magic-spells 0.2.0 → 0.3.0

package/README.md

@@ -48,6 +48,7 @@ wins over a stored one; pasted keys are never re-minted.
 | `magic logout [--product <p>]` | revoke and forget credentials |
 | `magic whoami [--json]` | your account (name, email, sign-in expiry) and per product: key source (env, account, manual, none), workspaces, default, masked keys |
 | `magic doctor [--json]` | Node, credential store, Account and your sign-in, and per product: API reachable, key present, product checks |
+| `magic update [--check] [--json]` | update magic to the latest version: runs `npm install -g magic-spells@<latest>` for a global npm install; `--check` and `--json` only report |
 | `magic mcp [--products a,b]` | the MCP server over stdio: every product's tools, prefixed (`pyramid_*`) |
 | `magic pyramid <noun> <verb>` | Pyramid: `task next`, `task move WEB-42 --status "In Review"`, `task comment`, `project list`, `whoami`, … (`magic pyramid --help`) |
 
@@ -55,6 +56,11 @@ Global flags: `--json`, `--yes/-y`, `--no-color`, `--quiet/-q`, `--workspace <ha
 Output is JSON whenever stdout is not a terminal; errors go to stderr as
 `{ "error": { "code", "message", "hint", "product" } }`.
 
+Once a day `magic` asks the npm registry for the latest version in the background
+(cached under `updateCheck` in `config.json`) and, when a newer one exists, prints one
+line to stderr after the command. Never under `--json`, `--quiet`, `magic mcp` or when
+stdout or stderr is not a terminal.
+
 ## MCP
 
 ```sh
@@ -77,6 +83,7 @@ stored, without restarting the server. With several workspaces in a product, set
 | `MAGIC_ALLOW_DESTRUCTIVE=1` | allow destructive operations (with `--yes`, or `yes: true` in MCP) |
 | `MAGIC_CREDENTIALS_FILE=1` | store keys in the 0600 file instead of the OS keychain |
 | `XDG_CONFIG_HOME` | where `magic/` (config and credentials file) lives |
+| `MAGIC_NO_UPDATE_CHECK=1` | no update notice (also off under `CI`) |
 | `NO_COLOR` | no colour |
 
 ## Exit codes

package/dist/{chunk-JZ7XESF4.js → chunk-DVHFBLQP.js}

@@ -560,13 +560,16 @@ function matchCommand(cmds, argv) {
   }
   return void 0;
 }
+function defOf(schema) {
+  return schema?.def;
+}
 function baseType(schema) {
   let cur = schema;
   let optional = false;
   for (let guard = 0; guard < 12; guard++) {
-    const def = cur._def;
-    const name = def?.typeName;
-    if ((name === "ZodOptional" || name === "ZodNullable" || name === "ZodDefault") && def?.innerType) {
+    const def = defOf(cur);
+    const name = def?.type;
+    if ((name === "optional" || name === "nullable" || name === "default") && def?.innerType) {
       optional = true;
       cur = def.innerType;
       continue;
@@ -580,31 +583,27 @@ function describeFields(input) {
   if (!shape) return [];
   return Object.entries(shape).map(([key, raw]) => {
     const { type, optional } = baseType(raw);
-    const def = type._def;
+    const def = defOf(type);
     let kind = "string";
     let values;
-    switch (def?.typeName) {
-      case "ZodBoolean":
+    switch (def?.type) {
+      case "boolean":
         kind = "boolean";
         break;
-      case "ZodNumber":
+      case "number":
         kind = "number";
         break;
-      case "ZodArray": {
-        const el = def.type ? baseType(def.type).type : void 0;
-        const elName = el?._def?.typeName;
-        kind = elName === "ZodObject" ? "json" : "string[]";
+      case "array": {
+        const el = def.element ? baseType(def.element).type : void 0;
+        kind = defOf(el)?.type === "object" ? "json" : "string[]";
         break;
       }
-      case "ZodEnum":
-        kind = "enum";
-        if (Array.isArray(def.values)) values = def.values;
-        break;
-      case "ZodNativeEnum":
+      case "enum":
         kind = "enum";
+        if (def.entries) values = Object.values(def.entries).map(String);
         break;
-      case "ZodObject":
-      case "ZodRecord":
+      case "object":
+      case "record":
         kind = "json";
         break;
     }
@@ -1566,12 +1565,17 @@ async function startLoopback(opts) {
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
     const state = url.searchParams.get("state");
     if (done || exchanging || req.method !== "GET" || url.pathname !== "/callback") {
-      return reply(res, 400, "Bad request.");
+      return reply(res, 400, "Bad request", "Bad request.");
     }
-    if (!sameState(state, opts.state)) return reply(res, 400, "Bad request.");
+    if (!sameState(state, opts.state)) return reply(res, 400, "Bad request", "Bad request.");
     const error = url.searchParams.get("error");
     if (error) {
-      reply(res, 200, "Sign-in cancelled. You can close this tab and return to your terminal.");
+      reply(
+        res,
+        200,
+        "Sign-in cancelled",
+        "Sign-in cancelled. You can close this tab and return to your terminal."
+      );
       return finish({
         error: error === "access_denied" ? cancelledError() : new MagicError("auth_invalid", `Account refused the sign-in (${error}).`, {
           product: ACCOUNT_PRODUCT
@@ -1579,17 +1583,17 @@ async function startLoopback(opts) {
       });
     }
     const code = url.searchParams.get("code");
-    if (!code) return reply(res, 400, "Bad request.");
+    if (!code) return reply(res, 400, "Bad request", "Bad request.");
     exchanging = true;
     clearTimeout(timer);
     const signals = [AbortSignal.timeout(CODE_EXCHANGE_TIMEOUT_MS)];
     if (opts.signal) signals.push(opts.signal);
     try {
       const value = await opts.exchange(code, redirectUri, AbortSignal.any(signals));
-      reply(res, 200, "Signed in to Magic Spells. You can close this tab.");
+      reply(res, 200, "Signed in", "Signed in to Magic Spells. You can close this tab.");
       finish({ value });
     } catch (err) {
-      reply(res, 400, "Sign-in failed. Return to your terminal for details.");
+      reply(res, 400, "Sign-in failed", "Sign-in failed. Return to your terminal for details.");
       finish({ error: toMagicError(err, { product: ACCOUNT_PRODUCT }) });
     }
   };
@@ -1625,14 +1629,145 @@ function sameState(got, want) {
   const b = Buffer.from(want);
   return a.length === b.length && timingSafeEqual(a, b);
 }
-function reply(res, status, text) {
+function reply(res, status, heading, text) {
   res.writeHead(status, {
-    "content-type": "text/plain; charset=utf-8",
+    "content-type": "text/html; charset=utf-8",
     "cache-control": "no-store",
+    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
     connection: "close"
   });
-  res.end(`${text}
+  res.end(page(heading, text));
+}
+function page(heading, text) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Magic Spells</title>
+<style>
+:root { color-scheme: light dark; --bg: #ffffff; --fg: #111111; --muted: #555555; }
+@media (prefers-color-scheme: dark) { :root { --bg: #111111; --fg: #f2f2f2; --muted: #a0a0a0; } }
+html, body { height: 100%; margin: 0; }
+body { display: flex; align-items: center; justify-content: center; padding: 0 16px; background: var(--bg); color: var(--fg); font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; text-align: center; }
+h1 { margin: 0 0 8px; font-size: 1.5rem; font-weight: 600; }
+p { margin: 0; color: var(--muted); line-height: 1.5; }
+</style>
+</head>
+<body>
+<main>
+<h1>${heading}</h1>
+<p>${text}</p>
+</main>
+</body>
+</html>
+`;
+}
+
+// ../kit/src/update.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { get as httpGet } from "node:http";
+import { get as httpsGet } from "node:https";
+import { dirname as dirname2 } from "node:path";
+var UPDATE_REGISTRY_URL = "https://registry.npmjs.org/magic-spells/latest";
+var VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+function fetchLatestVersion(url, opts) {
+  return new Promise((resolve, reject) => {
+    const get = url.startsWith("https:") ? httpsGet : httpGet;
+    const req = get(url, { headers: { accept: "application/json" } }, (res) => {
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`The npm registry answered HTTP ${res.statusCode}.`));
+        return;
+      }
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => body += chunk);
+      res.on("error", reject);
+      res.on("end", () => {
+        let version;
+        try {
+          version = JSON.parse(body).version;
+        } catch {
+        }
+        if (typeof version === "string" && VERSION_PATTERN.test(version)) resolve(version);
+        else reject(new Error("The npm registry answered without a valid version."));
+      });
+    });
+    const timer = setTimeout(() => {
+      const err = Object.assign(new Error("The npm registry did not answer in time."), {
+        code: "ETIMEDOUT"
+      });
+      req.destroy(err);
+    }, opts.timeoutMs);
+    req.on("close", () => clearTimeout(timer));
+    req.on("error", reject);
+    if (opts.unref) {
+      timer.unref();
+      req.on("socket", (socket) => socket.unref());
+    }
+  });
+}
+function isNewer(latest, current) {
+  const parse = (v) => {
+    const [core = "", pre] = v.split("-", 2);
+    return [core.split(".").map(Number), pre !== void 0];
+  };
+  const [a, aPre] = parse(latest);
+  const [b, bPre] = parse(current);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);
+  }
+  return bPre && !aPre;
+}
+var WINDOWS_GLOBAL = /\\(npm|nodejs|nvm\\v[^\\]+|volta\\tools\\image\\packages\\magic-spells)\\node_modules\\magic-spells\\/i;
+function installMethod(binPath) {
+  if (/[/\\]_npx[/\\]/.test(binPath)) return "npx";
+  if (binPath.includes("/lib/node_modules/magic-spells/")) return "npm-global";
+  if (WINDOWS_GLOBAL.test(binPath)) return "npm-global";
+  return "other";
+}
+function readUpdateCheck(file) {
+  const c = file?.updateCheck;
+  if (!c || typeof c.checkedAt !== "string" || typeof c.latest !== "string") return null;
+  if (!VERSION_PATTERN.test(c.latest) || Number.isNaN(Date.parse(c.checkedAt))) return null;
+  return { checkedAt: c.checkedAt, latest: c.latest };
+}
+function updateCheckDue(check, now) {
+  return !check || now - Date.parse(check.checkedAt) >= UPDATE_CHECK_INTERVAL_MS;
+}
+function writeUpdateCheck(path, check) {
+  let text = null;
+  try {
+    text = readFileSync4(path, "utf8");
+  } catch {
+  }
+  let file = {};
+  if (text !== null) {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
+    file = parsed;
+  }
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify({ ...file, updateCheck: check }, null, 2)}
 `);
+  renameSync(tmp, path);
+}
+function updateNotice(current, latest) {
+  return isNewer(latest, current) ? `A newer magic is available: ${latest} (you have ${current}). Run \`magic update\`.` : null;
+}
+function registryError(err) {
+  const message = err instanceof Error ? err.message : "The npm registry could not be reached.";
+  return new MagicError("network", message, {
+    hint: "Check your connection, or run npm install -g magic-spells@latest."
+  });
 }
 
 // ../kit/src/mcp.ts
@@ -1753,18 +1888,18 @@ var TtlCache = class {
 };
 
 // ../kit/src/version.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readPackageVersion(moduleUrl) {
-  let dir = dirname2(fileURLToPath(moduleUrl));
+  let dir = dirname3(fileURLToPath(moduleUrl));
   for (let i = 0; i < 8; i++) {
     try {
-      const pkg = JSON.parse(readFileSync4(join4(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync5(join4(dir, "package.json"), "utf8"));
       if (typeof pkg.version === "string") return pkg.version;
     } catch {
     }
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1822,6 +1957,16 @@ export {
   runWithRemint,
   runDoctorChecks,
   startLoopback,
+  UPDATE_REGISTRY_URL,
+  VERSION_PATTERN,
+  fetchLatestVersion,
+  isNewer,
+  installMethod,
+  readUpdateCheck,
+  updateCheckDue,
+  writeUpdateCheck,
+  updateNotice,
+  registryError,
   runProductCli,
   createMcpServer,
   TtlCache,

package/dist/{chunk-PQFOO5A7.js → chunk-M2ECPY3Q.js}

@@ -4,7 +4,7 @@ import {
   readStr,
   rec,
   toMagicError
-} from "./chunk-JZ7XESF4.js";
+} from "./chunk-DVHFBLQP.js";
 
 // ../pyramid/src/operations/index.ts
 import { z } from "zod";

package/dist/main.js

@@ -2,6 +2,8 @@ import {
   AccountClient,
   GRANT_ITEM,
   MagicError,
+  UPDATE_REGISTRY_URL,
+  VERSION_PATTERN,
   authorizeUrl,
   buildContext,
   cell,
@@ -11,12 +13,15 @@ import {
   createMcpServer,
   createPkce,
   exitCodeFor,
+  fetchLatestVersion,
   forgetProductKey,
   forgetSessions,
   grantExpired,
   grantFromToken,
   grantIdleExpiry,
+  installMethod,
   isMagicError,
+  isNewer,
   jsonMode,
   loadCliConfig,
   manualItem,
@@ -34,7 +39,9 @@ import {
   readIndex,
   readPackageVersion,
   readStr,
+  readUpdateCheck,
   rec,
+  registryError,
   remintFor,
   render,
   renderError,
@@ -49,9 +56,12 @@ import {
   startLoopback,
   storeSessions,
   toMagicError,
+  updateCheckDue,
+  updateNotice,
   usage,
-  waitForDevice
-} from "./chunk-JZ7XESF4.js";
+  waitForDevice,
+  writeUpdateCheck
+} from "./chunk-DVHFBLQP.js";
 
 // src/browser.ts
 import { spawn } from "node:child_process";
@@ -821,8 +831,8 @@ async function serveMcp(shell, argv) {
   process.stdin.on("close", () => void shutdown("stdin closed"));
   process.stdin.on("end", () => void shutdown("stdin end"));
   await built.server.connect(transport);
-  const summary = built.products.map((p) => `${p.module.id} (${p.operations.length} tools)`);
-  err(`ready on stdio \xB7 ${summary.join(", ")}`);
+  const summary2 = built.products.map((p) => `${p.module.id} (${p.operations.length} tools)`);
+  err(`ready on stdio \xB7 ${summary2.join(", ")}`);
   for (const { module } of built.products) {
     try {
       await resolveCredential(module, { env: shell.env, store: shell.store });
@@ -845,6 +855,133 @@ function guardStdout() {
   console.debug = toErr;
 }
 
+// src/commands/update.ts
+import { spawn as spawn2 } from "node:child_process";
+import { realpathSync } from "node:fs";
+var LOOKUP_TIMEOUT_MS = 5e3;
+var BACKGROUND_TIMEOUT_MS = 2e3;
+var MANUAL = "npm install -g magic-spells@latest";
+async function update(shell, argv) {
+  if (wantsHelp(argv)) {
+    shell.io.err(
+      "Usage: magic update [--check] [--json]\n\nUpdate magic to the latest version; --check only reports.\n"
+    );
+    return 0;
+  }
+  const args = [...argv];
+  rejectWorkspace("update", shell.opts);
+  const check = takeSwitch(args, "check");
+  noMoreArgs("update", args);
+  const deps = shell.update;
+  let latest;
+  try {
+    latest = await fetchLatestVersion(deps.registryUrl ?? UPDATE_REGISTRY_URL, {
+      timeoutMs: LOOKUP_TIMEOUT_MS
+    });
+  } catch (err) {
+    throw registryError(err);
+  }
+  const binPath = deps.binPath ?? runningBin();
+  const current = version();
+  const report2 = {
+    current,
+    latest,
+    upToDate: !isNewer(latest, current),
+    method: installMethod(binPath)
+  };
+  if (check || shell.opts.json) {
+    if (jsonMode(shell.opts, shell.io)) render(report2, shell.opts, shell.io);
+    else shell.io.out(`${summary(report2)}
+`);
+    return 0;
+  }
+  if (report2.upToDate) {
+    shell.io.out(`${summary(report2)}
+`);
+    return 0;
+  }
+  if (report2.method === "npx") {
+    shell.io.out(
+      "You're running magic through npx, which already fetches the latest version; nothing to update.\n"
+    );
+    return 0;
+  }
+  if (report2.method === "other") {
+    shell.io.out(
+      `${summary(report2)}
+This magic runs from ${binPath}, not a global npm install. To install the latest globally:
+  ${MANUAL}
+`
+    );
+    return 0;
+  }
+  if (!VERSION_PATTERN.test(latest)) throw registryError(new Error("Invalid version."));
+  const spec = `magic-spells@${latest}`;
+  if (!shell.opts.quiet)
+    shell.io.err(`Updating magic ${current} \u2192 ${latest}: npm install -g ${spec}
+`);
+  const code = await (deps.npmInstall ?? npmInstall)(spec);
+  if (code !== 0) {
+    throw new MagicError("unknown", `npm install -g ${spec} failed (exit ${code}).`, {
+      hint: `Run ${MANUAL} yourself to see why.`
+    });
+  }
+  shell.io.out(`magic ${latest} installed.
+`);
+  return 0;
+}
+function summary(r) {
+  return r.upToDate ? `magic ${r.current} is the latest version.` : `magic ${r.latest} is available (you have ${r.current}).`;
+}
+function runningBin() {
+  const bin = process.argv[1] ?? "";
+  try {
+    return realpathSync(bin);
+  } catch {
+    return bin;
+  }
+}
+function npmInstall(spec) {
+  const win = process.platform === "win32";
+  return new Promise((resolve, reject) => {
+    const child = spawn2(win ? "npm.cmd" : "npm", ["install", "-g", spec], {
+      stdio: "inherit",
+      shell: win
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}
+var NO_NOTICE = /* @__PURE__ */ new Set(["update", "mcp"]);
+function startUpdateNotice(ctx) {
+  const has = (...flags) => flags.some((f) => ctx.argv.includes(f));
+  if (NO_NOTICE.has(ctx.cmd) || has("--json", "--quiet", "-q", "--help", "-h")) return noop;
+  if (!ctx.stderrIsTTY || !ctx.io.isTTY()) return noop;
+  const file = readConfigFile(ctx.configPath);
+  try {
+    if (!loadCliConfig({ products: [], env: ctx.env, file }).updateCheck) return noop;
+  } catch {
+    return noop;
+  }
+  const cached2 = readUpdateCheck(file);
+  const now = ctx.deps.now ?? Date.now;
+  if (updateCheckDue(cached2, now())) {
+    const done = fetchLatestVersion(ctx.deps.registryUrl ?? UPDATE_REGISTRY_URL, {
+      timeoutMs: BACKGROUND_TIMEOUT_MS,
+      unref: true
+    }).then((latest) => {
+      writeUpdateCheck(ctx.configPath, { checkedAt: new Date(now()).toISOString(), latest });
+    }).catch(() => {
+    });
+    ctx.deps.onBackgroundCheck?.(done);
+  }
+  const line = cached2 ? updateNotice(version(), cached2.latest) : null;
+  return line ? () => ctx.io.err(`${line}
+`) : noop;
+}
+function noop() {
+}
+
 // src/commands/whoami.ts
 async function whoami(shell, argv) {
   if (wantsHelp(argv)) {
@@ -974,12 +1111,12 @@ var PRODUCTS = [
   {
     id: "pyramid",
     title: "Pyramid \u2014 projects and tasks",
-    load: async () => (await import("./src-L2I546M7.js")).default
+    load: async () => (await import("./src-PD2ETWZD.js")).default
   },
   {
     id: "sites",
     title: "Sites \u2014 sign-in only until its commands arrive",
-    load: async () => (await import("./src-DJYPPJFM.js")).default
+    load: async () => (await import("./src-GSMZBKYC.js")).default
   },
   {
     id: "marketing",
@@ -1038,7 +1175,8 @@ var COMMANDS = {
   logout: { summary: "revoke and forget credentials: logout [--product <p>]", run: logout },
   whoami: { summary: "your account and your workspaces in each product", run: whoami },
   doctor: { summary: "check the install, the sign-in and each product", run: doctor },
-  mcp: { summary: "serve every product\u2019s tools over stdio: mcp [--products a,b]", run: serveMcp }
+  mcp: { summary: "serve every product\u2019s tools over stdio: mcp [--products a,b]", run: serveMcp },
+  update: { summary: "update magic to the latest version: update [--check]", run: update }
 };
 function help(products) {
   const lines = [
@@ -1075,34 +1213,51 @@ async function run(argv, deps = {}) {
     return 0;
   }
   const store = () => deps.store ?? createCredentialStore({ env });
-  const readConfig = () => readConfigFile(configFilePath({ env }));
-  const entry = products.find((p) => p.id === cmd);
-  if (entry) {
-    const product = await entry.load();
-    return runProductCli(product, rest, { io, env, store: store(), readConfig });
-  }
-  let opts = { json: argv.includes("--json"), yes: false, quiet: false };
-  try {
-    const command = COMMANDS[cmd];
-    if (!command) throw usage(`unknown command "${cmd}"`, "Run `magic --help` for usage.");
-    const parsed = parseGlobals(rest, [], env);
-    opts = parsed.opts;
-    const shell = {
-      io,
-      env,
-      store: store(),
-      entries: products,
-      opts,
-      readConfig,
-      readSecret: deps.readSecret ?? readSecret,
-      openBrowser: deps.openBrowser ?? openBrowser,
-      confirm: deps.confirm !== void 0 ? deps.confirm : process.stdin.isTTY ? confirmOnTty : null,
-      platform: deps.platform ?? process.platform,
-      login: deps.login ?? {}
-    };
-    return await command.run(shell, parsed.rest);
-  } catch (err) {
-    return renderError(toMagicError(err), opts, io);
+  const configPath = configFilePath({ env });
+  const readConfig = () => readConfigFile(configPath);
+  const updateDeps = deps.update ?? {};
+  const notice = startUpdateNotice({
+    cmd,
+    argv,
+    io,
+    env,
+    stderrIsTTY: deps.stderrIsTTY ?? process.stderr.isTTY === true,
+    configPath,
+    deps: updateDeps
+  });
+  const code = await dispatch();
+  notice();
+  return code;
+  async function dispatch() {
+    const entry = products.find((p) => p.id === cmd);
+    if (entry) {
+      const product = await entry.load();
+      return runProductCli(product, rest, { io, env, store: store(), readConfig });
+    }
+    let opts = { json: argv.includes("--json"), yes: false, quiet: false };
+    try {
+      const command = COMMANDS[cmd];
+      if (!command) throw usage(`unknown command "${cmd}"`, "Run `magic --help` for usage.");
+      const parsed = parseGlobals(rest, [], env);
+      opts = parsed.opts;
+      const shell = {
+        io,
+        env,
+        store: store(),
+        entries: products,
+        opts,
+        readConfig,
+        readSecret: deps.readSecret ?? readSecret,
+        openBrowser: deps.openBrowser ?? openBrowser,
+        confirm: deps.confirm !== void 0 ? deps.confirm : process.stdin.isTTY ? confirmOnTty : null,
+        platform: deps.platform ?? process.platform,
+        login: deps.login ?? {},
+        update: updateDeps
+      };
+      return await command.run(shell, parsed.rest);
+    } catch (err) {
+      return renderError(toMagicError(err), opts, io);
+    }
   }
 }
 export {

package/dist/{operations-GGMLIYEW.js → operations-V5BL44TP.js}

@@ -1,8 +1,8 @@
 import {
   operations,
   operationsByName
-} from "./chunk-PQFOO5A7.js";
-import "./chunk-JZ7XESF4.js";
+} from "./chunk-M2ECPY3Q.js";
+import "./chunk-DVHFBLQP.js";
 export {
   operations,
   operationsByName

package/dist/{src-DJYPPJFM.js → src-GSMZBKYC.js}

@@ -3,7 +3,7 @@ var sites = {
   id: "sites",
   title: "Sites",
   credential: "sites_",
-  apiUrl: "https://api.sites.magicspells.io",
+  apiUrl: "https://sites-api.magicspells.io",
   keyHelp: "Sites \u2192 Settings \u2192 Access keys",
   sessions: { path: "/v1/cli/sessions" },
   load: async () => [],

package/dist/{src-L2I546M7.js → src-PD2ETWZD.js}

@@ -3,13 +3,13 @@ import {
   operationsByName,
   pyramidError,
   toPyramidError
-} from "./chunk-PQFOO5A7.js";
+} from "./chunk-M2ECPY3Q.js";
 import {
   MagicError,
   TtlCache,
   readField,
   readStr
-} from "./chunk-JZ7XESF4.js";
+} from "./chunk-DVHFBLQP.js";
 
 // ../pyramid/src/cache/resolver.ts
 var TTL_MS = 6e4;
@@ -884,10 +884,10 @@ var PYRAMID_CREDENTIAL = {
   credential: "pyramid_",
   keyHelp: "Pyramid \u2192 Settings \u2192 API Keys"
 };
-var DEFAULT_API_URL = "https://api.pyramid.magicspells.io";
+var DEFAULT_API_URL = "https://pyramid.magicspells.io";
 
 // ../pyramid/src/doctor.ts
-var whoamiOp = async () => (await import("./operations-GGMLIYEW.js")).operationsByName.get("pyramid.whoami");
+var whoamiOp = async () => (await import("./operations-V5BL44TP.js")).operationsByName.get("pyramid.whoami");
 var doctorChecks = [
   {
     name: "pyramid auth",
@@ -1049,7 +1049,7 @@ var pyramid = {
   // `magic login` mints workspace keys here from the Account grant (API-PYRAMID-CLI-SESSIONS).
   sessions: { path: "/v1/cli/sessions" },
   // The operations graph loads only when a Pyramid command runs.
-  load: async () => (await import("./operations-GGMLIYEW.js")).operations,
+  load: async () => (await import("./operations-V5BL44TP.js")).operations,
   client(session, config) {
     const api = new PyramidClient({
       apiKey: session.key,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "magic-spells",
-	"version": "0.2.0",
+	"version": "0.3.0",
 	"description": "Magic CLI — one command line and MCP server for Magic Spells' hosted services.",
 	"license": "MIT",
 	"type": "module",
@@ -21,7 +21,7 @@
 	"dependencies": {
 		"@modelcontextprotocol/sdk": "^1.12.0",
 		"undici": "^6.19.0",
-		"zod": "^3.23.8"
+		"zod": "^4.6.7"
 	},
 	"scripts": {
 		"bundle": "node scripts/bundle.mjs",