@dinoxx/dinox-cli 1.0.14 → 1.0.15

package/dist/auth/userInfo.d.ts

@@ -8,6 +8,7 @@ export type AuthIdentity = {
 export declare function fetchUserInfoWithAuthorization(input: {
     authorization: string;
     config: ResolvedDinoxConfig;
+    timeoutMs?: number;
     signal?: AbortSignal;
 }): Promise<AuthIdentity>;
 export declare function refreshAndPersistAuthIdentity(rawConfig: DinoxConfig, resolvedConfig: ResolvedDinoxConfig): Promise<AuthIdentity>;

package/dist/auth/userInfo.js

@@ -1,5 +1,7 @@
 import { saveConfig } from '../config/store.js';
 import { DinoxError } from '../utils/errors.js';
+import { createTimeoutSignal, mergeAbortSignals } from '../utils/abort.js';
+import { toAuthorizationHeaderValue } from '../utils/authToken.js';
 const AUTH_CODE_OK = '000000';
 function normalizeOptionalString(value) {
     if (typeof value !== 'string') {
@@ -59,17 +61,34 @@ function resolveUserInfoEndpoint(config) {
 export async function fetchUserInfoWithAuthorization(input) {
     const authorization = normalizeOptionalString(input.authorization);
     if (!authorization) {
-        throw new DinoxError('Authorization is required for user info');
+        throw new DinoxError('Token is required for user info');
     }
     const endpoint = resolveUserInfoEndpoint(input.config);
-    const response = await fetch(endpoint, {
-        method: 'GET',
-        headers: {
-            Authorization: authorization,
-            'Content-Type': 'application/json',
-        },
-        signal: input.signal,
-    });
+    const effectiveTimeoutMs = input.timeoutMs ?? input.config.sync.timeoutMs;
+    const timeout = typeof effectiveTimeoutMs === 'number' && Number.isFinite(effectiveTimeoutMs) && effectiveTimeoutMs > 0
+        ? createTimeoutSignal(effectiveTimeoutMs)
+        : null;
+    const requestSignal = mergeAbortSignals([input.signal, timeout?.signal]);
+    let response;
+    try {
+        response = await fetch(endpoint, {
+            method: 'GET',
+            headers: {
+                Authorization: toAuthorizationHeaderValue(authorization),
+                'Content-Type': 'application/json',
+            },
+            signal: requestSignal,
+        });
+    }
+    catch (error) {
+        if (timeout?.signal.aborted && !input.signal?.aborted) {
+            throw new DinoxError(`User info request timed out after ${effectiveTimeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        timeout?.cancel();
+    }
     if (!response.ok) {
         const body = await response.text().catch(() => '');
         throw new DinoxError(`User info request failed (${response.status}): ${body || endpoint}`);
@@ -80,7 +99,7 @@ export async function fetchUserInfoWithAuthorization(input) {
 export async function refreshAndPersistAuthIdentity(rawConfig, resolvedConfig) {
     const authorization = normalizeOptionalString(resolvedConfig.auth.authorization);
     if (!authorization) {
-        throw new DinoxError('Authorization is required to fetch user info');
+        throw new DinoxError('Token is required to fetch user info');
     }
     const identity = await fetchUserInfoWithAuthorization({
         authorization,

package/dist/commands/auth/index.js

@@ -5,20 +5,12 @@ import { getPowerSyncDbPath } from '../../config/paths.js';
 import { redactAuthorization } from '../../utils/redact.js';
 import { DinoxError } from '../../utils/errors.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
+import { normalizeAuthToken } from '../../utils/authToken.js';
 import { refreshAndPersistAuthIdentity } from '../../auth/userInfo.js';
 import { connectPowerSync, getStatusSnapshot } from '../../powersync/runtime.js';
 import { fetchCredentialsWithAuthorization } from '../../powersync/connector.js';
 import { runSingleSyncPass } from '../../powersync/syncPass.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 async function removeSqliteArtifacts(dbPath) {
     const artifacts = ['', '-wal', '-shm'];
     for (const suffix of artifacts) {
@@ -31,15 +23,15 @@ export function registerAuthCommands(program) {
         .description('Authentication and PowerSync connectivity commands');
     auth
         .command('login')
-        .description('Save authorization token and verify PowerSync connectivity')
-        .argument('<authorization>', 'full Authorization header value (e.g. "Bearer <token>")')
-        .action(async (authorization, _options, command) => {
-        const auth = authorization?.trim();
-        if (!auth) {
-            throw new DinoxError('Authorization token is required');
+        .description('Save login token and verify PowerSync connectivity')
+        .argument('<token>', 'login token (pass the raw token string, without Bearer prefix)')
+        .action(async (token, _options, command) => {
+        const rawToken = normalizeAuthToken(token);
+        if (!rawToken) {
+            throw new DinoxError('Token is required');
         }
         const config = await loadConfig();
-        config.auth = { ...(config.auth ?? {}), authorization: auth };
+        config.auth = { ...(config.auth ?? {}), authorization: rawToken };
         await saveConfig(config);
         const resolved = resolveConfig(config);
         const globals = command.optsWithGlobals?.() ?? {};
@@ -47,9 +39,10 @@ export function registerAuthCommands(program) {
         const jsonOutput = Boolean(globals.json);
         // 1) Token exchange sanity check.
         await fetchCredentialsWithAuthorization({
-            authorization: auth,
+            authorization: rawToken,
             endpoint: resolved.powersync.endpoint,
             credentialsUrl: resolved.powersync.tokenEndpoint,
+            timeoutMs,
         });
         // 1.5) Fetch and persist user identity.
         const identity = await refreshAndPersistAuthIdentity(config, resolved);
@@ -93,12 +86,16 @@ export function registerAuthCommands(program) {
     });
     auth
         .command('logout')
-        .description('Clear saved authorization token')
+        .description('Clear saved login token')
         .option('--clear-local-db', 'delete the local PowerSync SQLite database')
         .action(async (options) => {
         const config = await loadConfig();
         if (config.auth) {
             config.auth.authorization = undefined;
+            config.auth.userId = undefined;
+            config.auth.username = undefined;
+            config.auth.email = undefined;
+            config.auth.userInfoSyncedAt = undefined;
         }
         await saveConfig(config);
         if (options.clearLocalDb) {

package/dist/commands/boxes/index.js

@@ -2,20 +2,11 @@ import { loadConfig } from '../../config/store.js';
 import { resolveConfig } from '../../config/resolve.js';
 import { DinoxError } from '../../utils/errors.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { syncNoteTokenIndex } from '../../powersync/tokenIndex.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { addBox, listBoxes } from './repo.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 async function syncBeforeBoxCommand(db, offline, timeoutMs) {
     if (offline) {
         return;

package/dist/commands/notes/index.d.ts

@@ -1,2 +1,41 @@
 import { Command } from 'commander';
+import { type SearchedNote } from './repo.js';
+type NoteSearchResponse = {
+    meta: {
+        query: string;
+        returned_count: number;
+        total_count: number;
+        stale: boolean;
+        applied_filters: {
+            include_deleted: boolean;
+            tags_expression: string | null;
+            created_at_range: {
+                from: string | null;
+                to: string | null;
+            } | null;
+            days: number | null;
+            box_names: string[];
+            box_ids: string[];
+            match_empty_boxes: boolean;
+            sql_expression: string | null;
+        };
+    };
+    notes: SearchedNote[];
+};
+type BuildNoteSearchResponseInput = {
+    query: string;
+    notes: SearchedNote[];
+    stale: boolean;
+    includeDeleted: boolean;
+    tagsExpression?: string;
+    createdAtFrom?: string;
+    createdAtTo?: string;
+    days?: number;
+    boxNames: string[];
+    boxIds: string[];
+    matchEmptyBoxes: boolean;
+    sqlExpression?: string;
+};
+export declare function buildNoteSearchResponse(input: BuildNoteSearchResponseInput): NoteSearchResponse;
 export declare function registerNoteCommands(program: Command): void;
+export {};

package/dist/commands/notes/index.js

@@ -5,21 +5,12 @@ import { readStringOrFile } from '../../utils/argValue.js';
 import { generateId } from '../../utils/id.js';
 import { convertMarkdownToNoteContent } from '../../utils/tiptapMarkdown.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { syncNoteTokenIndex } from '../../powersync/tokenIndex.js';
 import { createNote, getNote, getNoteDetails, assertNotesUpdatable, resolveZettelBoxIdsForCreate, resolveZettelBoxIdsForSearch, resolveZettelBoxIdsForUpdate, searchNotes, softDeleteNote, updateNote, validateTagsForCreate, validateTagsForUpdate, } from './repo.js';
 import { parseCreatedAtRange } from './searchTime.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 function parseNoteType(value) {
     const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
     if (normalized === 'note' || normalized === 'crawl') {
@@ -105,6 +96,50 @@ async function syncBeforeNoteCommand(db, offline, timeoutMs) {
     await waitForIdleDataFlow(db, Math.min(timeoutMs, 10_000));
     await syncNoteTokenIndex(db);
 }
+function normalizeDaysForMeta(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (!/^\d+$/.test(trimmed)) {
+        return undefined;
+    }
+    const parsed = Number(trimmed);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return undefined;
+    }
+    return Math.trunc(parsed);
+}
+export function buildNoteSearchResponse(input) {
+    const query = input.query.trim();
+    const tagsExpression = input.tagsExpression?.trim() ?? '';
+    const sqlExpression = input.sqlExpression?.trim() ?? '';
+    const hasCreatedAtRange = Boolean(input.createdAtFrom || input.createdAtTo);
+    return {
+        meta: {
+            query,
+            returned_count: input.notes.length,
+            total_count: input.notes.length,
+            stale: input.stale,
+            applied_filters: {
+                include_deleted: input.includeDeleted,
+                tags_expression: tagsExpression || null,
+                created_at_range: hasCreatedAtRange
+                    ? {
+                        from: input.createdAtFrom ?? null,
+                        to: input.createdAtTo ?? null,
+                    }
+                    : null,
+                days: input.days ?? null,
+                box_names: [...input.boxNames],
+                box_ids: [...input.boxIds],
+                match_empty_boxes: input.matchEmptyBoxes,
+                sql_expression: sqlExpression || null,
+            },
+        },
+        notes: input.notes,
+    };
+}
 export function registerNoteCommands(program) {
     const note = program.command('note').description('Manage notes');
     note
@@ -123,7 +158,7 @@ export function registerNoteCommands(program) {
         const offline = Boolean(globals.offline);
         const config = resolveConfig(await loadConfig());
         const timeoutMs = parseSyncTimeoutMs(globals.syncTimeout) ?? config.sync.timeoutMs;
-        const { db } = await connectPowerSync({ config, offline, timeoutMs });
+        const { db, stale } = await connectPowerSync({ config, offline, timeoutMs });
         try {
             await syncBeforeNoteCommand(db, offline, timeoutMs);
             const keyword = query?.trim() ?? '';
@@ -148,7 +183,21 @@ export function registerNoteCommands(program) {
                 matchEmptyZettelBoxes: parsedBoxInput.isExplicitEmptyArray,
                 sqlExpression: sqlExpression || undefined,
             });
-            printYaml(rows);
+            const response = buildNoteSearchResponse({
+                query: keyword,
+                notes: rows,
+                stale: offline ? true : stale,
+                includeDeleted: Boolean(options.includeDeleted),
+                tagsExpression: tagsExpression || undefined,
+                createdAtFrom,
+                createdAtTo,
+                days: normalizeDaysForMeta(options.days),
+                boxNames: parsedBoxInput.values,
+                boxIds: zettelBoxIds,
+                matchEmptyBoxes: parsedBoxInput.isExplicitEmptyArray,
+                sqlExpression: sqlExpression || undefined,
+            });
+            printYaml(response);
         }
         finally {
             await db.close().catch(() => undefined);

package/dist/commands/prompt/index.js

@@ -2,20 +2,11 @@ import { loadConfig } from '../../config/store.js';
 import { resolveConfig } from '../../config/resolve.js';
 import { DinoxError } from '../../utils/errors.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { syncNoteTokenIndex } from '../../powersync/tokenIndex.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { addPrompt, listPrompts } from './repo.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 async function syncBeforePromptCommand(db, offline, timeoutMs) {
     if (offline) {
         return;

package/dist/commands/sync.js

@@ -1,19 +1,9 @@
 import { loadConfig } from '../config/store.js';
 import { resolveConfig } from '../config/resolve.js';
-import { DinoxError } from '../utils/errors.js';
 import { printYaml } from '../utils/output.js';
+import { parseSyncTimeoutMs } from '../utils/syncTimeout.js';
 import { connectPowerSync, getStatusSnapshot } from '../powersync/runtime.js';
 import { runSingleSyncPass } from '../powersync/syncPass.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 export function registerSyncCommand(program) {
     program
         .command('sync')

package/dist/commands/tags/index.js

@@ -2,20 +2,11 @@ import { loadConfig } from '../../config/store.js';
 import { resolveConfig } from '../../config/resolve.js';
 import { DinoxError } from '../../utils/errors.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { syncNoteTokenIndex } from '../../powersync/tokenIndex.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { addTag, listTags } from './repo.js';
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 async function syncBeforeTagCommand(db, offline, timeoutMs) {
     if (offline) {
         return;

package/dist/commands/todo/index.js

@@ -3,6 +3,7 @@ import { resolveConfig } from '../../config/resolve.js';
 import { DinoxError } from '../../utils/errors.js';
 import { readStringOrFile } from '../../utils/argValue.js';
 import { printYaml } from '../../utils/output.js';
+import { parseSyncTimeoutMs } from '../../utils/syncTimeout.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { appendTodoTasks, createTodoNote, normalizeTaskTexts, searchTodoTasks, updateTodoTaskStatus, } from './repo.js';
@@ -12,16 +13,6 @@ const DEFAULT_TASK_LIMIT = 50;
 const DEFAULT_NOTE_SCAN_LIMIT = 200;
 const MAX_TASK_LIMIT = 500;
 const MAX_NOTE_SCAN_LIMIT = 5000;
-function parseSyncTimeoutMs(value) {
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = Number(value);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        throw new DinoxError('--sync-timeout must be a positive integer');
-    }
-    return Math.trunc(parsed);
-}
 function parseTaskStatus(value) {
     const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
     if (normalized === 'all' || normalized === 'completed' || normalized === 'uncompleted') {

package/dist/config/resolve.js

@@ -1,4 +1,5 @@
 import { POWERSYNC_DEFAULT_ENDPOINT, POWERSYNC_DEFAULT_TOKEN_ENDPOINT, POWERSYNC_DEFAULT_UPLOAD_BASE_URL, } from './serviceEndpoints.js';
+import { normalizeAuthToken } from '../utils/authToken.js';
 const DEFAULT_UPLOAD_V4_PATH = '/powersync/v4/uploadData';
 const DEFAULT_UPLOAD_V2_PATH = '/powersync/v2/uploadData';
 const DEFAULT_SYNC_TIMEOUT_MS = 300_000;
@@ -20,7 +21,7 @@ function parsePositiveInt(value) {
     return Math.trunc(parsed);
 }
 export function resolveConfig(raw) {
-    const fileAuth = nonEmptyString(raw.auth?.authorization);
+    const fileAuth = normalizeAuthToken(raw.auth?.authorization);
     const fileUserId = nonEmptyString(raw.auth?.userId);
     const fileUsername = nonEmptyString(raw.auth?.username ?? undefined) ?? raw.auth?.username ?? undefined;
     const fileEmail = nonEmptyString(raw.auth?.email ?? undefined) ?? raw.auth?.email ?? undefined;
@@ -29,7 +30,7 @@ export function resolveConfig(raw) {
     const fileUploadV4Path = nonEmptyString(raw.powersync?.uploadV4Path);
     const fileUploadV2Path = nonEmptyString(raw.powersync?.uploadV2Path);
     const fileTimeoutMs = parsePositiveInt(raw.sync?.timeoutMs);
-    const envAuth = nonEmptyString(process.env.DINOX_AUTHORIZATION);
+    const envAuth = normalizeAuthToken(process.env.DINOX_AUTHORIZATION);
     const envTokenEndpoint = nonEmptyString(process.env.DINOX_POWERSYNC_TOKEN_ENDPOINT) ?? nonEmptyString(process.env.POWERSYNC_TOKEN_ENDPOINT);
     const envUploadV4Path = nonEmptyString(process.env.DINOX_POWERSYNC_UPLOAD_V4_PATH);
     const envUploadV2Path = nonEmptyString(process.env.DINOX_POWERSYNC_UPLOAD_V2_PATH);

package/dist/config/store.js

@@ -2,9 +2,24 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { getConfigDir, getConfigFilePath } from './paths.js';
 import { generateId } from '../utils/id.js';
+import { DinoxError } from '../utils/errors.js';
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+const FORBIDDEN_KEY_PATH_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+function splitKeyPath(keyPath) {
+    const segments = keyPath
+        .split('.')
+        .map(segment => segment.trim())
+        .filter(Boolean);
+    for (const segment of segments) {
+        const normalized = segment.toLowerCase();
+        if (FORBIDDEN_KEY_PATH_SEGMENTS.has(normalized)) {
+            throw new DinoxError(`Invalid config key path: ${keyPath}`);
+        }
+    }
+    return segments;
+}
 async function ensureConfigDir() {
     const dir = getConfigDir();
     await fs.mkdir(dir, { recursive: true, mode: 0o700 });
@@ -47,7 +62,7 @@ export async function saveConfig(config) {
     await fs.rename(tmpPath, filePath);
 }
 function setDeepValue(target, keyPath, value) {
-    const segments = keyPath.split('.').filter(Boolean);
+    const segments = splitKeyPath(keyPath);
     if (segments.length === 0) {
         return;
     }
@@ -63,7 +78,7 @@ function setDeepValue(target, keyPath, value) {
     cursor[segments[segments.length - 1]] = value;
 }
 function getDeepValue(target, keyPath) {
-    const segments = keyPath.split('.').filter(Boolean);
+    const segments = splitKeyPath(keyPath);
     let cursor = target;
     for (const segment of segments) {
         if (!isPlainObject(cursor)) {

package/dist/config/types.d.ts

@@ -1,8 +1,7 @@
 export type DinoxConfig = {
     auth?: {
         /**
-         * Full Authorization header value.
-         * Example: "Bearer <token>".
+         * Login token string (pass the raw token string; do not include a Bearer prefix).
          */
         authorization?: string;
         /**

package/dist/powersync/connector.d.ts

@@ -13,9 +13,10 @@ export declare class PowerSyncConnector implements PowerSyncBackendConnector {
     fetchCredentials(): Promise<PowerSyncCredentials>;
     uploadData(database: AbstractPowerSyncDatabase): Promise<void>;
 }
-export declare function fetchCredentialsWithAuthorization({ authorization, endpoint, credentialsUrl, signal, }: {
+export declare function fetchCredentialsWithAuthorization({ authorization, endpoint, credentialsUrl, timeoutMs, signal, }: {
     authorization: string;
     endpoint: string;
     credentialsUrl: string;
+    timeoutMs?: number;
     signal?: AbortSignal;
 }): Promise<PowerSyncCredentials>;

package/dist/powersync/connector.js

@@ -1,3 +1,5 @@
+import { createTimeoutSignal, mergeAbortSignals } from '../utils/abort.js';
+import { toAuthorizationHeaderValue } from '../utils/authToken.js';
 /**
  * Connector that fetches PowerSync credentials from your backend.
  * This is injectable for testability.
@@ -23,7 +25,7 @@ export class PowerSyncConnector {
         await this.uploader(database);
     }
 }
-export async function fetchCredentialsWithAuthorization({ authorization, endpoint, credentialsUrl, signal, }) {
+export async function fetchCredentialsWithAuthorization({ authorization, endpoint, credentialsUrl, timeoutMs, signal, }) {
     if (!authorization) {
         throw new Error('PowerSync credential exchange requires an authorization token');
     }
@@ -33,14 +35,30 @@ export async function fetchCredentialsWithAuthorization({ authorization, endpoin
     if (!credentialsUrl) {
         throw new Error('PowerSync credential exchange requires a token endpoint');
     }
-    const response = await fetch(credentialsUrl, {
-        method: 'GET',
-        headers: {
-            Authorization: authorization,
-            'Content-Type': 'application/json',
-        },
-        signal,
-    });
+    const timeout = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0
+        ? createTimeoutSignal(timeoutMs)
+        : null;
+    const requestSignal = mergeAbortSignals([signal, timeout?.signal]);
+    let response;
+    try {
+        response = await fetch(credentialsUrl, {
+            method: 'GET',
+            headers: {
+                Authorization: toAuthorizationHeaderValue(authorization),
+                'Content-Type': 'application/json',
+            },
+            signal: requestSignal,
+        });
+    }
+    catch (error) {
+        if (timeout?.signal.aborted && !signal?.aborted) {
+            throw new Error(`PowerSync credential exchange timed out after ${timeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        timeout?.cancel();
+    }
     if (!response.ok) {
         const errorText = await response.text().catch(() => '');
         throw new Error(`Received ${response.status} from ${credentialsUrl}: ${errorText}`);

package/dist/powersync/runtime.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import { PowerSyncDatabase } from '@powersync/node';
 import { getDataDir, getPowerSyncDbPath } from '../config/paths.js';
 import { DinoxError } from '../utils/errors.js';
+import { createTimeoutSignal } from '../utils/abort.js';
 import { AppSchema } from './schema/index.js';
 import { PowerSyncConnector, fetchCredentialsWithAuthorization } from './connector.js';
 import { createPowerSyncUploadHandler } from './uploader.js';
@@ -10,14 +11,6 @@ async function ensureDataDir() {
     await fs.mkdir(dir, { recursive: true, mode: 0o700 });
     return dir;
 }
-function createTimeoutSignal(timeoutMs) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    return {
-        signal: controller.signal,
-        cancel: () => clearTimeout(timer),
-    };
-}
 export function getStatusSnapshot(db) {
     const raw = db.currentStatus?.toJSON?.() ?? {};
     const lastSyncedAt = raw.lastSyncedAt instanceof Date ? raw.lastSyncedAt.toISOString() : raw.lastSyncedAt ?? null;
@@ -55,7 +48,7 @@ export async function openPowerSyncDatabase() {
 }
 function assertConfigured(config) {
     if (!config.auth.authorization) {
-        throw new DinoxError('Not logged in. Run: dino auth login <authorization>');
+        throw new DinoxError('Not logged in. Run: dino auth login <token>');
     }
 }
 export async function connectPowerSync(args) {
@@ -70,6 +63,7 @@ export async function connectPowerSync(args) {
             uploadBaseUrl: args.config.powersync.uploadBaseUrl,
             uploadV4Path: args.config.powersync.uploadV4Path,
             uploadV2Path: args.config.powersync.uploadV2Path,
+            timeoutMs: args.timeoutMs,
         })
         : undefined;
     const connector = new PowerSyncConnector(async () => {
@@ -77,6 +71,7 @@ export async function connectPowerSync(args) {
             authorization: args.config.auth.authorization,
             endpoint: args.config.powersync.endpoint,
             credentialsUrl: args.config.powersync.tokenEndpoint,
+            timeoutMs: args.timeoutMs,
         });
     }, uploader);
     await db.connect(connector);

package/dist/powersync/uploader.d.ts

@@ -4,4 +4,5 @@ export declare function createPowerSyncUploadHandler(options: {
     uploadBaseUrl: string;
     uploadV4Path: string;
     uploadV2Path: string;
+    timeoutMs?: number;
 }): UploadHandler;

package/dist/powersync/uploader.js

@@ -1,4 +1,6 @@
 import { UpdateType } from '@powersync/common';
+import { createTimeoutSignal, mergeAbortSignals } from '../utils/abort.js';
+import { toAuthorizationHeaderValue } from '../utils/authToken.js';
 const FATAL_RESPONSE_CODES = [/^22...$/, /^23...$/, /^42501$/];
 function shouldFallbackToLegacy(status) {
     return status === 404 || status === 405;
@@ -45,14 +47,34 @@ function isFatalUploadError(error) {
     return typeof code === 'string' && FATAL_RESPONSE_CODES.some(regex => regex.test(code));
 }
 async function dispatchMutation(options) {
-    const response = await fetch(options.url, {
-        method: options.method,
-        headers: {
-            Authorization: options.authorization,
-            'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(options.payload),
-    });
+    const timeout = typeof options.timeoutMs === 'number' && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
+        ? createTimeoutSignal(options.timeoutMs)
+        : null;
+    const requestSignal = mergeAbortSignals([options.signal, timeout?.signal]);
+    let response;
+    try {
+        response = await fetch(options.url, {
+            method: options.method,
+            headers: {
+                Authorization: toAuthorizationHeaderValue(options.authorization),
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(options.payload),
+            signal: requestSignal,
+        });
+    }
+    catch (error) {
+        if (timeout?.signal.aborted && !options.signal?.aborted) {
+            const err = new Error(`PowerSync upload timed out (${options.method} ${options.url}) after ${options.timeoutMs}ms`);
+            err.name = 'PowerSyncUploadError';
+            err.status = 408;
+            throw err;
+        }
+        throw error;
+    }
+    finally {
+        timeout?.cancel();
+    }
     if (response.ok) {
         return;
     }
@@ -75,11 +97,11 @@ async function uploadTransaction(args) {
         switch (op.op) {
             case UpdateType.PUT:
                 try {
-                    await dispatchMutation({ authorization: args.authorization, url: primaryUrl, method: 'PUT', payload: record });
+                    await dispatchMutation({ authorization: args.authorization, url: primaryUrl, method: 'PUT', payload: record, timeoutMs: args.timeoutMs });
                 }
                 catch (error) {
                     if (shouldFallbackToLegacy(error?.status)) {
-                        await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'PUT', payload: record });
+                        await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'PUT', payload: record, timeoutMs: args.timeoutMs });
                     }
                     else {
                         throw error;
@@ -88,11 +110,11 @@ async function uploadTransaction(args) {
                 break;
             case UpdateType.PATCH:
                 try {
-                    await dispatchMutation({ authorization: args.authorization, url: primaryUrl, method: 'PATCH', payload: record });
+                    await dispatchMutation({ authorization: args.authorization, url: primaryUrl, method: 'PATCH', payload: record, timeoutMs: args.timeoutMs });
                 }
                 catch (error) {
                     if (shouldFallbackToLegacy(error?.status)) {
-                        await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'PATCH', payload: record });
+                        await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'PATCH', payload: record, timeoutMs: args.timeoutMs });
                     }
                     else {
                         throw error;
@@ -100,7 +122,7 @@ async function uploadTransaction(args) {
                 }
                 break;
             case UpdateType.DELETE:
-                await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'DELETE', payload: record });
+                await dispatchMutation({ authorization: args.authorization, url: fallbackUrl, method: 'DELETE', payload: record, timeoutMs: args.timeoutMs });
                 break;
             default:
                 break;
@@ -120,6 +142,7 @@ export function createPowerSyncUploadHandler(options) {
                 uploadBaseUrl: options.uploadBaseUrl,
                 uploadV4Path: options.uploadV4Path,
                 uploadV2Path: options.uploadV2Path,
+                timeoutMs: options.timeoutMs,
             });
             await transaction.complete();
         }

package/dist/utils/abort.d.ts

@@ -0,0 +1,6 @@
+export type TimeoutSignal = {
+    signal: AbortSignal;
+    cancel: () => void;
+};
+export declare function createTimeoutSignal(timeoutMs: number): TimeoutSignal;
+export declare function mergeAbortSignals(signals: Array<AbortSignal | undefined>): AbortSignal | undefined;

package/dist/utils/abort.js

@@ -0,0 +1,23 @@
+export function createTimeoutSignal(timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    // Best-effort: don't keep the process alive solely for the timeout.
+    if (typeof timer.unref === 'function') {
+        timer.unref();
+    }
+    return {
+        signal: controller.signal,
+        cancel: () => clearTimeout(timer),
+    };
+}
+export function mergeAbortSignals(signals) {
+    const filtered = signals.filter(Boolean);
+    if (filtered.length === 0) {
+        return undefined;
+    }
+    if (filtered.length === 1) {
+        return filtered[0];
+    }
+    // Node.js 20+ supports AbortSignal.any().
+    return AbortSignal.any(filtered);
+}

package/dist/utils/authToken.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeAuthToken(value: unknown): string | undefined;
+export declare function toAuthorizationHeaderValue(token: string): string;

package/dist/utils/authToken.js

@@ -0,0 +1,23 @@
+export function normalizeAuthToken(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    if (trimmed.toLowerCase().startsWith('bearer ')) {
+        const withoutPrefix = trimmed.slice('bearer '.length).trim();
+        return withoutPrefix || undefined;
+    }
+    return trimmed;
+}
+export function toAuthorizationHeaderValue(token) {
+    // Backend expects a standard Authorization header. Be defensive: callers may pass
+    // a full "Bearer ..." header value or a raw token.
+    const normalized = normalizeAuthToken(token);
+    if (!normalized) {
+        throw new Error('Missing auth token');
+    }
+    return `Bearer ${normalized}`;
+}

package/dist/utils/syncTimeout.d.ts

@@ -0,0 +1 @@
+export declare function parseSyncTimeoutMs(value: unknown): number | undefined;

package/dist/utils/syncTimeout.js

@@ -0,0 +1,19 @@
+import { DinoxError } from './errors.js';
+export function parseSyncTimeoutMs(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    const text = typeof value === 'string' ? value.trim() : typeof value === 'number' ? String(value) : '';
+    if (!text) {
+        return undefined;
+    }
+    // Commander options are typically strings; be strict and fail fast for non-integers.
+    if (!/^\d+$/.test(text)) {
+        throw new DinoxError('--sync-timeout must be a positive integer');
+    }
+    const parsed = Number(text);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+        throw new DinoxError('--sync-timeout must be a positive integer');
+    }
+    return parsed;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dinoxx/dinox-cli",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Dinox CLI",
   "main": "dist/dinox.js",
   "scripts": {