@thenavidm/threads-mcp-cli 1.1.0

package/dist/auth/store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Where tokens live between runs.
+ *
+ * A Threads long-lived token is valid for 60 days and can be refreshed for
+ * another 60 at any point after it is 24 hours old. Miss that window and it is
+ * gone permanently: there is no grace period and no way to refresh an expired
+ * one. The whole point of writing tokens to a file the server owns is that the
+ * server can then refresh them on its own, which an environment variable pasted
+ * into a client config can never do.
+ *
+ * The file is written 0600, and the directory 0700, because it holds
+ * credentials that can post as you. Writes go to a temporary file in the same
+ * directory and are then renamed, so a crash mid-write leaves the previous
+ * tokens intact rather than a truncated file that locks you out.
+ */
+import type { Account } from "../config.js";
+export type StoredToken = {
+    user_id: string;
+    username?: string;
+    access_token: string;
+    /** Unix ms. */
+    expires_at?: number;
+    /** Unix ms this token was last minted or refreshed. */
+    obtained_at?: number;
+    scopes?: string[];
+};
+export type TokenFile = {
+    version: 1;
+    accounts: StoredToken[];
+};
+export declare function readStore(path: string): TokenFile;
+export declare function writeStore(path: string, file: TokenFile): void;
+/** Insert or replace one profile's token, keyed by profile id. */
+export declare function upsertToken(path: string, token: StoredToken): void;
+export declare function removeToken(path: string, userIdOrUsername: string): boolean;
+/** The stored tokens, as accounts the rest of the server understands. */
+export declare function accountsFromStore(path: string): Account[];

package/dist/auth/store.js

@@ -0,0 +1,88 @@
+/**
+ * Where tokens live between runs.
+ *
+ * A Threads long-lived token is valid for 60 days and can be refreshed for
+ * another 60 at any point after it is 24 hours old. Miss that window and it is
+ * gone permanently: there is no grace period and no way to refresh an expired
+ * one. The whole point of writing tokens to a file the server owns is that the
+ * server can then refresh them on its own, which an environment variable pasted
+ * into a client config can never do.
+ *
+ * The file is written 0600, and the directory 0700, because it holds
+ * credentials that can post as you. Writes go to a temporary file in the same
+ * directory and are then renamed, so a crash mid-write leaves the previous
+ * tokens intact rather than a truncated file that locks you out.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, unlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { normalizeUsername } from "../config.js";
+const EMPTY = { version: 1, accounts: [] };
+export function readStore(path) {
+    if (!existsSync(path))
+        return { ...EMPTY, accounts: [] };
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!parsed || typeof parsed !== "object")
+            return { ...EMPTY, accounts: [] };
+        const accounts = parsed.accounts;
+        if (!Array.isArray(accounts))
+            return { ...EMPTY, accounts: [] };
+        return {
+            version: 1,
+            accounts: accounts.filter((a) => Boolean(a && typeof a.access_token === "string" && typeof a.user_id === "string")),
+        };
+    }
+    catch {
+        // A corrupt store must not take the server down. It behaves as empty, and
+        // `doctor` reports it, because silently overwriting someone's only working
+        // token would be worse than refusing to read it.
+        process.stderr.write(`[threads-mcp] Token store at ${path} is unreadable. Ignoring it.\n`);
+        return { ...EMPTY, accounts: [] };
+    }
+}
+export function writeStore(path, file) {
+    const dir = dirname(path);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = join(dir, `.tokens.${process.pid}.tmp`);
+    writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    try {
+        renameSync(tmp, path);
+        chmodSync(path, 0o600);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // Nothing useful to do; the rename failure is the real error.
+        }
+        throw error;
+    }
+}
+/** Insert or replace one profile's token, keyed by profile id. */
+export function upsertToken(path, token) {
+    const file = readStore(path);
+    const rest = file.accounts.filter((a) => a.user_id !== token.user_id);
+    writeStore(path, { version: 1, accounts: [...rest, token] });
+}
+export function removeToken(path, userIdOrUsername) {
+    const file = readStore(path);
+    const needle = normalizeUsername(userIdOrUsername);
+    const kept = file.accounts.filter((a) => a.user_id !== needle && normalizeUsername(a.username ?? "") !== needle);
+    if (kept.length === file.accounts.length)
+        return false;
+    writeStore(path, { version: 1, accounts: kept });
+    return true;
+}
+/** The stored tokens, as accounts the rest of the server understands. */
+export function accountsFromStore(path) {
+    return readStore(path).accounts.map((a) => ({
+        accessToken: a.access_token,
+        userId: a.user_id,
+        username: a.username ? normalizeUsername(a.username) : undefined,
+        expiresAt: a.expires_at,
+        source: "store",
+    }));
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAkBjD,MAAM,KAAK,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEtD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAI,MAAoB,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,QAAQ,CAAC,MAAM,CACvB,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAC3G;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,2EAA2E;QAC3E,iDAAiD;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,IAAI,gCAAgC,CAAC,CAAC;QAC3F,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAe;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IACpD,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAkB;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,gBAAwB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,MAAM,CAC9E,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,MAAM,EAAE,OAAgB;KACzB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Minting and refreshing Threads tokens.
+ *
+ * Three token states exist and they are easy to confuse:
+ *
+ *   short-lived   1 hour.  What the OAuth code exchange returns.
+ *   long-lived    60 days. What you get by exchanging a short-lived token,
+ *                 and the only kind worth storing.
+ *   refreshed     60 days from the refresh. Allowed once the token is at
+ *                 least 24 hours old, and impossible once it has expired.
+ *
+ * That last sentence is the entire reason this file exists. A token that is
+ * never refreshed dies on day 60 and cannot be revived; the person has to walk
+ * the whole OAuth flow again. A server that refreshes on a schedule turns a
+ * recurring 60-day outage into something nobody has to think about.
+ *
+ * `maybeRefresh` is called before every request rather than on a timer, because
+ * an MCP server is not a daemon. It runs when a client launches it and stops
+ * when the client quits, and a timer that fires on day 59 fires in a process
+ * that has not existed for weeks.
+ */
+import type { Account, Config } from "../config.js";
+export type TokenResponse = {
+    access_token: string;
+    token_type?: string;
+    /** Seconds until expiry. About 5,183,944 for a fresh long-lived token. */
+    expires_in?: number;
+};
+/**
+ * Exchange the short-lived token from the OAuth code flow for a 60-day one.
+ *
+ * This needs the app secret, which is why `login` needs THREADS_APP_SECRET and
+ * pasting a token from Meta's Graph API Explorer does not: that explorer hands
+ * out short-lived tokens, and a short-lived token pasted into a config stops
+ * working in an hour. `login` is the path that produces something durable.
+ */
+export declare function exchangeForLongLived(shortLivedToken: string, appSecret: string, host: string, timeoutMs?: number): Promise<TokenResponse>;
+/** Extend a long-lived token by another 60 days. No app secret required. */
+export declare function refreshLongLived(token: string, host: string, timeoutMs?: number): Promise<TokenResponse>;
+/** Days until this token expires, or undefined when the expiry is unknown. */
+export declare function daysRemaining(account: Account, now?: number): number | undefined;
+/**
+ * Whether this token should be refreshed now.
+ *
+ * Two conditions, both from Meta's rules. It has to be at least 24 hours old,
+ * and it has to still be alive. An expiry we do not know about is left alone:
+ * a token pasted in from the environment has no recorded expiry, and refreshing
+ * something on a guess would burn a call and could not be written anywhere
+ * useful anyway.
+ */
+export declare function shouldRefresh(account: Account, windowDays: number, now?: number): boolean;
+/** Turn Meta's `expires_in` seconds into the absolute expiry we store. */
+export declare function expiryFrom(response: TokenResponse, now?: number): number | undefined;
+export declare function refreshWindowOf(config: Config): number;

package/dist/auth/tokens.js

@@ -0,0 +1,96 @@
+/**
+ * Minting and refreshing Threads tokens.
+ *
+ * Three token states exist and they are easy to confuse:
+ *
+ *   short-lived   1 hour.  What the OAuth code exchange returns.
+ *   long-lived    60 days. What you get by exchanging a short-lived token,
+ *                 and the only kind worth storing.
+ *   refreshed     60 days from the refresh. Allowed once the token is at
+ *                 least 24 hours old, and impossible once it has expired.
+ *
+ * That last sentence is the entire reason this file exists. A token that is
+ * never refreshed dies on day 60 and cannot be revived; the person has to walk
+ * the whole OAuth flow again. A server that refreshes on a schedule turns a
+ * recurring 60-day outage into something nobody has to think about.
+ *
+ * `maybeRefresh` is called before every request rather than on a timer, because
+ * an MCP server is not a daemon. It runs when a client launches it and stops
+ * when the client quits, and a timer that fires on day 59 fires in a process
+ * that has not existed for weeks.
+ */
+import { AuthenticationError, errorFor } from "../api/errors.js";
+const DAY_MS = 86_400_000;
+async function tokenCall(url, endpoint, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, { signal: controller.signal });
+        const text = await res.text();
+        if (!res.ok)
+            throw errorFor(res.status, endpoint, text);
+        const parsed = JSON.parse(text);
+        if (!parsed.access_token) {
+            throw new AuthenticationError(`${endpoint} returned no access_token.`, res.status, endpoint);
+        }
+        return parsed;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Exchange the short-lived token from the OAuth code flow for a 60-day one.
+ *
+ * This needs the app secret, which is why `login` needs THREADS_APP_SECRET and
+ * pasting a token from Meta's Graph API Explorer does not: that explorer hands
+ * out short-lived tokens, and a short-lived token pasted into a config stops
+ * working in an hour. `login` is the path that produces something durable.
+ */
+export async function exchangeForLongLived(shortLivedToken, appSecret, host, timeoutMs = 30_000) {
+    const url = new URL(`${host}/access_token`);
+    url.searchParams.set("grant_type", "th_exchange_token");
+    url.searchParams.set("client_secret", appSecret);
+    url.searchParams.set("access_token", shortLivedToken);
+    return tokenCall(url.toString(), "/access_token", timeoutMs);
+}
+/** Extend a long-lived token by another 60 days. No app secret required. */
+export async function refreshLongLived(token, host, timeoutMs = 30_000) {
+    const url = new URL(`${host}/refresh_access_token`);
+    url.searchParams.set("grant_type", "th_refresh_token");
+    url.searchParams.set("access_token", token);
+    return tokenCall(url.toString(), "/refresh_access_token", timeoutMs);
+}
+/** Days until this token expires, or undefined when the expiry is unknown. */
+export function daysRemaining(account, now = Date.now()) {
+    if (!account.expiresAt)
+        return undefined;
+    return Math.floor((account.expiresAt - now) / DAY_MS);
+}
+/**
+ * Whether this token should be refreshed now.
+ *
+ * Two conditions, both from Meta's rules. It has to be at least 24 hours old,
+ * and it has to still be alive. An expiry we do not know about is left alone:
+ * a token pasted in from the environment has no recorded expiry, and refreshing
+ * something on a guess would burn a call and could not be written anywhere
+ * useful anyway.
+ */
+export function shouldRefresh(account, windowDays, now = Date.now()) {
+    const remaining = daysRemaining(account, now);
+    if (remaining === undefined)
+        return false;
+    if (remaining <= 0)
+        return false;
+    if (account.expiresAt && now < account.expiresAt - 59 * DAY_MS)
+        return false;
+    return remaining <= windowDays;
+}
+/** Turn Meta's `expires_in` seconds into the absolute expiry we store. */
+export function expiryFrom(response, now = Date.now()) {
+    return typeof response.expires_in === "number" ? now + response.expires_in * 1000 : undefined;
+}
+export function refreshWindowOf(config) {
+    return config.refreshWindowDays;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,GAAG,UAAU,CAAC;AAS1B,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,QAAgB,EAAE,SAAiB;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,GAAG,QAAQ,4BAA4B,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,eAAuB,EACvB,SAAiB,EACjB,IAAY,EACZ,SAAS,GAAG,MAAM;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAY,EACZ,SAAS,GAAG,MAAM;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9D,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,UAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,SAAS,IAAI,UAAU,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,QAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClE,OAAO,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAClC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The CLI adapter.
+ *
+ * `register()` in tools/kit.ts turns a `ToolSpec` into an MCP tool. This turns
+ * the same spec into a shell command, from the same `ALL_TOOLS` array, through
+ * the same handler and the same `WriteGuard`. Nothing is described twice, so a
+ * tool added tomorrow is a command tomorrow and the two surfaces cannot drift.
+ *
+ * The command IS the tool name. `create_post` runs as `create-post`, and the
+ * underscore form works too. Inventing a prettier command tree would mean a
+ * hand-written mapping, which is exactly the drift this avoids, and it would
+ * force anyone reading the SKILL.md to learn two vocabularies for one action.
+ *
+ * Zod is the only schema: every flag, its placeholder, its help text and its
+ * validation come from the shape the MCP tool already declares.
+ */
+import { type ZodRawShape } from "zod";
+/** How a value reaches the parser, once the Zod wrappers are peeled off. */
+type FlagKind = "string" | "number" | "boolean" | "enum" | "json";
+type Flag = {
+    /** The schema key, e.g. `reply_control`. */
+    key: string;
+    /** The long flag, e.g. `--reply-control`. */
+    flag: string;
+    kind: FlagKind;
+    required: boolean;
+    repeatable: boolean;
+    choices?: string[];
+    help: string;
+};
+export declare function flagsFor(shape: ZodRawShape): Flag[];
+/**
+ * Parse argv against a tool's flags.
+ *
+ * Zod does the real validation afterwards, so this only has to get the values
+ * into the right JavaScript types and catch the mistakes Zod would report in
+ * terms of a schema the person at the terminal never sees.
+ */
+export declare function parseArgs(argv: string[], flags: Flag[]): Record<string, unknown>;
+/** Exit codes, so a script can branch without parsing the message. */
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly usage: 2;
+    readonly notFound: 3;
+    readonly auth: 4;
+    readonly api: 5;
+    readonly rateLimited: 7;
+    readonly config: 10;
+};
+/** Map a thrown error onto one of those, from the shape the API gave back. */
+export declare function exitCodeFor(error: unknown): number;
+/**
+ * `--select id,post.title` keeps only the named fields. Dotted paths descend,
+ * arrays are traversed element-wise. This is what makes a long feed affordable.
+ */
+export declare function selectFields(data: unknown, paths: string[]): unknown;
+export declare function isCliCommand(argv: string[]): boolean;
+export declare function runCli(argv: string[]): Promise<number>;
+export {};