magic-spells 0.1.0 → 0.2.0

package/dist/{chunk-YT2Z756Z.js → chunk-JZ7XESF4.js}

@@ -25,6 +25,9 @@ var MagicError = class _MagicError extends Error {
     return out;
   }
 };
+function isMagicError(e) {
+  return e instanceof MagicError;
+}
 function exitCodeFor(code) {
   switch (code) {
     case "usage":
@@ -32,6 +35,7 @@ function exitCodeFor(code) {
     case "not_logged_in":
     case "auth_invalid":
     case "auth_expired":
+    case "auth_cancelled":
       return 3;
     case "permission_denied":
       return 4;
@@ -165,6 +169,8 @@ function configDir(opts = {}) {
 
 // ../kit/src/config.ts
 var DEFAULT_ACCOUNT_URL = "https://account.magicspells.io";
+var ACCOUNT_CLIENT_ID_PLACEHOLDER = "set-magic-cli-client-id";
+var DEFAULT_ACCOUNT_CLIENT_ID = "magic-cli";
 function productEnvVar(id, suffix) {
   return `MAGIC_${id.toUpperCase().replace(/-/g, "_")}_${suffix}`;
 }
@@ -198,6 +204,7 @@ function loadCliConfig(opts) {
       env.MAGIC_ACCOUNT_URL || file?.accountUrl || DEFAULT_ACCOUNT_URL,
       "MAGIC_ACCOUNT_URL"
     ),
+    accountClientId: env.MAGIC_ACCOUNT_CLIENT_ID?.trim() || DEFAULT_ACCOUNT_CLIENT_ID,
     products,
     defaultWorkspace,
     allowDestructive: env.MAGIC_ALLOW_DESTRUCTIVE === "1",
@@ -220,6 +227,17 @@ function normalizeUrl(value, source) {
   return trimmed;
 }
 
+// ../kit/src/read.ts
+function rec(v) {
+  return v && typeof v === "object" ? v : {};
+}
+function readStr(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function readField(obj, key) {
+  return obj && typeof obj === "object" && key in obj ? obj[key] : void 0;
+}
+
 // ../kit/src/keychain.ts
 import { execFileSync } from "node:child_process";
 import { chmodSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
@@ -694,6 +712,533 @@ function usage(message, hint) {
 // ../kit/src/cli.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 
+// ../kit/src/sessions.ts
+import { hostname } from "node:os";
+
+// ../kit/src/account.ts
+import { createHash, randomBytes } from "node:crypto";
+var ACCOUNT_PRODUCT = "account";
+var GRANT_PREFIX = "magic_";
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_GRANT_SECONDS = 60 * 24 * 60 * 60;
+function createPkce(bytes = randomBytes(32)) {
+  const verifier = bytes.toString("base64url");
+  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+function randomState() {
+  return randomBytes(24).toString("base64url");
+}
+function authorizeUrl(p) {
+  const url = new URL("/auth/authorize", p.accountUrl);
+  url.searchParams.set("client_id", p.clientId);
+  url.searchParams.set("redirect_uri", p.redirectUri);
+  url.searchParams.set("state", p.state);
+  url.searchParams.set("code_challenge", p.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("scope", "basic");
+  return url.toString();
+}
+function requireClientId(clientId) {
+  if (!clientId || clientId === ACCOUNT_CLIENT_ID_PLACEHOLDER) {
+    throw new MagicError("usage", "This build of magic has no Account client id.", {
+      product: ACCOUNT_PRODUCT,
+      hint: "Set MAGIC_ACCOUNT_CLIENT_ID to the magic application\u2019s client id."
+    });
+  }
+  return clientId;
+}
+var AccountClient = class {
+  accountUrl;
+  id;
+  fetch;
+  constructor(opts) {
+    this.accountUrl = opts.accountUrl;
+    this.id = opts.clientId;
+    this.fetch = opts.fetch ?? fetch;
+  }
+  get clientId() {
+    return requireClientId(this.id);
+  }
+  /** Exchange a loopback `code` for the grant (`grant_type=authorization_code`). */
+  async exchangeCode(p) {
+    const res = await this.post(
+      "/auth/token",
+      {
+        grant_type: "authorization_code",
+        code: p.code,
+        code_verifier: p.verifier,
+        client_id: this.clientId,
+        redirect_uri: p.redirectUri
+      },
+      p.signal
+    );
+    if (!res.ok) throw tokenError(res.status, res.code);
+    return readToken(res.body);
+  }
+  /** Start the device flow (`POST /auth/device`). */
+  async startDevice(signal) {
+    const res = await this.post(
+      "/auth/device",
+      { client_id: this.clientId, scope: "basic" },
+      signal
+    );
+    if (!res.ok) throw tokenError(res.status, res.code);
+    const b = res.body;
+    if (typeof b.device_code !== "string" || typeof b.user_code !== "string" || typeof b.verification_uri !== "string") {
+      throw new MagicError("unknown", "Account answered the device request without a code.", {
+        product: ACCOUNT_PRODUCT
+      });
+    }
+    return {
+      device_code: b.device_code,
+      user_code: b.user_code,
+      verification_uri: b.verification_uri,
+      ...typeof b.verification_uri_complete === "string" ? { verification_uri_complete: b.verification_uri_complete } : {},
+      expires_in: positive(b.expires_in, 600),
+      interval: positive(b.interval, 5)
+    };
+  }
+  /**
+   * One device poll. Pending and slow_down come back as values; access_denied
+   * (auth_cancelled) and expired_token (auth_expired) throw.
+   */
+  async pollDevice(deviceCode, signal) {
+    const res = await this.post(
+      "/auth/token",
+      { grant_type: DEVICE_GRANT_TYPE, device_code: deviceCode, client_id: this.clientId },
+      signal
+    );
+    if (res.ok) return { status: "approved", token: readToken(res.body) };
+    if (res.code === "authorization_pending") return { status: "pending" };
+    if (res.code === "slow_down") return { status: "slow_down" };
+    throw tokenError(res.status, res.code);
+  }
+  /**
+   * Revoke the grant (`POST /auth/revoke token=…`). `unsupported` when this Account
+   * has no revoke endpoint (404/405); other failures throw.
+   */
+  async revoke(token, signal) {
+    const res = await this.post("/auth/revoke", { token }, signal);
+    if (res.ok) return "revoked";
+    if (res.status === 404 || res.status === 405) return "unsupported";
+    throw tokenError(res.status, res.code);
+  }
+  async post(path, form, signal) {
+    let res;
+    try {
+      res = await this.fetch(new URL(path, this.accountUrl), {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams(form).toString(),
+        ...signal ? { signal } : {}
+      });
+    } catch (err) {
+      throw transportError(err, signal);
+    }
+    const text = await res.text().catch(() => "");
+    let body = null;
+    try {
+      body = text ? JSON.parse(text) : null;
+    } catch {
+      body = null;
+    }
+    return { ok: res.ok, status: res.status, code: errorCode(body), body };
+  }
+};
+async function waitForDevice(client, start, opts = {}) {
+  const sleep = opts.sleep ?? abortableSleep;
+  const now = opts.now ?? Date.now;
+  const deadline = now() + start.expires_in * 1e3;
+  let interval = start.interval * 1e3;
+  for (; ; ) {
+    const until = now() + interval;
+    while (now() < until) {
+      if (opts.signal?.aborted) throw cancelledError();
+      opts.onTick?.(Math.max(0, Math.ceil((deadline - now()) / 1e3)));
+      await sleep(Math.min(1e3, until - now()), opts.signal).catch((err) => {
+        throw opts.signal?.aborted ? cancelledError() : err;
+      });
+    }
+    if (opts.signal?.aborted) throw cancelledError();
+    if (now() >= deadline) throw expiredCodeError();
+    const poll = await client.pollDevice(start.device_code, opts.signal);
+    if (poll.status === "approved") return poll.token;
+    if (poll.status === "slow_down") interval += 5e3;
+  }
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(cancelledError());
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(cancelledError());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function cancelledError() {
+  return new MagicError("auth_cancelled", "Login cancelled.", { product: ACCOUNT_PRODUCT });
+}
+function expiredCodeError() {
+  return new MagicError("auth_expired", "The code expired.", {
+    product: ACCOUNT_PRODUCT,
+    hint: "Run `magic login` again."
+  });
+}
+function errorCode(body) {
+  if (!body || typeof body !== "object" || !("error" in body)) return void 0;
+  const e = body.error;
+  if (typeof e === "string") return e;
+  if (e && typeof e === "object" && typeof e.code === "string") {
+    return e.code;
+  }
+  return void 0;
+}
+function tokenError(status, code) {
+  const product = ACCOUNT_PRODUCT;
+  switch (code) {
+    case "access_denied":
+      return cancelledError();
+    case "expired_token":
+      return expiredCodeError();
+    case "invalid_client":
+      return new MagicError("auth_invalid", "Account does not know this client.", {
+        product,
+        hint: "Check MAGIC_ACCOUNT_CLIENT_ID and MAGIC_ACCOUNT_URL."
+      });
+    case "invalid_grant":
+      return new MagicError("auth_invalid", "Account refused the sign-in code.", {
+        product,
+        hint: "Run `magic login` again."
+      });
+  }
+  if (status === 429 || code === "slow_down" || code === "rate_limited") {
+    return new MagicError("rate_limited", "Account is rate limiting sign-ins.", {
+      product,
+      hint: "Wait a minute and try again."
+    });
+  }
+  if (status >= 500) {
+    return new MagicError("product_unavailable", `Account is unavailable (HTTP ${status}).`, {
+      product
+    });
+  }
+  return new MagicError(
+    "auth_invalid",
+    `Account refused the request (HTTP ${status}${code ? `, ${code}` : ""}).`,
+    { product }
+  );
+}
+function transportError(err, signal) {
+  if (signal?.aborted) return cancelledError();
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = err instanceof Error && err.cause instanceof Error ? `: ${err.cause.message}` : "";
+  if (err instanceof Error && !isNetworkError(err)) {
+    return new MagicError("unknown", message, { product: ACCOUNT_PRODUCT });
+  }
+  return new MagicError("network", `Cannot reach Account (${message}${cause}).`, {
+    product: ACCOUNT_PRODUCT,
+    hint: "Check MAGIC_ACCOUNT_URL and your network connection."
+  });
+}
+function readToken(body) {
+  const b = body ?? {};
+  if (typeof b.access_token !== "string" || !b.access_token.startsWith(GRANT_PREFIX)) {
+    throw new MagicError("auth_invalid", "Account answered without a magic grant.", {
+      product: ACCOUNT_PRODUCT,
+      hint: "Check MAGIC_ACCOUNT_URL points at Magic Spells Account."
+    });
+  }
+  return {
+    token_type: "Bearer",
+    access_token: b.access_token,
+    expires_in: positive(b.expires_in, DEFAULT_GRANT_SECONDS),
+    grant_id: typeof b.grant_id === "string" ? b.grant_id : ""
+  };
+}
+function positive(v, fallback) {
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : fallback;
+}
+
+// ../kit/src/sessions.ts
+var GRANT_ITEM = "account:grant";
+var SESSIONS_ITEM = "account:sessions";
+var GRANT_IDLE_MS = 14 * 24 * 60 * 60 * 1e3;
+function sessionItem(product, handle) {
+  return `${product}:${handle}`;
+}
+function grantFromToken(token, accountUrl, now = /* @__PURE__ */ new Date()) {
+  return {
+    access_token: token.access_token,
+    grant_id: token.grant_id,
+    token_type: "Bearer",
+    obtained_at: now.toISOString(),
+    expires_at: new Date(now.getTime() + token.expires_in * 1e3).toISOString(),
+    last_used_at: now.toISOString(),
+    account_url: accountUrl
+  };
+}
+function grantIdleExpiry(grant) {
+  const idle = Date.parse(grant.last_used_at) + GRANT_IDLE_MS;
+  const hard = Date.parse(grant.expires_at);
+  return new Date(Math.min(idle, hard)).toISOString();
+}
+function grantExpired(grant, now = Date.now()) {
+  return Date.parse(grantIdleExpiry(grant)) <= now;
+}
+async function readGrant(store) {
+  const raw = await store.get(GRANT_ITEM);
+  if (!raw) return null;
+  try {
+    const g = JSON.parse(raw);
+    if (typeof g.access_token !== "string" || !g.access_token.startsWith(GRANT_PREFIX)) return null;
+    return g;
+  } catch {
+    return null;
+  }
+}
+async function saveGrant(store, grant) {
+  await store.set(GRANT_ITEM, JSON.stringify(grant));
+}
+async function readIndex(store) {
+  const raw = await store.get(SESSIONS_ITEM);
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveIndex(store, index) {
+  if (Object.keys(index).length === 0) await store.delete(SESSIONS_ITEM);
+  else await store.set(SESSIONS_ITEM, JSON.stringify(index));
+}
+async function readSession(store, product, handle) {
+  const raw = await store.get(sessionItem(product, handle));
+  if (!raw) return null;
+  try {
+    const s = JSON.parse(raw);
+    return typeof s.key === "string" && s.key.length > 0 ? { ...s, product, key: s.key, source: "account" } : null;
+  } catch {
+    return null;
+  }
+}
+function sessionLabel(host = hostname()) {
+  return `magic on ${host}`.slice(0, 80);
+}
+async function mintSessions(spec, opts) {
+  const path = spec.sessions?.path;
+  if (!path) throw new Error(`${spec.id} declares no sessions route`);
+  const body = { label: opts.label ?? sessionLabel() };
+  if (opts.workspace) body.workspace = opts.workspace;
+  const res = await call(spec, opts, opts.apiUrl + path, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${opts.grant}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw sessionError(spec, res.status, res.body);
+  return readSessions(spec, res.body);
+}
+async function revokeSessions(spec, opts) {
+  const path = spec.sessions?.path;
+  if (!path) throw new Error(`${spec.id} declares no sessions route`);
+  const res = await call(spec, opts, opts.apiUrl + path, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${opts.key}`, accept: "application/json" }
+  });
+  if (!res.ok) {
+    throw mapHttpError(res.status, res.body, { product: spec.id, title: spec.title });
+  }
+}
+async function call(spec, opts, url, init) {
+  let res;
+  try {
+    res = await (opts.fetch ?? fetch)(url, {
+      ...init,
+      ...opts.signal ? { signal: opts.signal } : {}
+    });
+  } catch (err) {
+    const e = toMagicError(err, {
+      product: spec.id,
+      networkHint: `Check ${productEnvVar(spec.id, "URL")} and your network connection.`
+    });
+    const cause = err instanceof Error && err.cause instanceof Error ? `: ${err.cause.message}` : "";
+    throw cause ? new MagicError(e.code, `${e.message}${cause}`, {
+      product: e.product,
+      ...e.hint ? { hint: e.hint } : {}
+    }) : e;
+  }
+  const text = await res.text().catch(() => "");
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = null;
+  }
+  return { ok: res.ok, status: res.status, body };
+}
+function sessionError(spec, status, body) {
+  const code = readStr(rec(rec(body).error).code);
+  if (status === 401) {
+    return new MagicError("not_logged_in", "Your Magic Spells sign-in is no longer valid.", {
+      product: spec.id,
+      hint: "Run `magic login`."
+    });
+  }
+  if (status === 403 && code === "no_workspaces") {
+    return new MagicError("permission_denied", `You have no ${spec.title} workspaces.`, {
+      product: spec.id,
+      details: { reason: "no_workspaces" }
+    });
+  }
+  if (status === 404) {
+    return new MagicError("not_found", `No ${spec.title} workspace by that handle.`, {
+      product: spec.id,
+      details: { kind: "workspace" }
+    });
+  }
+  return mapHttpError(status, body, { product: spec.id, title: spec.title });
+}
+function readSessions(spec, body) {
+  const b = rec(body);
+  const raw = Array.isArray(b.sessions) ? b.sessions : [];
+  const sessions = [];
+  for (const item of raw) {
+    const s = rec(item);
+    const key = readStr(s.key);
+    const ws = rec(s.workspace);
+    const handle = readStr(ws.handle);
+    if (!key || !key.startsWith(spec.credential) || !handle) {
+      throw new MagicError("unknown", `${spec.title} answered with a malformed session.`, {
+        product: spec.id
+      });
+    }
+    sessions.push({
+      product: spec.id,
+      key,
+      ...readStr(s.key_id) ? { key_id: readStr(s.key_id) } : {},
+      workspace: { id: readStr(ws.id) ?? "", handle, name: readStr(ws.name) ?? handle },
+      ...readStr(s.role) ? { role: readStr(s.role) } : {},
+      ...readStr(s.expires_at) ? { expires_at: readStr(s.expires_at) } : {},
+      source: "account"
+    });
+  }
+  const workspaces = (Array.isArray(b.workspaces) ? b.workspaces : []).flatMap(
+    (item) => {
+      const w = rec(item);
+      const handle = readStr(w.handle);
+      if (!handle) return [];
+      return [
+        {
+          id: readStr(w.id) ?? "",
+          handle,
+          name: readStr(w.name) ?? handle,
+          role: readStr(w.role) ?? ""
+        }
+      ];
+    }
+  );
+  const u = rec(b.user);
+  const email = readStr(u.email);
+  const user = email ? { id: readStr(u.id) ?? "", display_name: readStr(u.display_name) ?? email, email } : void 0;
+  return { sessions, workspaces, ...user ? { user } : {} };
+}
+async function storeSessions(store, product, res, now = /* @__PURE__ */ new Date()) {
+  const index = await readIndex(store);
+  const handles = new Set(res.sessions.map((s) => s.workspace.handle));
+  for (const old of index[product]?.workspaces ?? []) {
+    if (!handles.has(old.handle)) await store.delete(sessionItem(product, old.handle));
+  }
+  for (const s of res.sessions) {
+    await store.set(sessionItem(product, s.workspace.handle), JSON.stringify(s));
+  }
+  const workspaces = res.sessions.map((s) => {
+    const listed = res.workspaces.find((w) => w.handle === s.workspace.handle);
+    return {
+      id: s.workspace.id || listed?.id || "",
+      handle: s.workspace.handle,
+      name: s.workspace.name || listed?.name || s.workspace.handle,
+      role: s.role ?? listed?.role ?? ""
+    };
+  });
+  const entry = {
+    workspaces,
+    ...workspaces.length === 1 ? { default: workspaces[0].handle } : {},
+    minted_at: now.toISOString()
+  };
+  index[product] = entry;
+  await saveIndex(store, index);
+  return entry;
+}
+async function productSessions(store, product) {
+  const entry = (await readIndex(store))[product];
+  const out = [];
+  for (const w of entry?.workspaces ?? []) {
+    const s = await readSession(store, product, w.handle);
+    if (s) out.push(s);
+  }
+  return out;
+}
+async function forgetSessions(store, product) {
+  const index = await readIndex(store);
+  const entry = index[product];
+  if (!entry) return [];
+  const items = entry.workspaces.map((w) => sessionItem(product, w.handle));
+  for (const item of items) await store.delete(item);
+  delete index[product];
+  await saveIndex(store, index);
+  return items;
+}
+async function touchGrant(store, grant) {
+  const touched = { ...grant, last_used_at: (/* @__PURE__ */ new Date()).toISOString() };
+  await saveGrant(store, touched);
+  return touched;
+}
+async function remintSession(spec, session, opts) {
+  const grant = await readGrant(opts.store);
+  const handle = session.workspace?.handle;
+  if (!grant || !handle) {
+    throw new MagicError("not_logged_in", `Your ${spec.title} session has expired.`, {
+      product: spec.id,
+      hint: "Run `magic login`."
+    });
+  }
+  const res = await mintSessions(spec, {
+    apiUrl: opts.apiUrl,
+    grant: grant.access_token,
+    workspace: handle,
+    ...opts.fetch ? { fetch: opts.fetch } : {},
+    ...opts.signal ? { signal: opts.signal } : {}
+  });
+  const fresh = res.sessions.find((s) => s.workspace?.handle === handle);
+  if (!fresh) {
+    throw new MagicError(
+      "not_found",
+      `You no longer reach the ${spec.title} workspace "${handle}".`,
+      {
+        product: spec.id,
+        details: { kind: "workspace" },
+        hint: "Run `magic login` to refresh your workspaces."
+      }
+    );
+  }
+  await opts.store.set(sessionItem(spec.id, handle), JSON.stringify(fresh));
+  await touchGrant(opts.store, grant);
+  return fresh;
+}
+
 // ../kit/src/credentials.ts
 function manualItem(product) {
   return `${product}:manual`;
@@ -719,7 +1264,8 @@ function parseStoredSession(product, value) {
 }
 function loginHint(spec) {
   const where = spec.keyHelp ? ` (${spec.keyHelp})` : "";
-  return `Set ${productEnvVar(spec.id, "KEY")} or run \`magic login --product-key\` with a ${spec.credential}\u2026 key${where}.`;
+  const manual = `${productEnvVar(spec.id, "KEY")} or run \`magic login --product-key\` with a ${spec.credential}\u2026 key${where}.`;
+  return spec.sessions ? `Run \`magic login\`, or set ${manual}` : `Set ${manual}`;
 }
 function checkPrefix(spec, key) {
   if (!key.startsWith(spec.credential)) {
@@ -740,16 +1286,40 @@ async function resolveCredential(spec, opts) {
     checkPrefix(spec, envKey);
     return { product: spec.id, key: envKey, source: "env" };
   }
+  const minted = (await readIndex(opts.store))[spec.id];
+  const handle = opts.workspace ?? minted?.default;
+  if (minted && handle) {
+    const account = await readSession(opts.store, spec.id, handle);
+    if (account) {
+      checkPrefix(spec, account.key);
+      return account;
+    }
+    if (opts.workspace) {
+      throw new MagicError("not_found", `No ${spec.title} session for workspace "${handle}".`, {
+        product: spec.id,
+        details: { kind: "workspace" },
+        candidates: minted.workspaces.map((w) => w.handle),
+        hint: "Pick one of the listed workspaces, or run `magic login` to refresh them."
+      });
+    }
+  }
   const stored = await opts.store.get(manualItem(spec.id));
   const session = stored ? parseStoredSession(spec.id, stored) : null;
-  if (!session) {
-    throw new MagicError("not_logged_in", `No ${spec.title} key found.`, {
+  if (session) {
+    checkPrefix(spec, session.key);
+    return session;
+  }
+  if (minted && minted.workspaces.length > 1) {
+    throw new MagicError("usage", `You have several ${spec.title} workspaces; choose one.`, {
       product: spec.id,
-      hint: loginHint(spec)
+      candidates: minted.workspaces.map((w) => w.handle),
+      hint: "Pass --workspace <handle>, or set defaultWorkspace in the config file."
     });
   }
-  checkPrefix(spec, session.key);
-  return session;
+  throw new MagicError("not_logged_in", `No ${spec.title} key found.`, {
+    product: spec.id,
+    hint: loginHint(spec)
+  });
 }
 async function saveProductKey(spec, store, key) {
   const trimmed = key.trim();
@@ -772,7 +1342,12 @@ function productConfig(product, deps, extra = {}) {
   });
 }
 async function buildContext(product, config, deps, requiresSession = true) {
-  const session = requiresSession ? await resolveCredential(product, { env: deps.env ?? process.env, store: deps.store }) : null;
+  const workspace = config.defaultWorkspace[product.id];
+  const session = requiresSession ? await resolveCredential(product, {
+    env: deps.env ?? process.env,
+    store: deps.store,
+    ...workspace ? { workspace } : {}
+  }) : null;
   return contextFor(product, config, session, deps.signal);
 }
 function contextFor(product, config, session, signal = new AbortController().signal) {
@@ -783,6 +1358,27 @@ function contextFor(product, config, session, signal = new AbortController().sig
     signal
   };
 }
+function remintFor(product, store) {
+  return async (ctx) => {
+    if (ctx.session?.source !== "account" || !product.sessions) return null;
+    const fresh = await remintSession(product, ctx.session, {
+      store,
+      apiUrl: ctx.config.products[product.id].apiUrl,
+      signal: ctx.signal
+    });
+    return contextFor(product, ctx.config, fresh, ctx.signal);
+  };
+}
+async function runWithRemint(op, input, ctx, remint) {
+  try {
+    return await op.run(input, ctx);
+  } catch (err) {
+    if (!remint || !isMagicError(err) || err.code !== "auth_expired") throw err;
+    const fresh = await remint(ctx);
+    if (!fresh) throw err;
+    return op.run(input, fresh);
+  }
+}
 
 // ../kit/src/cli.ts
 async function runProductCli(product, argv, deps) {
@@ -840,7 +1436,7 @@ async function runProductCli(product, argv, deps) {
       if (!config.allowDestructive) throw destructiveDisabled(product.id);
     }
     const ctx = await buildContext(product, config, deps, op.meta?.requiresSession !== false);
-    const out = await op.run(input, ctx);
+    const out = await runWithRemint(op, input, ctx, remintFor(product, deps.store));
     render(out, opts, io);
     return 0;
   } catch (err) {
@@ -864,11 +1460,8 @@ function buildInput(cmd, parsed, productFlags, opts) {
   for (const [key, value] of Object.entries(productFlags)) {
     if (has(key) && raw[key] === void 0) raw[key] = value;
   }
-  if (opts.workspace) {
-    if (!has("workspace")) {
-      throw usage(`--workspace is not supported by ${cmd.words.join(" ")}`);
-    }
-    if (raw.workspace === void 0) raw.workspace = opts.workspace;
+  if (opts.workspace && has("workspace") && raw.workspace === void 0) {
+    raw.workspace = opts.workspace;
   }
   const result = cmd.op.input.safeParse(coerce(raw, fields));
   if (!result.success) {
@@ -926,17 +1519,6 @@ function summaryOf(op) {
   return op.meta?.destructive ? `${op.summary} [destructive]` : op.summary;
 }
 
-// ../kit/src/read.ts
-function rec(v) {
-  return v && typeof v === "object" ? v : {};
-}
-function readStr(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function readField(obj, key) {
-  return obj && typeof obj === "object" && key in obj ? obj[key] : void 0;
-}
-
 // ../kit/src/doctor.ts
 async function runDoctorChecks(checks, ctx, product = "magic") {
   const results = [];
@@ -957,6 +1539,102 @@ async function runDoctorChecks(checks, ctx, product = "magic") {
   return results;
 }
 
+// ../kit/src/loopback.ts
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+var LOOPBACK_TIMEOUT_MS = 2 * 60 * 1e3;
+var CODE_EXCHANGE_TIMEOUT_MS = 30 * 1e3;
+async function startLoopback(opts) {
+  let settle;
+  const result = new Promise((resolve, reject) => settle = { resolve, reject });
+  result.catch(() => {
+  });
+  let done = false;
+  let exchanging = false;
+  const server = createServer((req, res) => void handle(req, res));
+  const finish = (outcome) => {
+    if (done) return;
+    done = true;
+    clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", onAbort);
+    server.close();
+    server.closeIdleConnections();
+    if ("value" in outcome) settle.resolve(outcome.value);
+    else settle.reject(outcome.error);
+  };
+  const handle = async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const state = url.searchParams.get("state");
+    if (done || exchanging || req.method !== "GET" || url.pathname !== "/callback") {
+      return reply(res, 400, "Bad request.");
+    }
+    if (!sameState(state, opts.state)) return reply(res, 400, "Bad request.");
+    const error = url.searchParams.get("error");
+    if (error) {
+      reply(res, 200, "Sign-in cancelled. You can close this tab and return to your terminal.");
+      return finish({
+        error: error === "access_denied" ? cancelledError() : new MagicError("auth_invalid", `Account refused the sign-in (${error}).`, {
+          product: ACCOUNT_PRODUCT
+        })
+      });
+    }
+    const code = url.searchParams.get("code");
+    if (!code) return reply(res, 400, "Bad request.");
+    exchanging = true;
+    clearTimeout(timer);
+    const signals = [AbortSignal.timeout(CODE_EXCHANGE_TIMEOUT_MS)];
+    if (opts.signal) signals.push(opts.signal);
+    try {
+      const value = await opts.exchange(code, redirectUri, AbortSignal.any(signals));
+      reply(res, 200, "Signed in to Magic Spells. You can close this tab.");
+      finish({ value });
+    } catch (err) {
+      reply(res, 400, "Sign-in failed. Return to your terminal for details.");
+      finish({ error: toMagicError(err, { product: ACCOUNT_PRODUCT }) });
+    }
+  };
+  const onAbort = () => finish({ error: cancelledError() });
+  const timer = setTimeout(
+    () => finish({
+      error: new MagicError("auth_expired", "Sign-in timed out waiting for the browser.", {
+        product: ACCOUNT_PRODUCT,
+        hint: "Run `magic login --device` to sign in with a code instead."
+      })
+    }),
+    opts.timeoutMs ?? LOOPBACK_TIMEOUT_MS
+  );
+  timer.unref?.();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  }).catch((err) => {
+    clearTimeout(timer);
+    throw toMagicError(err, { product: ACCOUNT_PRODUCT });
+  });
+  const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+  if (opts.signal?.aborted) onAbort();
+  else opts.signal?.addEventListener("abort", onAbort, { once: true });
+  return { redirectUri, result };
+}
+function sameState(got, want) {
+  if (got === null) return false;
+  const a = Buffer.from(got);
+  const b = Buffer.from(want);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function reply(res, status, text) {
+  res.writeHead(status, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store",
+    connection: "close"
+  });
+  res.end(`${text}
+`);
+}
+
 // ../kit/src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
@@ -988,7 +1666,7 @@ ${text}` : text];
 }
 function registerProduct(server, p) {
   for (const op of p.operations) {
-    if (onSurface(op, "mcp")) registerTool(server, p.module.id, op, p.context);
+    if (onSurface(op, "mcp")) registerTool(server, p.module.id, op, p.context, p.remint);
   }
   p.module.mcp?.register?.(server, p.context);
 }
@@ -1000,7 +1678,7 @@ function toolInputShape(op) {
     yes: z.boolean().optional().describe("Confirm this destructive action (also needs MAGIC_ALLOW_DESTRUCTIVE=1).")
   };
 }
-async function callTool(product, op, context, args) {
+async function callTool(product, op, context, args, remint) {
   try {
     const ctx = await context();
     const { yes, ...rest } = args ?? {};
@@ -1015,7 +1693,7 @@ async function callTool(product, op, context, args) {
     }
     const parsed = op.input.safeParse(op.meta?.destructive ? rest : args ?? {});
     if (!parsed.success) throw invalidInput(product, parsed.error);
-    const result = await op.run(parsed.data, ctx);
+    const result = await runWithRemint(op, parsed.data, ctx, remint);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   } catch (err) {
     return toToolError(toMagicError(err, { product }));
@@ -1030,14 +1708,14 @@ function invalidInput(product, error) {
     ...field ? { details: { field } } : {}
   });
 }
-function registerTool(server, product, op, context) {
+function registerTool(server, product, op, context, remint) {
   const description = op.detail ? `${op.summary}
 
 ${op.detail}` : op.summary;
   server.registerTool(
     toolName(op),
     { description, inputSchema: toolInputShape(op) },
-    async (args) => callTool(product, op, context, args)
+    async (args) => callTool(product, op, context, args, remint)
   );
 }
 
@@ -1095,12 +1773,35 @@ function readPackageVersion(moduleUrl) {
 
 export {
   MagicError,
+  isMagicError,
   exitCodeFor,
   mapHttpError,
   toMagicError,
   productEnvVar,
   configFilePath,
   readConfigFile,
+  loadCliConfig,
+  createPkce,
+  randomState,
+  authorizeUrl,
+  AccountClient,
+  waitForDevice,
+  rec,
+  readStr,
+  readField,
+  GRANT_ITEM,
+  sessionItem,
+  grantFromToken,
+  grantIdleExpiry,
+  grantExpired,
+  readGrant,
+  saveGrant,
+  readIndex,
+  mintSessions,
+  revokeSessions,
+  storeSessions,
+  productSessions,
+  forgetSessions,
   manualItem,
   maskKey,
   resolveCredential,
@@ -1117,12 +1818,12 @@ export {
   productConfig,
   buildContext,
   contextFor,
+  remintFor,
+  runWithRemint,
   runDoctorChecks,
+  startLoopback,
   runProductCli,
   createMcpServer,
   TtlCache,
-  rec,
-  readStr,
-  readField,
   readPackageVersion
 };