magic-spells 0.1.0 → 0.2.0

package/dist/main.js

@@ -1,31 +1,85 @@
 import {
+  AccountClient,
+  GRANT_ITEM,
   MagicError,
+  authorizeUrl,
   buildContext,
   cell,
   configFilePath,
   contextFor,
   createCredentialStore,
   createMcpServer,
+  createPkce,
   exitCodeFor,
   forgetProductKey,
+  forgetSessions,
+  grantExpired,
+  grantFromToken,
+  grantIdleExpiry,
+  isMagicError,
   jsonMode,
+  loadCliConfig,
   manualItem,
   maskKey,
+  mintSessions,
   parseGlobals,
   processIO,
   productConfig,
   productEnvVar,
+  productSessions,
+  randomState,
   readConfigFile,
+  readField,
+  readGrant,
+  readIndex,
   readPackageVersion,
+  readStr,
+  rec,
+  remintFor,
   render,
   renderError,
   resolveCredential,
+  revokeSessions,
   runDoctorChecks,
   runProductCli,
+  runWithRemint,
+  saveGrant,
   saveProductKey,
+  sessionItem,
+  startLoopback,
+  storeSessions,
   toMagicError,
-  usage
-} from "./chunk-YT2Z756Z.js";
+  usage,
+  waitForDevice
+} from "./chunk-JZ7XESF4.js";
+
+// src/browser.ts
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+function browserIsLocal(env, platform) {
+  if (env.SSH_CONNECTION) return false;
+  if (platform === "linux") return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+  return true;
+}
+function openBrowser(url) {
+  return new Promise((resolve) => {
+    const platform = process.platform;
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+    const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.once("error", () => resolve(false));
+    child.once("close", (code) => resolve(code === 0));
+    child.unref();
+  });
+}
+async function confirmOnTty(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
+}
 
 // src/version.ts
 var cached;
@@ -93,9 +147,10 @@ async function doctor(shell, argv) {
   }
   rejectWorkspace("doctor", shell.opts);
   noMoreArgs("doctor", argv);
-  const checks = [...shellChecks(shell)];
-  for (const product of await loadProducts(shell))
-    checks.push(...await productChecks(shell, product));
+  const products = await loadProducts(shell);
+  const checks = [...shellChecks(shell), ...await accountChecks(shell)];
+  const signedIn = await anyCredential(shell, products);
+  for (const product of products) checks.push(...await productChecks(shell, product, signedIn));
   const ok = checks.every((c) => c.ok);
   if (jsonMode(shell.opts, shell.io)) render({ ok, checks }, shell.opts, shell.io);
   else printHuman(shell, checks);
@@ -123,7 +178,79 @@ function shellChecks(shell) {
     }
   ];
 }
-async function productChecks(shell, product) {
+async function accountChecks(shell) {
+  const grant = await readGrant(shell.store);
+  let accountUrl;
+  try {
+    accountUrl = loadCliConfig({
+      products: [],
+      env: shell.env,
+      file: shell.readConfig()
+    }).accountUrl;
+  } catch (err) {
+    const e = toMagicError(err);
+    return [{ name: "account", product: "account", ok: false, code: e.code, detail: e.message }];
+  }
+  const results = [];
+  try {
+    const res = await fetch(accountUrl, {
+      method: "HEAD",
+      signal: AbortSignal.timeout(REACH_TIMEOUT_MS)
+    });
+    results.push({
+      name: "account",
+      product: "account",
+      ok: true,
+      detail: `${accountUrl} answers (HTTP ${res.status})`
+    });
+  } catch (err) {
+    const e = toMagicError(networkish(err), {
+      product: "account",
+      networkHint: "Check MAGIC_ACCOUNT_URL and your network connection."
+    });
+    const detail = e.hint ? `${e.message} \u2014 ${e.hint}` : e.message;
+    results.push(
+      grant ? { name: "account", product: "account", ok: false, code: e.code, detail } : { name: "account", product: "account", ok: true, warn: true, detail }
+    );
+  }
+  if (!grant) {
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: true,
+      warn: true,
+      detail: "Not signed in (run `magic login`); product keys only."
+    });
+  } else if (grantExpired(grant)) {
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: false,
+      code: "not_logged_in",
+      detail: "Your sign-in has ended \u2014 run `magic login`."
+    });
+  } else {
+    const who = grant.user ? `${grant.user.display_name} <${grant.user.email}>` : "signed in";
+    results.push({
+      name: "account grant",
+      product: "account",
+      ok: true,
+      detail: `${who} until ${grant.expires_at.slice(0, 10)} (idle sign-out after ${grantIdleExpiry(grant).slice(0, 10)})`,
+      data: { user: grant.user ?? null, expires_at: grant.expires_at }
+    });
+  }
+  return results;
+}
+async function anyCredential(shell, products) {
+  if (await readGrant(shell.store)) return true;
+  if (Object.keys(await readIndex(shell.store)).length > 0) return true;
+  for (const p of products) {
+    if (shell.env[productEnvVar(p.id, "KEY")]?.trim()) return true;
+    if (await shell.store.locate(manualItem(p.id)) !== null) return true;
+  }
+  return false;
+}
+async function productChecks(shell, product, signedIn) {
   const id = product.id;
   const networkHint = `Check ${productEnvVar(id, "URL")} and your network connection.`;
   const fail = (name, err) => {
@@ -160,22 +287,39 @@ async function productChecks(shell, product) {
   }
   let session;
   try {
-    session = await resolveCredential(product, { env: shell.env, store: shell.store });
+    const workspace = config.defaultWorkspace[id];
+    session = await resolveCredential(product, {
+      env: shell.env,
+      store: shell.store,
+      ...workspace ? { workspace } : {}
+    });
   } catch (err) {
-    results.push(fail(`${id} key`, err));
+    const failed = fail(`${id} key`, err);
+    const soft = failed.code === "usage" || failed.code === "not_logged_in" && signedIn;
+    results.push(soft ? { ...failed, ok: true, warn: true } : failed);
     return results;
   }
+  let ctx = contextFor(product, config, session);
+  if (session.source === "account" && Date.parse(session.expires_at ?? "") <= Date.now()) {
+    try {
+      ctx = await remintFor(product, shell.store)(ctx) ?? ctx;
+    } catch (err) {
+      results.push(fail(`${id} key`, err));
+      return results;
+    }
+  }
   results.push({
     name: `${id} key`,
     product: id,
     ok: true,
-    detail: `${maskKey(session.key, product.credential)} from ${session.source === "env" ? "the environment" : "the store"}`
+    detail: `${maskKey(ctx.session.key, product.credential)} from ${keySource(session.source)}${session.workspace ? ` (workspace ${session.workspace.handle})` : ""}`
   });
-  results.push(
-    ...await runDoctorChecks(product.doctor ?? [], contextFor(product, config, session), id)
-  );
+  results.push(...await runDoctorChecks(product.doctor ?? [], ctx, id));
   return results;
 }
+function keySource(source) {
+  return source === "env" ? "the environment" : source === "account" ? "your sign-in" : "a pasted key";
+}
 function networkish(err) {
   if (err instanceof Error && err.cause instanceof Error) {
     return new Error(`${err.message}: ${err.cause.message}`);
@@ -193,15 +337,23 @@ function printHuman(shell, checks) {
 }
 
 // src/commands/login.ts
-var LOGIN_HELP = `Usage: magic login --product-key [<product>]
+var LOGIN_HELP = `Usage: magic login [--device] [--product <product>] [--yes]
+       magic login --product-key [<product>]
 
-Stores a product key (from a hidden prompt, or stdin when piped) in the OS keychain,
-or a 0600 file where there is none. Without <product>, the key's prefix picks it.
-Account sign-in (\`magic login\` alone) arrives in a later release.
+Signs in to your Magic Spells account, then mints a short-lived key in each product
+for every workspace you belong to. Opens your browser when one is on this machine;
+otherwise (or with --device) prints a code to enter on any device.
+
+  --device             sign in with a code instead of a browser on this machine
+  --product <product>  mint (or re-mint) one product's keys
+  --yes, -y            replace an existing sign-in without asking
+  --product-key        store a pasted product key instead (from a hidden prompt or
+                       stdin; for CI). Without <product>, the key's prefix picks it.
 `;
 var LOGOUT_HELP = `Usage: magic logout [--product <product>]
 
-Forgets the stored key of every product, or of one.
+Revokes your product keys and your sign-in, and deletes every stored credential.
+With --product, only that product's keys (you stay signed in).
 `;
 async function login(shell, argv) {
   const args = [...argv];
@@ -210,12 +362,276 @@ async function login(shell, argv) {
     return 0;
   }
   rejectWorkspace("login", shell.opts);
-  if (!takeSwitch(args, "product-key")) {
+  if (takeSwitch(args, "product-key")) return productKeyLogin(shell, args);
+  const device = takeSwitch(args, "device");
+  const only = takeValue(args, "product");
+  noMoreArgs("login", args);
+  if (only) chooseEntries(shell, [only]);
+  const all = await loadProducts(shell);
+  const targets = all.filter((p) => p.sessions && (!only || p.id === only));
+  if (only && targets.length === 0) {
     throw usage(
-      "Account login is not available yet.",
-      "Run `magic login --product-key [<product>]` to store a product key."
+      `${only} does not mint keys from your account.`,
+      `Run \`magic login --product-key ${only}\` to store a key.`
     );
   }
+  const config = loadCliConfig({
+    products: all.map((p) => ({ id: p.id, apiUrl: p.apiUrl })),
+    env: shell.env,
+    file: shell.readConfig()
+  });
+  const interrupt = interruptSignal(shell);
+  try {
+    const old = await readGrant(shell.store);
+    const live = old && !grantExpired(old) ? old : null;
+    let grant;
+    let previous = null;
+    if (only && live) {
+      grant = live;
+    } else {
+      if (live) await confirmReplace(shell, live);
+      previous = old ? await snapshot(shell, all, old) : null;
+      const token = await signIn(shell, config, device, interrupt.signal);
+      grant = grantFromToken(token, config.accountUrl);
+      await saveGrant(shell.store, grant);
+    }
+    const minted = await mintAll(shell, config, targets, grant, interrupt.signal);
+    grant = await rememberUser(shell, config, minted, grant);
+    if (previous) await retire(shell, config, previous, minted);
+    const result = loginResult(grant, minted);
+    report(shell, result);
+    if (jsonMode(shell.opts, shell.io)) render(result, shell.opts, shell.io);
+    return 0;
+  } finally {
+    interrupt.dispose();
+  }
+}
+function interruptSignal(shell) {
+  if (shell.login.interrupt) return { signal: shell.login.interrupt, dispose: () => {
+  } };
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  return { signal: controller.signal, dispose: () => process.off("SIGINT", onSigint) };
+}
+async function confirmReplace(shell, grant) {
+  if (shell.opts.yes) return;
+  const who = grant.user ? `${grant.user.display_name} (${grant.user.email})` : "another person";
+  if (!shell.confirm) {
+    throw usage(`Already logged in as ${who}.`, "Re-run with --yes to replace that sign-in.");
+  }
+  if (!await shell.confirm(`Already logged in as ${who}. Replace that sign-in? [y/N] `)) {
+    throw cancelled();
+  }
+}
+async function signIn(shell, config, forceDevice, signal) {
+  const client = new AccountClient({
+    accountUrl: config.accountUrl,
+    clientId: config.accountClientId
+  });
+  void client.clientId;
+  const local = browserIsLocal(shell.env, shell.platform);
+  return !forceDevice && local ? loopbackSignIn(shell, client, signal) : deviceSignIn(shell, client, local, signal);
+}
+async function loopbackSignIn(shell, client, signal) {
+  const pkce = createPkce();
+  const state = randomState();
+  const loopback = await startLoopback({
+    state,
+    signal,
+    ...shell.login.loopbackTimeoutMs !== void 0 ? { timeoutMs: shell.login.loopbackTimeoutMs } : {},
+    exchange: (code, redirectUri, exchangeSignal) => client.exchangeCode({ code, verifier: pkce.verifier, redirectUri, signal: exchangeSignal })
+  });
+  const url = authorizeUrl({
+    accountUrl: client.accountUrl,
+    clientId: client.clientId,
+    redirectUri: loopback.redirectUri,
+    state,
+    challenge: pkce.challenge
+  });
+  if (await shell.openBrowser(url)) {
+    note(shell, "Opened your browser to sign in to Magic Spells. Waiting for you to finish\u2026");
+  } else {
+    shell.io.err(`Open this page to sign in to Magic Spells:
+
+  ${url}
+
+`);
+  }
+  return loopback.result;
+}
+async function deviceSignIn(shell, client, browserLocal, signal) {
+  const start = await client.startDevice(signal);
+  const bold = (t) => shell.opts.color === false ? t : `\x1B[1m${t}\x1B[22m`;
+  const big = start.user_code.split("").join(" ");
+  shell.io.err(
+    `To sign in, open this page on any device:
+
+  ${start.verification_uri}
+
+and enter the code:
+
+      ${bold(big)}
+
+`
+  );
+  if (browserLocal && start.verification_uri_complete) {
+    if (await shell.openBrowser(start.verification_uri_complete)) {
+      note(shell, "Opened your browser.");
+    }
+  }
+  const countdown = shell.io.isTTY() && !shell.opts.quiet;
+  if (!countdown) {
+    note(shell, `Waiting for approval (the code expires in ${minutes(start.expires_in)})\u2026`);
+  }
+  try {
+    return await waitForDevice(client, start, {
+      signal,
+      ...shell.login.sleep ? { sleep: shell.login.sleep } : {},
+      ...shell.login.now ? { now: shell.login.now } : {},
+      ...countdown ? { onTick: (s) => shell.io.err(`\rWaiting for approval\u2026 ${clock(s)} left `) } : {}
+    });
+  } finally {
+    if (countdown) shell.io.err("\r\x1B[K");
+  }
+}
+async function mintAll(shell, config, products, grant, signal) {
+  const answers = await Promise.all(
+    products.map(async (product) => {
+      try {
+        const res = await mintSessions(product, {
+          apiUrl: config.products[product.id].apiUrl,
+          grant: grant.access_token,
+          signal
+        });
+        return { product, res };
+      } catch (err) {
+        return { product, error: toMagicError(err, { product: product.id }) };
+      }
+    })
+  );
+  const out = [];
+  for (const a of answers) {
+    if (!a.res) {
+      out.push({ product: a.product, error: a.error });
+    } else if (a.res.sessions.length === 0) {
+      out.push({
+        product: a.product,
+        error: new MagicError("permission_denied", `You have no ${a.product.title} workspaces.`, {
+          product: a.product.id,
+          details: { reason: "no_workspaces" }
+        })
+      });
+    } else {
+      const entry = await storeSessions(shell.store, a.product.id, a.res);
+      out.push({
+        product: a.product,
+        entry,
+        sessions: a.res.sessions,
+        ...a.res.user ? { user: a.res.user } : {}
+      });
+    }
+  }
+  return out;
+}
+async function rememberUser(shell, config, minted, grant) {
+  let user = minted.find((m) => m.user)?.user ?? grant.user;
+  for (const m of minted) {
+    if (user || !m.sessions) continue;
+    try {
+      const op = (await m.product.load()).find((o) => o.name === `${m.product.id}.whoami`);
+      if (!op) continue;
+      const ctx = contextFor(m.product, config, m.sessions[0]);
+      const identity = await runWithRemint(
+        op,
+        op.input.parse({}),
+        ctx,
+        remintFor(m.product, shell.store)
+      );
+      const u = rec(readField(identity, "user"));
+      const email = readStr(u.email);
+      if (email) {
+        user = {
+          id: readStr(u.id) ?? "",
+          display_name: readStr(u.display_name) ?? readStr(u.name) ?? email,
+          email
+        };
+      }
+    } catch {
+    }
+  }
+  const touched = {
+    ...grant,
+    ...user ? { user } : {},
+    ...minted.some((m) => m.sessions) ? { last_used_at: (/* @__PURE__ */ new Date()).toISOString() } : {}
+  };
+  await saveGrant(shell.store, touched);
+  return touched;
+}
+async function snapshot(shell, all, grant) {
+  const sessions = [];
+  for (const product of all) {
+    const s = await productSessions(shell.store, product.id);
+    if (s.length > 0) sessions.push({ product, sessions: s });
+  }
+  return { grant, sessions };
+}
+async function retire(shell, config, previous, minted) {
+  for (const { product, sessions } of previous.sessions) {
+    await revokeProduct(product, sessions, config).catch(() => {
+    });
+    if (!minted.some((m) => m.product.id === product.id && m.sessions)) {
+      await forgetSessions(shell.store, product.id);
+    }
+  }
+  await new AccountClient({ accountUrl: previous.grant.account_url }).revoke(previous.grant.access_token).catch(() => {
+  });
+}
+function loginResult(grant, minted) {
+  const products = {};
+  for (const m of minted) {
+    products[m.product.id] = m.entry ? { workspaces: m.entry.workspaces.map((w) => w.handle), default: m.entry.default ?? null } : { error: m.error.toJSON() };
+  }
+  return {
+    account: {
+      user: grant.user ?? null,
+      expires_at: grant.expires_at,
+      account_url: grant.account_url
+    },
+    products
+  };
+}
+function report(shell, result) {
+  if (shell.opts.quiet) return;
+  const u = result.account.user;
+  const lines = [u ? `Logged in as ${u.display_name} (${u.email}).` : "Logged in."];
+  const width = Math.max(...Object.keys(result.products).map((id) => id.length));
+  for (const [id, p] of Object.entries(result.products)) {
+    let line;
+    if ("error" in p) {
+      line = `skipped: ${p.error.message}${p.error.hint ? ` ${p.error.hint}` : ""}`;
+    } else {
+      const n = p.workspaces.length;
+      const which = `${n} workspace${n === 1 ? "" : "s"}: ${p.workspaces.join(", ")}`;
+      line = p.default ? `${which} (default)` : `${which} (use --workspace to pick one)`;
+    }
+    lines.push(`  ${id.padEnd(width)}  ${line}`);
+  }
+  shell.io.err(`${lines.join("\n")}
+`);
+}
+function note(shell, line) {
+  if (!shell.opts.quiet) shell.io.err(`${line}
+`);
+}
+function minutes(seconds) {
+  const m = Math.round(seconds / 60);
+  return m === 1 ? "1 minute" : `${m} minutes`;
+}
+function clock(seconds) {
+  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+async function productKeyLogin(shell, args) {
   if (args.some((a) => a.includes("_"))) {
     throw usage(
       "Keys are never read from arguments.",
@@ -241,6 +657,21 @@ async function login(shell, argv) {
   );
   return 0;
 }
+function byPrefix(products, key) {
+  const match = products.find((p) => key.startsWith(p.credential));
+  if (match) return match;
+  throw usage(
+    "The key prefix matches no product.",
+    `Known prefixes: ${products.map((p) => `${p.credential} (${p.id})`).join(", ")}.`
+  );
+}
+function envShadowNote(shell, product) {
+  const envVar = productEnvVar(product.id, "KEY");
+  if (shell.env[envVar]?.trim() && !shell.opts.quiet) {
+    shell.io.err(`note: ${envVar} is set and takes precedence over the stored key.
+`);
+  }
+}
 async function logout(shell, argv) {
   const args = [...argv];
   if (wantsHelp(args)) {
@@ -250,28 +681,65 @@ async function logout(shell, argv) {
   rejectWorkspace("logout", shell.opts);
   const one = takeValue(args, "product");
   noMoreArgs("logout", args);
-  const removed = [];
-  for (const product of await loadProducts(shell, one ? [one] : void 0)) {
-    if (await shell.store.locate(manualItem(product.id)) !== null) removed.push(product.id);
+  const chosen = await loadProducts(shell, one ? [one] : void 0);
+  const grant = await readGrant(shell.store);
+  const result = { removed: [], revoked: [], account: "none" };
+  const errors = {};
+  for (const product of chosen) {
+    const sessions = await productSessions(shell.store, product.id);
+    if (sessions.length > 0 && product.sessions) {
+      try {
+        await revokeProduct(product, sessions, productConfig(product, shell));
+        result.revoked.push(product.id);
+      } catch (err) {
+        errors[product.id] = toMagicError(err, { product: product.id }).toJSON();
+      }
+    }
+    const items = await forgetSessions(shell.store, product.id);
+    const hadManual = await shell.store.locate(manualItem(product.id)) !== null;
     await forgetProductKey(product, shell.store);
+    if (items.length > 0 || hadManual) result.removed.push(product.id);
     envShadowNote(shell, product);
   }
-  render({ removed }, shell.opts, shell.io);
+  if (one) {
+    result.account = grant ? "kept" : "none";
+  } else if (grant) {
+    try {
+      result.account = await new AccountClient({ accountUrl: grant.account_url }).revoke(
+        grant.access_token
+      );
+    } catch (err) {
+      result.account = "failed";
+      errors.account = toMagicError(err, { product: "account" }).toJSON();
+    }
+    await shell.store.delete(GRANT_ITEM);
+  }
+  if (Object.keys(errors).length > 0) result.errors = errors;
+  if (!shell.opts.quiet) {
+    if (result.account === "unsupported") {
+      shell.io.err(
+        "note: Account does not offer grant revocation yet; the sign-in was forgotten here.\n"
+      );
+    }
+    for (const [id, e] of Object.entries(errors)) {
+      shell.io.err(`note: ${id}: could not revoke server-side (${e.message}); forgotten here.
+`);
+    }
+  }
+  render(result, shell.opts, shell.io);
   return 0;
 }
-function byPrefix(products, key) {
-  const match = products.find((p) => key.startsWith(p.credential));
-  if (match) return match;
-  throw usage(
-    "The key prefix matches no product.",
-    `Known prefixes: ${products.map((p) => `${p.credential} (${p.id})`).join(", ")}.`
-  );
-}
-function envShadowNote(shell, product) {
-  const envVar = productEnvVar(product.id, "KEY");
-  if (shell.env[envVar]?.trim() && !shell.opts.quiet) {
-    shell.io.err(`note: ${envVar} is set and takes precedence over the stored key.
-`);
+async function revokeProduct(product, sessions, config) {
+  for (const s of sessions) {
+    try {
+      await revokeSessions(product, { apiUrl: config.products[product.id].apiUrl, key: s.key });
+      return;
+    } catch (err) {
+      if (isMagicError(err) && (err.code === "auth_invalid" || err.code === "auth_expired")) {
+        continue;
+      }
+      throw err;
+    }
   }
 }
 
@@ -295,7 +763,13 @@ async function buildMcp(shell, argv, signal) {
     try {
       const module = await entry.load();
       const operations = await module.load();
-      products.push({ module, operations, context: contextSource(shell, module, signal) });
+      if (operations.length === 0 && !module.mcp && !ids?.includes(entry.id)) continue;
+      products.push({
+        module,
+        operations,
+        context: contextSource(shell, module, signal),
+        remint: remintFor(module, shell.store)
+      });
     } catch (err) {
       skip(entry.id, err);
     }
@@ -374,12 +848,24 @@ function guardStdout() {
 // src/commands/whoami.ts
 async function whoami(shell, argv) {
   if (wantsHelp(argv)) {
-    shell.io.err("Usage: magic whoami [--json]\n\nWho each product key belongs to.\n");
+    shell.io.err(
+      "Usage: magic whoami [--json]\n\nYour account, and your workspaces and keys in each product.\n"
+    );
     return 0;
   }
   rejectWorkspace("whoami", shell.opts);
   noMoreArgs("whoami", argv);
-  const result = { account: null, products: {} };
+  const grant = await readGrant(shell.store);
+  const result = {
+    account: grant ? {
+      user: grant.user ?? null,
+      grant_id: grant.grant_id,
+      expires_at: grant.expires_at,
+      idle_expires_at: grantIdleExpiry(grant),
+      account_url: grant.account_url
+    } : null,
+    products: {}
+  };
   let firstError;
   for (const product of await loadProducts(shell)) {
     const entry = await identify(shell, product);
@@ -389,36 +875,87 @@ async function whoami(shell, argv) {
   if (jsonMode(shell.opts, shell.io)) render(result, shell.opts, shell.io);
   else printHuman2(shell, result);
   if (firstError) return exitCodeFor(firstError.code);
-  if (Object.values(result.products).every((p) => p.source === "none")) {
-    if (!shell.opts.quiet) shell.io.err("No product keys. Run `magic login --product-key`.\n");
+  if (!result.account && Object.values(result.products).every((p) => p.source === "none")) {
+    if (!shell.opts.quiet) shell.io.err("Not logged in. Run `magic login`.\n");
     return exitCodeFor("not_logged_in");
   }
   return 0;
 }
 async function identify(shell, product) {
-  const source = shell.env[productEnvVar(product.id, "KEY")]?.trim() ? "env" : storeLabel(await shell.store.locate(manualItem(product.id)));
-  if (source === "none") return { identity: { source, key: null, identity: null } };
-  let key = null;
+  const id = product.id;
+  const sessions = await productSessions(shell.store, id);
+  const index = (await readIndex(shell.store))[id];
+  const envSet = Boolean(shell.env[productEnvVar(id, "KEY")]?.trim());
+  const manualAt = await shell.store.locate(manualItem(id));
+  const source = envSet ? "env" : sessions.length > 0 ? "account" : manualAt ? "manual" : "none";
+  const stored = source === "account" ? sessions[0].workspace.handle : null;
+  const base = {
+    source,
+    stored_in: source === "account" ? storeLabel(await shell.store.locate(sessionItem(id, stored))) : source === "manual" ? storeLabel(manualAt) : null,
+    key: null,
+    default: index?.default ?? null,
+    workspaces: workspaces(product, sessions, index?.workspaces ?? []),
+    identity: null
+  };
+  if (source === "none") return { identity: base };
+  let session;
+  const config = productConfig(product, shell);
+  try {
+    const workspace = config.defaultWorkspace[id];
+    session = await resolveCredential(product, {
+      env: shell.env,
+      store: shell.store,
+      ...workspace ? { workspace } : {}
+    });
+  } catch (err) {
+    const error = toMagicError(err, { product: id });
+    if (error.code === "usage") return { identity: base };
+    return { identity: { ...base, error: error.toJSON() }, error };
+  }
+  const identity = { ...base, key: maskKey(session.key, product.credential) };
   try {
-    const session = await resolveCredential(product, { env: shell.env, store: shell.store });
-    key = maskKey(session.key, product.credential);
-    const op = (await product.load()).find((o) => o.name === `${product.id}.whoami`);
-    if (!op) return { identity: { source, key, identity: null } };
-    const config = productConfig(product, shell);
-    const identity = await op.run(op.input.parse({}), contextFor(product, config, session));
-    return { identity: { source, key, identity } };
+    const op = (await product.load()).find((o) => o.name === `${id}.whoami`);
+    if (!op) return { identity };
+    const ctx = contextFor(product, config, session);
+    const who = await runWithRemint(op, op.input.parse({}), ctx, remintFor(product, shell.store));
+    return { identity: { ...identity, identity: who } };
   } catch (err) {
-    const error = toMagicError(err, { product: product.id });
-    return { identity: { source, key, identity: null, error: error.toJSON() }, error };
+    const error = toMagicError(err, { product: id });
+    return { identity: { ...identity, error: error.toJSON() }, error };
   }
 }
+function workspaces(product, sessions, listed) {
+  return listed.map((w) => {
+    const s = sessions.find((x) => x.workspace?.handle === w.handle);
+    return {
+      handle: w.handle,
+      name: w.name,
+      role: w.role,
+      key: s ? maskKey(s.key, product.credential) : null,
+      expires_at: s?.expires_at ?? null
+    };
+  });
+}
 function printHuman2(shell, result) {
   const lines = [];
+  const a = result.account;
+  if (a) {
+    lines.push(a.user ? `${a.user.display_name} <${a.user.email}>` : "Signed in");
+    lines.push(
+      `  signed in until ${day(a.expires_at)}; ends after ${day(a.idle_expires_at)} unused`
+    );
+  } else {
+    lines.push("Not signed in to a Magic Spells account.");
+  }
+  lines.push("");
   for (const [id, p] of Object.entries(result.products)) {
-    const rows = [
-      ["source", p.source],
-      ...p.key ? [["key", p.key]] : []
-    ];
+    const rows = [["source", p.source]];
+    if (p.key) rows.push(["key", p.key]);
+    for (const w of p.workspaces) {
+      const mark = w.handle === p.default ? " (default)" : "";
+      const expires = w.expires_at ? `, key expires ${w.expires_at}` : "";
+      rows.push([w.handle, `${w.name} \xB7 ${w.role}${w.key ? ` \xB7 ${w.key}` : ""}${mark}${expires}`]);
+    }
     if (p.identity && typeof p.identity === "object") {
       for (const [k, v] of Object.entries(p.identity)) rows.push([k, cell(v)]);
     }
@@ -428,13 +965,26 @@ function printHuman2(shell, result) {
   }
   shell.io.out(lines.join("\n"));
 }
+function day(iso) {
+  return iso.slice(0, 10);
+}
 
 // src/products.ts
 var PRODUCTS = [
   {
     id: "pyramid",
     title: "Pyramid \u2014 projects and tasks",
-    load: async () => (await import("./src-4S3XHPWY.js")).default
+    load: async () => (await import("./src-L2I546M7.js")).default
+  },
+  {
+    id: "sites",
+    title: "Sites \u2014 sign-in only until its commands arrive",
+    load: async () => (await import("./src-DJYPPJFM.js")).default
+  },
+  {
+    id: "marketing",
+    title: "Marketing \u2014 sign-in only until its commands arrive",
+    load: async () => (await import("./src-KJGFPRQP.js")).default
   }
 ];
 
@@ -484,10 +1034,10 @@ async function readAll(stream) {
 
 // src/main.ts
 var COMMANDS = {
-  login: { summary: "store a product key: login --product-key [<product>]", run: login },
-  logout: { summary: "forget stored keys: logout [--product <product>]", run: logout },
-  whoami: { summary: "who each product key belongs to", run: whoami },
-  doctor: { summary: "check the install, the keys and each product", run: doctor },
+  login: { summary: "sign in and mint product keys: login [--device] [--product <p>]", run: login },
+  logout: { summary: "revoke and forget credentials: logout [--product <p>]", run: logout },
+  whoami: { summary: "your account and your workspaces in each product", run: whoami },
+  doctor: { summary: "check the install, the sign-in and each product", run: doctor },
   mcp: { summary: "serve every product\u2019s tools over stdio: mcp [--products a,b]", run: serveMcp }
 };
 function help(products) {
@@ -544,7 +1094,11 @@ async function run(argv, deps = {}) {
       entries: products,
       opts,
       readConfig,
-      readSecret: deps.readSecret ?? readSecret
+      readSecret: deps.readSecret ?? readSecret,
+      openBrowser: deps.openBrowser ?? openBrowser,
+      confirm: deps.confirm !== void 0 ? deps.confirm : process.stdin.isTTY ? confirmOnTty : null,
+      platform: deps.platform ?? process.platform,
+      login: deps.login ?? {}
     };
     return await command.run(shell, parsed.rest);
   } catch (err) {