magic-spells 0.0.0-stage → 0.2.0

package/dist/main.js

@@ -0,0 +1,1111 @@
+import {
+  AccountClient,
+  GRANT_ITEM,
+  MagicError,
+  authorizeUrl,
+  buildContext,
+  cell,
+  configFilePath,
+  contextFor,
+  createCredentialStore,
+  createMcpServer,
+  createPkce,
+  exitCodeFor,
+  forgetProductKey,
+  forgetSessions,
+  grantExpired,
+  grantFromToken,
+  grantIdleExpiry,
+  isMagicError,
+  jsonMode,
+  loadCliConfig,
+  manualItem,
+  maskKey,
+  mintSessions,
+  parseGlobals,
+  processIO,
+  productConfig,
+  productEnvVar,
+  productSessions,
+  randomState,
+  readConfigFile,
+  readField,
+  readGrant,
+  readIndex,
+  readPackageVersion,
+  readStr,
+  rec,
+  remintFor,
+  render,
+  renderError,
+  resolveCredential,
+  revokeSessions,
+  runDoctorChecks,
+  runProductCli,
+  runWithRemint,
+  saveGrant,
+  saveProductKey,
+  sessionItem,
+  startLoopback,
+  storeSessions,
+  toMagicError,
+  usage,
+  waitForDevice
+} from "./chunk-JZ7XESF4.js";
+
+// src/browser.ts
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+function browserIsLocal(env, platform) {
+  if (env.SSH_CONNECTION) return false;
+  if (platform === "linux") return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+  return true;
+}
+function openBrowser(url) {
+  return new Promise((resolve) => {
+    const platform = process.platform;
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+    const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.once("error", () => resolve(false));
+    child.once("close", (code) => resolve(code === 0));
+    child.unref();
+  });
+}
+async function confirmOnTty(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
+}
+
+// src/version.ts
+var cached;
+function version() {
+  return cached ??= readPackageVersion(import.meta.url);
+}
+
+// src/shell.ts
+function chooseEntries(shell, ids) {
+  const known = shell.entries.map((e) => e.id);
+  for (const id of ids ?? []) {
+    if (!known.includes(id)) {
+      throw usage(`unknown product "${id}"`, `Products: ${known.join(", ")}.`);
+    }
+  }
+  return ids ? shell.entries.filter((e) => ids.includes(e.id)) : shell.entries;
+}
+async function loadProducts(shell, ids) {
+  return Promise.all(chooseEntries(shell, ids).map((e) => e.load()));
+}
+function takeValue(args, name) {
+  for (let i = 0; i < args.length; i++) {
+    const tok = args[i];
+    if (tok === `--${name}`) {
+      const v = args[i + 1];
+      if (v === void 0 || v.startsWith("--")) throw usage(`flag --${name} expects a value`);
+      args.splice(i, 2);
+      return v;
+    }
+    if (tok.startsWith(`--${name}=`)) {
+      args.splice(i, 1);
+      return tok.slice(name.length + 3);
+    }
+  }
+  return void 0;
+}
+function wantsHelp(args) {
+  return args.includes("--help") || args.includes("-h");
+}
+function takeSwitch(args, name) {
+  const i = args.indexOf(`--${name}`);
+  if (i < 0) return false;
+  args.splice(i, 1);
+  return true;
+}
+function noMoreArgs(command, args) {
+  if (args.length > 0) throw usage(`${command}: unexpected argument "${args[0]}"`);
+}
+function rejectWorkspace(command, opts) {
+  if (opts.workspace) throw usage(`--workspace is not supported by ${command}`);
+}
+function storeLabel(where) {
+  return where === "keyring" ? "keychain" : where ?? "none";
+}
+function cancelled() {
+  return new MagicError("usage", "Cancelled.");
+}
+
+// src/commands/doctor.ts
+var REACH_TIMEOUT_MS = 5e3;
+async function doctor(shell, argv) {
+  if (wantsHelp(argv)) {
+    shell.io.err("Usage: magic doctor [--json]\n\nCheck the install, the keys and each product.\n");
+    return 0;
+  }
+  rejectWorkspace("doctor", shell.opts);
+  noMoreArgs("doctor", argv);
+  const products = await loadProducts(shell);
+  const checks = [...shellChecks(shell), ...await accountChecks(shell)];
+  const signedIn = await anyCredential(shell, products);
+  for (const product of products) checks.push(...await productChecks(shell, product, signedIn));
+  const ok = checks.every((c) => c.ok);
+  if (jsonMode(shell.opts, shell.io)) render({ ok, checks }, shell.opts, shell.io);
+  else printHuman(shell, checks);
+  const failed = checks.find((c) => !c.ok);
+  return failed ? exitCodeFor(failed.code ?? "unknown") : 0;
+}
+function shellChecks(shell) {
+  const fileChosen = shell.env.MAGIC_CREDENTIALS_FILE === "1";
+  return [
+    {
+      name: "cli",
+      product: "magic",
+      ok: true,
+      detail: `magic ${version()}`,
+      data: { version: version() }
+    },
+    // Information only: bin/magic.js exits before this runs on Node < 24.
+    { name: "node", product: "magic", ok: true, detail: `Node ${process.versions.node}` },
+    shell.store.backend === "keyring" ? { name: "credential store", product: "magic", ok: true, detail: "OS keychain" } : {
+      name: "credential store",
+      product: "magic",
+      ok: true,
+      ...fileChosen ? {} : { warn: true },
+      detail: fileChosen ? "file (MAGIC_CREDENTIALS_FILE=1), mode 0600" : "file, mode 0600 \u2014 no OS keychain on this machine"
+    }
+  ];
+}
+async function accountChecks(shell) {
+  const grant = await readGrant(shell.store);
+  let accountUrl;
+  try {
+    accountUrl = loadCliConfig({
+      products: [],
+      env: shell.env,
+      file: shell.readConfig()
+    }).accountUrl;
+  } catch (err) {
+    const e = toMagicError(err);
+    return [{ name: "account", product: "account", ok: false, code: e.code, detail: e.message }];
+  }
+  const results = [];
+  try {
+    const res = await fetch(accountUrl, {
+      method: "HEAD",
+      signal: AbortSignal.timeout(REACH_TIMEOUT_MS)
+    });
+    results.push({
+      name: "account",
+      product: "account",
+      ok: true,
+      detail: `${accountUrl} answers (HTTP ${res.status})`
+    });
+  } catch (err) {
+    const e = toMagicError(networkish(err), {
+      product: "account",
+      networkHint: "Check MAGIC_ACCOUNT_URL and your network connection."
+    });
+    const detail = e.hint ? `${e.message} \u2014 ${e.hint}` : e.message;
+    results.push(
+      grant ? { name: "account", product: "account", ok: false, code: e.code, detail } : { name: "account", product: "account", ok: true, warn: true, detail }
+    );
+  }
+  if (!grant) {
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: true,
+      warn: true,
+      detail: "Not signed in (run `magic login`); product keys only."
+    });
+  } else if (grantExpired(grant)) {
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: false,
+      code: "not_logged_in",
+      detail: "Your sign-in has ended \u2014 run `magic login`."
+    });
+  } else {
+    const who = grant.user ? `${grant.user.display_name} <${grant.user.email}>` : "signed in";
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: true,
+      detail: `${who} until ${grant.expires_at.slice(0, 10)} (idle sign-out after ${grantIdleExpiry(grant).slice(0, 10)})`,
+      data: { user: grant.user ?? null, expires_at: grant.expires_at }
+    });
+  }
+  return results;
+}
+async function anyCredential(shell, products) {
+  if (await readGrant(shell.store)) return true;
+  if (Object.keys(await readIndex(shell.store)).length > 0) return true;
+  for (const p of products) {
+    if (shell.env[productEnvVar(p.id, "KEY")]?.trim()) return true;
+    if (await shell.store.locate(manualItem(p.id)) !== null) return true;
+  }
+  return false;
+}
+async function productChecks(shell, product, signedIn) {
+  const id = product.id;
+  const networkHint = `Check ${productEnvVar(id, "URL")} and your network connection.`;
+  const fail = (name, err) => {
+    const e = toMagicError(err, { product: id, networkHint });
+    return {
+      name,
+      product: id,
+      ok: false,
+      code: e.code,
+      detail: e.hint ? `${e.message} \u2014 ${e.hint}` : e.message
+    };
+  };
+  let config;
+  try {
+    config = productConfig(product, shell);
+  } catch (err) {
+    return [fail(`${id} config`, err)];
+  }
+  const apiUrl = config.products[id].apiUrl;
+  const results = [];
+  try {
+    const res = await fetch(apiUrl, {
+      method: "HEAD",
+      signal: AbortSignal.timeout(REACH_TIMEOUT_MS)
+    });
+    results.push({
+      name: `${id} api`,
+      product: id,
+      ok: true,
+      detail: `${apiUrl} answers (HTTP ${res.status})`
+    });
+  } catch (err) {
+    results.push(fail(`${id} api`, networkish(err)));
+  }
+  let session;
+  try {
+    const workspace = config.defaultWorkspace[id];
+    session = await resolveCredential(product, {
+      env: shell.env,
+      store: shell.store,
+      ...workspace ? { workspace } : {}
+    });
+  } catch (err) {
+    const failed = fail(`${id} key`, err);
+    const soft = failed.code === "usage" || failed.code === "not_logged_in" && signedIn;
+    results.push(soft ? { ...failed, ok: true, warn: true } : failed);
+    return results;
+  }
+  let ctx = contextFor(product, config, session);
+  if (session.source === "account" && Date.parse(session.expires_at ?? "") <= Date.now()) {
+    try {
+      ctx = await remintFor(product, shell.store)(ctx) ?? ctx;
+    } catch (err) {
+      results.push(fail(`${id} key`, err));
+      return results;
+    }
+  }
+  results.push({
+    name: `${id} key`,
+    product: id,
+    ok: true,
+    detail: `${maskKey(ctx.session.key, product.credential)} from ${keySource(session.source)}${session.workspace ? ` (workspace ${session.workspace.handle})` : ""}`
+  });
+  results.push(...await runDoctorChecks(product.doctor ?? [], ctx, id));
+  return results;
+}
+function keySource(source) {
+  return source === "env" ? "the environment" : source === "account" ? "your sign-in" : "a pasted key";
+}
+function networkish(err) {
+  if (err instanceof Error && err.cause instanceof Error) {
+    return new Error(`${err.message}: ${err.cause.message}`);
+  }
+  return err;
+}
+function printHuman(shell, checks) {
+  const width = Math.max(...checks.map((c) => c.name.length));
+  const lines = checks.map((c) => {
+    const mark = !c.ok ? "FAIL" : c.warn ? "warn" : "ok  ";
+    return `${mark}  ${c.name.padEnd(width)}  ${c.detail}`;
+  });
+  shell.io.out(`${lines.join("\n")}
+`);
+}
+
+// src/commands/login.ts
+var LOGIN_HELP = `Usage: magic login [--device] [--product <product>] [--yes]
+       magic login --product-key [<product>]
+
+Signs in to your Magic Spells account, then mints a short-lived key in each product
+for every workspace you belong to. Opens your browser when one is on this machine;
+otherwise (or with --device) prints a code to enter on any device.
+
+  --device             sign in with a code instead of a browser on this machine
+  --product <product>  mint (or re-mint) one product's keys
+  --yes, -y            replace an existing sign-in without asking
+  --product-key        store a pasted product key instead (from a hidden prompt or
+                       stdin; for CI). Without <product>, the key's prefix picks it.
+`;
+var LOGOUT_HELP = `Usage: magic logout [--product <product>]
+
+Revokes your product keys and your sign-in, and deletes every stored credential.
+With --product, only that product's keys (you stay signed in).
+`;
+async function login(shell, argv) {
+  const args = [...argv];
+  if (wantsHelp(args)) {
+    shell.io.err(LOGIN_HELP);
+    return 0;
+  }
+  rejectWorkspace("login", shell.opts);
+  if (takeSwitch(args, "product-key")) return productKeyLogin(shell, args);
+  const device = takeSwitch(args, "device");
+  const only = takeValue(args, "product");
+  noMoreArgs("login", args);
+  if (only) chooseEntries(shell, [only]);
+  const all = await loadProducts(shell);
+  const targets = all.filter((p) => p.sessions && (!only || p.id === only));
+  if (only && targets.length === 0) {
+    throw usage(
+      `${only} does not mint keys from your account.`,
+      `Run \`magic login --product-key ${only}\` to store a key.`
+    );
+  }
+  const config = loadCliConfig({
+    products: all.map((p) => ({ id: p.id, apiUrl: p.apiUrl })),
+    env: shell.env,
+    file: shell.readConfig()
+  });
+  const interrupt = interruptSignal(shell);
+  try {
+    const old = await readGrant(shell.store);
+    const live = old && !grantExpired(old) ? old : null;
+    let grant;
+    let previous = null;
+    if (only && live) {
+      grant = live;
+    } else {
+      if (live) await confirmReplace(shell, live);
+      previous = old ? await snapshot(shell, all, old) : null;
+      const token = await signIn(shell, config, device, interrupt.signal);
+      grant = grantFromToken(token, config.accountUrl);
+      await saveGrant(shell.store, grant);
+    }
+    const minted = await mintAll(shell, config, targets, grant, interrupt.signal);
+    grant = await rememberUser(shell, config, minted, grant);
+    if (previous) await retire(shell, config, previous, minted);
+    const result = loginResult(grant, minted);
+    report(shell, result);
+    if (jsonMode(shell.opts, shell.io)) render(result, shell.opts, shell.io);
+    return 0;
+  } finally {
+    interrupt.dispose();
+  }
+}
+function interruptSignal(shell) {
+  if (shell.login.interrupt) return { signal: shell.login.interrupt, dispose: () => {
+  } };
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  return { signal: controller.signal, dispose: () => process.off("SIGINT", onSigint) };
+}
+async function confirmReplace(shell, grant) {
+  if (shell.opts.yes) return;
+  const who = grant.user ? `${grant.user.display_name} (${grant.user.email})` : "another person";
+  if (!shell.confirm) {
+    throw usage(`Already logged in as ${who}.`, "Re-run with --yes to replace that sign-in.");
+  }
+  if (!await shell.confirm(`Already logged in as ${who}. Replace that sign-in? [y/N] `)) {
+    throw cancelled();
+  }
+}
+async function signIn(shell, config, forceDevice, signal) {
+  const client = new AccountClient({
+    accountUrl: config.accountUrl,
+    clientId: config.accountClientId
+  });
+  void client.clientId;
+  const local = browserIsLocal(shell.env, shell.platform);
+  return !forceDevice && local ? loopbackSignIn(shell, client, signal) : deviceSignIn(shell, client, local, signal);
+}
+async function loopbackSignIn(shell, client, signal) {
+  const pkce = createPkce();
+  const state = randomState();
+  const loopback = await startLoopback({
+    state,
+    signal,
+    ...shell.login.loopbackTimeoutMs !== void 0 ? { timeoutMs: shell.login.loopbackTimeoutMs } : {},
+    exchange: (code, redirectUri, exchangeSignal) => client.exchangeCode({ code, verifier: pkce.verifier, redirectUri, signal: exchangeSignal })
+  });
+  const url = authorizeUrl({
+    accountUrl: client.accountUrl,
+    clientId: client.clientId,
+    redirectUri: loopback.redirectUri,
+    state,
+    challenge: pkce.challenge
+  });
+  if (await shell.openBrowser(url)) {
+    note(shell, "Opened your browser to sign in to Magic Spells. Waiting for you to finish\u2026");
+  } else {
+    shell.io.err(`Open this page to sign in to Magic Spells:
+
+  ${url}
+
+`);
+  }
+  return loopback.result;
+}
+async function deviceSignIn(shell, client, browserLocal, signal) {
+  const start = await client.startDevice(signal);
+  const bold = (t) => shell.opts.color === false ? t : `\x1B[1m${t}\x1B[22m`;
+  const big = start.user_code.split("").join(" ");
+  shell.io.err(
+    `To sign in, open this page on any device:
+
+  ${start.verification_uri}
+
+and enter the code:
+
+      ${bold(big)}
+
+`
+  );
+  if (browserLocal && start.verification_uri_complete) {
+    if (await shell.openBrowser(start.verification_uri_complete)) {
+      note(shell, "Opened your browser.");
+    }
+  }
+  const countdown = shell.io.isTTY() && !shell.opts.quiet;
+  if (!countdown) {
+    note(shell, `Waiting for approval (the code expires in ${minutes(start.expires_in)})\u2026`);
+  }
+  try {
+    return await waitForDevice(client, start, {
+      signal,
+      ...shell.login.sleep ? { sleep: shell.login.sleep } : {},
+      ...shell.login.now ? { now: shell.login.now } : {},
+      ...countdown ? { onTick: (s) => shell.io.err(`\rWaiting for approval\u2026 ${clock(s)} left `) } : {}
+    });
+  } finally {
+    if (countdown) shell.io.err("\r\x1B[K");
+  }
+}
+async function mintAll(shell, config, products, grant, signal) {
+  const answers = await Promise.all(
+    products.map(async (product) => {
+      try {
+        const res = await mintSessions(product, {
+          apiUrl: config.products[product.id].apiUrl,
+          grant: grant.access_token,
+          signal
+        });
+        return { product, res };
+      } catch (err) {
+        return { product, error: toMagicError(err, { product: product.id }) };
+      }
+    })
+  );
+  const out = [];
+  for (const a of answers) {
+    if (!a.res) {
+      out.push({ product: a.product, error: a.error });
+    } else if (a.res.sessions.length === 0) {
+      out.push({
+        product: a.product,
+        error: new MagicError("permission_denied", `You have no ${a.product.title} workspaces.`, {
+          product: a.product.id,
+          details: { reason: "no_workspaces" }
+        })
+      });
+    } else {
+      const entry = await storeSessions(shell.store, a.product.id, a.res);
+      out.push({
+        product: a.product,
+        entry,
+        sessions: a.res.sessions,
+        ...a.res.user ? { user: a.res.user } : {}
+      });
+    }
+  }
+  return out;
+}
+async function rememberUser(shell, config, minted, grant) {
+  let user = minted.find((m) => m.user)?.user ?? grant.user;
+  for (const m of minted) {
+    if (user || !m.sessions) continue;
+    try {
+      const op = (await m.product.load()).find((o) => o.name === `${m.product.id}.whoami`);
+      if (!op) continue;
+      const ctx = contextFor(m.product, config, m.sessions[0]);
+      const identity = await runWithRemint(
+        op,
+        op.input.parse({}),
+        ctx,
+        remintFor(m.product, shell.store)
+      );
+      const u = rec(readField(identity, "user"));
+      const email = readStr(u.email);
+      if (email) {
+        user = {
+          id: readStr(u.id) ?? "",
+          display_name: readStr(u.display_name) ?? readStr(u.name) ?? email,
+          email
+        };
+      }
+    } catch {
+    }
+  }
+  const touched = {
+    ...grant,
+    ...user ? { user } : {},
+    ...minted.some((m) => m.sessions) ? { last_used_at: (/* @__PURE__ */ new Date()).toISOString() } : {}
+  };
+  await saveGrant(shell.store, touched);
+  return touched;
+}
+async function snapshot(shell, all, grant) {
+  const sessions = [];
+  for (const product of all) {
+    const s = await productSessions(shell.store, product.id);
+    if (s.length > 0) sessions.push({ product, sessions: s });
+  }
+  return { grant, sessions };
+}
+async function retire(shell, config, previous, minted) {
+  for (const { product, sessions } of previous.sessions) {
+    await revokeProduct(product, sessions, config).catch(() => {
+    });
+    if (!minted.some((m) => m.product.id === product.id && m.sessions)) {
+      await forgetSessions(shell.store, product.id);
+    }
+  }
+  await new AccountClient({ accountUrl: previous.grant.account_url }).revoke(previous.grant.access_token).catch(() => {
+  });
+}
+function loginResult(grant, minted) {
+  const products = {};
+  for (const m of minted) {
+    products[m.product.id] = m.entry ? { workspaces: m.entry.workspaces.map((w) => w.handle), default: m.entry.default ?? null } : { error: m.error.toJSON() };
+  }
+  return {
+    account: {
+      user: grant.user ?? null,
+      expires_at: grant.expires_at,
+      account_url: grant.account_url
+    },
+    products
+  };
+}
+function report(shell, result) {
+  if (shell.opts.quiet) return;
+  const u = result.account.user;
+  const lines = [u ? `Logged in as ${u.display_name} (${u.email}).` : "Logged in."];
+  const width = Math.max(...Object.keys(result.products).map((id) => id.length));
+  for (const [id, p] of Object.entries(result.products)) {
+    let line;
+    if ("error" in p) {
+      line = `skipped: ${p.error.message}${p.error.hint ? ` ${p.error.hint}` : ""}`;
+    } else {
+      const n = p.workspaces.length;
+      const which = `${n} workspace${n === 1 ? "" : "s"}: ${p.workspaces.join(", ")}`;
+      line = p.default ? `${which} (default)` : `${which} (use --workspace to pick one)`;
+    }
+    lines.push(`  ${id.padEnd(width)}  ${line}`);
+  }
+  shell.io.err(`${lines.join("\n")}
+`);
+}
+function note(shell, line) {
+  if (!shell.opts.quiet) shell.io.err(`${line}
+`);
+}
+function minutes(seconds) {
+  const m = Math.round(seconds / 60);
+  return m === 1 ? "1 minute" : `${m} minutes`;
+}
+function clock(seconds) {
+  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+async function productKeyLogin(shell, args) {
+  if (args.some((a) => a.includes("_"))) {
+    throw usage(
+      "Keys are never read from arguments.",
+      "Run `magic login --product-key` and paste the key at the prompt, or pipe it on stdin."
+    );
+  }
+  const named = args.length > 0 && !args[0].startsWith("--") ? args.shift() : void 0;
+  if (args.length > 0) {
+    throw usage("login: unexpected arguments.", "Usage: magic login --product-key [<product>]");
+  }
+  const products = await loadProducts(shell, named ? [named] : void 0);
+  const label = named ? `${products[0].title} key` : "Product key";
+  const key = await shell.readSecret(`${label} (input hidden): `);
+  if (!key) throw usage("No key given.", "Paste the key at the prompt, or pipe it on stdin.");
+  const product = named ? products[0] : byPrefix(products, key);
+  await saveProductKey(product, shell.store, key);
+  const where = storeLabel(await shell.store.locate(manualItem(product.id)));
+  envShadowNote(shell, product);
+  render(
+    { product: product.id, key: maskKey(key, product.credential), stored_in: where },
+    shell.opts,
+    shell.io
+  );
+  return 0;
+}
+function byPrefix(products, key) {
+  const match = products.find((p) => key.startsWith(p.credential));
+  if (match) return match;
+  throw usage(
+    "The key prefix matches no product.",
+    `Known prefixes: ${products.map((p) => `${p.credential} (${p.id})`).join(", ")}.`
+  );
+}
+function envShadowNote(shell, product) {
+  const envVar = productEnvVar(product.id, "KEY");
+  if (shell.env[envVar]?.trim() && !shell.opts.quiet) {
+    shell.io.err(`note: ${envVar} is set and takes precedence over the stored key.
+`);
+  }
+}
+async function logout(shell, argv) {
+  const args = [...argv];
+  if (wantsHelp(args)) {
+    shell.io.err(LOGOUT_HELP);
+    return 0;
+  }
+  rejectWorkspace("logout", shell.opts);
+  const one = takeValue(args, "product");
+  noMoreArgs("logout", args);
+  const chosen = await loadProducts(shell, one ? [one] : void 0);
+  const grant = await readGrant(shell.store);
+  const result = { removed: [], revoked: [], account: "none" };
+  const errors = {};
+  for (const product of chosen) {
+    const sessions = await productSessions(shell.store, product.id);
+    if (sessions.length > 0 && product.sessions) {
+      try {
+        await revokeProduct(product, sessions, productConfig(product, shell));
+        result.revoked.push(product.id);
+      } catch (err) {
+        errors[product.id] = toMagicError(err, { product: product.id }).toJSON();
+      }
+    }
+    const items = await forgetSessions(shell.store, product.id);
+    const hadManual = await shell.store.locate(manualItem(product.id)) !== null;
+    await forgetProductKey(product, shell.store);
+    if (items.length > 0 || hadManual) result.removed.push(product.id);
+    envShadowNote(shell, product);
+  }
+  if (one) {
+    result.account = grant ? "kept" : "none";
+  } else if (grant) {
+    try {
+      result.account = await new AccountClient({ accountUrl: grant.account_url }).revoke(
+        grant.access_token
+      );
+    } catch (err) {
+      result.account = "failed";
+      errors.account = toMagicError(err, { product: "account" }).toJSON();
+    }
+    await shell.store.delete(GRANT_ITEM);
+  }
+  if (Object.keys(errors).length > 0) result.errors = errors;
+  if (!shell.opts.quiet) {
+    if (result.account === "unsupported") {
+      shell.io.err(
+        "note: Account does not offer grant revocation yet; the sign-in was forgotten here.\n"
+      );
+    }
+    for (const [id, e] of Object.entries(errors)) {
+      shell.io.err(`note: ${id}: could not revoke server-side (${e.message}); forgotten here.
+`);
+    }
+  }
+  render(result, shell.opts, shell.io);
+  return 0;
+}
+async function revokeProduct(product, sessions, config) {
+  for (const s of sessions) {
+    try {
+      await revokeSessions(product, { apiUrl: config.products[product.id].apiUrl, key: s.key });
+      return;
+    } catch (err) {
+      if (isMagicError(err) && (err.code === "auth_invalid" || err.code === "auth_expired")) {
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+
+// src/commands/mcp.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+var PREAMBLE = "Magic MCP \u2014 tools for Magic Spells services. Every tool, resource and prompt is prefixed with its product (`pyramid_\u2026`); each product\u2019s rules follow under its own heading. Errors come back as `{ error: { code, message, hint, product } }`: act on `code`.";
+async function buildMcp(shell, argv, signal) {
+  const args = [...argv];
+  rejectWorkspace("mcp", shell.opts);
+  const list = takeValue(args, "products");
+  noMoreArgs("mcp", args);
+  const ids = list?.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  const skipped = /* @__PURE__ */ new Set();
+  const skip = (id, err) => {
+    skipped.add(id);
+    shell.io.err(`magic mcp: ${id}: left out (${toMagicError(err, { product: id }).message})
+`);
+  };
+  const products = [];
+  for (const entry of chooseEntries(shell, ids)) {
+    try {
+      const module = await entry.load();
+      const operations = await module.load();
+      if (operations.length === 0 && !module.mcp && !ids?.includes(entry.id)) continue;
+      products.push({
+        module,
+        operations,
+        context: contextSource(shell, module, signal),
+        remint: remintFor(module, shell.store)
+      });
+    } catch (err) {
+      skip(entry.id, err);
+    }
+  }
+  const server = createMcpServer({
+    name: "magic",
+    version: version(),
+    preamble: PREAMBLE,
+    products,
+    onSkip: skip
+  });
+  return { server, products: products.filter((p) => !skipped.has(p.module.id)) };
+}
+function contextSource(shell, module, signal) {
+  return async () => buildContext(module, productConfig(module, shell), {
+    env: shell.env,
+    store: shell.store,
+    signal
+  });
+}
+async function serveMcp(shell, argv) {
+  if (wantsHelp(argv)) {
+    shell.io.err(
+      "Usage: magic mcp [--products a,b]\n\nServe every product\u2019s tools to an MCP host over stdio.\n"
+    );
+    return 0;
+  }
+  guardStdout();
+  const err = (line) => shell.io.err(`magic mcp: ${line}
+`);
+  const controller = new AbortController();
+  const built = await buildMcp(shell, argv, controller.signal);
+  const transport = new StdioServerTransport();
+  let closing = false;
+  const shutdown = async (reason) => {
+    if (closing) return;
+    closing = true;
+    err(`shutting down (${reason}).`);
+    controller.abort();
+    try {
+      await built.server.close();
+    } catch (e) {
+      err(`error during shutdown: ${toMagicError(e).message}`);
+    }
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  process.stdin.on("close", () => void shutdown("stdin closed"));
+  process.stdin.on("end", () => void shutdown("stdin end"));
+  await built.server.connect(transport);
+  const summary = built.products.map((p) => `${p.module.id} (${p.operations.length} tools)`);
+  err(`ready on stdio \xB7 ${summary.join(", ")}`);
+  for (const { module } of built.products) {
+    try {
+      await resolveCredential(module, { env: shell.env, store: shell.store });
+    } catch (e) {
+      const why = toMagicError(e, { product: module.id });
+      err(
+        `${module.id}: ${why.message} Its tools answer ${why.code} until that is fixed. ${why.hint ?? ""}`.trim()
+      );
+    }
+  }
+  return 0;
+}
+function guardStdout() {
+  const toErr = (...args) => {
+    process.stderr.write(`${args.map((a) => typeof a === "string" ? a : String(a)).join(" ")}
+`);
+  };
+  console.log = toErr;
+  console.info = toErr;
+  console.debug = toErr;
+}
+
+// src/commands/whoami.ts
+async function whoami(shell, argv) {
+  if (wantsHelp(argv)) {
+    shell.io.err(
+      "Usage: magic whoami [--json]\n\nYour account, and your workspaces and keys in each product.\n"
+    );
+    return 0;
+  }
+  rejectWorkspace("whoami", shell.opts);
+  noMoreArgs("whoami", argv);
+  const grant = await readGrant(shell.store);
+  const result = {
+    account: grant ? {
+      user: grant.user ?? null,
+      grant_id: grant.grant_id,
+      expires_at: grant.expires_at,
+      idle_expires_at: grantIdleExpiry(grant),
+      account_url: grant.account_url
+    } : null,
+    products: {}
+  };
+  let firstError;
+  for (const product of await loadProducts(shell)) {
+    const entry = await identify(shell, product);
+    result.products[product.id] = entry.identity;
+    firstError ??= entry.error;
+  }
+  if (jsonMode(shell.opts, shell.io)) render(result, shell.opts, shell.io);
+  else printHuman2(shell, result);
+  if (firstError) return exitCodeFor(firstError.code);
+  if (!result.account && Object.values(result.products).every((p) => p.source === "none")) {
+    if (!shell.opts.quiet) shell.io.err("Not logged in. Run `magic login`.\n");
+    return exitCodeFor("not_logged_in");
+  }
+  return 0;
+}
+async function identify(shell, product) {
+  const id = product.id;
+  const sessions = await productSessions(shell.store, id);
+  const index = (await readIndex(shell.store))[id];
+  const envSet = Boolean(shell.env[productEnvVar(id, "KEY")]?.trim());
+  const manualAt = await shell.store.locate(manualItem(id));
+  const source = envSet ? "env" : sessions.length > 0 ? "account" : manualAt ? "manual" : "none";
+  const stored = source === "account" ? sessions[0].workspace.handle : null;
+  const base = {
+    source,
+    stored_in: source === "account" ? storeLabel(await shell.store.locate(sessionItem(id, stored))) : source === "manual" ? storeLabel(manualAt) : null,
+    key: null,
+    default: index?.default ?? null,
+    workspaces: workspaces(product, sessions, index?.workspaces ?? []),
+    identity: null
+  };
+  if (source === "none") return { identity: base };
+  let session;
+  const config = productConfig(product, shell);
+  try {
+    const workspace = config.defaultWorkspace[id];
+    session = await resolveCredential(product, {
+      env: shell.env,
+      store: shell.store,
+      ...workspace ? { workspace } : {}
+    });
+  } catch (err) {
+    const error = toMagicError(err, { product: id });
+    if (error.code === "usage") return { identity: base };
+    return { identity: { ...base, error: error.toJSON() }, error };
+  }
+  const identity = { ...base, key: maskKey(session.key, product.credential) };
+  try {
+    const op = (await product.load()).find((o) => o.name === `${id}.whoami`);
+    if (!op) return { identity };
+    const ctx = contextFor(product, config, session);
+    const who = await runWithRemint(op, op.input.parse({}), ctx, remintFor(product, shell.store));
+    return { identity: { ...identity, identity: who } };
+  } catch (err) {
+    const error = toMagicError(err, { product: id });
+    return { identity: { ...identity, error: error.toJSON() }, error };
+  }
+}
+function workspaces(product, sessions, listed) {
+  return listed.map((w) => {
+    const s = sessions.find((x) => x.workspace?.handle === w.handle);
+    return {
+      handle: w.handle,
+      name: w.name,
+      role: w.role,
+      key: s ? maskKey(s.key, product.credential) : null,
+      expires_at: s?.expires_at ?? null
+    };
+  });
+}
+function printHuman2(shell, result) {
+  const lines = [];
+  const a = result.account;
+  if (a) {
+    lines.push(a.user ? `${a.user.display_name} <${a.user.email}>` : "Signed in");
+    lines.push(
+      `  signed in until ${day(a.expires_at)}; ends after ${day(a.idle_expires_at)} unused`
+    );
+  } else {
+    lines.push("Not signed in to a Magic Spells account.");
+  }
+  lines.push("");
+  for (const [id, p] of Object.entries(result.products)) {
+    const rows = [["source", p.source]];
+    if (p.key) rows.push(["key", p.key]);
+    for (const w of p.workspaces) {
+      const mark = w.handle === p.default ? " (default)" : "";
+      const expires = w.expires_at ? `, key expires ${w.expires_at}` : "";
+      rows.push([w.handle, `${w.name} \xB7 ${w.role}${w.key ? ` \xB7 ${w.key}` : ""}${mark}${expires}`]);
+    }
+    if (p.identity && typeof p.identity === "object") {
+      for (const [k, v] of Object.entries(p.identity)) rows.push([k, cell(v)]);
+    }
+    if (p.error) rows.push(["error", `[${p.error.code}] ${p.error.message}`]);
+    const width = Math.max(...rows.map(([k]) => k.length));
+    lines.push(id, ...rows.map(([k, v]) => `  ${k.padEnd(width)}  ${v}`), "");
+  }
+  shell.io.out(lines.join("\n"));
+}
+function day(iso) {
+  return iso.slice(0, 10);
+}
+
+// src/products.ts
+var PRODUCTS = [
+  {
+    id: "pyramid",
+    title: "Pyramid \u2014 projects and tasks",
+    load: async () => (await import("./src-L2I546M7.js")).default
+  },
+  {
+    id: "sites",
+    title: "Sites \u2014 sign-in only until its commands arrive",
+    load: async () => (await import("./src-DJYPPJFM.js")).default
+  },
+  {
+    id: "marketing",
+    title: "Marketing \u2014 sign-in only until its commands arrive",
+    load: async () => (await import("./src-KJGFPRQP.js")).default
+  }
+];
+
+// src/secret.ts
+async function readSecret(prompt) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) {
+    process.stderr.write("reading key from stdin\u2026\n");
+    return (await readAll(stdin)).trim();
+  }
+  process.stderr.write(prompt);
+  stdin.setRawMode(true);
+  stdin.setEncoding("utf8");
+  stdin.resume();
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const finish = () => {
+      stdin.off("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      process.stderr.write("\n");
+    };
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n" || ch === "") {
+          finish();
+          resolve(value.trim());
+          return;
+        }
+        if (ch === "") {
+          finish();
+          reject(cancelled());
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") value = value.slice(0, -1);
+        else value += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+async function readAll(stream) {
+  let text = "";
+  for await (const chunk of stream) text += String(chunk);
+  return text;
+}
+
+// src/main.ts
+var COMMANDS = {
+  login: { summary: "sign in and mint product keys: login [--device] [--product <p>]", run: login },
+  logout: { summary: "revoke and forget credentials: logout [--product <p>]", run: logout },
+  whoami: { summary: "your account and your workspaces in each product", run: whoami },
+  doctor: { summary: "check the install, the sign-in and each product", run: doctor },
+  mcp: { summary: "serve every product\u2019s tools over stdio: mcp [--products a,b]", run: serveMcp }
+};
+function help(products) {
+  const lines = [
+    "magic \u2014 the command line for Magic Spells services",
+    "",
+    "Usage: magic <command> [args] [--flags]",
+    "       magic <product> <noun> <verb> [args] [--flags]",
+    "",
+    "Commands:",
+    ...Object.entries(COMMANDS).map(([name, c]) => `  ${name.padEnd(21)}${c.summary}`),
+    `  ${"version".padEnd(21)}print the version`,
+    "",
+    "Products:",
+    ...products.map((p) => `  ${p.id.padEnd(21)}${p.title}`),
+    "",
+    "Global flags: --json --yes/-y --no-color --quiet/-q --workspace <handle> --version --help",
+    "Run `magic <product> --help` for a product\u2019s commands.",
+    ""
+  ];
+  return lines.join("\n");
+}
+async function run(argv, deps = {}) {
+  const io = deps.io ?? processIO;
+  const env = deps.env ?? process.env;
+  const products = deps.products ?? PRODUCTS;
+  const [cmd, ...rest] = argv;
+  if (cmd === "version" || cmd === "--version" || cmd === "-v") {
+    io.out(`magic ${version()}
+`);
+    return 0;
+  }
+  if (cmd === void 0 || cmd === "help" || cmd === "--help" || cmd === "-h") {
+    io.err(help(products));
+    return 0;
+  }
+  const store = () => deps.store ?? createCredentialStore({ env });
+  const readConfig = () => readConfigFile(configFilePath({ env }));
+  const entry = products.find((p) => p.id === cmd);
+  if (entry) {
+    const product = await entry.load();
+    return runProductCli(product, rest, { io, env, store: store(), readConfig });
+  }
+  let opts = { json: argv.includes("--json"), yes: false, quiet: false };
+  try {
+    const command = COMMANDS[cmd];
+    if (!command) throw usage(`unknown command "${cmd}"`, "Run `magic --help` for usage.");
+    const parsed = parseGlobals(rest, [], env);
+    opts = parsed.opts;
+    const shell = {
+      io,
+      env,
+      store: store(),
+      entries: products,
+      opts,
+      readConfig,
+      readSecret: deps.readSecret ?? readSecret,
+      openBrowser: deps.openBrowser ?? openBrowser,
+      confirm: deps.confirm !== void 0 ? deps.confirm : process.stdin.isTTY ? confirmOnTty : null,
+      platform: deps.platform ?? process.platform,
+      login: deps.login ?? {}
+    };
+    return await command.run(shell, parsed.rest);
+  } catch (err) {
+    return renderError(toMagicError(err), opts, io);
+  }
+}
+export {
+  run,
+  version
+};