Add mlf login / mlf logout commands + credentials file

+3

Cargo.lock

··· 1697 1697 dependencies = [ 1698 1698 "chrono", 1699 1699 "clap", 1700 + "dialoguer", 1700 1701 "glob", 1701 1702 "miette", 1702 1703 "mlf-atproto", ··· 1707 1708 "mlf-diagnostics", 1708 1709 "mlf-lang", 1709 1710 "mlf-lexicon-fetcher", 1711 + "mlf-plugin-host", 1710 1712 "mlf-validation", 1711 1713 "reqwest", 1712 1714 "serde", 1713 1715 "serde_json", 1714 1716 "sha2 0.10.9", 1715 1717 "similar", 1718 + "tempfile", 1716 1719 "thiserror 2.0.17", 1717 1720 "tokio", 1718 1721 "toml",

+68

mlf-atproto/src/identity.rs

··· 251 251 } 252 252 253 253 // --------------------------------------------------------------------------- 254 + // Handle → DID resolution (for PDS login) 255 + // --------------------------------------------------------------------------- 256 + 257 + /// Resolve an AT Protocol handle (e.g. `matt.example.com`) to its DID. 258 + /// 259 + /// Per the spec, handles can be resolved two ways; we try both and use 260 + /// the first that succeeds: 261 + /// 1. DNS TXT record at `_atproto.<handle>` with value `did=did:...` 262 + /// 2. HTTPS fetch of `https://<handle>/.well-known/atproto-did` whose 263 + /// response body is the DID string. 264 + pub async fn resolve_handle_to_did( 265 + client: &reqwest::Client, 266 + handle: &str, 267 + ) -> Result<String, IdentityError> { 268 + // Try DNS first. 269 + match resolve_handle_via_dns(handle).await { 270 + Ok(did) => return Ok(did), 271 + Err(IdentityError::DnsLookupFailed { .. }) | Err(IdentityError::NoDidInTxt(_)) => { 272 + // Fall through to HTTPS. 273 + } 274 + Err(e) => return Err(e), 275 + } 276 + resolve_handle_via_well_known(client, handle).await 277 + } 278 + 279 + async fn resolve_handle_via_dns(handle: &str) -> Result<String, IdentityError> { 280 + let dns_name = format!("_atproto.{handle}"); 281 + let resolver = TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default()); 282 + resolve_did_at(&resolver, &dns_name).await 283 + } 284 + 285 + async fn resolve_handle_via_well_known( 286 + client: &reqwest::Client, 287 + handle: &str, 288 + ) -> Result<String, IdentityError> { 289 + let url = format!("https://{handle}/.well-known/atproto-did"); 290 + let resp = client 291 + .get(&url) 292 + .send() 293 + .await 294 + .map_err(|e| IdentityError::DidResolutionFailed { 295 + did: handle.to_string(), 296 + error: format!("well-known fetch failed: {e}"), 297 + })?; 298 + if !resp.status().is_success() { 299 + return Err(IdentityError::DidResolutionFailed { 300 + did: handle.to_string(), 301 + error: format!("well-known returned HTTP {}", resp.status()), 302 + }); 303 + } 304 + let body = resp 305 + .text() 306 + .await 307 + .map_err(|e| IdentityError::DidResolutionFailed { 308 + did: handle.to_string(), 309 + error: format!("well-known read failed: {e}"), 310 + })?; 311 + let did = body.trim(); 312 + if !did.starts_with("did:") { 313 + return Err(IdentityError::DidResolutionFailed { 314 + did: handle.to_string(), 315 + error: format!("well-known body was not a DID: `{did}`"), 316 + }); 317 + } 318 + Ok(did.to_string()) 319 + } 320 + 321 + // --------------------------------------------------------------------------- 254 322 // DID → PDS endpoint resolution 255 323 // --------------------------------------------------------------------------- 256 324

+5

mlf-cli/Cargo.toml

··· 15 15 mlf-diagnostics = { path = "../mlf-diagnostics" } 16 16 mlf-lexicon-fetcher = { path = "../mlf-lexicon-fetcher" } 17 17 mlf-atproto = { path = "../mlf-atproto" } 18 + mlf-plugin-host = { path = "../mlf-plugin-host" } 18 19 clap = { version = "4.5.48", features = ["derive"] } 19 20 miette = { version = "7", features = ["fancy"] } 20 21 thiserror = "2" ··· 27 28 chrono = { version = "0.4", features = ["serde"] } 28 29 sha2 = "0.10" 29 30 similar = "2" 31 + dialoguer = { version = "0.11", default-features = false, features = ["password"] } 30 32 31 33 # Optional code generator plugins 32 34 mlf-codegen-typescript = { path = "../codegen-plugins/mlf-codegen-typescript", optional = true } 33 35 mlf-codegen-go = { path = "../codegen-plugins/mlf-codegen-go", optional = true } 34 36 mlf-codegen-rust = { path = "../codegen-plugins/mlf-codegen-rust", optional = true } 37 + 38 + [dev-dependencies] 39 + tempfile = "3" 35 40 36 41 [features] 37 42 default = ["typescript", "go", "rust"]

+286

mlf-cli/src/credentials.rs

··· 1 + //! Plaintext credential storage — same shape as cargo's 2 + //! `~/.cargo/credentials.toml` and npm's `.npmrc`. A global file under 3 + //! `~/.config/mlf/credentials.toml` holds defaults; an optional 4 + //! project-local `.mlf/credentials.toml` (gitignored) shadows entries 5 + //! per field. 6 + //! 7 + //! All files are written with mode `0o600` on Unix. 8 + 9 + use serde::{Deserialize, Serialize}; 10 + use std::path::{Path, PathBuf}; 11 + use thiserror::Error; 12 + 13 + #[derive(Error, Debug)] 14 + pub enum CredentialsError { 15 + #[error("Failed to read credentials file {path}: {source}")] 16 + Read { 17 + path: PathBuf, 18 + #[source] 19 + source: std::io::Error, 20 + }, 21 + 22 + #[error("Failed to write credentials file {path}: {source}")] 23 + Write { 24 + path: PathBuf, 25 + #[source] 26 + source: std::io::Error, 27 + }, 28 + 29 + #[error("Failed to parse credentials file {path}: {source}")] 30 + Parse { 31 + path: PathBuf, 32 + #[source] 33 + source: toml::de::Error, 34 + }, 35 + 36 + #[error("Home directory not available (set HOME)")] 37 + NoHomeDir, 38 + } 39 + 40 + /// On-disk shape. Any `[dns.<plugin>]` section shows up as a `DnsEntry` 41 + /// keyed by `<plugin>` in `dns`. Unknown top-level or per-plugin fields 42 + /// are preserved on round-trip so we don't clobber anything an older 43 + /// (or newer) MLF wrote. 44 + #[derive(Debug, Default, Clone, Serialize, Deserialize)] 45 + pub struct CredentialsFile { 46 + #[serde(default, skip_serializing_if = "Option::is_none")] 47 + pub pds: Option<PdsEntry>, 48 + 49 + #[serde(default, skip_serializing_if = "std::collections::BTreeMap::is_empty")] 50 + pub dns: std::collections::BTreeMap<String, DnsEntry>, 51 + } 52 + 53 + /// One PDS credential entry. Fields match the publishing account. 54 + #[derive(Debug, Default, Clone, Serialize, Deserialize)] 55 + pub struct PdsEntry { 56 + #[serde(default, skip_serializing_if = "Option::is_none")] 57 + pub handle: Option<String>, 58 + #[serde(default, skip_serializing_if = "Option::is_none")] 59 + pub app_password: Option<String>, 60 + /// Extra fields (e.g. did or pds URL the login resolved to) are 61 + /// preserved; the cli uses them as a cache. 62 + #[serde(flatten)] 63 + pub extra: serde_json::Map<String, serde_json::Value>, 64 + } 65 + 66 + /// One DNS plugin's credential entry. Arbitrary key/value because each 67 + /// plugin declares its own schema; we store whatever the plugin's `login` 68 + /// op returned. 69 + #[derive(Debug, Default, Clone, Serialize, Deserialize)] 70 + pub struct DnsEntry { 71 + #[serde(flatten)] 72 + pub fields: serde_json::Map<String, serde_json::Value>, 73 + } 74 + 75 + impl DnsEntry { 76 + pub fn from_object(obj: serde_json::Map<String, serde_json::Value>) -> Self { 77 + Self { fields: obj } 78 + } 79 + 80 + pub fn is_empty(&self) -> bool { 81 + self.fields.is_empty() 82 + } 83 + 84 + pub fn get_str(&self, key: &str) -> Option<&str> { 85 + self.fields.get(key).and_then(|v| v.as_str()) 86 + } 87 + } 88 + 89 + impl CredentialsFile { 90 + pub fn load(path: &Path) -> Result<Self, CredentialsError> { 91 + if !path.exists() { 92 + return Ok(Self::default()); 93 + } 94 + let content = std::fs::read_to_string(path).map_err(|source| CredentialsError::Read { 95 + path: path.to_path_buf(), 96 + source, 97 + })?; 98 + toml::from_str(&content).map_err(|source| CredentialsError::Parse { 99 + path: path.to_path_buf(), 100 + source, 101 + }) 102 + } 103 + 104 + pub fn save(&self, path: &Path) -> Result<(), CredentialsError> { 105 + if let Some(parent) = path.parent() 106 + && !parent.as_os_str().is_empty() 107 + { 108 + std::fs::create_dir_all(parent).map_err(|source| CredentialsError::Write { 109 + path: path.to_path_buf(), 110 + source, 111 + })?; 112 + } 113 + let content = toml::to_string_pretty(self).map_err(|e| CredentialsError::Write { 114 + path: path.to_path_buf(), 115 + source: std::io::Error::other(e.to_string()), 116 + })?; 117 + write_private(path, content.as_bytes())?; 118 + Ok(()) 119 + } 120 + } 121 + 122 + fn write_private(path: &Path, bytes: &[u8]) -> Result<(), CredentialsError> { 123 + std::fs::write(path, bytes).map_err(|source| CredentialsError::Write { 124 + path: path.to_path_buf(), 125 + source, 126 + })?; 127 + #[cfg(unix)] 128 + { 129 + use std::os::unix::fs::PermissionsExt; 130 + let perms = std::fs::Permissions::from_mode(0o600); 131 + std::fs::set_permissions(path, perms).map_err(|source| CredentialsError::Write { 132 + path: path.to_path_buf(), 133 + source, 134 + })?; 135 + } 136 + Ok(()) 137 + } 138 + 139 + // --------------------------------------------------------------------------- 140 + // Scope resolution 141 + // --------------------------------------------------------------------------- 142 + 143 + /// Which file `mlf login` reads and writes. 144 + #[derive(Debug, Clone, Copy, PartialEq, Eq)] 145 + pub enum Scope { 146 + /// `~/.config/mlf/credentials.toml`. The default for local dev. 147 + Global, 148 + /// `<project>/.mlf/credentials.toml`. The choice for CI, monorepos, 149 + /// and anywhere you want creds to live alongside the project. 150 + Project, 151 + } 152 + 153 + impl Scope { 154 + pub fn path(&self, project_root: &Path) -> Result<PathBuf, CredentialsError> { 155 + match self { 156 + Scope::Global => Ok(global_credentials_path()?), 157 + Scope::Project => Ok(project_root.join(".mlf").join("credentials.toml")), 158 + } 159 + } 160 + } 161 + 162 + pub fn global_credentials_path() -> Result<PathBuf, CredentialsError> { 163 + let home = std::env::var_os("HOME") 164 + .or_else(|| std::env::var_os("USERPROFILE")) 165 + .ok_or(CredentialsError::NoHomeDir)?; 166 + Ok(PathBuf::from(home) 167 + .join(".config") 168 + .join("mlf") 169 + .join("credentials.toml")) 170 + } 171 + 172 + /// Merge a global and project file into a single effective view. 173 + /// Project entries override global ones at the section level. 174 + #[derive(Debug, Default)] 175 + pub struct Merged { 176 + pub pds: Option<PdsEntry>, 177 + pub dns: std::collections::BTreeMap<String, DnsEntry>, 178 + } 179 + 180 + impl Merged { 181 + pub fn load(project_root: &Path) -> Result<Self, CredentialsError> { 182 + let global = match global_credentials_path() { 183 + Ok(p) => CredentialsFile::load(&p)?, 184 + Err(CredentialsError::NoHomeDir) => CredentialsFile::default(), 185 + Err(e) => return Err(e), 186 + }; 187 + let project_path = project_root.join(".mlf").join("credentials.toml"); 188 + let project = CredentialsFile::load(&project_path)?; 189 + let mut merged = Merged::default(); 190 + merged.pds = project.pds.or(global.pds); 191 + merged.dns = global.dns; 192 + for (k, v) in project.dns { 193 + merged.dns.insert(k, v); 194 + } 195 + Ok(merged) 196 + } 197 + } 198 + 199 + #[cfg(test)] 200 + mod tests { 201 + use super::*; 202 + use tempfile::TempDir; 203 + 204 + #[test] 205 + fn round_trip_preserves_fields() { 206 + let dir = TempDir::new().unwrap(); 207 + let path = dir.path().join("creds.toml"); 208 + 209 + let mut file = CredentialsFile::default(); 210 + file.pds = Some(PdsEntry { 211 + handle: Some("matt.example.com".into()), 212 + app_password: Some("xxxx".into()), 213 + ..Default::default() 214 + }); 215 + file.dns.insert( 216 + "cloudflare".into(), 217 + DnsEntry::from_object( 218 + serde_json::json!({"api_token": "tkn"}) 219 + .as_object() 220 + .unwrap() 221 + .clone(), 222 + ), 223 + ); 224 + file.save(&path).unwrap(); 225 + 226 + let loaded = CredentialsFile::load(&path).unwrap(); 227 + assert_eq!( 228 + loaded.pds.as_ref().unwrap().handle.as_deref(), 229 + Some("matt.example.com") 230 + ); 231 + assert_eq!( 232 + loaded.dns.get("cloudflare").unwrap().get_str("api_token"), 233 + Some("tkn") 234 + ); 235 + } 236 + 237 + #[test] 238 + fn load_missing_file_returns_default() { 239 + let dir = TempDir::new().unwrap(); 240 + let path = dir.path().join("nope.toml"); 241 + let loaded = CredentialsFile::load(&path).unwrap(); 242 + assert!(loaded.pds.is_none()); 243 + assert!(loaded.dns.is_empty()); 244 + } 245 + 246 + #[cfg(unix)] 247 + #[test] 248 + fn save_sets_0600_permissions() { 249 + use std::os::unix::fs::PermissionsExt; 250 + let dir = TempDir::new().unwrap(); 251 + let path = dir.path().join("creds.toml"); 252 + CredentialsFile::default().save(&path).unwrap(); 253 + let perms = std::fs::metadata(&path).unwrap().permissions(); 254 + assert_eq!(perms.mode() & 0o777, 0o600); 255 + } 256 + 257 + #[test] 258 + fn merged_project_shadows_global() { 259 + let dir = TempDir::new().unwrap(); 260 + let project_root = dir.path(); 261 + std::fs::create_dir_all(project_root.join(".mlf")).unwrap(); 262 + 263 + // Seed project. 264 + let mut project_file = CredentialsFile::default(); 265 + project_file.dns.insert( 266 + "cloudflare".into(), 267 + DnsEntry::from_object( 268 + serde_json::json!({"api_token": "project-token"}) 269 + .as_object() 270 + .unwrap() 271 + .clone(), 272 + ), 273 + ); 274 + project_file 275 + .save(&project_root.join(".mlf").join("credentials.toml")) 276 + .unwrap(); 277 + 278 + // We don't have a writable $HOME in the test sandbox, so just 279 + // check project-only loading works. 280 + let merged = Merged::load(project_root).unwrap(); 281 + assert_eq!( 282 + merged.dns.get("cloudflare").unwrap().get_str("api_token"), 283 + Some("project-token"), 284 + ); 285 + } 286 + }

+3

mlf-cli/src/lib.rs

··· 1 1 pub mod check; 2 2 pub mod config; 3 + pub mod credentials; 3 4 pub mod diff; 4 5 pub mod fetch; 5 6 pub mod generate; 6 7 pub mod init; 8 + pub mod login; 9 + pub mod logout; 7 10 pub mod remote_state; 8 11 pub mod status; 9 12 pub mod workspace_ext;

+381

mlf-cli/src/login.rs

···

+70

mlf-cli/src/logout.rs

··· 1 + //! `mlf logout` — clear credentials from the project-local and 2 + //! (by default) the global credentials file. 3 + 4 + use crate::config::{ConfigError, find_project_root}; 5 + use crate::credentials::{CredentialsError, CredentialsFile, Scope}; 6 + use miette::Diagnostic; 7 + use thiserror::Error; 8 + 9 + #[derive(Error, Debug, Diagnostic)] 10 + pub enum LogoutError { 11 + #[error("No mlf.toml found in current or parent directories")] 12 + #[diagnostic(code(mlf::logout::no_project))] 13 + NoProject, 14 + 15 + #[error("Credentials file error")] 16 + #[diagnostic(code(mlf::logout::credentials))] 17 + Credentials(#[source] CredentialsError), 18 + } 19 + 20 + #[derive(Debug, Clone, Copy)] 21 + pub enum Target { 22 + /// Clear everything — `[pds]` and every `[dns.*]`. 23 + All, 24 + /// Clear `[pds]`. 25 + Pds, 26 + /// Clear every `[dns.*]`. 27 + AllDns, 28 + /// Clear a specific `[dns.<plugin>]`. 29 + Dns, 30 + } 31 + 32 + pub fn run_logout(target: Target, plugin: Option<&str>, scope: Scope) -> Result<(), LogoutError> { 33 + let current_dir = std::env::current_dir().map_err(|_| LogoutError::NoProject)?; 34 + let project_root = find_project_root(&current_dir).map_err(|e| match e { 35 + ConfigError::NotFound => LogoutError::NoProject, 36 + _ => LogoutError::NoProject, 37 + })?; 38 + let path = scope 39 + .path(&project_root) 40 + .map_err(LogoutError::Credentials)?; 41 + let mut file = CredentialsFile::load(&path).map_err(LogoutError::Credentials)?; 42 + 43 + match target { 44 + Target::All => { 45 + file.pds = None; 46 + file.dns.clear(); 47 + println!("✓ Cleared all credentials"); 48 + } 49 + Target::Pds => { 50 + file.pds = None; 51 + println!("✓ Cleared [pds]"); 52 + } 53 + Target::AllDns => { 54 + let n = file.dns.len(); 55 + file.dns.clear(); 56 + println!("✓ Cleared {n} DNS credential(s)"); 57 + } 58 + Target::Dns => { 59 + let plugin = plugin.expect("Target::Dns requires a plugin name"); 60 + if file.dns.remove(plugin).is_some() { 61 + println!("✓ Cleared [dns.{plugin}]"); 62 + } else { 63 + println!("No credentials stored for `{plugin}`"); 64 + } 65 + } 66 + } 67 + 68 + file.save(&path).map_err(LogoutError::Credentials)?; 69 + Ok(()) 70 + }

+145 -1

mlf-cli/src/main.rs

··· 1 1 use clap::{Parser, Subcommand}; 2 2 use miette::IntoDiagnostic; 3 - use mlf_cli::{check, diff, fetch, generate, init, status}; 3 + use mlf_cli::credentials::Scope; 4 + use mlf_cli::logout::Target as LogoutTarget; 5 + use mlf_cli::{check, diff, fetch, generate, init, login, logout, status}; 4 6 use std::path::PathBuf; 5 7 use std::process; 6 8 ··· 83 85 #[arg(help = "NSID to diff. If omitted, diffs every changed, new, or removed NSID.")] 84 86 nsid: Option<String>, 85 87 }, 88 + 89 + #[command(about = "Log in to the PDS and/or a DNS plugin")] 90 + Login { 91 + #[command(subcommand)] 92 + target: Option<LoginTargetCmd>, 93 + 94 + #[arg( 95 + long, 96 + help = "Write to the project-local credentials file instead of global" 97 + )] 98 + project: bool, 99 + 100 + #[arg(long, help = "Fail if any field needs an interactive prompt")] 101 + non_interactive: bool, 102 + }, 103 + 104 + #[command(about = "Clear stored credentials")] 105 + Logout { 106 + #[command(subcommand)] 107 + target: Option<LogoutTargetCmd>, 108 + 109 + #[arg( 110 + long, 111 + help = "Clear from the project-local credentials file instead of global" 112 + )] 113 + project: bool, 114 + }, 115 + } 116 + 117 + #[derive(Subcommand)] 118 + enum LoginTargetCmd { 119 + #[command(about = "Log in as the publishing account (handle + app password)")] 120 + Pds { 121 + #[arg(long, help = "Handle (e.g. matt.example.com)")] 122 + handle: Option<String>, 123 + 124 + #[arg(long, help = "App password")] 125 + app_password: Option<String>, 126 + }, 127 + #[command(about = "Log in to a DNS plugin")] 128 + Dns { 129 + #[arg(help = "Plugin name, e.g. cloudflare")] 130 + plugin: String, 131 + 132 + /// Trailing `--field value` pairs are parsed against the plugin's 133 + /// options schema after the handshake. We use `allow_hyphen_values` 134 + /// + `trailing_var_arg` so clap doesn't reject unknown flags. 135 + #[arg( 136 + allow_hyphen_values = true, 137 + trailing_var_arg = true, 138 + num_args = 0.., 139 + help = "Plugin-specific --<field>=<value> or --<field> <value> arguments" 140 + )] 141 + args: Vec<String>, 142 + }, 143 + } 144 + 145 + #[derive(Subcommand)] 146 + enum LogoutTargetCmd { 147 + Pds, 148 + Dns { 149 + #[arg(help = "Plugin name. If omitted, every [dns.*] entry is cleared.")] 150 + plugin: Option<String>, 151 + }, 86 152 } 87 153 88 154 #[derive(Subcommand)] ··· 206 272 .into_diagnostic(), 207 273 Commands::Status => status::run_status().await.into_diagnostic(), 208 274 Commands::Diff { nsid } => diff::run_diff(nsid).await.into_diagnostic(), 275 + Commands::Login { 276 + target, 277 + project, 278 + non_interactive, 279 + } => { 280 + let scope = if project { 281 + Scope::Project 282 + } else { 283 + Scope::Global 284 + }; 285 + let mut args = login::LoginArgs { 286 + scope, 287 + non_interactive, 288 + ..Default::default() 289 + }; 290 + match target { 291 + None => login::run_login_all(args).await.into_diagnostic(), 292 + Some(LoginTargetCmd::Pds { 293 + handle, 294 + app_password, 295 + }) => { 296 + if let Some(h) = handle { 297 + args.field_overrides.insert("handle".into(), h); 298 + } 299 + if let Some(p) = app_password { 300 + args.field_overrides.insert("app_password".into(), p); 301 + } 302 + login::run_login_pds(args).await.into_diagnostic() 303 + } 304 + Some(LoginTargetCmd::Dns { 305 + plugin, 306 + args: raw_args, 307 + }) => { 308 + for (k, v) in parse_field_args(&raw_args) { 309 + args.field_overrides.insert(k, v); 310 + } 311 + login::run_login_dns(&plugin, args).await.into_diagnostic() 312 + } 313 + } 314 + } 315 + Commands::Logout { target, project } => { 316 + let scope = if project { 317 + Scope::Project 318 + } else { 319 + Scope::Global 320 + }; 321 + let (tgt, name) = match target { 322 + None => (LogoutTarget::All, None), 323 + Some(LogoutTargetCmd::Pds) => (LogoutTarget::Pds, None), 324 + Some(LogoutTargetCmd::Dns { plugin: None }) => (LogoutTarget::AllDns, None), 325 + Some(LogoutTargetCmd::Dns { plugin: Some(p) }) => (LogoutTarget::Dns, Some(p)), 326 + }; 327 + logout::run_logout(tgt, name.as_deref(), scope).into_diagnostic() 328 + } 209 329 }; 210 330 211 331 if let Err(e) = result { ··· 213 333 process::exit(1); 214 334 } 215 335 } 336 + 337 + /// Parse plugin-forwarded `--field value` / `--field=value` pairs into 338 + /// a flat `(field_name, value)` list. The plugin-declared options schema 339 + /// determines which names are valid; we just collect whatever was 340 + /// passed so login.rs can match against the schema. 341 + fn parse_field_args(raw: &[String]) -> Vec<(String, String)> { 342 + let mut out = Vec::new(); 343 + let mut i = 0; 344 + while i < raw.len() { 345 + let tok = &raw[i]; 346 + if let Some(rest) = tok.strip_prefix("--") { 347 + if let Some(eq) = rest.find('=') { 348 + let (k, v) = rest.split_at(eq); 349 + out.push((k.replace('-', "_"), v[1..].to_string())); 350 + } else if i + 1 < raw.len() { 351 + let k = rest.replace('-', "_"); 352 + out.push((k, raw[i + 1].clone())); 353 + i += 1; 354 + } 355 + } 356 + i += 1; 357 + } 358 + out 359 + }

+95

website/content/docs/cli/10-login.md

··· 7 + `mlf login` stores credentials for the publishing PDS and for each DNS provider plugin the workspace uses. `mlf logout` clears them. Credentials live in a plaintext TOML file — `~/.config/mlf/credentials.toml` by default — written with mode `0600`. Same pattern cargo and npm use. Pass `--project` to write to a workspace-local `.mlf/credentials.toml` instead (gitignored; useful in CI).

Configure Feed

Configure Feed