magic-spells 0.0.0-stage → 0.2.0

package/dist/chunk-JZ7XESF4.js

@@ -0,0 +1,1829 @@
+// ../kit/src/errors.ts
+var SHELL_PRODUCT = "magic";
+var MagicError = class _MagicError extends Error {
+  code;
+  product;
+  hint;
+  candidates;
+  details;
+  constructor(code, message, opts = {}) {
+    super(message);
+    this.name = "MagicError";
+    this.code = code;
+    this.product = opts.product ?? SHELL_PRODUCT;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.candidates !== void 0) this.candidates = opts.candidates;
+    if (opts.details !== void 0) this.details = opts.details;
+    Object.setPrototypeOf(this, _MagicError.prototype);
+  }
+  /** The inner envelope: what `{ error: … }` wraps on stderr and in MCP results. */
+  toJSON() {
+    const out = { code: this.code, message: this.message, product: this.product };
+    if (this.hint !== void 0) out.hint = this.hint;
+    if (this.candidates !== void 0) out.candidates = this.candidates;
+    if (this.details !== void 0) out.details = this.details;
+    return out;
+  }
+};
+function isMagicError(e) {
+  return e instanceof MagicError;
+}
+function exitCodeFor(code) {
+  switch (code) {
+    case "usage":
+      return 2;
+    case "not_logged_in":
+    case "auth_invalid":
+    case "auth_expired":
+    case "auth_cancelled":
+      return 3;
+    case "permission_denied":
+      return 4;
+    case "not_found":
+      return 5;
+    case "ambiguous_name":
+      return 6;
+    case "validation_failed":
+    case "conflict":
+    case "diagnostics":
+      return 7;
+    case "destructive_action_disabled":
+      return 8;
+    case "rate_limited":
+      return 9;
+    case "network":
+      return 10;
+    case "product_unavailable":
+      return 11;
+    case "unknown":
+      return 1;
+    default: {
+      const never = code;
+      void never;
+      return 1;
+    }
+  }
+}
+function toToolError(e) {
+  return {
+    content: [{ type: "text", text: JSON.stringify({ error: e.toJSON() }) }],
+    isError: true
+  };
+}
+function readEnvelope(body) {
+  if (!body || typeof body !== "object" || !("error" in body)) return {};
+  const err = body.error;
+  if (!err || typeof err !== "object") return {};
+  const e = err;
+  const rawField = e.details && typeof e.details === "object" ? e.details.field : void 0;
+  return {
+    code: typeof e.code === "string" ? e.code : void 0,
+    message: typeof e.message === "string" ? e.message : void 0,
+    field: typeof rawField === "string" && rawField.length > 0 ? rawField : void 0
+  };
+}
+function mapHttpError(status, body, opts) {
+  const env = readEnvelope(body);
+  const product = opts.product;
+  const message = env.message ?? `${opts.title ?? product} request failed (HTTP ${status}).`;
+  if (status === 401) {
+    const expired = `${env.code ?? ""} ${env.message ?? ""}`.toLowerCase().includes("expired");
+    return new MagicError(expired ? "auth_expired" : "auth_invalid", message, {
+      product,
+      ...opts.authHint ? { hint: opts.authHint } : {}
+    });
+  }
+  if (status === 403) return new MagicError("permission_denied", message, { product });
+  if (status === 404) {
+    const hay = `${env.code ?? ""} ${env.message ?? ""}`.toLowerCase();
+    const kind = opts.notFoundKinds?.find((k) => hay.includes(k));
+    return new MagicError("not_found", message, {
+      product,
+      ...kind ? { details: { kind } } : {}
+    });
+  }
+  if (status === 400 || status === 422) {
+    return env.field === void 0 ? new MagicError("validation_failed", message, { product }) : new MagicError("validation_failed", message, {
+      product,
+      hint: `The server rejected the \`${env.field}\` field.`,
+      details: { field: env.field }
+    });
+  }
+  if (status === 409) {
+    return new MagicError("conflict", message, {
+      product,
+      hint: "The resource changed since you last read it \u2014 reread it and try again."
+    });
+  }
+  if (status === 429) {
+    return new MagicError("rate_limited", message, { product, hint: "Slow down and retry." });
+  }
+  return new MagicError("unknown", message, { product });
+}
+function toMagicError(e, opts = {}) {
+  if (e instanceof MagicError) return e;
+  const product = opts.product ?? SHELL_PRODUCT;
+  if (e instanceof Error) {
+    if (isNetworkError(e)) {
+      return new MagicError("network", e.message, {
+        product,
+        hint: opts.networkHint ?? "Check your network connection."
+      });
+    }
+    return new MagicError("unknown", e.message, { product });
+  }
+  return new MagicError("unknown", typeof e === "string" ? e : "Unknown error.", { product });
+}
+function isNetworkError(e) {
+  const code = e.code ?? "";
+  if ([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "ECONNRESET",
+    "ETIMEDOUT",
+    "EAI_AGAIN",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_SOCKET",
+    "UND_ERR_HEADERS_TIMEOUT"
+  ].includes(code)) {
+    return true;
+  }
+  if (e.name === "AbortError" || e.name === "TimeoutError") return true;
+  return /fetch failed|network|socket|connect/i.test(e.message ?? "");
+}
+
+// ../kit/src/config.ts
+import { readFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+
+// ../kit/src/paths.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+function configDir(opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir();
+  if (platform === "win32") return join(env.APPDATA ?? join(home, "AppData", "Roaming"), "magic");
+  return join(env.XDG_CONFIG_HOME || join(home, ".config"), "magic");
+}
+
+// ../kit/src/config.ts
+var DEFAULT_ACCOUNT_URL = "https://account.magicspells.io";
+var ACCOUNT_CLIENT_ID_PLACEHOLDER = "set-magic-cli-client-id";
+var DEFAULT_ACCOUNT_CLIENT_ID = "magic-cli";
+function productEnvVar(id, suffix) {
+  return `MAGIC_${id.toUpperCase().replace(/-/g, "_")}_${suffix}`;
+}
+function configFilePath(opts = {}) {
+  return join2(configDir(opts), "config.json");
+}
+function readConfigFile(path = configFilePath(), read = (p) => readFileSync(p, "utf8")) {
+  try {
+    const parsed = JSON.parse(read(path));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function loadCliConfig(opts) {
+  const env = opts.env ?? process.env;
+  const file = opts.file ?? null;
+  const products = {};
+  const defaultWorkspace = {};
+  for (const p of opts.products) {
+    const envVar = productEnvVar(p.id, "URL");
+    products[p.id] = {
+      apiUrl: normalizeUrl(env[envVar] || file?.products?.[p.id]?.apiUrl || p.apiUrl, envVar)
+    };
+    const ws = opts.workspace ?? file?.defaultWorkspace?.[p.id];
+    if (ws) defaultWorkspace[p.id] = ws;
+  }
+  const fileTelemetry = file?.telemetry;
+  return {
+    accountUrl: normalizeUrl(
+      env.MAGIC_ACCOUNT_URL || file?.accountUrl || DEFAULT_ACCOUNT_URL,
+      "MAGIC_ACCOUNT_URL"
+    ),
+    accountClientId: env.MAGIC_ACCOUNT_CLIENT_ID?.trim() || DEFAULT_ACCOUNT_CLIENT_ID,
+    products,
+    defaultWorkspace,
+    allowDestructive: env.MAGIC_ALLOW_DESTRUCTIVE === "1",
+    telemetry: fileTelemetry === "on" || fileTelemetry === "off" ? fileTelemetry : "unset",
+    updateCheck: !env.CI && !env.MAGIC_NO_UPDATE_CHECK,
+    output: {
+      json: opts.output?.json ?? false,
+      color: opts.output?.color ?? !env.NO_COLOR,
+      quiet: opts.output?.quiet ?? false
+    }
+  };
+}
+function normalizeUrl(value, source) {
+  const trimmed = value.endsWith("/") ? value.slice(0, -1) : value;
+  try {
+    new URL(trimmed);
+  } catch {
+    throw new MagicError("usage", `${source} is not a valid URL: "${value}".`);
+  }
+  return trimmed;
+}
+
+// ../kit/src/read.ts
+function rec(v) {
+  return v && typeof v === "object" ? v : {};
+}
+function readStr(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function readField(obj, key) {
+  return obj && typeof obj === "object" && key in obj ? obj[key] : void 0;
+}
+
+// ../kit/src/keychain.ts
+import { execFileSync } from "node:child_process";
+import { chmodSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+var KEYCHAIN_SERVICE = "io.magicspells.cli";
+var SECURITY = "/usr/bin/security";
+function credentialsFilePath(opts = {}) {
+  return join3(configDir(opts), "credentials.json");
+}
+var realExec = (file, args) => execFileSync(file, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function createCredentialStore(opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const env = opts.env ?? process.env;
+  const chosen = env.MAGIC_CREDENTIALS_FILE === "1";
+  const warn = chosen ? () => {
+  } : opts.warn ?? defaultWarn;
+  const file = createFileStore(credentialsFilePath(opts), warn);
+  if (platform !== "darwin" || chosen) return file;
+  return createMacStore(opts.exec ?? realExec, file);
+}
+function defaultWarn(line2) {
+  process.stderr.write(`${line2}
+`);
+}
+function createFileStore(path, warn) {
+  let warned = false;
+  const read = () => {
+    try {
+      const parsed = JSON.parse(readFileSync2(path, "utf8"));
+      return { items: parsed.items && typeof parsed.items === "object" ? parsed.items : {} };
+    } catch {
+      return { items: {} };
+    }
+  };
+  const write = (data) => {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeFileSync(path, `${JSON.stringify(data, null, 2)}
+`, { mode: 384 });
+    chmodSync(path, 384);
+  };
+  const value = (item) => {
+    const v = read().items[item];
+    return typeof v === "string" && v.length > 0 ? v : null;
+  };
+  return {
+    backend: "file",
+    async get(item) {
+      return value(item);
+    },
+    async locate(item) {
+      return value(item) === null ? null : "file";
+    },
+    async set(item, secret) {
+      if (!warned) {
+        warn(`warning: storing credentials in ${path} (mode 0600), not the OS keychain.`);
+        warned = true;
+      }
+      const data = read();
+      data.items[item] = secret;
+      write(data);
+    },
+    async delete(item) {
+      const data = read();
+      if (!(item in data.items)) return;
+      delete data.items[item];
+      write(data);
+    }
+  };
+}
+function createMacStore(exec, file) {
+  const fromKeychain = (item) => {
+    try {
+      const v = exec(SECURITY, [
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        item,
+        "-w"
+      ]).trim();
+      return v.length > 0 ? v : null;
+    } catch {
+      return null;
+    }
+  };
+  return {
+    backend: "keyring",
+    async get(item) {
+      return fromKeychain(item) ?? file.get(item);
+    },
+    async locate(item) {
+      return fromKeychain(item) !== null ? "keyring" : file.locate(item);
+    },
+    async set(item, secret) {
+      try {
+        exec(SECURITY, [
+          "add-generic-password",
+          "-U",
+          "-s",
+          KEYCHAIN_SERVICE,
+          "-a",
+          item,
+          "-w",
+          secret
+        ]);
+      } catch {
+        await file.set(item, secret);
+      }
+    },
+    async delete(item) {
+      try {
+        exec(SECURITY, ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", item]);
+      } catch {
+      }
+      await file.delete(item);
+    }
+  };
+}
+
+// ../kit/src/render.ts
+var processIO = {
+  out: (text) => void process.stdout.write(text),
+  err: (text) => void process.stderr.write(text),
+  isTTY: () => process.stdout.isTTY === true
+};
+function line(write, text) {
+  write(text.endsWith("\n") ? text : `${text}
+`);
+}
+function jsonMode(opts, io = processIO) {
+  return opts.json || !io.isTTY();
+}
+function render(result, opts, io = processIO) {
+  if (jsonMode(opts, io)) {
+    line(io.out, JSON.stringify(result, null, 2));
+    return;
+  }
+  renderHuman(result, opts, io);
+}
+function isPage(v) {
+  return typeof v === "object" && v !== null && Array.isArray(v.items) && "next_cursor" in v;
+}
+function renderHuman(result, opts, io) {
+  const out = (t) => line(io.out, t);
+  if (result === null || result === void 0) {
+    out("(none)");
+    return;
+  }
+  if (isPage(result)) {
+    renderRows(result.items, out);
+    if (result.next_cursor && !opts.quiet) line(io.err, `more: --cursor ${result.next_cursor}`);
+    return;
+  }
+  if (Array.isArray(result)) {
+    renderRows(result, out);
+    return;
+  }
+  if (typeof result !== "object") {
+    out(String(result));
+    return;
+  }
+  const rec2 = result;
+  const keys = Object.keys(rec2);
+  if (keys.length === 0) {
+    out("(empty)");
+    return;
+  }
+  const width = Math.max(...keys.map((k) => k.length));
+  for (const k of keys) out(`${k.padEnd(width)}  ${cell(rec2[k])}`);
+}
+function renderRows(rows, out) {
+  if (rows.length === 0) {
+    out("(no results)");
+    return;
+  }
+  if (rows.every((r) => typeof r !== "object" || r === null)) {
+    for (const r of rows) out(cell(r));
+    return;
+  }
+  const objs = rows.map((r) => r && typeof r === "object" ? r : {});
+  const cols = [];
+  for (const o of objs) for (const k of Object.keys(o)) if (!cols.includes(k)) cols.push(k);
+  const matrix = objs.map((o) => cols.map((c) => cell(o[c])));
+  const widths = cols.map((c, i) => Math.max(c.length, ...matrix.map((row) => row[i].length)));
+  out(cols.map((c, i) => c.padEnd(widths[i])).join("  "));
+  for (const row of matrix) out(row.map((v, i) => v.padEnd(widths[i])).join("  "));
+}
+function cell(v) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  if (Array.isArray(v)) return v.map(cell).join(", ");
+  if (typeof v === "object") {
+    const o = v;
+    if (typeof o.name === "string") return o.name;
+    if (typeof o.display_name === "string") {
+      return typeof o.job_title === "string" && o.job_title.length > 0 ? `${o.display_name} (${o.job_title})` : o.display_name;
+    }
+    if (typeof o.key === "string") return o.key;
+    if (typeof o.id === "string") return o.id;
+    return JSON.stringify(v);
+  }
+  return String(v);
+}
+function renderError(e, opts, io = processIO) {
+  const shape = e.toJSON();
+  if (jsonMode(opts, io)) {
+    line(io.err, JSON.stringify({ error: shape }, null, 2));
+  } else {
+    line(io.err, `error [${shape.code}]: ${shape.message}`);
+    if (shape.hint) line(io.err, `  hint: ${shape.hint}`);
+    if (shape.candidates && shape.candidates.length > 0) {
+      line(io.err, `  candidates: ${shape.candidates.join(", ")}`);
+    }
+  }
+  return exitCodeFor(e.code);
+}
+
+// ../kit/src/operation.ts
+function toolName(op) {
+  return op.name.replace(/[.-]/g, "_");
+}
+function commandWords(op) {
+  return op.name.split(".").slice(1);
+}
+function onSurface(op, surface) {
+  return op.meta?.surfaces?.includes(surface) ?? true;
+}
+function assertRegistry(product, ops) {
+  const names = /* @__PURE__ */ new Set();
+  const tools = /* @__PURE__ */ new Set();
+  for (const op of ops) {
+    const parts = op.name.split(".");
+    if (parts[0] !== product || parts.length < 2 || parts.length > 3) {
+      throw new Error(`operation "${op.name}" must be named ${product}.<noun>.<verb>`);
+    }
+    if (!parts.every((p) => /^[a-z][a-z0-9-]*$/.test(p))) {
+      throw new Error(`operation "${op.name}" must be lower case words`);
+    }
+    if (names.has(op.name)) throw new Error(`duplicate operation "${op.name}"`);
+    if (tools.has(toolName(op))) throw new Error(`duplicate MCP tool "${toolName(op)}"`);
+    names.add(op.name);
+    tools.add(toolName(op));
+  }
+}
+
+// ../kit/src/argv.ts
+function parseGlobals(argv, productFlags = [], env = process.env) {
+  const opts = {
+    json: false,
+    yes: false,
+    quiet: false,
+    ...env.NO_COLOR ? { color: false } : {}
+  };
+  const flags = {};
+  const rest = [];
+  const valueFlag = (name, set, i) => {
+    const v = argv[i + 1];
+    if (v === void 0 || v.startsWith("--")) {
+      throw new MagicError("usage", `flag --${name} expects a value`);
+    }
+    set(v);
+    return i + 1;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    switch (tok) {
+      case "--json":
+        opts.json = true;
+        continue;
+      case "--yes":
+      case "-y":
+        opts.yes = true;
+        continue;
+      case "--quiet":
+      case "-q":
+        opts.quiet = true;
+        continue;
+      case "--no-color":
+        opts.color = false;
+        continue;
+      case "--workspace":
+        i = valueFlag("workspace", (v) => opts.workspace = v, i);
+        continue;
+    }
+    if (tok.startsWith("--workspace=")) {
+      opts.workspace = tok.slice("--workspace=".length);
+      continue;
+    }
+    const pf = productFlags.find((f) => tok === `--${f}` || tok.startsWith(`--${f}=`));
+    if (pf) {
+      const key = pf.replace(/-/g, "_");
+      if (tok.includes("=")) flags[key] = tok.slice(tok.indexOf("=") + 1);
+      else i = valueFlag(pf, (v) => flags[key] = v, i);
+      continue;
+    }
+    rest.push(tok);
+  }
+  return { opts, productFlags: flags, rest };
+}
+function buildCommands(ops) {
+  return ops.map((op) => ({
+    op,
+    words: commandWords(op),
+    verbAliases: op.meta?.cli?.verbAliases ?? [],
+    positionals: op.meta?.cli?.positionals ?? []
+  }));
+}
+function matchCommand(cmds, argv) {
+  const sorted = [...cmds].sort((a, b) => b.words.length - a.words.length);
+  for (const cmd of sorted) {
+    const n = cmd.words.length;
+    if (argv.length < n) continue;
+    const head = argv.slice(0, n - 1);
+    const last = argv[n - 1];
+    const lastOk = last === cmd.words[n - 1] || cmd.verbAliases.includes(last);
+    if (lastOk && head.every((w, i) => w === cmd.words[i])) {
+      return { cmd, args: argv.slice(n) };
+    }
+  }
+  return void 0;
+}
+function baseType(schema) {
+  let cur = schema;
+  let optional = false;
+  for (let guard = 0; guard < 12; guard++) {
+    const def = cur._def;
+    const name = def?.typeName;
+    if ((name === "ZodOptional" || name === "ZodNullable" || name === "ZodDefault") && def?.innerType) {
+      optional = true;
+      cur = def.innerType;
+      continue;
+    }
+    break;
+  }
+  return { type: cur, optional };
+}
+function describeFields(input) {
+  const shape = input.shape;
+  if (!shape) return [];
+  return Object.entries(shape).map(([key, raw]) => {
+    const { type, optional } = baseType(raw);
+    const def = type._def;
+    let kind = "string";
+    let values;
+    switch (def?.typeName) {
+      case "ZodBoolean":
+        kind = "boolean";
+        break;
+      case "ZodNumber":
+        kind = "number";
+        break;
+      case "ZodArray": {
+        const el = def.type ? baseType(def.type).type : void 0;
+        const elName = el?._def?.typeName;
+        kind = elName === "ZodObject" ? "json" : "string[]";
+        break;
+      }
+      case "ZodEnum":
+        kind = "enum";
+        if (Array.isArray(def.values)) values = def.values;
+        break;
+      case "ZodNativeEnum":
+        kind = "enum";
+        break;
+      case "ZodObject":
+      case "ZodRecord":
+        kind = "json";
+        break;
+    }
+    const spec = { key, kind, required: !optional };
+    if (values) spec.values = values;
+    return spec;
+  });
+}
+function keyToFlag(key) {
+  return key.replace(/_/g, "-");
+}
+function flagToKey(flag, fields, aliases = {}) {
+  if (aliases[flag]) return aliases[flag];
+  const snake = flag.replace(/-/g, "_");
+  const direct = fields.find((f) => f.key === snake || keyToFlag(f.key) === flag);
+  if (direct) return direct.key;
+  const plural = fields.find((f) => f.kind === "string[]" && f.key === `${snake}s`);
+  if (plural) return plural.key;
+  const seg = fields.filter((f) => f.key.split("_")[0] === snake);
+  if (seg.length === 1) return seg[0].key;
+  return void 0;
+}
+function parseCommandArgs(cmd, args) {
+  const cli = cmd.op.meta?.cli ?? {};
+  const fields = describeFields(cmd.op.input);
+  const byKey = new Map(fields.map((f) => [f.key, f]));
+  const switchNames = /* @__PURE__ */ new Set([
+    ...Object.keys(cli.presets ?? {}),
+    ...Object.keys(cli.routes ?? {})
+  ]);
+  const raw = {};
+  const parsed = { raw, switches: [] };
+  const queue = [...cmd.positionals];
+  const label = cmd.words.join(" ");
+  const pushArray = (key, value) => {
+    const parts = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    raw[key] = [...Array.isArray(raw[key]) ? raw[key] : [], ...parts];
+  };
+  for (let i = 0; i < args.length; i++) {
+    const tok = args[i];
+    if (tok.startsWith("--")) {
+      let name = tok.slice(2);
+      let inline;
+      const eq = name.indexOf("=");
+      if (eq >= 0) {
+        inline = name.slice(eq + 1);
+        name = name.slice(0, eq);
+      }
+      if (switchNames.has(name)) {
+        parsed.switches.push(name);
+        continue;
+      }
+      if (cli.fileInput && name === "file") {
+        const v = inline ?? args[++i];
+        if (v === void 0) throw usage(`${label}: flag --file expects a path`);
+        parsed.file = v;
+        continue;
+      }
+      const key = flagToKey(name, fields, cli.aliases);
+      if (!key) throw usage(`${label}: unknown flag --${name}`);
+      const spec = byKey.get(key);
+      if (spec.kind === "boolean") {
+        raw[key] = inline === void 0 ? true : inline !== "false";
+        continue;
+      }
+      const value = inline ?? args[++i];
+      if (value === void 0) throw usage(`${label}: flag --${name} expects a value`);
+      if (spec.kind === "string[]") pushArray(key, value);
+      else if (spec.kind === "json") raw[key] = parseJsonFlag(label, name, value);
+      else raw[key] = value;
+      continue;
+    }
+    const posKey = queue.shift();
+    if (!posKey) throw usage(`${label}: unexpected argument "${tok}"`);
+    if (byKey.get(posKey)?.kind === "string[]") pushArray(posKey, tok);
+    else raw[posKey] = tok;
+  }
+  return parsed;
+}
+function parseJsonFlag(label, flag, value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw usage(`${label}: flag --${flag} expects JSON`);
+  }
+}
+function coerce(raw, fields) {
+  const out = {};
+  for (const f of fields) {
+    const v = raw[f.key];
+    if (v === void 0) continue;
+    if (f.kind === "number" && typeof v === "string") {
+      const n = Number(v);
+      out[f.key] = Number.isNaN(n) ? v : n;
+    } else {
+      out[f.key] = v;
+    }
+  }
+  return out;
+}
+function usage(message, hint) {
+  return new MagicError("usage", message, hint ? { hint } : {});
+}
+
+// ../kit/src/cli.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+
+// ../kit/src/sessions.ts
+import { hostname } from "node:os";
+
+// ../kit/src/account.ts
+import { createHash, randomBytes } from "node:crypto";
+var ACCOUNT_PRODUCT = "account";
+var GRANT_PREFIX = "magic_";
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_GRANT_SECONDS = 60 * 24 * 60 * 60;
+function createPkce(bytes = randomBytes(32)) {
+  const verifier = bytes.toString("base64url");
+  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+function randomState() {
+  return randomBytes(24).toString("base64url");
+}
+function authorizeUrl(p) {
+  const url = new URL("/auth/authorize", p.accountUrl);
+  url.searchParams.set("client_id", p.clientId);
+  url.searchParams.set("redirect_uri", p.redirectUri);
+  url.searchParams.set("state", p.state);
+  url.searchParams.set("code_challenge", p.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("scope", "basic");
+  return url.toString();
+}
+function requireClientId(clientId) {
+  if (!clientId || clientId === ACCOUNT_CLIENT_ID_PLACEHOLDER) {
+    throw new MagicError("usage", "This build of magic has no Account client id.", {
+      product: ACCOUNT_PRODUCT,
+      hint: "Set MAGIC_ACCOUNT_CLIENT_ID to the magic application\u2019s client id."
+    });
+  }
+  return clientId;
+}
+var AccountClient = class {
+  accountUrl;
+  id;
+  fetch;
+  constructor(opts) {
+    this.accountUrl = opts.accountUrl;
+    this.id = opts.clientId;
+    this.fetch = opts.fetch ?? fetch;
+  }
+  get clientId() {
+    return requireClientId(this.id);
+  }
+  /** Exchange a loopback `code` for the grant (`grant_type=authorization_code`). */
+  async exchangeCode(p) {
+    const res = await this.post(
+      "/auth/token",
+      {
+        grant_type: "authorization_code",
+        code: p.code,
+        code_verifier: p.verifier,
+        client_id: this.clientId,
+        redirect_uri: p.redirectUri
+      },
+      p.signal
+    );
+    if (!res.ok) throw tokenError(res.status, res.code);
+    return readToken(res.body);
+  }
+  /** Start the device flow (`POST /auth/device`). */
+  async startDevice(signal) {
+    const res = await this.post(
+      "/auth/device",
+      { client_id: this.clientId, scope: "basic" },
+      signal
+    );
+    if (!res.ok) throw tokenError(res.status, res.code);
+    const b = res.body;
+    if (typeof b.device_code !== "string" || typeof b.user_code !== "string" || typeof b.verification_uri !== "string") {
+      throw new MagicError("unknown", "Account answered the device request without a code.", {
+        product: ACCOUNT_PRODUCT
+      });
+    }
+    return {
+      device_code: b.device_code,
+      user_code: b.user_code,
+      verification_uri: b.verification_uri,
+      ...typeof b.verification_uri_complete === "string" ? { verification_uri_complete: b.verification_uri_complete } : {},
+      expires_in: positive(b.expires_in, 600),
+      interval: positive(b.interval, 5)
+    };
+  }
+  /**
+   * One device poll. Pending and slow_down come back as values; access_denied
+   * (auth_cancelled) and expired_token (auth_expired) throw.
+   */
+  async pollDevice(deviceCode, signal) {
+    const res = await this.post(
+      "/auth/token",
+      { grant_type: DEVICE_GRANT_TYPE, device_code: deviceCode, client_id: this.clientId },
+      signal
+    );
+    if (res.ok) return { status: "approved", token: readToken(res.body) };
+    if (res.code === "authorization_pending") return { status: "pending" };
+    if (res.code === "slow_down") return { status: "slow_down" };
+    throw tokenError(res.status, res.code);
+  }
+  /**
+   * Revoke the grant (`POST /auth/revoke token=…`). `unsupported` when this Account
+   * has no revoke endpoint (404/405); other failures throw.
+   */
+  async revoke(token, signal) {
+    const res = await this.post("/auth/revoke", { token }, signal);
+    if (res.ok) return "revoked";
+    if (res.status === 404 || res.status === 405) return "unsupported";
+    throw tokenError(res.status, res.code);
+  }
+  async post(path, form, signal) {
+    let res;
+    try {
+      res = await this.fetch(new URL(path, this.accountUrl), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams(form).toString(),
+        ...signal ? { signal } : {}
+      });
+    } catch (err) {
+      throw transportError(err, signal);
+    }
+    const text = await res.text().catch(() => "");
+    let body = null;
+    try {
+      body = text ? JSON.parse(text) : null;
+    } catch {
+      body = null;
+    }
+    return { ok: res.ok, status: res.status, code: errorCode(body), body };
+  }
+};
+async function waitForDevice(client, start, opts = {}) {
+  const sleep = opts.sleep ?? abortableSleep;
+  const now = opts.now ?? Date.now;
+  const deadline = now() + start.expires_in * 1e3;
+  let interval = start.interval * 1e3;
+  for (; ; ) {
+    const until = now() + interval;
+    while (now() < until) {
+      if (opts.signal?.aborted) throw cancelledError();
+      opts.onTick?.(Math.max(0, Math.ceil((deadline - now()) / 1e3)));
+      await sleep(Math.min(1e3, until - now()), opts.signal).catch((err) => {
+        throw opts.signal?.aborted ? cancelledError() : err;
+      });
+    }
+    if (opts.signal?.aborted) throw cancelledError();
+    if (now() >= deadline) throw expiredCodeError();
+    const poll = await client.pollDevice(start.device_code, opts.signal);
+    if (poll.status === "approved") return poll.token;
+    if (poll.status === "slow_down") interval += 5e3;
+  }
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(cancelledError());
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(cancelledError());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function cancelledError() {
+  return new MagicError("auth_cancelled", "Login cancelled.", { product: ACCOUNT_PRODUCT });
+}
+function expiredCodeError() {
+  return new MagicError("auth_expired", "The code expired.", {
+    product: ACCOUNT_PRODUCT,
+    hint: "Run `magic login` again."
+  });
+}
+function errorCode(body) {
+  if (!body || typeof body !== "object" || !("error" in body)) return void 0;
+  const e = body.error;
+  if (typeof e === "string") return e;
+  if (e && typeof e === "object" && typeof e.code === "string") {
+    return e.code;
+  }
+  return void 0;
+}
+function tokenError(status, code) {
+  const product = ACCOUNT_PRODUCT;
+  switch (code) {
+    case "access_denied":
+      return cancelledError();
+    case "expired_token":
+      return expiredCodeError();
+    case "invalid_client":
+      return new MagicError("auth_invalid", "Account does not know this client.", {
+        product,
+        hint: "Check MAGIC_ACCOUNT_CLIENT_ID and MAGIC_ACCOUNT_URL."
+      });
+    case "invalid_grant":
+      return new MagicError("auth_invalid", "Account refused the sign-in code.", {
+        product,
+        hint: "Run `magic login` again."
+      });
+  }
+  if (status === 429 || code === "slow_down" || code === "rate_limited") {
+    return new MagicError("rate_limited", "Account is rate limiting sign-ins.", {
+      product,
+      hint: "Wait a minute and try again."
+    });
+  }
+  if (status >= 500) {
+    return new MagicError("product_unavailable", `Account is unavailable (HTTP ${status}).`, {
+      product
+    });
+  }
+  return new MagicError(
+    "auth_invalid",
+    `Account refused the request (HTTP ${status}${code ? `, ${code}` : ""}).`,
+    { product }
+  );
+}
+function transportError(err, signal) {
+  if (signal?.aborted) return cancelledError();
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = err instanceof Error && err.cause instanceof Error ? `: ${err.cause.message}` : "";
+  if (err instanceof Error && !isNetworkError(err)) {
+    return new MagicError("unknown", message, { product: ACCOUNT_PRODUCT });
+  }
+  return new MagicError("network", `Cannot reach Account (${message}${cause}).`, {
+    product: ACCOUNT_PRODUCT,
+    hint: "Check MAGIC_ACCOUNT_URL and your network connection."
+  });
+}
+function readToken(body) {
+  const b = body ?? {};
+  if (typeof b.access_token !== "string" || !b.access_token.startsWith(GRANT_PREFIX)) {
+    throw new MagicError("auth_invalid", "Account answered without a magic grant.", {
+      product: ACCOUNT_PRODUCT,
+      hint: "Check MAGIC_ACCOUNT_URL points at Magic Spells Account."
+    });
+  }
+  return {
+    token_type: "Bearer",
+    access_token: b.access_token,
+    expires_in: positive(b.expires_in, DEFAULT_GRANT_SECONDS),
+    grant_id: typeof b.grant_id === "string" ? b.grant_id : ""
+  };
+}
+function positive(v, fallback) {
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : fallback;
+}
+
+// ../kit/src/sessions.ts
+var GRANT_ITEM = "account:grant";
+var SESSIONS_ITEM = "account:sessions";
+var GRANT_IDLE_MS = 14 * 24 * 60 * 60 * 1e3;
+function sessionItem(product, handle) {
+  return `${product}:${handle}`;
+}
+function grantFromToken(token, accountUrl, now = /* @__PURE__ */ new Date()) {
+  return {
+    access_token: token.access_token,
+    grant_id: token.grant_id,
+    token_type: "Bearer",
+    obtained_at: now.toISOString(),
+    expires_at: new Date(now.getTime() + token.expires_in * 1e3).toISOString(),
+    last_used_at: now.toISOString(),
+    account_url: accountUrl
+  };
+}
+function grantIdleExpiry(grant) {
+  const idle = Date.parse(grant.last_used_at) + GRANT_IDLE_MS;
+  const hard = Date.parse(grant.expires_at);
+  return new Date(Math.min(idle, hard)).toISOString();
+}
+function grantExpired(grant, now = Date.now()) {
+  return Date.parse(grantIdleExpiry(grant)) <= now;
+}
+async function readGrant(store) {
+  const raw = await store.get(GRANT_ITEM);
+  if (!raw) return null;
+  try {
+    const g = JSON.parse(raw);
+    if (typeof g.access_token !== "string" || !g.access_token.startsWith(GRANT_PREFIX)) return null;
+    return g;
+  } catch {
+    return null;
+  }
+}
+async function saveGrant(store, grant) {
+  await store.set(GRANT_ITEM, JSON.stringify(grant));
+}
+async function readIndex(store) {
+  const raw = await store.get(SESSIONS_ITEM);
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveIndex(store, index) {
+  if (Object.keys(index).length === 0) await store.delete(SESSIONS_ITEM);
+  else await store.set(SESSIONS_ITEM, JSON.stringify(index));
+}
+async function readSession(store, product, handle) {
+  const raw = await store.get(sessionItem(product, handle));
+  if (!raw) return null;
+  try {
+    const s = JSON.parse(raw);
+    return typeof s.key === "string" && s.key.length > 0 ? { ...s, product, key: s.key, source: "account" } : null;
+  } catch {
+    return null;
+  }
+}
+function sessionLabel(host = hostname()) {
+  return `magic on ${host}`.slice(0, 80);
+}
+async function mintSessions(spec, opts) {
+  const path = spec.sessions?.path;
+  if (!path) throw new Error(`${spec.id} declares no sessions route`);
+  const body = { label: opts.label ?? sessionLabel() };
+  if (opts.workspace) body.workspace = opts.workspace;
+  const res = await call(spec, opts, opts.apiUrl + path, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${opts.grant}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw sessionError(spec, res.status, res.body);
+  return readSessions(spec, res.body);
+}
+async function revokeSessions(spec, opts) {
+  const path = spec.sessions?.path;
+  if (!path) throw new Error(`${spec.id} declares no sessions route`);
+  const res = await call(spec, opts, opts.apiUrl + path, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${opts.key}`, accept: "application/json" }
+  });
+  if (!res.ok) {
+    throw mapHttpError(res.status, res.body, { product: spec.id, title: spec.title });
+  }
+}
+async function call(spec, opts, url, init) {
+  let res;
+  try {
+    res = await (opts.fetch ?? fetch)(url, {
+      ...init,
+      ...opts.signal ? { signal: opts.signal } : {}
+    });
+  } catch (err) {
+    const e = toMagicError(err, {
+      product: spec.id,
+      networkHint: `Check ${productEnvVar(spec.id, "URL")} and your network connection.`
+    });
+    const cause = err instanceof Error && err.cause instanceof Error ? `: ${err.cause.message}` : "";
+    throw cause ? new MagicError(e.code, `${e.message}${cause}`, {
+      product: e.product,
+      ...e.hint ? { hint: e.hint } : {}
+    }) : e;
+  }
+  const text = await res.text().catch(() => "");
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = null;
+  }
+  return { ok: res.ok, status: res.status, body };
+}
+function sessionError(spec, status, body) {
+  const code = readStr(rec(rec(body).error).code);
+  if (status === 401) {
+    return new MagicError("not_logged_in", "Your Magic Spells sign-in is no longer valid.", {
+      product: spec.id,
+      hint: "Run `magic login`."
+    });
+  }
+  if (status === 403 && code === "no_workspaces") {
+    return new MagicError("permission_denied", `You have no ${spec.title} workspaces.`, {
+      product: spec.id,
+      details: { reason: "no_workspaces" }
+    });
+  }
+  if (status === 404) {
+    return new MagicError("not_found", `No ${spec.title} workspace by that handle.`, {
+      product: spec.id,
+      details: { kind: "workspace" }
+    });
+  }
+  return mapHttpError(status, body, { product: spec.id, title: spec.title });
+}
+function readSessions(spec, body) {
+  const b = rec(body);
+  const raw = Array.isArray(b.sessions) ? b.sessions : [];
+  const sessions = [];
+  for (const item of raw) {
+    const s = rec(item);
+    const key = readStr(s.key);
+    const ws = rec(s.workspace);
+    const handle = readStr(ws.handle);
+    if (!key || !key.startsWith(spec.credential) || !handle) {
+      throw new MagicError("unknown", `${spec.title} answered with a malformed session.`, {
+        product: spec.id
+      });
+    }
+    sessions.push({
+      product: spec.id,
+      key,
+      ...readStr(s.key_id) ? { key_id: readStr(s.key_id) } : {},
+      workspace: { id: readStr(ws.id) ?? "", handle, name: readStr(ws.name) ?? handle },
+      ...readStr(s.role) ? { role: readStr(s.role) } : {},
+      ...readStr(s.expires_at) ? { expires_at: readStr(s.expires_at) } : {},
+      source: "account"
+    });
+  }
+  const workspaces = (Array.isArray(b.workspaces) ? b.workspaces : []).flatMap(
+    (item) => {
+      const w = rec(item);
+      const handle = readStr(w.handle);
+      if (!handle) return [];
+      return [
+        {
+          id: readStr(w.id) ?? "",
+          handle,
+          name: readStr(w.name) ?? handle,
+          role: readStr(w.role) ?? ""
+        }
+      ];
+    }
+  );
+  const u = rec(b.user);
+  const email = readStr(u.email);
+  const user = email ? { id: readStr(u.id) ?? "", display_name: readStr(u.display_name) ?? email, email } : void 0;
+  return { sessions, workspaces, ...user ? { user } : {} };
+}
+async function storeSessions(store, product, res, now = /* @__PURE__ */ new Date()) {
+  const index = await readIndex(store);
+  const handles = new Set(res.sessions.map((s) => s.workspace.handle));
+  for (const old of index[product]?.workspaces ?? []) {
+    if (!handles.has(old.handle)) await store.delete(sessionItem(product, old.handle));
+  }
+  for (const s of res.sessions) {
+    await store.set(sessionItem(product, s.workspace.handle), JSON.stringify(s));
+  }
+  const workspaces = res.sessions.map((s) => {
+    const listed = res.workspaces.find((w) => w.handle === s.workspace.handle);
+    return {
+      id: s.workspace.id || listed?.id || "",
+      handle: s.workspace.handle,
+      name: s.workspace.name || listed?.name || s.workspace.handle,
+      role: s.role ?? listed?.role ?? ""
+    };
+  });
+  const entry = {
+    workspaces,
+    ...workspaces.length === 1 ? { default: workspaces[0].handle } : {},
+    minted_at: now.toISOString()
+  };
+  index[product] = entry;
+  await saveIndex(store, index);
+  return entry;
+}
+async function productSessions(store, product) {
+  const entry = (await readIndex(store))[product];
+  const out = [];
+  for (const w of entry?.workspaces ?? []) {
+    const s = await readSession(store, product, w.handle);
+    if (s) out.push(s);
+  }
+  return out;
+}
+async function forgetSessions(store, product) {
+  const index = await readIndex(store);
+  const entry = index[product];
+  if (!entry) return [];
+  const items = entry.workspaces.map((w) => sessionItem(product, w.handle));
+  for (const item of items) await store.delete(item);
+  delete index[product];
+  await saveIndex(store, index);
+  return items;
+}
+async function touchGrant(store, grant) {
+  const touched = { ...grant, last_used_at: (/* @__PURE__ */ new Date()).toISOString() };
+  await saveGrant(store, touched);
+  return touched;
+}
+async function remintSession(spec, session, opts) {
+  const grant = await readGrant(opts.store);
+  const handle = session.workspace?.handle;
+  if (!grant || !handle) {
+    throw new MagicError("not_logged_in", `Your ${spec.title} session has expired.`, {
+      product: spec.id,
+      hint: "Run `magic login`."
+    });
+  }
+  const res = await mintSessions(spec, {
+    apiUrl: opts.apiUrl,
+    grant: grant.access_token,
+    workspace: handle,
+    ...opts.fetch ? { fetch: opts.fetch } : {},
+    ...opts.signal ? { signal: opts.signal } : {}
+  });
+  const fresh = res.sessions.find((s) => s.workspace?.handle === handle);
+  if (!fresh) {
+    throw new MagicError(
+      "not_found",
+      `You no longer reach the ${spec.title} workspace "${handle}".`,
+      {
+        product: spec.id,
+        details: { kind: "workspace" },
+        hint: "Run `magic login` to refresh your workspaces."
+      }
+    );
+  }
+  await opts.store.set(sessionItem(spec.id, handle), JSON.stringify(fresh));
+  await touchGrant(opts.store, grant);
+  return fresh;
+}
+
+// ../kit/src/credentials.ts
+function manualItem(product) {
+  return `${product}:manual`;
+}
+function maskKey(key, prefix) {
+  const m = new RegExp(`^${escapeRegExp(prefix)}([^_]+)_(.+)$`).exec(key);
+  if (!m) return `${prefix}\u2026`;
+  return `${prefix}${m[1]}_\u2026${m[2].slice(-4)}`;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseStoredSession(product, value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed.key === "string" && parsed.key.length > 0) {
+      return { ...parsed, product, key: parsed.key, source: parsed.source ?? "manual" };
+    }
+  } catch {
+    if (value.trim().length > 0) return { product, key: value.trim(), source: "manual" };
+  }
+  return null;
+}
+function loginHint(spec) {
+  const where = spec.keyHelp ? ` (${spec.keyHelp})` : "";
+  const manual = `${productEnvVar(spec.id, "KEY")} or run \`magic login --product-key\` with a ${spec.credential}\u2026 key${where}.`;
+  return spec.sessions ? `Run \`magic login\`, or set ${manual}` : `Set ${manual}`;
+}
+function checkPrefix(spec, key) {
+  if (!key.startsWith(spec.credential)) {
+    throw new MagicError(
+      "auth_invalid",
+      `${spec.title} key must start with "${spec.credential}".`,
+      {
+        product: spec.id,
+        hint: loginHint(spec)
+      }
+    );
+  }
+}
+async function resolveCredential(spec, opts) {
+  const env = opts.env ?? process.env;
+  const envKey = env[productEnvVar(spec.id, "KEY")]?.trim();
+  if (envKey) {
+    checkPrefix(spec, envKey);
+    return { product: spec.id, key: envKey, source: "env" };
+  }
+  const minted = (await readIndex(opts.store))[spec.id];
+  const handle = opts.workspace ?? minted?.default;
+  if (minted && handle) {
+    const account = await readSession(opts.store, spec.id, handle);
+    if (account) {
+      checkPrefix(spec, account.key);
+      return account;
+    }
+    if (opts.workspace) {
+      throw new MagicError("not_found", `No ${spec.title} session for workspace "${handle}".`, {
+        product: spec.id,
+        details: { kind: "workspace" },
+        candidates: minted.workspaces.map((w) => w.handle),
+        hint: "Pick one of the listed workspaces, or run `magic login` to refresh them."
+      });
+    }
+  }
+  const stored = await opts.store.get(manualItem(spec.id));
+  const session = stored ? parseStoredSession(spec.id, stored) : null;
+  if (session) {
+    checkPrefix(spec, session.key);
+    return session;
+  }
+  if (minted && minted.workspaces.length > 1) {
+    throw new MagicError("usage", `You have several ${spec.title} workspaces; choose one.`, {
+      product: spec.id,
+      candidates: minted.workspaces.map((w) => w.handle),
+      hint: "Pass --workspace <handle>, or set defaultWorkspace in the config file."
+    });
+  }
+  throw new MagicError("not_logged_in", `No ${spec.title} key found.`, {
+    product: spec.id,
+    hint: loginHint(spec)
+  });
+}
+async function saveProductKey(spec, store, key) {
+  const trimmed = key.trim();
+  checkPrefix(spec, trimmed);
+  const session = { product: spec.id, key: trimmed, source: "manual" };
+  await store.set(manualItem(spec.id), JSON.stringify(session));
+  return session;
+}
+async function forgetProductKey(spec, store) {
+  await store.delete(manualItem(spec.id));
+}
+
+// ../kit/src/context.ts
+function productConfig(product, deps, extra = {}) {
+  return loadCliConfig({
+    products: [{ id: product.id, apiUrl: product.apiUrl }],
+    env: deps.env ?? process.env,
+    file: (deps.readConfig ?? (() => readConfigFile()))(),
+    ...extra
+  });
+}
+async function buildContext(product, config, deps, requiresSession = true) {
+  const workspace = config.defaultWorkspace[product.id];
+  const session = requiresSession ? await resolveCredential(product, {
+    env: deps.env ?? process.env,
+    store: deps.store,
+    ...workspace ? { workspace } : {}
+  }) : null;
+  return contextFor(product, config, session, deps.signal);
+}
+function contextFor(product, config, session, signal = new AbortController().signal) {
+  return {
+    config,
+    session,
+    client: product.client(session ?? { product: product.id, key: "", source: "env" }, config),
+    signal
+  };
+}
+function remintFor(product, store) {
+  return async (ctx) => {
+    if (ctx.session?.source !== "account" || !product.sessions) return null;
+    const fresh = await remintSession(product, ctx.session, {
+      store,
+      apiUrl: ctx.config.products[product.id].apiUrl,
+      signal: ctx.signal
+    });
+    return contextFor(product, ctx.config, fresh, ctx.signal);
+  };
+}
+async function runWithRemint(op, input, ctx, remint) {
+  try {
+    return await op.run(input, ctx);
+  } catch (err) {
+    if (!remint || !isMagicError(err) || err.code !== "auth_expired") throw err;
+    const fresh = await remint(ctx);
+    if (!fresh) throw err;
+    return op.run(input, fresh);
+  }
+}
+
+// ../kit/src/cli.ts
+async function runProductCli(product, argv, deps) {
+  const io = deps.io ?? processIO;
+  let opts = { json: false, yes: false, quiet: false };
+  try {
+    const parsed = parseGlobals(argv, product.globalFlags, deps.env ?? process.env);
+    opts = parsed.opts;
+    const { rest, productFlags } = parsed;
+    const extra = rest[0] ? product.commands?.[rest[0]] : void 0;
+    if (extra) {
+      if (opts.workspace) throw usage(`--workspace is not supported by ${rest[0]}`);
+      return await extra.run(rest.slice(1));
+    }
+    const ops = await product.load();
+    assertRegistry(product.id, ops);
+    const cmds = buildCommands(ops.filter((op2) => onSurface(op2, "cli")));
+    if (rest.length === 0 || ["help", "--help", "-h"].includes(rest[0])) {
+      io.err(helpText(product, cmds));
+      return 0;
+    }
+    const matched = matchCommand(cmds, rest);
+    if (!matched) {
+      throw usage(
+        `unknown command: ${product.id} ${rest.join(" ")}`,
+        `Run \`magic ${product.id} --help\` for usage.`
+      );
+    }
+    let { cmd } = matched;
+    let args = matched.args;
+    let parsedArgs = parseCommandArgs(cmd, args);
+    const routes = cmd.op.meta?.cli?.routes ?? {};
+    const route = parsedArgs.switches.find((s) => routes[s]);
+    if (route) {
+      const target = cmds.find((c) => c.op.name === routes[route]);
+      if (!target) throw new Error(`route --${route} names a missing operation`);
+      cmd = target;
+      args = args.filter((a) => a !== `--${route}`);
+      parsedArgs = parseCommandArgs(cmd, args);
+    }
+    const input = buildInput(cmd, parsedArgs, productFlags, opts);
+    const op = cmd.op;
+    const config = productConfig(product, deps, {
+      output: {
+        json: opts.json,
+        quiet: opts.quiet,
+        ...opts.color === false ? { color: false } : {}
+      },
+      ...opts.workspace ? { workspace: opts.workspace } : {}
+    });
+    if (op.meta?.destructive) {
+      if (!opts.yes) {
+        throw usage(`${cmd.words.join(" ")} is destructive \u2014 re-run with --yes to confirm.`);
+      }
+      if (!config.allowDestructive) throw destructiveDisabled(product.id);
+    }
+    const ctx = await buildContext(product, config, deps, op.meta?.requiresSession !== false);
+    const out = await runWithRemint(op, input, ctx, remintFor(product, deps.store));
+    render(out, opts, io);
+    return 0;
+  } catch (err) {
+    return renderError(toMagicError(err, { product: product.id }), opts, io);
+  }
+}
+function destructiveDisabled(product) {
+  return new MagicError("destructive_action_disabled", "This action is destructive and disabled.", {
+    product,
+    hint: "Set MAGIC_ALLOW_DESTRUCTIVE=1 to enable destructive operations."
+  });
+}
+function buildInput(cmd, parsed, productFlags, opts) {
+  const cli = cmd.op.meta?.cli ?? {};
+  const fields = describeFields(cmd.op.input);
+  const has = (key) => fields.some((f) => f.key === key);
+  const raw = parsed.raw;
+  for (const s of parsed.switches) Object.assign(raw, cli.presets?.[s] ?? {});
+  if (cli.fileInput && parsed.file !== void 0)
+    raw[cli.fileInput] = loadFileInput(parsed.file, cli.fileInput);
+  for (const [key, value] of Object.entries(productFlags)) {
+    if (has(key) && raw[key] === void 0) raw[key] = value;
+  }
+  if (opts.workspace && has("workspace") && raw.workspace === void 0) {
+    raw.workspace = opts.workspace;
+  }
+  const result = cmd.op.input.safeParse(coerce(raw, fields));
+  if (!result.success) {
+    const first = result.error.issues[0];
+    const where = first?.path.length ? ` (${first.path.join(".")})` : "";
+    throw usage(
+      `${cmd.words.join(" ")}: invalid arguments${where}: ${first?.message ?? "validation failed"}`
+    );
+  }
+  return result.data;
+}
+function loadFileInput(path, key) {
+  let text;
+  try {
+    text = readFileSync3(path, "utf8");
+  } catch (err) {
+    throw usage(`cannot read --file ${path}: ${err.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw usage(`--file ${path} is not valid JSON: ${err.message}`);
+  }
+  if (Array.isArray(parsed)) return parsed;
+  const inner = parsed && typeof parsed === "object" ? parsed[key] : void 0;
+  if (Array.isArray(inner)) return inner;
+  throw usage(`--file ${path} must be a JSON array (or { "${key}": [...] }).`);
+}
+function helpText(product, cmds) {
+  const lines = [
+    `magic ${product.id} \u2014 ${product.title}`,
+    "",
+    `Usage: magic ${product.id} <command> [args] [--flags]`,
+    "",
+    "Commands:"
+  ];
+  const rows = cmds.map((c) => {
+    const last = c.words[c.words.length - 1];
+    const verb = c.verbAliases.length ? `${last} (${c.verbAliases.join(", ")})` : last;
+    const name = [...c.words.slice(0, -1), verb].join(" ");
+    const pos = c.positionals.map((p) => `<${p}>`).join(" ");
+    return [`${name} ${pos}`.trim(), summaryOf(c.op)];
+  });
+  for (const [name, cmd] of Object.entries(product.commands ?? {})) rows.push([name, cmd.summary]);
+  const width = Math.min(40, Math.max(...rows.map(([n]) => n.length)) + 2);
+  for (const [name, summary] of rows) lines.push(`  ${name.padEnd(width)}${summary}`);
+  lines.push("");
+  const pf = (product.globalFlags ?? []).map((f) => ` --${f} <${f}>`).join("");
+  lines.push(`Flags: --json --yes/-y --no-color --quiet/-q --workspace <handle>${pf}`);
+  return `${lines.join("\n")}
+`;
+}
+function summaryOf(op) {
+  return op.meta?.destructive ? `${op.summary} [destructive]` : op.summary;
+}
+
+// ../kit/src/doctor.ts
+async function runDoctorChecks(checks, ctx, product = "magic") {
+  const results = [];
+  for (const check of checks) {
+    try {
+      results.push({ name: check.name, product, ...await check.run(ctx) });
+    } catch (err) {
+      const e = toMagicError(err, { product });
+      results.push({
+        name: check.name,
+        product,
+        ok: false,
+        detail: e.hint ? `${e.message} \u2014 ${e.hint}` : e.message,
+        code: e.code
+      });
+    }
+  }
+  return results;
+}
+
+// ../kit/src/loopback.ts
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+var LOOPBACK_TIMEOUT_MS = 2 * 60 * 1e3;
+var CODE_EXCHANGE_TIMEOUT_MS = 30 * 1e3;
+async function startLoopback(opts) {
+  let settle;
+  const result = new Promise((resolve, reject) => settle = { resolve, reject });
+  result.catch(() => {
+  });
+  let done = false;
+  let exchanging = false;
+  const server = createServer((req, res) => void handle(req, res));
+  const finish = (outcome) => {
+    if (done) return;
+    done = true;
+    clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", onAbort);
+    server.close();
+    server.closeIdleConnections();
+    if ("value" in outcome) settle.resolve(outcome.value);
+    else settle.reject(outcome.error);
+  };
+  const handle = async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const state = url.searchParams.get("state");
+    if (done || exchanging || req.method !== "GET" || url.pathname !== "/callback") {
+      return reply(res, 400, "Bad request.");
+    }
+    if (!sameState(state, opts.state)) return reply(res, 400, "Bad request.");
+    const error = url.searchParams.get("error");
+    if (error) {
+      reply(res, 200, "Sign-in cancelled. You can close this tab and return to your terminal.");
+      return finish({
+        error: error === "access_denied" ? cancelledError() : new MagicError("auth_invalid", `Account refused the sign-in (${error}).`, {
+          product: ACCOUNT_PRODUCT
+        })
+      });
+    }
+    const code = url.searchParams.get("code");
+    if (!code) return reply(res, 400, "Bad request.");
+    exchanging = true;
+    clearTimeout(timer);
+    const signals = [AbortSignal.timeout(CODE_EXCHANGE_TIMEOUT_MS)];
+    if (opts.signal) signals.push(opts.signal);
+    try {
+      const value = await opts.exchange(code, redirectUri, AbortSignal.any(signals));
+      reply(res, 200, "Signed in to Magic Spells. You can close this tab.");
+      finish({ value });
+    } catch (err) {
+      reply(res, 400, "Sign-in failed. Return to your terminal for details.");
+      finish({ error: toMagicError(err, { product: ACCOUNT_PRODUCT }) });
+    }
+  };
+  const onAbort = () => finish({ error: cancelledError() });
+  const timer = setTimeout(
+    () => finish({
+      error: new MagicError("auth_expired", "Sign-in timed out waiting for the browser.", {
+        product: ACCOUNT_PRODUCT,
+        hint: "Run `magic login --device` to sign in with a code instead."
+      })
+    }),
+    opts.timeoutMs ?? LOOPBACK_TIMEOUT_MS
+  );
+  timer.unref?.();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  }).catch((err) => {
+    clearTimeout(timer);
+    throw toMagicError(err, { product: ACCOUNT_PRODUCT });
+  });
+  const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+  if (opts.signal?.aborted) onAbort();
+  else opts.signal?.addEventListener("abort", onAbort, { once: true });
+  return { redirectUri, result };
+}
+function sameState(got, want) {
+  if (got === null) return false;
+  const a = Buffer.from(got);
+  const b = Buffer.from(want);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function reply(res, status, text) {
+  res.writeHead(status, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store",
+    connection: "close"
+  });
+  res.end(`${text}
+`);
+}
+
+// ../kit/src/mcp.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+function createMcpServer(opts) {
+  const products = opts.products.filter((p) => {
+    try {
+      registerProduct(new McpServer({ name: opts.name, version: opts.version }), p);
+      return true;
+    } catch (err) {
+      if (!opts.onSkip) throw err;
+      opts.onSkip(p.module.id, err);
+      return false;
+    }
+  });
+  const sections = products.flatMap((p) => {
+    const text = p.module.mcp?.instructions?.(opts.version);
+    if (!text) return [];
+    return [opts.preamble ? `## ${p.module.title}
+
+${text}` : text];
+  });
+  const instructions = [...opts.preamble ? [opts.preamble] : [], ...sections].join("\n\n");
+  const server = new McpServer(
+    { name: opts.name, version: opts.version },
+    instructions ? { instructions } : {}
+  );
+  for (const p of products) registerProduct(server, p);
+  return server;
+}
+function registerProduct(server, p) {
+  for (const op of p.operations) {
+    if (onSurface(op, "mcp")) registerTool(server, p.module.id, op, p.context, p.remint);
+  }
+  p.module.mcp?.register?.(server, p.context);
+}
+function toolInputShape(op) {
+  const shape = op.input.shape ?? {};
+  if (!op.meta?.destructive) return shape;
+  return {
+    ...shape,
+    yes: z.boolean().optional().describe("Confirm this destructive action (also needs MAGIC_ALLOW_DESTRUCTIVE=1).")
+  };
+}
+async function callTool(product, op, context, args, remint) {
+  try {
+    const ctx = await context();
+    const { yes, ...rest } = args ?? {};
+    if (op.meta?.destructive) {
+      if (!ctx.config.allowDestructive) throw destructiveDisabled(product);
+      if (yes !== true) {
+        throw new MagicError("destructive_action_disabled", "This action is destructive.", {
+          product,
+          hint: "Pass yes: true to confirm it."
+        });
+      }
+    }
+    const parsed = op.input.safeParse(op.meta?.destructive ? rest : args ?? {});
+    if (!parsed.success) throw invalidInput(product, parsed.error);
+    const result = await runWithRemint(op, parsed.data, ctx, remint);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  } catch (err) {
+    return toToolError(toMagicError(err, { product }));
+  }
+}
+function invalidInput(product, error) {
+  const first = error.issues[0];
+  const field = first?.path.join(".") ?? "";
+  const message = first?.message ?? "Invalid input.";
+  return new MagicError("validation_failed", field ? `${field}: ${message}` : message, {
+    product,
+    ...field ? { details: { field } } : {}
+  });
+}
+function registerTool(server, product, op, context, remint) {
+  const description = op.detail ? `${op.summary}
+
+${op.detail}` : op.summary;
+  server.registerTool(
+    toolName(op),
+    { description, inputSchema: toolInputShape(op) },
+    async (args) => callTool(product, op, context, args, remint)
+  );
+}
+
+// ../kit/src/cache.ts
+var TtlCache = class {
+  constructor(ttlMs, now = () => Date.now()) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+  entries = /* @__PURE__ */ new Map();
+  get(key) {
+    const hit = this.entries.get(key);
+    if (!hit) return void 0;
+    if (hit.expiresAt > this.now()) return hit.value;
+    this.entries.delete(key);
+    return void 0;
+  }
+  set(key, value) {
+    this.entries.set(key, { value, expiresAt: this.now() + this.ttlMs });
+  }
+  delete(key) {
+    this.entries.delete(key);
+  }
+  clear() {
+    this.entries.clear();
+  }
+  /** Return the live entry, or load, store and return a fresh one. */
+  async getOrLoad(key, load) {
+    const hit = this.get(key);
+    if (hit !== void 0) return hit;
+    const value = await load();
+    this.set(key, value);
+    return value;
+  }
+};
+
+// ../kit/src/version.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+function readPackageVersion(moduleUrl) {
+  let dir = dirname2(fileURLToPath(moduleUrl));
+  for (let i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse(readFileSync4(join4(dir, "package.json"), "utf8"));
+      if (typeof pkg.version === "string") return pkg.version;
+    } catch {
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return "0.0.0";
+}
+
+export {
+  MagicError,
+  isMagicError,
+  exitCodeFor,
+  mapHttpError,
+  toMagicError,
+  productEnvVar,
+  configFilePath,
+  readConfigFile,
+  loadCliConfig,
+  createPkce,
+  randomState,
+  authorizeUrl,
+  AccountClient,
+  waitForDevice,
+  rec,
+  readStr,
+  readField,
+  GRANT_ITEM,
+  sessionItem,
+  grantFromToken,
+  grantIdleExpiry,
+  grantExpired,
+  readGrant,
+  saveGrant,
+  readIndex,
+  mintSessions,
+  revokeSessions,
+  storeSessions,
+  productSessions,
+  forgetSessions,
+  manualItem,
+  maskKey,
+  resolveCredential,
+  saveProductKey,
+  forgetProductKey,
+  createCredentialStore,
+  processIO,
+  jsonMode,
+  render,
+  cell,
+  renderError,
+  parseGlobals,
+  usage,
+  productConfig,
+  buildContext,
+  contextFor,
+  remintFor,
+  runWithRemint,
+  runDoctorChecks,
+  startLoopback,
+  runProductCli,
+  createMcpServer,
+  TtlCache,
+  readPackageVersion
+};