isOAuthProfile(profile))
+                return { name, type: "oauth", status: profile.state, default: name === config.defaultProfile, ...(profile.state === "authorizing" ? {} : { scopes: profile.scopes }) };
             if (isApiKeyProfile(profile)) {
                 return {
                     default: name === config.defaultProfile,

package/dist/commands/profiles/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/set.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,cAAc;IACrD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAmD;IACrE,MAAM,CAAC,KAAK;;;;MAWV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAoC9B"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/set.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,cAAc;IACrD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAmD;IACrE,MAAM,CAAC,KAAK;;;;MAWV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsC9B"}

package/dist/commands/profiles/set.js

@@ -1,7 +1,7 @@
 import { Args, Flags } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind } from "../../key-kind.js";
-import { updateCliConfig } from "../../profiles.js";
+import { isOAuthProfile, updateCliConfig } from "../../profiles.js";
 export default class ProfilesSet extends SendmuxCommand {
     static args = {
         name: Args.string({
@@ -30,6 +30,9 @@ export default class ProfilesSet extends SendmuxCommand {
         }
         const keyKind = inferApiKeyKind(apiKey);
         const isDefault = await updateCliConfig(this.config.configDir, (config) => {
+            const existing = config.profiles[args.name];
+            if (existing && isOAuthProfile(existing))
+                throw new Error("Log out of this OAuth profile before replacing it.");
             config.profiles[args.name] = {
                 apiKey,
                 ...(flags["base-url"] ? { baseUrl: flags["base-url"] } : {}),

package/dist/commands/profiles/show.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/show.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAWvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAiE;IAE7E,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsC9B"}
+{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/show.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAiE;IAE7E,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAwC9B"}

package/dist/commands/profiles/show.js

@@ -1,7 +1,7 @@
 import { Args } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind, maskApiKey, } from "../../key-kind.js";
-import { isActiveAgentProfile, isApiKeyProfile, readCliConfig, } from "../../profiles.js";
+import { isActiveAgentProfile, isApiKeyProfile, isOAuthProfile, readCliConfig, } from "../../profiles.js";
 export default class ProfilesShow extends SendmuxCommand {
     static args = {
         name: Args.string({
@@ -21,28 +21,30 @@ export default class ProfilesShow extends SendmuxCommand {
         if (!profile) {
             this.error(`Sendmux profile "${profileName}" was not found.`, { exit: 2 });
         }
-        const data = isApiKeyProfile(profile)
-            ? {
-                api_key: maskApiKey(profile.apiKey),
-                default: profileName === config.defaultProfile,
-                key_kind: inferApiKeyKind(profile.apiKey),
-                name: profileName,
-                ...(profile.baseUrl ? { base_url: profile.baseUrl } : {}),
-                type: "api_key",
-            }
-            : {
-                default: profileName === config.defaultProfile,
-                ...(isActiveAgentProfile(profile)
-                    ? {
-                        mailbox_email: profile.mailboxEmail,
-                        owner_invite_status: profile.ownerInvite?.status,
-                        registration_id: profile.registrationId,
-                    }
-                    : {}),
-                name: profileName,
-                status: profile.state,
-                type: "agent",
-            };
+        const data = isOAuthProfile(profile)
+            ? { name: profileName, type: "oauth", status: profile.state, default: profileName === config.defaultProfile, ...(profile.state === "authorizing" ? {} : { scopes: profile.scopes }) }
+            : isApiKeyProfile(profile)
+                ? {
+                    api_key: maskApiKey(profile.apiKey),
+                    default: profileName === config.defaultProfile,
+                    key_kind: inferApiKeyKind(profile.apiKey),
+                    name: profileName,
+                    ...(profile.baseUrl ? { base_url: profile.baseUrl } : {}),
+                    type: "api_key",
+                }
+                : {
+                    default: profileName === config.defaultProfile,
+                    ...(isActiveAgentProfile(profile)
+                        ? {
+                            mailbox_email: profile.mailboxEmail,
+                            owner_invite_status: profile.ownerInvite?.status,
+                            registration_id: profile.registrationId,
+                        }
+                        : {}),
+                    name: profileName,
+                    status: profile.state,
+                    type: "agent",
+                };
         return this.renderResult({ ok: true, data, meta: {} });
     }
 }

package/dist/generated/operations.d.ts

@@ -1994,6 +1994,12 @@ export declare const operations: {
         readonly path: "/mailbox/events";
         readonly pathParams: readonly [];
         readonly queryParams: readonly [{
+            readonly name: "mailbox_id";
+            readonly required: false;
+            readonly schema: {
+                readonly type: "string";
+            };
+        }, {
             readonly name: "event_types";
             readonly required: false;
             readonly schema: {
@@ -2021,12 +2027,6 @@ export declare const operations: {
                 readonly minimum: 30;
                 readonly maximum: 3600;
             };
-        }, {
-            readonly name: "mailbox_id";
-            readonly required: false;
-            readonly schema: {
-                readonly type: "string";
-            };
         }];
         readonly responseKind: "json";
         readonly requestBodyRequired: false;

package/dist/generated/operations.js

@@ -2364,6 +2364,13 @@ export const operations = {
         "path": "/mailbox/events",
         "pathParams": [],
         "queryParams": [
+            {
+                "name": "mailbox_id",
+                "required": false,
+                "schema": {
+                    "type": "string"
+                }
+            },
             {
                 "name": "event_types",
                 "required": false,
@@ -2395,13 +2402,6 @@ export const operations = {
                     "minimum": 30,
                     "maximum": 3600
                 }
-            },
-            {
-                "name": "mailbox_id",
-                "required": false,
-                "schema": {
-                    "type": "string"
-                }
             }
         ],
         "responseKind": "json",

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export type { ActiveAgentCliProfile, AgentCliProfile, ApiKeyCliProfile, CliConfig, CliProfile, RegisteringAgentCliProfile, } from "./profiles.js";
+export type { ActiveAgentCliProfile, AgentCliProfile, ApiKeyCliProfile, ActiveOAuthCliProfile, AuthorizingOAuthCliProfile, OAuthCliProfile, CliConfig, CliProfile, RegisteringAgentCliProfile, } from "./profiles.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,0BAA0B,GAC3B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,SAAS,EACT,UAAU,EACV,0BAA0B,GAC3B,MAAM,eAAe,CAAC"}

package/dist/oauth-http.d.ts

@@ -0,0 +1,18 @@
+export declare const OAUTH_RESOURCE = "https://sendmux.ai/api";
+export declare const DEFAULT_OAUTH_ISSUER = "https://app.sendmux.ai";
+export declare function oauthUrl(value: string, issuer?: string): URL;
+export declare function oauthRequest(endpoint: string, init?: RequestInit): Promise<Record<string, unknown>>;
+export declare function discoverOAuth(issuer: string, scopes: string[]): Promise<{
+    authorization: string;
+    registration: string;
+    token: string;
+    revocation: string;
+}>;
+export declare function oauthTokenFields(value: Record<string, unknown>, allowedScopes: string[]): {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    scopes: string[];
+};
+export declare function oauthForm(fields: Record<string, string>): RequestInit;
+//# sourceMappingURL=oauth-http.d.ts.map

package/dist/oauth-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../src/oauth-http.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,2BAA2B,CAAC;AACvD,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,CAe5D;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2ClC;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;GA6BnE;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EAAE;;;;;EA2BxB;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAMrE"}

package/dist/oauth-http.js

@@ -0,0 +1,113 @@
+export const OAUTH_RESOURCE = "https://sendmux.ai/api";
+export const DEFAULT_OAUTH_ISSUER = "https://app.sendmux.ai";
+export function oauthUrl(value, issuer) {
+    const url = new URL(value);
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
+        url.username ||
+        url.password ||
+        url.hash ||
+        url.search ||
+        (issuer && url.origin !== new URL(issuer).origin))
+        throw new Error("OAuth endpoints must use HTTPS and the configured issuer origin.");
+    return url;
+}
+export async function oauthRequest(endpoint, init = {}) {
+    oauthUrl(endpoint);
+    try {
+        const response = await fetch(endpoint, {
+            ...init,
+            redirect: "error",
+            signal: init.signal ?? AbortSignal.timeout(15_000),
+            headers: { Accept: "application/json", ...init.headers },
+        });
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let bytes = 0;
+        if (reader) {
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > 256 * 1024)
+                        throw new Error("Response exceeds the OAuth size limit.");
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+        }
+        if (!response.ok)
+            throw new Error("OAuth request was rejected.");
+        if (bytes === 0)
+            return {};
+        if (!/^application\/json(?:;|$)/i.test(response.headers.get("content-type") ?? ""))
+            throw new Error("Invalid OAuth content type.");
+        const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Invalid OAuth response.");
+        return value;
+    }
+    catch {
+        throw new Error("OAuth request failed. Check the connection and try signing in again.");
+    }
+}
+export async function discoverOAuth(issuer, scopes) {
+    const url = oauthUrl(issuer);
+    const metadataUrl = `${url.origin}/.well-known/oauth-authorization-server${url.pathname === "/" ? "" : url.pathname}`;
+    const metadata = await oauthRequest(metadataUrl);
+    const supports = (field, value) => Array.isArray(metadata[field]) && metadata[field].includes(value);
+    if (metadata.issuer !== issuer ||
+        !supports("code_challenge_methods_supported", "S256") ||
+        !supports("token_endpoint_auth_methods_supported", "none") ||
+        metadata.authorization_response_iss_parameter_supported !== true ||
+        !supports("protected_resources", OAUTH_RESOURCE) ||
+        !scopes.every((scope) => supports("scopes_supported", scope)))
+        throw new Error("The issuer does not support the requested Sendmux OAuth connection.");
+    const endpoint = (name) => {
+        const value = metadata[name];
+        if (typeof value !== "string")
+            throw new Error("OAuth discovery is missing an endpoint.");
+        return oauthUrl(value, issuer).href;
+    };
+    return {
+        authorization: endpoint("authorization_endpoint"),
+        registration: endpoint("registration_endpoint"),
+        token: endpoint("token_endpoint"),
+        revocation: endpoint("revocation_endpoint"),
+    };
+}
+export function oauthTokenFields(value, allowedScopes) {
+    const validToken = (token) => typeof token === "string" && /^[A-Za-z0-9\-._~+/]+=*$/.test(token);
+    if (!validToken(value.access_token) ||
+        !validToken(value.refresh_token) ||
+        typeof value.token_type !== "string" ||
+        value.token_type.toLowerCase() !== "bearer" ||
+        typeof value.expires_in !== "number" ||
+        !Number.isSafeInteger(value.expires_in) ||
+        value.expires_in <= 0 ||
+        typeof value.scope !== "string")
+        throw new Error("The issuer returned invalid OAuth token metadata.");
+    const scopes = value.scope.split(" ").filter(Boolean);
+    if (!scopes.length || !scopes.every((scope) => allowedScopes.includes(scope)))
+        throw new Error("The issuer returned unexpected OAuth scopes.");
+    const expiresAt = Date.now() + value.expires_in * 1000;
+    if (!Number.isSafeInteger(expiresAt))
+        throw new Error("The issuer returned an invalid token lifetime.");
+    return {
+        accessToken: value.access_token,
+        refreshToken: value.refresh_token,
+        expiresAt,
+        scopes,
+    };
+}
+export function oauthForm(fields) {
+    return {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(fields),
+    };
+}

package/dist/oauth-login.d.ts

@@ -0,0 +1,13 @@
+export declare function loginOAuth(input: {
+    configDir: string;
+    name: string;
+    issuer: string;
+    scopes: string[];
+    noBrowser: boolean;
+    report: (message: string) => void;
+}): Promise<{
+    profile: string;
+    type: string;
+    scopes: string[];
+}>;
+//# sourceMappingURL=oauth-login.d.ts.map

package/dist/oauth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../src/oauth-login.ts"],"names":[],"mappings":"AAmBA,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;;;;GAsJA"}