@sendmux/cli 1.5.0 → 1.7.0

package/README.md

@@ -19,9 +19,9 @@ Agent-drivable command line interface for Sendmux.
 
 - No existing Sendmux account or API key is required to register an agent inbox.
 - npm global installs, `npx`, or a downloaded release tarball.
-- A root `smx_root_*` key for Management commands.
-- A send-capable `smx_mbx_*` key or owner-approved agent profile for Sending commands.
-- A mailbox-scoped `smx_mbx_*` key or registered agent profile for Mailbox commands.
+- Management commands require an OAuth profile with the requested permissions or a root `smx_root_*` key.
+- Sending commands require an OAuth profile with `email.send`, a send-capable `smx_mbx_*` key, or an owner-approved agent profile.
+- Mailbox commands require an OAuth profile with the requested mailbox permissions, a mailbox-scoped `smx_mbx_*` key, or a registered agent profile.
 
 ## Installation
 
@@ -31,6 +31,29 @@ npm install -g @sendmux/cli
 
 The package exposes the `sendmux` binary.
 
+## Sign in with OAuth
+
+Sign in through your browser and request only the permissions your workflow needs:
+
+```sh
+sendmux auth:login work --scope mailbox.read
+sendmux mailbox:get-connection --profile work --json
+```
+
+Repeat `--scope` for additional permissions, such as `email.send` or `domain.read`. The consent screen lets you choose the team and mailboxes. A login creates a new profile; it cannot overwrite an existing profile. Use `--no-browser` to print the authorization URL without opening it automatically; open that URL on the same computer so the loopback callback reaches the CLI.
+
+The CLI uses an authorization code with S256 PKCE and validates the callback state and issuer. Access and refresh tokens are saved in the protected local configuration file; command results and profile listings do not reveal them. API commands refresh tokens when needed. Concurrent commands share one refresh operation. If a refresh response is lost, the CLI requires a new login instead of replaying the old refresh token.
+
+Revoke the connection and remove its profile:
+
+```sh
+sendmux auth:logout work
+```
+
+If revocation fails, the profile stays available for another logout attempt. Revocation affects the connection associated with that profile.
+
+For a headless workflow that already has an access token, supply it through `SENDMUX_ACCESS_TOKEN`. Do not also set `SENDMUX_API_KEY` or pass `--api-key`. The CLI does not refresh an environment-supplied token; its issuer or your credential provider must renew it.
+
 ## Usage
 
 Register an agent inbox and save its durable read credential in a local profile:

package/dist/agent-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-auth.d.ts","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,qBAAqB,EAE1B,KAAK,SAAS,EAGf,MAAM,eAAe,CAAC;AAUvB,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAWD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,SAAS,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAyGnG;AAED,wBAAsB,gBAAgB,CAAC,EACrC,SAAS,EACT,KAAK,EACL,WAAW,GACZ,EAAE;IACD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC,CAiChD;AAED,wBAAsB,wBAAwB,CAAC,EAC7C,MAAM,EACN,SAAS,EACT,OAAO,EACP,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ClB;AA6DD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYxD;AAaD,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,SAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"agent-auth.d.ts","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,qBAAqB,EAE1B,KAAK,SAAS,EAGf,MAAM,eAAe,CAAC;AAYvB,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAWD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,SAAS,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAyGnG;AAED,wBAAsB,gBAAgB,CAAC,EACrC,SAAS,EACT,KAAK,EACL,WAAW,GACZ,EAAE;IACD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC,CAiChD;AAED,wBAAsB,wBAAwB,CAAC,EAC7C,MAAM,EACN,SAAS,EACT,OAAO,EACP,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClB;AA6DD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYxD;AAaD,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,SAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/agent-auth.js

@@ -7,6 +7,8 @@ const SENDING_API_RESOURCE = "https://smtp.sendmux.ai/api/v1";
 const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
 const READINESS_TIMEOUT_MS = 10 * 60 * 1_000;
+const AUTH_REQUEST_TIMEOUT_MS = 15_000;
+const MAX_AUTH_RESPONSE_BYTES = 256 * 1024;
 const SENDING_TOKEN_SKEW_MS = 60 * 1_000;
 export async function registerAgent(input) {
     const initialConfig = await readCliConfig(input.configDir);
@@ -155,6 +157,8 @@ export async function resolveAgentSendingToken({ config, configDir, profile, pro
         }),
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(AUTH_REQUEST_TIMEOUT_MS),
     });
     const body = await responseJson(response);
     if (!response.ok) {
@@ -257,22 +261,30 @@ export async function waitForMailbox(profile, timeoutMs = READINESS_TIMEOUT_MS)
         const remainingBeforeFetch = deadline - Date.now();
         if (remainingBeforeFetch <= 0)
             throw mailboxReadinessTimeoutError();
+        const signal = AbortSignal.timeout(remainingBeforeFetch);
         let response;
+        let body;
         try {
             response = await fetch(`${profile.appApiBaseUrl}/mailbox/me`, {
                 headers: { Authorization: `Bearer ${profile.accessToken}` },
-                signal: AbortSignal.timeout(remainingBeforeFetch),
+                redirect: "error",
+                signal,
             });
+            if (response.ok) {
+                await response.body?.cancel();
+                return;
+            }
+            body = await responseJson(response);
         }
         catch (error) {
-            if (isAbortError(error) || Date.now() >= deadline)
+            if (signal.aborted || isAbortError(error) || Date.now() >= deadline)
                 throw mailboxReadinessTimeoutError();
             throw error;
         }
-        if (response.ok)
-            return;
-        const body = await responseJson(response);
-        const provisioningUnavailable = response.status === 503 && (body.error === "service_unavailable" || body.error === "temporarily_unavailable");
+        const errorCode = typeof body.error === "object" && body.error !== null && !Array.isArray(body.error) && "code" in body.error
+            ? body.error.code
+            : body.error;
+        const provisioningUnavailable = response.status === 503 && (errorCode === "service_unavailable" || errorCode === "temporarily_unavailable");
         if (!provisioningUnavailable) {
             throw new Error(agentAuthFailureMessage(response.status, body));
         }
@@ -304,6 +316,8 @@ async function postJson(url, options) {
         body: JSON.stringify(options.body),
         headers: { "Content-Type": "application/json", ...options.headers },
         method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(AUTH_REQUEST_TIMEOUT_MS),
     });
     const body = await responseJson(response);
     if (!options.expectedStatuses.includes(response.status)) {
@@ -312,7 +326,37 @@ async function postJson(url, options) {
     return body;
 }
 async function responseJson(response) {
-    const body = await response.json().catch(() => null);
+    let bytes = 0;
+    let body;
+    try {
+        const reader = response.body?.getReader();
+        const chunks = [];
+        if (reader) {
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > MAX_AUTH_RESPONSE_BYTES)
+                        break;
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+        }
+        if (bytes <= MAX_AUTH_RESPONSE_BYTES) {
+            body = JSON.parse(new TextDecoder().decode(Buffer.concat(chunks)));
+        }
+    }
+    catch {
+        body = null;
+    }
+    if (bytes > MAX_AUTH_RESPONSE_BYTES) {
+        throw new Error("Sendmux agent authentication response exceeds the size limit.");
+    }
     if (!body || typeof body !== "object" || Array.isArray(body)) {
         throw new Error(`Sendmux agent authentication returned HTTP ${response.status} without a JSON object.`);
     }

package/dist/base-command.d.ts

@@ -5,12 +5,18 @@ export interface AuthFlags {
     "base-url"?: string;
     profile?: string;
 }
-export interface ResolvedAuth {
-    apiKey: string;
-    apiKeyKind: ApiKeyKind;
+export type ResolvedAuth = {
     baseUrl?: string;
     source: string;
-}
+} & ({
+    apiKey: string;
+    apiKeyKind: ApiKeyKind;
+    accessToken?: never;
+} | {
+    accessToken: string | (() => Promise<string>);
+    apiKey?: never;
+    apiKeyKind: "oauth";
+});
 export declare const authFlags: {
     "api-key": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     "base-url": import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -20,6 +26,7 @@ export declare abstract class SendmuxCommand extends Command {
     static enableJsonFlag: boolean;
     resolveAuth(flags: AuthFlags, expectedKind: RequiredApiKeyKind): Promise<ResolvedAuth>;
     renderResult(value: unknown): unknown;
+    protected toErrorJson(error: unknown): unknown;
     renderTextResult(value: string): unknown;
     renderBinaryResult(value: ArrayBuffer | ArrayBufferView | string): unknown;
     private assertKeyKind;

package/dist/base-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAQvB,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,SAAS;;;;CAcrB,CAAC;AAEF,8BAAsB,cAAe,SAAQ,OAAO;IAClD,MAAM,CAAC,cAAc,UAAQ;IAEvB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiF5F,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASrC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IASxC,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,OAAO;IAa1E,OAAO,CAAC,aAAa;CA4BtB"}
+{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAUvB,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,CACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/D;IAAE,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CACzF,CAAC;AAEF,eAAO,MAAM,SAAS;;;;CAcrB,CAAC;AAEF,8BAAsB,cAAe,SAAQ,OAAO;IAClD,MAAM,CAAC,cAAc,UAAQ;IAEvB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoG5F,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASrC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAM9C,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IASxC,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,OAAO;IAa1E,OAAO,CAAC,aAAa;CA4BtB"}

package/dist/base-command.js

@@ -1,7 +1,8 @@
 import { Command, Flags } from "@oclif/core";
 import { apiKeyKindLabel, inferApiKeyKind, isApiKeyCompatibleWithKind, } from "./key-kind.js";
 import { resolveAgentSendingToken } from "./agent-auth.js";
-import { isActiveAgentProfile, isAgentProfile, readCliConfig, } from "./profiles.js";
+import { resolveOAuthToken } from "./oauth-profile.js";
+import { isActiveAgentProfile, isAgentProfile, isOAuthProfile, readCliConfig, } from "./profiles.js";
 export const authFlags = {
     "api-key": Flags.string({
         description: "Sendmux API key. Defaults to SENDMUX_API_KEY.",
@@ -21,8 +22,21 @@ export class SendmuxCommand extends Command {
     static enableJsonFlag = true;
     async resolveAuth(flags, expectedKind) {
         const envApiKey = process.env.SENDMUX_API_KEY || undefined;
+        const accessToken = process.env.SENDMUX_ACCESS_TOKEN || undefined;
         const envBaseUrl = process.env.SENDMUX_BASE_URL || undefined;
         const envProfile = process.env.SENDMUX_PROFILE || undefined;
+        if (accessToken && (flags["api-key"] || envApiKey)) {
+            this.error("Provide exactly one of an API key or SENDMUX_ACCESS_TOKEN.", { exit: 2 });
+        }
+        if (accessToken) {
+            const baseUrl = flags["base-url"] ?? envBaseUrl;
+            return {
+                accessToken,
+                apiKeyKind: "oauth",
+                source: "SENDMUX_ACCESS_TOKEN",
+                ...(baseUrl ? { baseUrl } : {}),
+            };
+        }
         if (flags["api-key"] || envApiKey) {
             const apiKey = flags["api-key"] ?? envApiKey;
             if (!apiKey) {
@@ -52,6 +66,10 @@ export class SendmuxCommand extends Command {
                 exit: 2,
             });
         }
+        if (isOAuthProfile(profile)) {
+            const baseUrl = flags["base-url"] ?? envBaseUrl;
+            return { accessToken: () => resolveOAuthToken(this.config.configDir, profileName), apiKeyKind: "oauth", source: `OAuth profile "${profileName}"`, ...(baseUrl ? { baseUrl } : {}) };
+        }
         if (isAgentProfile(profile)) {
             if (!isActiveAgentProfile(profile)) {
                 this.error(`Sendmux agent profile "${profileName}" has not finished registration. Re-run \`sendmux agent:register ${profileName}\`.`, {
@@ -96,6 +114,11 @@ export class SendmuxCommand extends Command {
         this.log(JSON.stringify(value, null, 2));
         return value;
     }
+    toErrorJson(error) {
+        return {
+            error: error instanceof Error ? { ...error, message: error.message, name: error.name } : error,
+        };
+    }
     renderTextResult(value) {
         if (this.jsonEnabled()) {
             return { text: value };

package/dist/commands/auth/login.d.ts

@@ -0,0 +1,14 @@
+import { SendmuxCommand } from "../../base-command.js";
+export default class AuthLogin extends SendmuxCommand {
+    static description: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        issuer: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        scope: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        "no-browser": import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,cAAc;IACnD,MAAM,CAAC,WAAW,SAA4D;IAC9E,MAAM,CAAC,IAAI;;MAET;IACF,MAAM,CAAC,KAAK;;;;MAaV;IAEI,GAAG;CAYV"}

package/dist/commands/auth/login.js

@@ -0,0 +1,36 @@
+import { Args, Flags } from "@oclif/core";
+import { SendmuxCommand } from "../../base-command.js";
+import { DEFAULT_OAUTH_ISSUER } from "../../oauth-http.js";
+import { loginOAuth } from "../../oauth-login.js";
+export default class AuthLogin extends SendmuxCommand {
+    static description = "Sign in through the browser and save an OAuth profile.";
+    static args = {
+        name: Args.string({ required: true, description: "New profile name." }),
+    };
+    static flags = {
+        issuer: Flags.string({
+            default: DEFAULT_OAUTH_ISSUER,
+            description: "Sendmux authorization-server issuer.",
+        }),
+        scope: Flags.string({
+            multiple: true,
+            required: true,
+            description: "Permission to request. Repeat for multiple scopes.",
+        }),
+        "no-browser": Flags.boolean({
+            description: "Print the authorization URL without opening a browser.",
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AuthLogin);
+        const data = await loginOAuth({
+            configDir: this.config.configDir,
+            name: args.name,
+            issuer: flags.issuer,
+            scopes: flags.scope,
+            noBrowser: flags["no-browser"] ?? false,
+            report: (message) => process.stderr.write(`${message}\n`),
+        });
+        return this.renderResult({ ok: true, data, meta: {} });
+    }
+}

package/dist/commands/auth/logout.d.ts

@@ -0,0 +1,9 @@
+import { SendmuxCommand } from "../../base-command.js";
+export default class AuthLogout extends SendmuxCommand {
+    static description: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=logout.d.ts.map

package/dist/commands/auth/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,cAAc;IACpD,MAAM,CAAC,WAAW,SAC2C;IAC7D,MAAM,CAAC,IAAI;;MAIT;IAEI,GAAG;CAUV"}

package/dist/commands/auth/logout.js

@@ -0,0 +1,22 @@
+import { Args } from "@oclif/core";
+import { SendmuxCommand } from "../../base-command.js";
+import { logoutOAuth } from "../../oauth-profile.js";
+import { readCliConfig } from "../../profiles.js";
+export default class AuthLogout extends SendmuxCommand {
+    static description = "Revoke an OAuth connection and remove its local profile.";
+    static args = {
+        name: Args.string({
+            description: "OAuth profile name. Defaults to the configured profile.",
+        }),
+    };
+    async run() {
+        const { args } = await this.parse(AuthLogout);
+        const name = args.name ??
+            process.env.SENDMUX_PROFILE ??
+            (await readCliConfig(this.config.configDir)).defaultProfile;
+        if (!name)
+            this.error("Choose an OAuth profile to log out.", { exit: 2 });
+        const data = await logoutOAuth(this.config.configDir, name);
+        return this.renderResult({ ok: true, data, meta: {} });
+    }
+}

package/dist/commands/mailbox/stream-events.d.ts

@@ -35,6 +35,12 @@ export default class MailboxStreamEventsCommand extends OperationCommand {
         readonly path: "/mailbox/events";
         readonly pathParams: readonly [];
         readonly queryParams: readonly [{
+            readonly name: "mailbox_id";
+            readonly required: false;
+            readonly schema: {
+                readonly type: "string";
+            };
+        }, {
             readonly name: "event_types";
             readonly required: false;
             readonly schema: {
@@ -62,12 +68,6 @@ export default class MailboxStreamEventsCommand extends OperationCommand {
                 readonly minimum: 30;
                 readonly maximum: 3600;
             };
-        }, {
-            readonly name: "mailbox_id";
-            readonly required: false;
-            readonly schema: {
-                readonly type: "string";
-            };
         }];
         readonly responseKind: "json";
         readonly requestBodyRequired: false;

package/dist/commands/profiles/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAWvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,WAAW,SAAsC;IACxD,MAAM,CAAC,KAAK;;MAIV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAoC9B"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,WAAW,SAAsC;IACxD,MAAM,CAAC,KAAK;;MAIV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAqC9B"}

package/dist/commands/profiles/list.js

@@ -1,7 +1,7 @@
 import { Flags } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind, maskApiKey, } from "../../key-kind.js";
-import { isActiveAgentProfile, isApiKeyProfile, readCliConfig, } from "../../profiles.js";
+import { isActiveAgentProfile, isApiKeyProfile, isOAuthProfile, readCliConfig, } from "../../profiles.js";
 export default class ProfilesList extends SendmuxCommand {
     static description = "List local Sendmux CLI profiles.";
     static flags = {
@@ -13,6 +13,8 @@ export default class ProfilesList extends SendmuxCommand {
         const { flags } = await this.parse(ProfilesList);
         const config = await readCliConfig(this.config.configDir);
         const profiles = Object.entries(config.profiles).map(([name, profile]) => {
+            if (isOAuthProfile(profile))
+                return { name, type: "oauth", status: profile.state, default: name === config.defaultProfile, ...(profile.state === "authorizing" ? {} : { scopes: profile.scopes }) };
             if (isApiKeyProfile(profile)) {
                 return {
                     default: name === config.defaultProfile,

package/dist/commands/profiles/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/set.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,cAAc;IACrD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAmD;IACrE,MAAM,CAAC,KAAK;;;;MAWV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAoC9B"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/set.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,cAAc;IACrD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAmD;IACrE,MAAM,CAAC,KAAK;;;;MAWV;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsC9B"}

package/dist/commands/profiles/set.js

@@ -1,7 +1,7 @@
 import { Args, Flags } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind } from "../../key-kind.js";
-import { updateCliConfig } from "../../profiles.js";
+import { isOAuthProfile, updateCliConfig } from "../../profiles.js";
 export default class ProfilesSet extends SendmuxCommand {
     static args = {
         name: Args.string({
@@ -30,6 +30,9 @@ export default class ProfilesSet extends SendmuxCommand {
         }
         const keyKind = inferApiKeyKind(apiKey);
         const isDefault = await updateCliConfig(this.config.configDir, (config) => {
+            const existing = config.profiles[args.name];
+            if (existing && isOAuthProfile(existing))
+                throw new Error("Log out of this OAuth profile before replacing it.");
             config.profiles[args.name] = {
                 apiKey,
                 ...(flags["base-url"] ? { baseUrl: flags["base-url"] } : {}),

package/dist/commands/profiles/show.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/show.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAWvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAiE;IAE7E,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsC9B"}
+{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../../src/commands/profiles/show.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,cAAc;IACtD,MAAM,CAAC,IAAI;;MAKT;IACF,MAAM,CAAC,WAAW,SAAiE;IAE7E,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAwC9B"}

package/dist/commands/profiles/show.js

@@ -1,7 +1,7 @@
 import { Args } from "@oclif/core";
 import { SendmuxCommand } from "../../base-command.js";
 import { inferApiKeyKind, maskApiKey, } from "../../key-kind.js";
-import { isActiveAgentProfile, isApiKeyProfile, readCliConfig, } from "../../profiles.js";
+import { isActiveAgentProfile, isApiKeyProfile, isOAuthProfile, readCliConfig, } from "../../profiles.js";
 export default class ProfilesShow extends SendmuxCommand {
     static args = {
         name: Args.string({
@@ -21,28 +21,30 @@ export default class ProfilesShow extends SendmuxCommand {
         if (!profile) {
             this.error(`Sendmux profile "${profileName}" was not found.`, { exit: 2 });
         }
-        const data = isApiKeyProfile(profile)
-            ? {
-                api_key: maskApiKey(profile.apiKey),
-                default: profileName === config.defaultProfile,
-                key_kind: inferApiKeyKind(profile.apiKey),
-                name: profileName,
-                ...(profile.baseUrl ? { base_url: profile.baseUrl } : {}),
-                type: "api_key",
-            }
-            : {
-                default: profileName === config.defaultProfile,
-                ...(isActiveAgentProfile(profile)
-                    ? {
-                        mailbox_email: profile.mailboxEmail,
-                        owner_invite_status: profile.ownerInvite?.status,
-                        registration_id: profile.registrationId,
-                    }
-                    : {}),
-                name: profileName,
-                status: profile.state,
-                type: "agent",
-            };
+        const data = isOAuthProfile(profile)
+            ? { name: profileName, type: "oauth", status: profile.state, default: profileName === config.defaultProfile, ...(profile.state === "authorizing" ? {} : { scopes: profile.scopes }) }
+            : isApiKeyProfile(profile)
+                ? {
+                    api_key: maskApiKey(profile.apiKey),
+                    default: profileName === config.defaultProfile,
+                    key_kind: inferApiKeyKind(profile.apiKey),
+                    name: profileName,
+                    ...(profile.baseUrl ? { base_url: profile.baseUrl } : {}),
+                    type: "api_key",
+                }
+                : {
+                    default: profileName === config.defaultProfile,
+                    ...(isActiveAgentProfile(profile)
+                        ? {
+                            mailbox_email: profile.mailboxEmail,
+                            owner_invite_status: profile.ownerInvite?.status,
+                            registration_id: profile.registrationId,
+                        }
+                        : {}),
+                    name: profileName,
+                    status: profile.state,
+                    type: "agent",
+                };
         return this.renderResult({ ok: true, data, meta: {} });
     }
 }

package/dist/generated/operations.d.ts

@@ -1994,6 +1994,12 @@ export declare const operations: {
         readonly path: "/mailbox/events";
         readonly pathParams: readonly [];
         readonly queryParams: readonly [{
+            readonly name: "mailbox_id";
+            readonly required: false;
+            readonly schema: {
+                readonly type: "string";
+            };
+        }, {
             readonly name: "event_types";
             readonly required: false;
             readonly schema: {
@@ -2021,12 +2027,6 @@ export declare const operations: {
                 readonly minimum: 30;
                 readonly maximum: 3600;
             };
-        }, {
-            readonly name: "mailbox_id";
-            readonly required: false;
-            readonly schema: {
-                readonly type: "string";
-            };
         }];
         readonly responseKind: "json";
         readonly requestBodyRequired: false;

package/dist/generated/operations.js

@@ -2364,6 +2364,13 @@ export const operations = {
         "path": "/mailbox/events",
         "pathParams": [],
         "queryParams": [
+            {
+                "name": "mailbox_id",
+                "required": false,
+                "schema": {
+                    "type": "string"
+                }
+            },
             {
                 "name": "event_types",
                 "required": false,
@@ -2395,13 +2402,6 @@ export const operations = {
                     "minimum": 30,
                     "maximum": 3600
                 }
-            },
-            {
-                "name": "mailbox_id",
-                "required": false,
-                "schema": {
-                    "type": "string"
-                }
             }
         ],
         "responseKind": "json",

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export type { ActiveAgentCliProfile, AgentCliProfile, ApiKeyCliProfile, CliConfig, CliProfile, RegisteringAgentCliProfile, } from "./profiles.js";
+export type { ActiveAgentCliProfile, AgentCliProfile, ApiKeyCliProfile, ActiveOAuthCliProfile, AuthorizingOAuthCliProfile, OAuthCliProfile, CliConfig, CliProfile, RegisteringAgentCliProfile, } from "./profiles.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,0BAA0B,GAC3B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,SAAS,EACT,UAAU,EACV,0BAA0B,GAC3B,MAAM,eAAe,CAAC"}

package/dist/oauth-http.d.ts

@@ -0,0 +1,18 @@
+export declare const OAUTH_RESOURCE = "https://sendmux.ai/api";
+export declare const DEFAULT_OAUTH_ISSUER = "https://app.sendmux.ai";
+export declare function oauthUrl(value: string, issuer?: string): URL;
+export declare function oauthRequest(endpoint: string, init?: RequestInit): Promise<Record<string, unknown>>;
+export declare function discoverOAuth(issuer: string, scopes: string[]): Promise<{
+    authorization: string;
+    registration: string;
+    token: string;
+    revocation: string;
+}>;
+export declare function oauthTokenFields(value: Record<string, unknown>, allowedScopes: string[]): {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    scopes: string[];
+};
+export declare function oauthForm(fields: Record<string, string>): RequestInit;
+//# sourceMappingURL=oauth-http.d.ts.map

package/dist/oauth-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../src/oauth-http.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,2BAA2B,CAAC;AACvD,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,CAe5D;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2ClC;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;GA6BnE;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EAAE;;;;;EA2BxB;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAMrE"}