@lotargo/memory_plugin 1.6.7 → 1.6.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/CHANGELOG.md +154 -129
  2. package/README.md +611 -586
  3. package/mcp-server/admin/auth.js +675 -645
  4. package/mcp-server/ingest/normalizer.js +1 -1
  5. package/package.json +33 -17
  6. package/mcp-server/benchmarks/fetch_real_corpus.js +0 -351
  7. package/mcp-server/benchmarks/gpu_profile_benchmark.js +0 -170
  8. package/mcp-server/benchmarks/policy_dominance_test.js +0 -221
  9. package/mcp-server/benchmarks/quality_evaluator.js +0 -598
  10. package/mcp-server/benchmarks/raw_corpus_data.js +0 -613
  11. package/mcp-server/benchmarks/run_benchmarks.js +0 -366
  12. package/mcp-server/benchmarks/stress_ingestion.js +0 -195
  13. package/mcp-server/benchmarks/table_code_retrieval.js +0 -453
  14. package/mcp-server/benchmarks/test_dual_layer.js +0 -141
package/mcp-server/admin/auth.js CHANGED
@@ -1,645 +1,675 @@
1
- import http from "node:http";
2
- import crypto from "node:crypto";
3
- import { spawn } from "node:child_process";
4
- import { saveSecrets, deleteSecrets, loadSecrets, resolveEnvSecrets, getSecretsSource, invalidateAuthCache, onSecretsChanged } from "../config/auth_store.js";
5
- import { getConfig, updateConfig } from "../config/config_manager.js";
6
-
7
- // Register callback so resolveCloudSecrets() cache is cleared when secrets change
8
- onSecretsChanged(() => { _cachedResolvedSecrets = undefined; _cachedResolvedAt = 0; });
9
-
10
- export const TURSO_API_BASE = () => process.env.TURSO_API_BASE || "https://api.turso.tech";
11
-
12
- function openBrowser(url) {
13
- const platform = process.platform;
14
- try {
15
- if (platform === "win32") {
16
- spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
17
- } else if (platform === "darwin") {
18
- spawn("open", [url], { stdio: "ignore", detached: true }).unref();
19
- } else {
20
- spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
21
- }
22
- } catch (err) {
23
- // Browser auto-open is best-effort; the printed URL can be opened manually.
24
- }
25
- }
26
-
27
- // Starts a temporary loopback HTTP server to receive the OAuth callback.
28
- // Turso redirects the browser back to the root path: /?jwt=<JWT>&username=<USERNAME>
29
- // `expectedState` protects against OAuth CSRF: the callback is only accepted
30
- // when it echoes the random `state` value that was embedded in the login URL.
31
- export function startAuthLoopbackServer(port = 48900, expectedState = null) {
32
- return new Promise((resolve, reject) => {
33
- const server = http.createServer((req, res) => {
34
- const url = new URL(req.url, `http://${req.headers.host}`);
35
- const token = url.searchParams.get("jwt") || url.searchParams.get("token");
36
- const username = url.searchParams.get("username");
37
- const error = url.searchParams.get("error");
38
- const receivedState = url.searchParams.get("state");
39
-
40
- if (token) {
41
- if (expectedState && receivedState !== expectedState) {
42
- res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
43
- res.end("Invalid state parameter");
44
- server.close(() => reject(new Error("OAuth callback rejected: state parameter mismatch (possible CSRF attempt).")));
45
- return;
46
- }
47
- res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
48
- res.end(`
49
- <!DOCTYPE html>
50
- <html lang="en">
51
- <head>
52
- <meta charset="utf-8" />
53
- <meta name="viewport" content="width=device-width, initial-scale=1" />
54
- <title>Authorization Successful</title>
55
- <style>
56
- * { margin: 0; padding: 0; box-sizing: border-box; }
57
- body {
58
- min-height: 100vh;
59
- display: flex;
60
- align-items: center;
61
- justify-content: center;
62
- font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
63
- -webkit-font-smoothing: antialiased;
64
- background: radial-gradient(1200px 600px at 50% -10%, #1c2028 0%, #101218 55%, #0c0e13 100%);
65
- color: #e8ebf2;
66
- padding: 24px;
67
- }
68
- .card {
69
- max-width: 420px;
70
- width: 100%;
71
- background: #161a21;
72
- border: 1px solid rgba(255, 255, 255, 0.07);
73
- border-radius: 20px;
74
- padding: 46px 38px;
75
- text-align: center;
76
- box-shadow: 0 24px 70px rgba(0, 0, 0, 0.45);
77
- }
78
- .badge {
79
- width: 76px;
80
- height: 76px;
81
- margin: 0 auto 26px;
82
- border-radius: 50%;
83
- display: flex;
84
- align-items: center;
85
- justify-content: center;
86
- background: rgba(94, 224, 154, 0.10);
87
- border: 1px solid rgba(94, 224, 154, 0.28);
88
- }
89
- .badge svg { width: 36px; height: 36px; }
90
- h1 { font-size: 22px; font-weight: 600; letter-spacing: 0.2px; color: #f2f4f8; margin-bottom: 12px; }
91
- p { font-size: 14px; line-height: 1.65; color: #9aa3b2; }
92
- .hint { margin-top: 24px; font-size: 12.5px; color: #6f7887; }
93
- </style>
94
- </head>
95
- <body>
96
- <div class="card">
97
- <div class="badge">
98
- <svg viewBox="0 0 24 24" fill="none" stroke="#5ee09a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
99
- <path d="M20 6 9 17l-5-5" />
100
- </svg>
101
- </div>
102
- <h1>Authorization successful</h1>
103
- <p>Your credentials were received and stored securely on this device.</p>
104
- <div class="hint">You can now close this tab and return to the terminal.</div>
105
- </div>
106
- </body>
107
- </html>
108
- `);
109
-
110
- server.close(() => {
111
- resolve({ token, username: username || "" });
112
- });
113
- } else if (error) {
114
- res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
115
- res.end(`
116
- <!DOCTYPE html>
117
- <html lang="en">
118
- <head>
119
- <meta charset="utf-8" />
120
- <meta name="viewport" content="width=device-width, initial-scale=1" />
121
- <title>Authorization Failed</title>
122
- <style>
123
- * { margin: 0; padding: 0; box-sizing: border-box; }
124
- body {
125
- min-height: 100vh;
126
- display: flex;
127
- align-items: center;
128
- justify-content: center;
129
- font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
130
- -webkit-font-smoothing: antialiased;
131
- background: radial-gradient(1200px 600px at 50% -10%, #1c2028 0%, #101218 55%, #0c0e13 100%);
132
- color: #e8ebf2;
133
- padding: 24px;
134
- }
135
- .card {
136
- max-width: 400px;
137
- width: 100%;
138
- background: #161a21;
139
- border: 1px solid rgba(255, 255, 255, 0.07);
140
- border-radius: 20px;
141
- padding: 40px 34px;
142
- text-align: center;
143
- box-shadow: 0 24px 70px rgba(0, 0, 0, 0.45);
144
- }
145
- h1 { font-size: 20px; font-weight: 600; color: #f2f4f8; margin-bottom: 12px; }
146
- p { font-size: 14px; line-height: 1.65; color: #9aa3b2; }
147
- </style>
148
- </head>
149
- <body>
150
- <div class="card">
151
- <h1>Authorization failed</h1>
152
- <p>An error occurred during the login flow. Close this tab, return to the terminal, and try again.</p>
153
- </div>
154
- </body>
155
- </html>
156
- `);
157
- server.close(() => reject(new Error(`Authentication error: ${error}`)));
158
- } else {
159
- res.writeHead(404, { "Content-Type": "text/plain" });
160
- res.end("Not Found");
161
- }
162
- });
163
-
164
- server.on("error", (err) => {
165
- reject(err);
166
- });
167
-
168
- server.listen(port, "127.0.0.1", () => {
169
- console.log(`\n [*] Waiting for authorization on local port http://localhost:${port}/...`);
170
- });
171
- });
172
- }
173
-
174
- async function apiRequest(token, pathname, { method = "GET", body } = {}) {
175
- const res = await fetch(`${TURSO_API_BASE()}${pathname}`, {
176
- method,
177
- headers: {
178
- Authorization: `Bearer ${token}`,
179
- "Content-Type": "application/json",
180
- Accept: "application/json",
181
- },
182
- body: body ? JSON.stringify(body) : undefined,
183
- });
184
-
185
- const text = await res.text();
186
- let data = null;
187
- try {
188
- data = JSON.parse(text);
189
- } catch {}
190
-
191
- if (!res.ok) {
192
- const err = new Error(data?.error || `Turso API ${res.status}: ${text}`);
193
- err.status = res.status;
194
- throw err;
195
- }
196
- return data;
197
- }
198
-
199
- // Validate the account JWT obtained from OAuth and return current-user info.
200
- export async function validateTursoToken(token) {
201
- return apiRequest(token, "/v1/current-user");
202
- }
203
-
204
- export async function listOrganizations(token) {
205
- const data = await apiRequest(token, "/v1/organizations");
206
- const orgs = data?.organizations || [];
207
- return orgs.map((o) => ({
208
- slug: o.slug || o.Slug || o.id || o.Id || null,
209
- name: o.name || o.Name || null,
210
- id: o.id || o.Id || null,
211
- }));
212
- }
213
-
214
- export async function listDatabases(token, org) {
215
- const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`);
216
- const dbs = data?.databases || [];
217
- return dbs.map((d) => ({
218
- name: d.name || d.Name,
219
- hostname: d.hostname || d.Hostname,
220
- id: d.id || d.Id,
221
- }));
222
- }
223
-
224
- export async function createDatabase(token, org, name) {
225
- try {
226
- const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`, {
227
- method: "POST",
228
- body: { name },
229
- });
230
- const d = data?.database || data;
231
- return { name: d.name || d.Name, hostname: d.hostname || d.Hostname, id: d.id || d.Id };
232
- } catch (err) {
233
- // Fresh accounts have no default group; create one, then retry.
234
- if (!String(err.message || "").toLowerCase().includes("group")) {
235
- throw err;
236
- }
237
- console.log(` [CLOUD] No group found. Creating group "default"...`);
238
- await createGroup(token, org, "default");
239
- const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`, {
240
- method: "POST",
241
- body: { name, group: "default" },
242
- });
243
- const d = data?.database || data;
244
- return { name: d.name || d.Name, hostname: d.hostname || d.Hostname, id: d.id || d.Id };
245
- }
246
- }
247
-
248
- // Turso's public closest-region endpoint (no auth required).
249
- // Returns e.g. { server: "aws-eu-west-1", client: "ams" }.
250
- async function getClosestLocation() {
251
- if (process.env.TURSO_LOCATION) return process.env.TURSO_LOCATION;
252
- const fallback = "ams";
253
- try {
254
- const res = await fetch("https://region.turso.io/", { signal: AbortSignal.timeout(8000) });
255
- const data = await res.json().catch(() => null);
256
- const loc = data?.server || data?.client || null;
257
- if (loc && /^[a-z0-9-]+$/i.test(loc)) return loc;
258
- } catch {
259
- // ignore
260
- }
261
- return fallback;
262
- }
263
-
264
- export async function createGroup(token, org, name) {
265
- // Always provide an explicit location: Turso's internal auto-lookup fails
266
- // with "invalid location: Host not found" when the group has no location.
267
- const location = await getClosestLocation();
268
- const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/groups`, {
269
- method: "POST",
270
- body: { name, location },
271
- });
272
- return data?.group || data;
273
- }
274
-
275
- export async function createDatabaseToken(token, org, db, { expiration = "never", authorization = "full-access" } = {}) {
276
- const data = await apiRequest(
277
- token,
278
- `/v1/organizations/${encodeURIComponent(org)}/databases/${encodeURIComponent(db)}/auth/tokens?expiration=${encodeURIComponent(expiration)}&authorization=${encodeURIComponent(authorization)}`,
279
- { method: "POST", body: {} }
280
- );
281
- return data?.jwt || null;
282
- }
283
-
284
- function dbHostname(org, dbName) {
285
- return `${dbName}-${org}.turso.io`;
286
- }
287
-
288
- // Shared post-auth resolution: validate happens in the caller. Steps:
289
- // 1. Resolve an organization (explicit, first available, or username fallback).
290
- // 2. Pick or create a database.
291
- // 3. Mint a full-access token for that database.
292
- // 4. Persist the encrypted token + dbUrl and mark the session as authorized.
293
- async function finalizeCloudLogin({ token, username, org = null, databaseName = null, autoCreate = true, persist = true, apiToken = null }) {
294
- const accountUsername = username || "user";
295
-
296
- // Step 1: resolve organization + database namespace
297
- const orgs = await listOrganizations(token);
298
- let orgSlug;
299
- let orgName;
300
- if (orgs && orgs.length > 0) {
301
- const requested = org ? orgs.find((o) => (o.slug || o.name || o.id) === org) : null;
302
- const chosen = requested || orgs[0];
303
- orgSlug = chosen.slug || chosen.name || chosen.id || String(chosen);
304
- orgName = chosen.name || orgSlug;
305
- } else {
306
- // Personal accounts are not listed in /v1/organizations, but their own
307
- // username acts as the organization namespace in the Platform API.
308
- orgSlug = accountUsername;
309
- orgName = accountUsername;
310
- console.log(` [CLOUD] No organizations found. Using personal account "${orgSlug}" as the database namespace.`);
311
- }
312
-
313
- const dbs = await listDatabases(token, orgSlug);
314
- if (dbs.length > 0) {
315
- console.log(`\n [CLOUD] Databases in organization "${orgName}":`);
316
- dbs.forEach((d, i) => console.log(` ${i + 1}. ${d.name}`));
317
- }
318
-
319
- let dbName = databaseName;
320
- if (!dbName) {
321
- if (dbs.length > 0) {
322
- dbName = dbs[0].name;
323
- console.log(`\n [CLOUD] Using existing database: "${dbName}"`);
324
- } else if (autoCreate) {
325
- dbName = `memory-${accountUsername}`;
326
- console.log(`\n [CLOUD] No database found. Creating "${dbName}"...`);
327
- await createDatabase(token, orgSlug, dbName);
328
- console.log(` [OK] Database "${dbName}" created.`);
329
- } else {
330
- throw new Error("No databases found and autoCreate is disabled.");
331
- }
332
- }
333
-
334
- // Step 2: mint a full-access token for the database
335
- console.log(" [CLOUD] Issuing database access token...");
336
- const dbJwt = await createDatabaseToken(token, orgSlug, dbName);
337
- if (!dbJwt) {
338
- throw new Error("Failed to create database auth token.");
339
- }
340
-
341
- const dbUrl = `libsql://${dbHostname(orgSlug, dbName)}`;
342
-
343
- // Step 3: persist secrets and mark authorized
344
- if (persist) {
345
- saveSecrets({
346
- token: dbJwt,
347
- dbUrl,
348
- username: accountUsername,
349
- org: orgSlug,
350
- db: dbName,
351
- authorized: true,
352
- ...(apiToken ? { apiToken } : {}),
353
- });
354
- }
355
- updateConfig({ tursoUrl: dbUrl, authorized: true, username: accountUsername });
356
-
357
- return {
358
- token: dbJwt,
359
- dbUrl,
360
- username: accountUsername,
361
- org: orgSlug,
362
- db: dbName,
363
- authorized: true,
364
- ...(apiToken ? { apiToken } : {}),
365
- };
366
- }
367
-
368
- // Perform the full cloud login flow:
369
- // 1. OAuth browser flow against Turso (api.turso.tech).
370
- // 2. Validate the received account JWT.
371
- // 3. Resolve an organization and pick/create a database.
372
- // 4. Mint a full-access token for that database.
373
- // 5. Persist the encrypted token + dbUrl and mark the session as authorized.
374
- export async function loginToCloud({
375
- customPort = 48900,
376
- simulated = false,
377
- simulatedParams = null,
378
- autoCreate = true,
379
- databaseName = null,
380
- org = null,
381
- } = {}) {
382
- const state = crypto.randomBytes(16).toString("hex");
383
- const loginUrl = `${TURSO_API_BASE()}/?port=${customPort}&redirect=true&state=${state}&type=cli`;
384
-
385
- console.log(`\n [CLOUD] Please open your system browser to authorize:`);
386
- console.log(` \x1b[36m${loginUrl}\x1b[0m\n`);
387
-
388
- let received;
389
- if (simulated && simulatedParams) {
390
- received = await new Promise((resolve, reject) => {
391
- const serverPromise = startAuthLoopbackServer(customPort, state);
392
- const req = http.request(
393
- `http://127.0.0.1:${customPort}/?jwt=${encodeURIComponent(simulatedParams.jwt)}&username=${encodeURIComponent(simulatedParams.username)}&state=${encodeURIComponent(state)}`,
394
- { method: "GET" },
395
- (res) => {
396
- res.resume();
397
- }
398
- );
399
- req.on("error", (e) => reject(e));
400
- req.end();
401
- serverPromise.then(resolve).catch(reject);
402
- });
403
- } else {
404
- openBrowser(loginUrl);
405
- received = await startAuthLoopbackServer(customPort, state);
406
- }
407
-
408
- const { token, username } = received;
409
-
410
- // Step 2: validate the account token
411
- let userInfo = null;
412
- try {
413
- userInfo = await validateTursoToken(token);
414
- } catch (err) {
415
- throw new Error(`Token validation failed: ${err.message}`);
416
- }
417
- const accountUsername = username || userInfo?.username || userInfo?.name || "user";
418
- console.log(` [OK] Token is valid. User: ${accountUsername}`);
419
-
420
- const secrets = await finalizeCloudLogin({ token, username: accountUsername, org, databaseName, autoCreate });
421
-
422
- console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${secrets.dbUrl}\x1b[0m`);
423
- return secrets;
424
- }
425
-
426
- // Headless login with a Turso account API token (no browser, no loopback).
427
- // Create one at https://console.turso.tech or via `turso auth api-tokens create`.
428
- // The same Platform API is used to resolve the organization + database and to
429
- // mint a per-database token, exactly like the browser flow.
430
- export async function loginWithApiToken({
431
- token,
432
- org = null,
433
- databaseName = null,
434
- autoCreate = true,
435
- username = null,
436
- persist = true,
437
- } = {}) {
438
- if (!token) throw new Error("An account API token is required.");
439
- console.log("\n [CLOUD] Validating account API token...");
440
- let userInfo = null;
441
- try {
442
- userInfo = await validateTursoToken(token);
443
- } catch (err) {
444
- throw new Error(`Token validation failed: ${err.message}`);
445
- }
446
- const accountUsername = username || userInfo?.username || userInfo?.name || "user";
447
- console.log(` [OK] API token is valid. User: ${accountUsername}`);
448
-
449
- const secrets = await finalizeCloudLogin({
450
- token,
451
- username: accountUsername,
452
- org,
453
- databaseName,
454
- autoCreate,
455
- persist,
456
- apiToken: persist ? token : null,
457
- });
458
-
459
- console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${secrets.dbUrl}\x1b[0m`);
460
- return secrets;
461
- }
462
-
463
- // Direct headless login with an existing database URL + auth token.
464
- // No Platform API calls are made; org/db are derived from the endpoint.
465
- export async function loginWithDatabaseToken({
466
- token,
467
- dbUrl,
468
- username = "",
469
- org = "",
470
- db = "",
471
- validate = true,
472
- } = {}) {
473
- if (!token || !dbUrl) throw new Error("Both a database auth token and a libsql:// URL are required.");
474
-
475
- // Derive org + database name from the endpoint (libsql://<db>-<org>.turso.io)
476
- let resolvedOrg = org;
477
- let resolvedDb = db;
478
- const m = String(dbUrl).match(/^libsql:\/\/(.+)\.turso\.io$/);
479
- if (m) {
480
- const host = m[1];
481
- const sep = host.lastIndexOf("-");
482
- if (sep > 0) {
483
- resolvedDb = resolvedDb || host.slice(0, sep);
484
- resolvedOrg = resolvedOrg || host.slice(sep + 1);
485
- }
486
- }
487
-
488
- if (validate) {
489
- console.log(" [CLOUD] Validating database token against the endpoint...");
490
- try {
491
- const { createClient } = await import("@libsql/client");
492
- const client = createClient({ url: dbUrl, authToken: token });
493
- await client.execute("SELECT 1");
494
- client.close();
495
- console.log(" [OK] Database token validated.");
496
- } catch (err) {
497
- throw new Error(`Database token validation failed: ${err.message}`);
498
- }
499
- }
500
-
501
- saveSecrets({ token, dbUrl, username, org: resolvedOrg, db: resolvedDb, authorized: true });
502
- updateConfig({ tursoUrl: dbUrl, authorized: true, username });
503
-
504
- console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${dbUrl}\x1b[0m`);
505
- return { token, dbUrl, username, org: resolvedOrg, db: resolvedDb, authorized: true };
506
- }
507
-
508
- // Pick up credentials from the environment or MEMORY_DIR/.env.
509
- // - TURSO_DB_URL + TURSO_DB_TOKEN: direct endpoint login (preferred, no API calls).
510
- // - TURSO_API_TOKEN: account API-token flow resolving org/db via the Platform API.
511
- // When persist is true the resolved secrets are also written to the encrypted store.
512
- export async function loginFromEnv({ persist = false } = {}) {
513
- const env = resolveEnvSecrets();
514
- if (!env) {
515
- return { ok: false, reason: "No cloud secrets found in the environment or MEMORY_DIR/.env." };
516
- }
517
-
518
- if (env.dbUrl && env.token) {
519
- const secrets = {
520
- token: env.token,
521
- dbUrl: env.dbUrl,
522
- username: env.username || "",
523
- org: env.org || "",
524
- db: env.database || "",
525
- authorized: true,
526
- };
527
- if (persist) saveSecrets(secrets);
528
- updateConfig({ tursoUrl: env.dbUrl, authorized: true, username: secrets.username });
529
- console.log(`\n \x1b[32m[OK] Cloud credentials imported from the environment! Endpoint: ${env.dbUrl}\x1b[0m`);
530
- return { ok: true, secrets, source: "env" };
531
- }
532
-
533
- if (env.apiToken) {
534
- // Resolve lazily; the raw API token stays in the environment and is NOT
535
- // persisted to the encrypted store (explicit `login --api-token` does that).
536
- const secrets = await loginWithApiToken({
537
- token: env.apiToken,
538
- org: env.org || null,
539
- databaseName: env.database || null,
540
- username: env.username || null,
541
- persist: false,
542
- });
543
- return { ok: true, secrets: { ...secrets, apiToken: env.apiToken }, source: "env" };
544
- }
545
-
546
- return {
547
- ok: false,
548
- reason: "Incomplete cloud secrets. Set TURSO_DB_URL + TURSO_DB_TOKEN (preferred) or TURSO_API_TOKEN (with optional TURSO_ORG / TURSO_DATABASE).",
549
- };
550
- }
551
-
552
- // Async resolution of the working cloud credentials (a DB URL + auth token).
553
- // Used by database.js at startup so a raw TURSO_API_TOKEN environment token
554
- // (which can only call the Platform API, not libsql) gets minted into a
555
- // per-database JWT without any interactive step.
556
- let _cachedResolvedSecrets = undefined;
557
- let _cachedResolvedAt = 0;
558
- const RESOLVED_CACHE_TTL_MS = 60_000; // 60s — avoids re-minting JWT on every getDatabase()
559
-
560
- export function invalidateResolvedCache() {
561
- _cachedResolvedSecrets = undefined;
562
- _cachedResolvedAt = 0;
563
- }
564
-
565
- export async function resolveCloudSecrets() {
566
- const now = Date.now();
567
- if (_cachedResolvedSecrets !== undefined && (now - _cachedResolvedAt) < RESOLVED_CACHE_TTL_MS) {
568
- return _cachedResolvedSecrets;
569
- }
570
-
571
- const secrets = loadSecrets();
572
- if (!secrets) { _cachedResolvedSecrets = null; return null; }
573
- if (secrets.apiToken && secrets.needsResolution) {
574
- const resolved = await loginWithApiToken({
575
- token: secrets.apiToken,
576
- org: secrets.org || null,
577
- databaseName: secrets.db || null,
578
- username: secrets.username || null,
579
- persist: false,
580
- });
581
- _cachedResolvedSecrets = { ...resolved, source: "env" };
582
- _cachedResolvedAt = Date.now();
583
- return _cachedResolvedSecrets;
584
- }
585
- _cachedResolvedSecrets = secrets;
586
- _cachedResolvedAt = Date.now();
587
- return _cachedResolvedSecrets;
588
- }
589
-
590
- // Store/replace a Turso account API token. Alias of the headless login flow:
591
- // the token is validated, an org/database is resolved and a per-database JWT
592
- // is minted, then both the API token and the resolved session are persisted.
593
- export async function setApiKey(token, { org = null, databaseName = null } = {}) {
594
- if (!token || typeof token !== "string" || !token.trim()) {
595
- throw new Error("An account API token is required.");
596
- }
597
- const secrets = await loginWithApiToken({ token: token.trim(), org, databaseName });
598
- return { ok: true, secrets };
599
- }
600
-
601
- // Remove a stored API token. The resolved database session is kept as a plain
602
- // browser/database session so an already-synced deployment keeps working.
603
- export function clearApiKey() {
604
- const existing = loadSecrets();
605
- if (!existing || !existing.apiToken) return { removed: false };
606
- const rest = { ...existing };
607
- delete rest.apiToken;
608
- if (rest.token && rest.dbUrl) {
609
- saveSecrets({ ...rest, authorized: true });
610
- invalidateAuthCache();
611
- invalidateResolvedCache();
612
- return { removed: true, keptDbSession: true };
613
- }
614
- deleteSecrets();
615
- invalidateAuthCache();
616
- invalidateResolvedCache();
617
- return { removed: true, keptDbSession: false };
618
- }
619
-
620
- // Non-throwing status report used by `auth-status` and the TUI.
621
- export function getAuthStatus() {
622
- const secrets = loadSecrets();
623
- const config = getConfig();
624
- const source = getSecretsSource();
625
- return {
626
- source: source || "none",
627
- configured: !!(secrets?.dbUrl || config.tursoUrl),
628
- authorized: !!config.authorized || source === "env" || source === "api-key",
629
- hasApiKey: !!secrets?.apiToken,
630
- dbUrl: secrets?.dbUrl || config.tursoUrl || "",
631
- username: secrets?.username || config.username || "",
632
- org: secrets?.org || "",
633
- database: secrets?.db || "",
634
- mode: config.mode || "only-local",
635
- };
636
- }
637
-
638
- // Logout and reset configurations
639
- export function logoutFromCloud() {
640
- const deleted = deleteSecrets();
641
- invalidateAuthCache();
642
- invalidateResolvedCache();
643
- updateConfig({ tursoUrl: "", mode: "only-local", authorized: false, username: "" });
644
- return deleted;
645
- }
1
+ import http from "node:http";
2
+ import crypto from "node:crypto";
3
+ import { spawn } from "node:child_process";
4
+ import { saveSecrets, deleteSecrets, loadSecrets, resolveEnvSecrets, getSecretsSource, invalidateAuthCache, onSecretsChanged } from "../config/auth_store.js";
5
+ import { getConfig, updateConfig } from "../config/config_manager.js";
6
+
7
+ // Register callback so resolveCloudSecrets() cache is cleared when secrets change
8
+ onSecretsChanged(() => { _cachedResolvedSecrets = undefined; _cachedResolvedAt = 0; });
9
+
10
+ export const TURSO_API_BASE = () => process.env.TURSO_API_BASE || "https://api.turso.tech";
11
+
12
+ export function browserLaunchSpec(url, platform = process.platform) {
13
+ if (platform === "win32") {
14
+ // Do not route URLs through cmd.exe. '&' is a command separator there and
15
+ // can truncate Turso's query string before redirect/state/type parameters.
16
+ return { command: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
17
+ }
18
+ if (platform === "darwin") return { command: "open", args: [url] };
19
+ return { command: "xdg-open", args: [url] };
20
+ }
21
+
22
+ function openBrowser(url) {
23
+ try {
24
+ const { command, args } = browserLaunchSpec(url);
25
+ const child = spawn(command, args, { stdio: "ignore", detached: true });
26
+ child.on("error", () => {});
27
+ child.unref();
28
+ } catch {
29
+ // Browser auto-open is best-effort; the printed URL can be opened manually.
30
+ }
31
+ }
32
+
33
+ // Starts a temporary loopback HTTP server to receive the OAuth callback.
34
+ // Turso redirects the browser back to the root path: /?jwt=<JWT>&username=<USERNAME>
35
+ // `expectedState` protects against OAuth CSRF: the callback is only accepted
36
+ // when it echoes the random `state` value that was embedded in the login URL.
37
+ export async function createAuthLoopbackServer(port = 0, expectedState = null) {
38
+ let resolveResult;
39
+ let rejectResult;
40
+ const result = new Promise((resolve, reject) => {
41
+ resolveResult = resolve;
42
+ rejectResult = reject;
43
+ });
44
+
45
+ const server = http.createServer((req, res) => {
46
+ const url = new URL(req.url, `http://${req.headers.host}`);
47
+ const token = url.searchParams.get("jwt") || url.searchParams.get("token");
48
+ const username = url.searchParams.get("username");
49
+ const error = url.searchParams.get("error");
50
+ const receivedState = url.searchParams.get("state");
51
+
52
+ if (token) {
53
+ if (expectedState && receivedState !== expectedState) {
54
+ res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
55
+ res.end("Invalid state parameter");
56
+ server.close(() => rejectResult(new Error("OAuth callback rejected: state parameter mismatch (possible CSRF attempt).")));
57
+ return;
58
+ }
59
+ res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
60
+ res.end(`
61
+ <!DOCTYPE html>
62
+ <html lang="en">
63
+ <head>
64
+ <meta charset="utf-8" />
65
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
66
+ <title>Authorization Successful</title>
67
+ <style>
68
+ * { margin: 0; padding: 0; box-sizing: border-box; }
69
+ body {
70
+ min-height: 100vh;
71
+ display: flex;
72
+ align-items: center;
73
+ justify-content: center;
74
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
75
+ -webkit-font-smoothing: antialiased;
76
+ background: radial-gradient(1200px 600px at 50% -10%, #1c2028 0%, #101218 55%, #0c0e13 100%);
77
+ color: #e8ebf2;
78
+ padding: 24px;
79
+ }
80
+ .card {
81
+ max-width: 420px;
82
+ width: 100%;
83
+ background: #161a21;
84
+ border: 1px solid rgba(255, 255, 255, 0.07);
85
+ border-radius: 20px;
86
+ padding: 46px 38px;
87
+ text-align: center;
88
+ box-shadow: 0 24px 70px rgba(0, 0, 0, 0.45);
89
+ }
90
+ .badge {
91
+ width: 76px;
92
+ height: 76px;
93
+ margin: 0 auto 26px;
94
+ border-radius: 50%;
95
+ display: flex;
96
+ align-items: center;
97
+ justify-content: center;
98
+ background: rgba(94, 224, 154, 0.10);
99
+ border: 1px solid rgba(94, 224, 154, 0.28);
100
+ }
101
+ .badge svg { width: 36px; height: 36px; }
102
+ h1 { font-size: 22px; font-weight: 600; letter-spacing: 0.2px; color: #f2f4f8; margin-bottom: 12px; }
103
+ p { font-size: 14px; line-height: 1.65; color: #9aa3b2; }
104
+ .hint { margin-top: 24px; font-size: 12.5px; color: #6f7887; }
105
+ </style>
106
+ </head>
107
+ <body>
108
+ <div class="card">
109
+ <div class="badge">
110
+ <svg viewBox="0 0 24 24" fill="none" stroke="#5ee09a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
111
+ <path d="M20 6 9 17l-5-5" />
112
+ </svg>
113
+ </div>
114
+ <h1>Authorization successful</h1>
115
+ <p>Your credentials were received and stored securely on this device.</p>
116
+ <div class="hint">You can now close this tab and return to the terminal.</div>
117
+ </div>
118
+ </body>
119
+ </html>
120
+ `);
121
+
122
+ server.close(() => {
123
+ resolveResult({ token, username: username || "" });
124
+ });
125
+ } else if (error) {
126
+ res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
127
+ res.end(`
128
+ <!DOCTYPE html>
129
+ <html lang="en">
130
+ <head>
131
+ <meta charset="utf-8" />
132
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
133
+ <title>Authorization Failed</title>
134
+ <style>
135
+ * { margin: 0; padding: 0; box-sizing: border-box; }
136
+ body {
137
+ min-height: 100vh;
138
+ display: flex;
139
+ align-items: center;
140
+ justify-content: center;
141
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
142
+ -webkit-font-smoothing: antialiased;
143
+ background: radial-gradient(1200px 600px at 50% -10%, #1c2028 0%, #101218 55%, #0c0e13 100%);
144
+ color: #e8ebf2;
145
+ padding: 24px;
146
+ }
147
+ .card {
148
+ max-width: 400px;
149
+ width: 100%;
150
+ background: #161a21;
151
+ border: 1px solid rgba(255, 255, 255, 0.07);
152
+ border-radius: 20px;
153
+ padding: 40px 34px;
154
+ text-align: center;
155
+ box-shadow: 0 24px 70px rgba(0, 0, 0, 0.45);
156
+ }
157
+ h1 { font-size: 20px; font-weight: 600; color: #f2f4f8; margin-bottom: 12px; }
158
+ p { font-size: 14px; line-height: 1.65; color: #9aa3b2; }
159
+ </style>
160
+ </head>
161
+ <body>
162
+ <div class="card">
163
+ <h1>Authorization failed</h1>
164
+ <p>An error occurred during the login flow. Close this tab, return to the terminal, and try again.</p>
165
+ </div>
166
+ </body>
167
+ </html>
168
+ `);
169
+ server.close(() => rejectResult(new Error(`Authentication error: ${error}`)));
170
+ } else {
171
+ res.writeHead(404, { "Content-Type": "text/plain" });
172
+ res.end("Not Found");
173
+ }
174
+ });
175
+
176
+ await new Promise((resolve, reject) => {
177
+ const onError = (err) => {
178
+ server.off("listening", onListening);
179
+ reject(err);
180
+ };
181
+ const onListening = () => {
182
+ server.off("error", onError);
183
+ resolve();
184
+ };
185
+ server.once("error", onError);
186
+ server.once("listening", onListening);
187
+ server.listen(port, "127.0.0.1");
188
+ });
189
+
190
+ const address = server.address();
191
+ const boundPort = typeof address === "object" && address ? address.port : port;
192
+ console.log(`\n [*] Waiting for authorization on local port http://localhost:${boundPort}/...`);
193
+
194
+ return {
195
+ port: boundPort,
196
+ result,
197
+ close: () => new Promise((resolve) => server.close(() => resolve())),
198
+ };
199
+ }
200
+
201
+ // Backward-compatible helper used by tests/older internal callers.
202
+ export function startAuthLoopbackServer(port = 48900, expectedState = null) {
203
+ return createAuthLoopbackServer(port, expectedState).then(({ result }) => result);
204
+ }
205
+
206
+ async function apiRequest(token, pathname, { method = "GET", body } = {}) {
207
+ const res = await fetch(`${TURSO_API_BASE()}${pathname}`, {
208
+ method,
209
+ headers: {
210
+ Authorization: `Bearer ${token}`,
211
+ "Content-Type": "application/json",
212
+ Accept: "application/json",
213
+ },
214
+ body: body ? JSON.stringify(body) : undefined,
215
+ });
216
+
217
+ const text = await res.text();
218
+ let data = null;
219
+ try {
220
+ data = JSON.parse(text);
221
+ } catch {}
222
+
223
+ if (!res.ok) {
224
+ const err = new Error(data?.error || `Turso API ${res.status}: ${text}`);
225
+ err.status = res.status;
226
+ throw err;
227
+ }
228
+ return data;
229
+ }
230
+
231
+ // Validate the account JWT obtained from OAuth and return current-user info.
232
+ export async function validateTursoToken(token) {
233
+ return apiRequest(token, "/v1/current-user");
234
+ }
235
+
236
+ export async function listOrganizations(token) {
237
+ const data = await apiRequest(token, "/v1/organizations");
238
+ const orgs = data?.organizations || [];
239
+ return orgs.map((o) => ({
240
+ slug: o.slug || o.Slug || o.id || o.Id || null,
241
+ name: o.name || o.Name || null,
242
+ id: o.id || o.Id || null,
243
+ }));
244
+ }
245
+
246
+ export async function listDatabases(token, org) {
247
+ const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`);
248
+ const dbs = data?.databases || [];
249
+ return dbs.map((d) => ({
250
+ name: d.name || d.Name,
251
+ hostname: d.hostname || d.Hostname,
252
+ id: d.id || d.Id,
253
+ }));
254
+ }
255
+
256
+ export async function createDatabase(token, org, name) {
257
+ try {
258
+ const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`, {
259
+ method: "POST",
260
+ body: { name },
261
+ });
262
+ const d = data?.database || data;
263
+ return { name: d.name || d.Name, hostname: d.hostname || d.Hostname, id: d.id || d.Id };
264
+ } catch (err) {
265
+ // Fresh accounts have no default group; create one, then retry.
266
+ if (!String(err.message || "").toLowerCase().includes("group")) {
267
+ throw err;
268
+ }
269
+ console.log(` [CLOUD] No group found. Creating group "default"...`);
270
+ await createGroup(token, org, "default");
271
+ const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/databases`, {
272
+ method: "POST",
273
+ body: { name, group: "default" },
274
+ });
275
+ const d = data?.database || data;
276
+ return { name: d.name || d.Name, hostname: d.hostname || d.Hostname, id: d.id || d.Id };
277
+ }
278
+ }
279
+
280
+ // Turso's public closest-region endpoint (no auth required).
281
+ // Returns e.g. { server: "aws-eu-west-1", client: "ams" }.
282
+ async function getClosestLocation() {
283
+ if (process.env.TURSO_LOCATION) return process.env.TURSO_LOCATION;
284
+ const fallback = "ams";
285
+ try {
286
+ const res = await fetch("https://region.turso.io/", { signal: AbortSignal.timeout(8000) });
287
+ const data = await res.json().catch(() => null);
288
+ const loc = data?.server || data?.client || null;
289
+ if (loc && /^[a-z0-9-]+$/i.test(loc)) return loc;
290
+ } catch {
291
+ // ignore
292
+ }
293
+ return fallback;
294
+ }
295
+
296
+ export async function createGroup(token, org, name) {
297
+ // Always provide an explicit location: Turso's internal auto-lookup fails
298
+ // with "invalid location: Host not found" when the group has no location.
299
+ const location = await getClosestLocation();
300
+ const data = await apiRequest(token, `/v1/organizations/${encodeURIComponent(org)}/groups`, {
301
+ method: "POST",
302
+ body: { name, location },
303
+ });
304
+ return data?.group || data;
305
+ }
306
+
307
+ export async function createDatabaseToken(token, org, db, { expiration = "never", authorization = "full-access" } = {}) {
308
+ const data = await apiRequest(
309
+ token,
310
+ `/v1/organizations/${encodeURIComponent(org)}/databases/${encodeURIComponent(db)}/auth/tokens?expiration=${encodeURIComponent(expiration)}&authorization=${encodeURIComponent(authorization)}`,
311
+ { method: "POST", body: {} }
312
+ );
313
+ return data?.jwt || null;
314
+ }
315
+
316
+ function dbHostname(org, dbName) {
317
+ return `${dbName}-${org}.turso.io`;
318
+ }
319
+
320
+ // Shared post-auth resolution: validate happens in the caller. Steps:
321
+ // 1. Resolve an organization (explicit, first available, or username fallback).
322
+ // 2. Pick or create a database.
323
+ // 3. Mint a full-access token for that database.
324
+ // 4. Persist the encrypted token + dbUrl and mark the session as authorized.
325
+ async function finalizeCloudLogin({ token, username, org = null, databaseName = null, autoCreate = true, persist = true, apiToken = null }) {
326
+ const accountUsername = username || "user";
327
+
328
+ // Step 1: resolve organization + database namespace
329
+ const orgs = await listOrganizations(token);
330
+ let orgSlug;
331
+ let orgName;
332
+ if (orgs && orgs.length > 0) {
333
+ const requested = org ? orgs.find((o) => (o.slug || o.name || o.id) === org) : null;
334
+ const chosen = requested || orgs[0];
335
+ orgSlug = chosen.slug || chosen.name || chosen.id || String(chosen);
336
+ orgName = chosen.name || orgSlug;
337
+ } else {
338
+ // Personal accounts are not listed in /v1/organizations, but their own
339
+ // username acts as the organization namespace in the Platform API.
340
+ orgSlug = accountUsername;
341
+ orgName = accountUsername;
342
+ console.log(` [CLOUD] No organizations found. Using personal account "${orgSlug}" as the database namespace.`);
343
+ }
344
+
345
+ const dbs = await listDatabases(token, orgSlug);
346
+ if (dbs.length > 0) {
347
+ console.log(`\n [CLOUD] Databases in organization "${orgName}":`);
348
+ dbs.forEach((d, i) => console.log(` ${i + 1}. ${d.name}`));
349
+ }
350
+
351
+ let dbName = databaseName;
352
+ if (!dbName) {
353
+ if (dbs.length > 0) {
354
+ dbName = dbs[0].name;
355
+ console.log(`\n [CLOUD] Using existing database: "${dbName}"`);
356
+ } else if (autoCreate) {
357
+ dbName = `memory-${accountUsername}`;
358
+ console.log(`\n [CLOUD] No database found. Creating "${dbName}"...`);
359
+ await createDatabase(token, orgSlug, dbName);
360
+ console.log(` [OK] Database "${dbName}" created.`);
361
+ } else {
362
+ throw new Error("No databases found and autoCreate is disabled.");
363
+ }
364
+ }
365
+
366
+ // Step 2: mint a full-access token for the database
367
+ console.log(" [CLOUD] Issuing database access token...");
368
+ const dbJwt = await createDatabaseToken(token, orgSlug, dbName);
369
+ if (!dbJwt) {
370
+ throw new Error("Failed to create database auth token.");
371
+ }
372
+
373
+ const dbUrl = `libsql://${dbHostname(orgSlug, dbName)}`;
374
+
375
+ // Step 3: persist secrets and mark authorized
376
+ if (persist) {
377
+ saveSecrets({
378
+ token: dbJwt,
379
+ dbUrl,
380
+ username: accountUsername,
381
+ org: orgSlug,
382
+ db: dbName,
383
+ authorized: true,
384
+ ...(apiToken ? { apiToken } : {}),
385
+ });
386
+ }
387
+ updateConfig({ tursoUrl: dbUrl, authorized: true, username: accountUsername });
388
+
389
+ return {
390
+ token: dbJwt,
391
+ dbUrl,
392
+ username: accountUsername,
393
+ org: orgSlug,
394
+ db: dbName,
395
+ authorized: true,
396
+ ...(apiToken ? { apiToken } : {}),
397
+ };
398
+ }
399
+
400
+ // Perform the full cloud login flow:
401
+ // 1. OAuth browser flow against Turso (api.turso.tech).
402
+ // 2. Validate the received account JWT.
403
+ // 3. Resolve an organization and pick/create a database.
404
+ // 4. Mint a full-access token for that database.
405
+ // 5. Persist the encrypted token + dbUrl and mark the session as authorized.
406
+ export async function loginToCloud({
407
+ customPort = 0,
408
+ simulated = false,
409
+ simulatedParams = null,
410
+ autoCreate = true,
411
+ databaseName = null,
412
+ org = null,
413
+ } = {}) {
414
+ const state = crypto.randomBytes(16).toString("hex");
415
+ const loopback = await createAuthLoopbackServer(customPort, state);
416
+ const loginUrl = `${TURSO_API_BASE()}/?port=${loopback.port}&redirect=true&state=${state}&type=cli`;
417
+
418
+ console.log(`\n [CLOUD] Please open your system browser to authorize:`);
419
+ console.log(` \x1b[36m${loginUrl}\x1b[0m\n`);
420
+
421
+ let received;
422
+ if (simulated && simulatedParams) {
423
+ const req = http.request(
424
+ `http://127.0.0.1:${loopback.port}/?jwt=${encodeURIComponent(simulatedParams.jwt)}&username=${encodeURIComponent(simulatedParams.username)}&state=${encodeURIComponent(state)}`,
425
+ { method: "GET" },
426
+ (res) => {
427
+ res.resume();
428
+ }
429
+ );
430
+ req.on("error", () => {});
431
+ req.end();
432
+ received = await loopback.result;
433
+ } else {
434
+ openBrowser(loginUrl);
435
+ received = await loopback.result;
436
+ }
437
+
438
+ const { token, username } = received;
439
+
440
+ // Step 2: validate the account token
441
+ let userInfo = null;
442
+ try {
443
+ userInfo = await validateTursoToken(token);
444
+ } catch (err) {
445
+ throw new Error(`Token validation failed: ${err.message}`);
446
+ }
447
+ const accountUsername = username || userInfo?.username || userInfo?.name || "user";
448
+ console.log(` [OK] Token is valid. User: ${accountUsername}`);
449
+
450
+ const secrets = await finalizeCloudLogin({ token, username: accountUsername, org, databaseName, autoCreate });
451
+
452
+ console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${secrets.dbUrl}\x1b[0m`);
453
+ return secrets;
454
+ }
455
+
456
+ // Headless login with a Turso account API token (no browser, no loopback).
457
+ // Create one at https://console.turso.tech or via `turso auth api-tokens create`.
458
+ // The same Platform API is used to resolve the organization + database and to
459
+ // mint a per-database token, exactly like the browser flow.
460
+ export async function loginWithApiToken({
461
+ token,
462
+ org = null,
463
+ databaseName = null,
464
+ autoCreate = true,
465
+ username = null,
466
+ persist = true,
467
+ } = {}) {
468
+ if (!token) throw new Error("An account API token is required.");
469
+ console.log("\n [CLOUD] Validating account API token...");
470
+ let userInfo = null;
471
+ try {
472
+ userInfo = await validateTursoToken(token);
473
+ } catch (err) {
474
+ throw new Error(`Token validation failed: ${err.message}`);
475
+ }
476
+ const accountUsername = username || userInfo?.username || userInfo?.name || "user";
477
+ console.log(` [OK] API token is valid. User: ${accountUsername}`);
478
+
479
+ const secrets = await finalizeCloudLogin({
480
+ token,
481
+ username: accountUsername,
482
+ org,
483
+ databaseName,
484
+ autoCreate,
485
+ persist,
486
+ apiToken: persist ? token : null,
487
+ });
488
+
489
+ console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${secrets.dbUrl}\x1b[0m`);
490
+ return secrets;
491
+ }
492
+
493
+ // Direct headless login with an existing database URL + auth token.
494
+ // No Platform API calls are made; org/db are derived from the endpoint.
495
+ export async function loginWithDatabaseToken({
496
+ token,
497
+ dbUrl,
498
+ username = "",
499
+ org = "",
500
+ db = "",
501
+ validate = true,
502
+ } = {}) {
503
+ if (!token || !dbUrl) throw new Error("Both a database auth token and a libsql:// URL are required.");
504
+
505
+ // Derive org + database name from the endpoint (libsql://<db>-<org>.turso.io)
506
+ let resolvedOrg = org;
507
+ let resolvedDb = db;
508
+ const m = String(dbUrl).match(/^libsql:\/\/(.+)\.turso\.io$/);
509
+ if (m) {
510
+ const host = m[1];
511
+ const sep = host.lastIndexOf("-");
512
+ if (sep > 0) {
513
+ resolvedDb = resolvedDb || host.slice(0, sep);
514
+ resolvedOrg = resolvedOrg || host.slice(sep + 1);
515
+ }
516
+ }
517
+
518
+ if (validate) {
519
+ console.log(" [CLOUD] Validating database token against the endpoint...");
520
+ try {
521
+ const { createClient } = await import("@libsql/client");
522
+ const client = createClient({ url: dbUrl, authToken: token });
523
+ await client.execute("SELECT 1");
524
+ client.close();
525
+ console.log(" [OK] Database token validated.");
526
+ } catch (err) {
527
+ throw new Error(`Database token validation failed: ${err.message}`);
528
+ }
529
+ }
530
+
531
+ saveSecrets({ token, dbUrl, username, org: resolvedOrg, db: resolvedDb, authorized: true });
532
+ updateConfig({ tursoUrl: dbUrl, authorized: true, username });
533
+
534
+ console.log(`\n \x1b[32m[OK] Successfully signed in to the cloud! Endpoint: ${dbUrl}\x1b[0m`);
535
+ return { token, dbUrl, username, org: resolvedOrg, db: resolvedDb, authorized: true };
536
+ }
537
+
538
+ // Pick up credentials from the environment or MEMORY_DIR/.env.
539
+ // - TURSO_DB_URL + TURSO_DB_TOKEN: direct endpoint login (preferred, no API calls).
540
+ // - TURSO_API_TOKEN: account API-token flow resolving org/db via the Platform API.
541
+ // When persist is true the resolved secrets are also written to the encrypted store.
542
+ export async function loginFromEnv({ persist = false } = {}) {
543
+ const env = resolveEnvSecrets();
544
+ if (!env) {
545
+ return { ok: false, reason: "No cloud secrets found in the environment or MEMORY_DIR/.env." };
546
+ }
547
+
548
+ if (env.dbUrl && env.token) {
549
+ const secrets = {
550
+ token: env.token,
551
+ dbUrl: env.dbUrl,
552
+ username: env.username || "",
553
+ org: env.org || "",
554
+ db: env.database || "",
555
+ authorized: true,
556
+ };
557
+ if (persist) saveSecrets(secrets);
558
+ updateConfig({ tursoUrl: env.dbUrl, authorized: true, username: secrets.username });
559
+ console.log(`\n \x1b[32m[OK] Cloud credentials imported from the environment! Endpoint: ${env.dbUrl}\x1b[0m`);
560
+ return { ok: true, secrets, source: "env" };
561
+ }
562
+
563
+ if (env.apiToken) {
564
+ // Resolve lazily; the raw API token stays in the environment and is NOT
565
+ // persisted to the encrypted store (explicit `login --api-token` does that).
566
+ const secrets = await loginWithApiToken({
567
+ token: env.apiToken,
568
+ org: env.org || null,
569
+ databaseName: env.database || null,
570
+ username: env.username || null,
571
+ persist: false,
572
+ });
573
+ return { ok: true, secrets: { ...secrets, apiToken: env.apiToken }, source: "env" };
574
+ }
575
+
576
+ return {
577
+ ok: false,
578
+ reason: "Incomplete cloud secrets. Set TURSO_DB_URL + TURSO_DB_TOKEN (preferred) or TURSO_API_TOKEN (with optional TURSO_ORG / TURSO_DATABASE).",
579
+ };
580
+ }
581
+
582
+ // Async resolution of the working cloud credentials (a DB URL + auth token).
583
+ // Used by database.js at startup so a raw TURSO_API_TOKEN environment token
584
+ // (which can only call the Platform API, not libsql) gets minted into a
585
+ // per-database JWT without any interactive step.
586
+ let _cachedResolvedSecrets = undefined;
587
+ let _cachedResolvedAt = 0;
588
+ const RESOLVED_CACHE_TTL_MS = 60_000; // 60s — avoids re-minting JWT on every getDatabase()
589
+
590
+ export function invalidateResolvedCache() {
591
+ _cachedResolvedSecrets = undefined;
592
+ _cachedResolvedAt = 0;
593
+ }
594
+
595
+ export async function resolveCloudSecrets() {
596
+ const now = Date.now();
597
+ if (_cachedResolvedSecrets !== undefined && (now - _cachedResolvedAt) < RESOLVED_CACHE_TTL_MS) {
598
+ return _cachedResolvedSecrets;
599
+ }
600
+
601
+ const secrets = loadSecrets();
602
+ if (!secrets) { _cachedResolvedSecrets = null; return null; }
603
+ if (secrets.apiToken && secrets.needsResolution) {
604
+ const resolved = await loginWithApiToken({
605
+ token: secrets.apiToken,
606
+ org: secrets.org || null,
607
+ databaseName: secrets.db || null,
608
+ username: secrets.username || null,
609
+ persist: false,
610
+ });
611
+ _cachedResolvedSecrets = { ...resolved, source: "env" };
612
+ _cachedResolvedAt = Date.now();
613
+ return _cachedResolvedSecrets;
614
+ }
615
+ _cachedResolvedSecrets = secrets;
616
+ _cachedResolvedAt = Date.now();
617
+ return _cachedResolvedSecrets;
618
+ }
619
+
620
+ // Store/replace a Turso account API token. Alias of the headless login flow:
621
+ // the token is validated, an org/database is resolved and a per-database JWT
622
+ // is minted, then both the API token and the resolved session are persisted.
623
+ export async function setApiKey(token, { org = null, databaseName = null } = {}) {
624
+ if (!token || typeof token !== "string" || !token.trim()) {
625
+ throw new Error("An account API token is required.");
626
+ }
627
+ const secrets = await loginWithApiToken({ token: token.trim(), org, databaseName });
628
+ return { ok: true, secrets };
629
+ }
630
+
631
+ // Remove a stored API token. The resolved database session is kept as a plain
632
+ // browser/database session so an already-synced deployment keeps working.
633
+ export function clearApiKey() {
634
+ const existing = loadSecrets();
635
+ if (!existing || !existing.apiToken) return { removed: false };
636
+ const rest = { ...existing };
637
+ delete rest.apiToken;
638
+ if (rest.token && rest.dbUrl) {
639
+ saveSecrets({ ...rest, authorized: true });
640
+ invalidateAuthCache();
641
+ invalidateResolvedCache();
642
+ return { removed: true, keptDbSession: true };
643
+ }
644
+ deleteSecrets();
645
+ invalidateAuthCache();
646
+ invalidateResolvedCache();
647
+ return { removed: true, keptDbSession: false };
648
+ }
649
+
650
+ // Non-throwing status report used by `auth-status` and the TUI.
651
+ export function getAuthStatus() {
652
+ const secrets = loadSecrets();
653
+ const config = getConfig();
654
+ const source = getSecretsSource();
655
+ return {
656
+ source: source || "none",
657
+ configured: !!(secrets?.dbUrl || config.tursoUrl),
658
+ authorized: !!config.authorized || source === "env" || source === "api-key",
659
+ hasApiKey: !!secrets?.apiToken,
660
+ dbUrl: secrets?.dbUrl || config.tursoUrl || "",
661
+ username: secrets?.username || config.username || "",
662
+ org: secrets?.org || "",
663
+ database: secrets?.db || "",
664
+ mode: config.mode || "only-local",
665
+ };
666
+ }
667
+
668
+ // Logout and reset configurations
669
+ export function logoutFromCloud() {
670
+ const deleted = deleteSecrets();
671
+ invalidateAuthCache();
672
+ invalidateResolvedCache();
673
+ updateConfig({ tursoUrl: "", mode: "only-local", authorized: false, username: "" });
674
+ return deleted;
675
+ }