@persistmemory/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2853 @@
+// ../sdk-js/dist/index.js
+function encodeQuery(params) {
+  if (!params) return "";
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) {
+      for (const one of value) search.append(key, String(one));
+      continue;
+    }
+    search.append(key, String(value));
+  }
+  const encoded = search.toString();
+  return encoded ? `?${encoded}` : "";
+}
+function pageQuery(params, cursor, extra) {
+  return {
+    ...params.limit !== void 0 ? { limit: params.limit } : {},
+    ...cursor !== void 0 ? { cursor } : params.cursor !== void 0 ? { cursor: params.cursor } : {},
+    ...extra
+  };
+}
+var DEFAULT_BACKOFF = { baseMs: 250, maxMs: 8e3, factor: 2, jitter: 1 };
+function backoffMs(attempt, options = {}) {
+  const base = options.baseMs ?? DEFAULT_BACKOFF.baseMs;
+  const max = options.maxMs ?? DEFAULT_BACKOFF.maxMs;
+  const factor = options.factor ?? DEFAULT_BACKOFF.factor;
+  const jitter = clamp01(options.jitter ?? DEFAULT_BACKOFF.jitter);
+  const random = options.random ?? Math.random;
+  const exponent = Math.max(0, Math.floor(attempt) - 1);
+  const ceiling = Math.min(max, base * Math.pow(factor, exponent));
+  if (jitter <= 0) return Math.round(ceiling);
+  const fixed = ceiling * (1 - jitter);
+  return Math.round(fixed + random() * (ceiling - fixed));
+}
+function delayFor(args) {
+  const computed = backoffMs(args.attempt, args.options ?? {});
+  if (args.retryAfterSeconds === void 0 || !Number.isFinite(args.retryAfterSeconds)) {
+    return computed;
+  }
+  return Math.max(computed, Math.max(0, args.retryAfterSeconds) * 1e3);
+}
+function clamp01(value) {
+  if (!Number.isFinite(value)) return 0;
+  return Math.min(1, Math.max(0, value));
+}
+var PersistMemoryError = class extends Error {
+  status;
+  code;
+  fields;
+  requestId;
+  retryAfterSeconds;
+  /** Retrying this exact request could plausibly succeed. */
+  retryable = false;
+  constructor(init) {
+    super(redact(init.message));
+    this.name = new.target.name;
+    this.status = init.status;
+    this.code = init.code;
+    if (init.fields) this.fields = init.fields;
+    if (init.requestId) this.requestId = init.requestId;
+    if (init.retryAfterSeconds !== void 0) this.retryAfterSeconds = init.retryAfterSeconds;
+  }
+  /**
+   * A one-line summary safe to log.
+   *
+   * Provided so callers reach for this instead of `JSON.stringify(error)`,
+   * which walks own properties and would pick up anything a future field
+   * holds. Everything here is already server-supplied and key-free.
+   */
+  toString() {
+    const id = this.requestId ? ` requestId=${this.requestId}` : "";
+    return `${this.name}: [${this.status} ${this.code}] ${this.message}${id}`;
+  }
+};
+var AuthenticationError = class extends PersistMemoryError {
+};
+var PermissionDeniedError = class extends PersistMemoryError {
+};
+var NotFoundError = class extends PersistMemoryError {
+};
+var ValidationError = class extends PersistMemoryError {
+};
+var ConflictError = class extends PersistMemoryError {
+};
+var RateLimitError = class extends PersistMemoryError {
+  retryable = true;
+};
+var ServerError = class extends PersistMemoryError {
+  retryable = true;
+};
+var ConnectionError = class extends PersistMemoryError {
+  retryable = true;
+  constructor(message2) {
+    super({ status: 0, code: "CONNECTION_ERROR", message: message2 });
+  }
+};
+var TimeoutError = class extends PersistMemoryError {
+  retryable = true;
+  constructor(message2) {
+    super({ status: 0, code: "TIMEOUT", message: message2 });
+  }
+};
+var AbortError = class extends PersistMemoryError {
+  constructor(message2 = "The request was aborted by the caller.") {
+    super({ status: 0, code: "ABORTED", message: message2 });
+  }
+};
+function errorFromResponse(status2, body, headers) {
+  const envelope = body ?? {};
+  const code = typeof envelope.error?.code === "string" ? envelope.error.code : codeForStatus(status2);
+  const message2 = typeof envelope.error?.message === "string" && envelope.error.message.length > 0 ? envelope.error.message : defaultMessage(status2);
+  const retryAfterSeconds = status2 === 429 || status2 === 503 ? retryAfterOf(headers) : void 0;
+  const init = {
+    status: status2,
+    code,
+    message: message2,
+    ...isFieldMap(envelope.error?.fields) ? { fields: envelope.error.fields } : {},
+    ...typeof envelope.error?.requestId === "string" ? { requestId: envelope.error.requestId } : {},
+    ...retryAfterSeconds !== void 0 ? { retryAfterSeconds } : {}
+  };
+  if (status2 === 429 || code === "RATE_LIMITED") return new RateLimitError(init);
+  if (status2 === 401 || code === "UNAUTHORIZED") return new AuthenticationError(init);
+  if (status2 === 403 || code === "FORBIDDEN") return new PermissionDeniedError(init);
+  if (status2 === 404 || code === "NOT_FOUND") return new NotFoundError(init);
+  if (status2 === 409 || code === "CONFLICT") return new ConflictError(init);
+  if (status2 === 400 || status2 === 413 || status2 === 422) return new ValidationError(init);
+  if (status2 >= 500) return new ServerError(init);
+  return new PersistMemoryError(init);
+}
+function retryAfterOf(headers) {
+  const raw = headers.get("retry-after");
+  if (!raw) return void 0;
+  const seconds = Number(raw.trim());
+  if (!Number.isFinite(seconds) || seconds < 0) return void 0;
+  return Math.min(seconds, 300);
+}
+function isFieldMap(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  return Object.values(value).every((one) => typeof one === "string");
+}
+function codeForStatus(status2) {
+  if (status2 === 401) return "UNAUTHORIZED";
+  if (status2 === 403) return "FORBIDDEN";
+  if (status2 === 404) return "NOT_FOUND";
+  if (status2 === 409) return "CONFLICT";
+  if (status2 === 429) return "RATE_LIMITED";
+  if (status2 === 413) return "PAYLOAD_TOO_LARGE";
+  if (status2 >= 500) return "INTERNAL_ERROR";
+  return "VALIDATION_ERROR";
+}
+function defaultMessage(status2) {
+  return `The API returned ${status2} with no readable error body.`;
+}
+function redact(text) {
+  return text.replace(/pm_(live|test)_[A-Za-z0-9_-]+/g, "pm_$1_[redacted]");
+}
+var DEFAULT_BASE_URL = "https://api.persistmemory.com";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_ATTEMPTS = 3;
+var RETRY_WITHOUT_ASKING = /* @__PURE__ */ new Set(["GET", "HEAD", "PATCH", "DELETE"]);
+var HttpClient = class {
+  /**
+   * The credential, in a private field, and never anywhere else.
+   *
+   * Private (`#`) rather than `readonly`: a public field is enumerable, so
+   * `JSON.stringify(client)` and every structured logger that walks own
+   * properties would write the key into a log line. `toJSON` and the inspect
+   * hook below close the two remaining paths - a bug report pasted from
+   * `console.log(client)` is exactly how a key gets shared with strangers.
+   */
+  #apiKey;
+  #baseUrl;
+  #fetch;
+  #timeoutMs;
+  #maxAttempts;
+  #backoff;
+  #sleep;
+  #userAgent;
+  constructor(options) {
+    if (typeof options.apiKey !== "string" || options.apiKey.trim().length === 0) {
+      throw new PersistMemoryError({
+        status: 0,
+        code: "VALIDATION_ERROR",
+        message: "An API key is required. Pass `apiKey`, or set PERSISTMEMORY_API_KEY."
+      });
+    }
+    const key = options.apiKey.trim();
+    if (/[\r\n\0]/.test(key)) {
+      throw new PersistMemoryError({
+        status: 0,
+        code: "VALIDATION_ERROR",
+        message: "The API key contains characters that cannot go in a header."
+      });
+    }
+    this.#apiKey = key;
+    this.#baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.#fetch = options.fetch ?? globalThis.fetch;
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    this.#backoff = options.backoff ?? {};
+    this.#sleep = options.sleep ?? defaultSleep;
+    this.#userAgent = options.userAgent ?? "persistmemory-sdk-js/0.1.0";
+  }
+  /**
+   * What this object looks like when something serialises it.
+   *
+   * Both hooks return the same key-free shape. `toJSON` covers
+   * `JSON.stringify`, the inspect symbol covers `console.log` under Node, and
+   * between them they cover how a credential actually escapes: not through a
+   * deliberate log line, but through an object dumped into a bug report.
+   */
+  toJSON() {
+    return { baseUrl: this.#baseUrl, apiKey: "[redacted]" };
+  }
+  [Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toJSON();
+  }
+  async get(path, query, options) {
+    return this.#request({
+      method: "GET",
+      path,
+      ...query ? { query } : {},
+      ...options ? { options } : {}
+    });
+  }
+  async post(path, body, options) {
+    return this.#request({
+      method: "POST",
+      path,
+      ...body !== void 0 ? { body } : {},
+      ...options ? { options } : {}
+    });
+  }
+  async patch(path, body, options) {
+    return this.#request({
+      method: "PATCH",
+      path,
+      ...body !== void 0 ? { body } : {},
+      ...options ? { options } : {}
+    });
+  }
+  async delete(path, body, options) {
+    return this.#request({
+      method: "DELETE",
+      path,
+      ...body !== void 0 ? { body } : {},
+      ...options ? { options } : {}
+    });
+  }
+  async #request(request) {
+    const maxAttempts = Math.max(1, request.options?.maxAttempts ?? this.#maxAttempts);
+    const url = this.#baseUrl + request.path + encodeQuery(request.query);
+    let attempt = 0;
+    for (; ; ) {
+      attempt += 1;
+      let error;
+      try {
+        return await this.#attempt(request, url);
+      } catch (thrown) {
+        if (!(thrown instanceof PersistMemoryError)) throw thrown;
+        error = thrown;
+      }
+      if (attempt >= maxAttempts) throw error;
+      if (!mayRetry(error, request)) throw error;
+      const delay = delayFor({
+        attempt,
+        ...error.retryAfterSeconds !== void 0 ? { retryAfterSeconds: error.retryAfterSeconds } : {},
+        options: this.#backoff
+      });
+      await this.#sleep(delay, request.options?.signal);
+    }
+  }
+  async #attempt(request, url) {
+    const timeoutMs = request.options?.timeoutMs ?? this.#timeoutMs;
+    const deadline = new AbortController();
+    const timer = setTimeout(() => deadline.abort(), timeoutMs);
+    const onCallerAbort = () => deadline.abort();
+    const caller = request.options?.signal;
+    caller?.addEventListener("abort", onCallerAbort, { once: true });
+    try {
+      if (caller?.aborted) throw new AbortError();
+      const response = await untilAborted(
+        this.#fetch(url, {
+          method: request.method,
+          headers: this.#headers(request),
+          ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {},
+          signal: deadline.signal
+        }),
+        deadline.signal
+      );
+      const payload = await readBody(response);
+      if (!response.ok) throw errorFromResponse(response.status, payload, response.headers);
+      return payload;
+    } catch (thrown) {
+      if (thrown instanceof PersistMemoryError) throw thrown;
+      if (caller?.aborted) throw new AbortError();
+      if (deadline.signal.aborted) {
+        throw new TimeoutError(`The request did not complete within ${timeoutMs}ms.`);
+      }
+      const detail = thrown instanceof Error ? redact(thrown.message) : "transport failure";
+      throw new ConnectionError(`Could not reach the API: ${detail}`);
+    } finally {
+      clearTimeout(timer);
+      caller?.removeEventListener("abort", onCallerAbort);
+    }
+  }
+  #headers(request) {
+    return {
+      // The only place the key is ever read.
+      authorization: `Bearer ${this.#apiKey}`,
+      accept: "application/json",
+      "user-agent": this.#userAgent,
+      ...request.body !== void 0 ? { "content-type": "application/json" } : {},
+      ...request.options?.idempotencyKey ? { "idempotency-key": request.options.idempotencyKey } : {}
+    };
+  }
+};
+function mayRetry(error, request) {
+  if (!error.retryable) return false;
+  if (RETRY_WITHOUT_ASKING.has(request.method)) return true;
+  if (request.options?.idempotencyKey) return true;
+  return error.status === 429;
+}
+async function readBody(response) {
+  if (response.status === 204) return void 0;
+  const text = await response.text().catch(() => "");
+  if (text.length === 0) return void 0;
+  const type = response.headers.get("content-type") ?? "";
+  if (!type.includes("json")) return { raw: text.slice(0, 500) };
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { raw: text.slice(0, 500) };
+  }
+}
+var SignalFired = class extends Error {
+  constructor() {
+    super("signal fired");
+    this.name = "SignalFired";
+  }
+};
+function untilAborted(work, signal) {
+  work.catch(() => void 0);
+  return new Promise((resolve5, reject) => {
+    if (signal.aborted) {
+      reject(new SignalFired());
+      return;
+    }
+    const onAbort = () => reject(new SignalFired());
+    signal.addEventListener("abort", onAbort, { once: true });
+    work.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve5(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve5, reject) => {
+    if (signal?.aborted) {
+      reject(new AbortError());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve5();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      reject(new AbortError());
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var Paginated = class {
+  #fetchPage;
+  constructor(fetchPage) {
+    this.#fetchPage = fetchPage;
+  }
+  /** The first page, and nothing more. For a UI that renders one page at a time. */
+  async first() {
+    return this.#fetchPage(void 0);
+  }
+  /**
+   * Page by page, for a caller that wants the cursors or wants to stop early.
+   *
+   * A generator rather than an array of pages: fetching them all up front
+   * would make "show me the first ten" cost every page in the account.
+   */
+  async *pages() {
+    let cursor;
+    const seen = /* @__PURE__ */ new Set();
+    for (; ; ) {
+      const page = await this.#fetchPage(cursor);
+      yield page;
+      const next = page.pagination.nextCursor;
+      if (!next) return;
+      if (seen.has(next)) return;
+      seen.add(next);
+      cursor = next;
+    }
+  }
+  /** Every item across every page. `for await (const memory of ...)`. */
+  async *[Symbol.asyncIterator]() {
+    for await (const page of this.pages()) {
+      for (const item of page.data) yield item;
+    }
+  }
+  /**
+   * Everything, in one array.
+   *
+   * `maxItems` is not optional, and that is the point. An unbounded `all()` on
+   * an account with two hundred thousand memories is a request loop that runs
+   * for minutes and an array that exhausts the heap, and the call site that
+   * does it reads as innocently as any other. Ask for a number you can hold.
+   */
+  async all(maxItems) {
+    const collected = [];
+    if (maxItems <= 0) return collected;
+    for await (const item of this) {
+      collected.push(item);
+      if (collected.length >= maxItems) break;
+    }
+    return collected;
+  }
+};
+var Memories = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  /**
+   * One page, plus the cursor loop.
+   *
+   * Returns a `Paginated`, so `await memories.list().first()` gets a page and
+   * `for await (const memory of memories.list())` walks the lot. The filters
+   * are carried into every page automatically - a caller re-passing them per
+   * page is a caller who will eventually forget one, and the pages after that
+   * come from a differently filtered list.
+   */
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/memories",
+        pageQuery(params, cursor, toQuery(params)),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(`/api/v1/memories/${encodeURIComponent(id)}`, void 0, options);
+  }
+  /**
+   * Hands material to the ingestion pipeline. Needs a key with `write` scope.
+   *
+   * This does NOT create a memory, and the return type says so: it answers 202
+   * with a job id. Extraction, entity resolution, deduplication and conflict
+   * detection all run afterwards and may produce one memory, several, or none.
+   * Poll `client.jobs.get(result.jobId)` to find out which.
+   *
+   * Pass an `idempotencyKey` if this can be retried by anything - a queue, a
+   * user pressing a button twice, or this client's own retry loop, which
+   * refuses to repeat a POST without one. `remember:note-42`, not a fresh
+   * random value per call.
+   */
+  async remember(params, options) {
+    return this.#http.post("/api/v1/remember", params, options);
+  }
+};
+function toQuery(params) {
+  return {
+    ...params.type !== void 0 ? { type: params.type } : {},
+    ...params.state !== void 0 ? { state: params.state } : {},
+    ...params.scope !== void 0 ? { scope: params.scope } : {},
+    ...params.spaceIds !== void 0 ? { spaceIds: params.spaceIds } : {},
+    ...params.createdAfter !== void 0 ? { createdAfter: params.createdAfter } : {},
+    ...params.createdBefore !== void 0 ? { createdBefore: params.createdBefore } : {},
+    ...params.minConfidence !== void 0 ? { minConfidence: params.minConfidence } : {},
+    ...params.includeHistorical !== void 0 ? { includeHistorical: params.includeHistorical } : {}
+  };
+}
+var Search = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  /**
+   * Ranked results, with an account of how they were found.
+   *
+   * Read `diagnostics.degraded` before showing the results. Search degrades
+   * rather than fails - with embeddings unavailable it falls back to
+   * deterministic retrieval and still answers - and a UI that cannot tell
+   * degraded from healthy tells the user the system knows nothing when it is
+   * merely looking with one eye.
+   */
+  async query(params, options) {
+    const query = {
+      query: params.query,
+      ...params.limit !== void 0 ? { limit: params.limit } : {},
+      ...params.scope !== void 0 ? { scope: params.scope } : {},
+      ...params.spaceIds !== void 0 ? { spaceIds: params.spaceIds } : {},
+      ...params.types !== void 0 ? { types: params.types } : {},
+      ...params.minScore !== void 0 ? { minScore: params.minScore } : {},
+      ...params.asOf !== void 0 ? { asOf: params.asOf } : {},
+      ...params.includeHistorical !== void 0 ? { includeHistorical: params.includeHistorical } : {},
+      ...params.includeEvidence !== void 0 ? { includeEvidence: params.includeEvidence } : {},
+      ...params.explain !== void 0 ? { explain: params.explain } : {}
+    };
+    return this.#http.get("/api/v1/search", query, options);
+  }
+  /**
+   * A context window, assembled and ready to paste into a prompt.
+   *
+   * A POST that is safe to repeat - it reads and returns, it writes nothing -
+   * so this is one of the few places where retrying without an idempotency key
+   * would be harmless. It still is not retried by default: the request loop
+   * decides by METHOD, and a per-endpoint exception is a rule that holds until
+   * someone adds a POST next to it that does write.
+   */
+  async context(params, options) {
+    return this.#http.post("/api/v1/context", params, options);
+  }
+};
+var Spaces = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/spaces",
+        pageQuery(params, cursor, {
+          ...params.includeArchived !== void 0 ? { includeArchived: params.includeArchived } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(`/api/v1/spaces/${encodeURIComponent(id)}`, void 0, options);
+  }
+  /**
+   * Creates a Space. Answers 201.
+   *
+   * Worth an idempotency key when a person is behind it: a double-clicked
+   * "create Space" button makes two Spaces called Work, and nothing later can
+   * tell which of them memories should have gone into.
+   */
+  async create(params, options) {
+    return this.#http.post("/api/v1/spaces", params, options);
+  }
+  /** Renaming, retention, and archiving - `archived` is a field, not a verb. */
+  async update(id, params, options) {
+    return this.#http.patch(`/api/v1/spaces/${encodeURIComponent(id)}`, params, options);
+  }
+  /**
+   * The memories filed in a Space.
+   *
+   * This endpoint answers `{ data, pagination: { limit } }` with no cursor: it
+   * returns the first `limit` members and stops. Wrapped in a `Paginated`
+   * anyway so it reads like every other list, and it simply yields one page -
+   * a caller who needs more should filter `memories.list` by `spaceIds`, which
+   * is the endpoint that actually pages.
+   */
+  memories(id, params = {}, options) {
+    return new Paginated(
+      () => this.#http.get(
+        `/api/v1/spaces/${encodeURIComponent(id)}/memories`,
+        { ...params.limit !== void 0 ? { limit: params.limit } : {} },
+        options
+      )
+    );
+  }
+  async addMemories(id, memoryIds, options) {
+    return this.#http.post(
+      `/api/v1/spaces/${encodeURIComponent(id)}/memories`,
+      { memoryIds },
+      options
+    );
+  }
+  /**
+   * Removes memberships. The memories themselves are untouched.
+   *
+   * A body on a DELETE, which is unusual and is what the API takes: the
+   * alternative is five hundred ids in a query string, and every proxy in
+   * between has its own limit on how long a URL may be.
+   */
+  async removeMemories(id, memoryIds, options) {
+    return this.#http.delete(
+      `/api/v1/spaces/${encodeURIComponent(id)}/memories`,
+      { memoryIds },
+      options
+    );
+  }
+};
+var Sources = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/sources",
+        pageQuery(params, cursor, {
+          ...params.provider !== void 0 ? { provider: params.provider } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(`/api/v1/sources/${encodeURIComponent(id)}`, void 0, options);
+  }
+};
+var Documents = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/documents",
+        pageQuery(params, cursor, {
+          ...params.sourceId !== void 0 ? { sourceId: params.sourceId } : {},
+          ...params.status !== void 0 ? { status: params.status } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(
+      `/api/v1/documents/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+};
+var Jobs = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/jobs",
+        pageQuery(params, cursor, {
+          ...params.status !== void 0 ? { status: params.status } : {},
+          ...params.type !== void 0 ? { type: params.type } : {}
+        }),
+        options
+      )
+    );
+  }
+  /**
+   * One job, by id. This is what `remember` hands back a reference to.
+   *
+   * `completed` is the terminal success state - the store's own word, not
+   * `succeeded`. A caller polling for a state the API never writes waits
+   * forever with nothing to show why.
+   */
+  async get(id, options) {
+    return this.#http.get(`/api/v1/jobs/${encodeURIComponent(id)}`, void 0, options);
+  }
+};
+var Entities = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/entities",
+        pageQuery(params, cursor, {
+          ...params.type !== void 0 ? { type: params.type } : {},
+          ...params.q !== void 0 ? { q: params.q } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(`/api/v1/entities/${encodeURIComponent(id)}`, void 0, options);
+  }
+  /**
+   * Which memories mention this entity, and how.
+   *
+   * Returns MENTIONS - a memory id, a role and a confidence - not the memories
+   * themselves. "Memories about Sam" and "memories Sam appears in" are
+   * different questions, and `role` is what separates them.
+   *
+   * Like the Space membership list, this endpoint answers with a `pagination`
+   * block that carries no cursor, so it yields one page and stops.
+   */
+  memories(id, params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        `/api/v1/entities/${encodeURIComponent(id)}/memories`,
+        pageQuery(params, cursor, {
+          ...params.role !== void 0 ? { role: params.role } : {},
+          ...params.minConfidence !== void 0 ? { minConfidence: params.minConfidence } : {}
+        }),
+        options
+      )
+    );
+  }
+};
+var Graph = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  async traverse(params, options) {
+    return this.#http.get(
+      "/api/v1/graph",
+      {
+        from: params.from,
+        ...params.depth !== void 0 ? { depth: params.depth } : {},
+        ...params.maxNodes !== void 0 ? { maxNodes: params.maxNodes } : {},
+        ...params.memoryLimit !== void 0 ? { memoryLimit: params.memoryLimit } : {}
+      },
+      options
+    );
+  }
+};
+var Conflicts = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/conflicts",
+        pageQuery(params, cursor, {
+          ...params.includeResolved !== void 0 ? { includeResolved: params.includeResolved } : {},
+          ...params.type !== void 0 ? { type: params.type } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(
+      `/api/v1/conflicts/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Settles one.
+   *
+   * `keep` names the winner and supersedes the loser; it does not delete it.
+   * `dismiss` records that the detector was wrong, which is worth knowing when
+   * the same pair trips it again.
+   *
+   * The parameter type is a union, so `keep` without a `keepId` does not
+   * compile. The server rejects it too - this just moves the failure from a
+   * 400 in production to a red squiggle.
+   */
+  async resolve(id, params, options) {
+    return this.#http.post(
+      `/api/v1/conflicts/${encodeURIComponent(id)}/resolve`,
+      params,
+      options
+    );
+  }
+};
+var Conversations = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/conversations",
+        pageQuery(params, cursor, {
+          ...params.channel !== void 0 ? { channel: params.channel } : {}
+        }),
+        options
+      )
+    );
+  }
+  async get(id, options) {
+    return this.#http.get(
+      `/api/v1/conversations/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+  async create(params = {}, options) {
+    return this.#http.post("/api/v1/conversations", params, options);
+  }
+  messages(id, params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        `/api/v1/conversations/${encodeURIComponent(id)}/messages`,
+        pageQuery(params, cursor, {}),
+        options
+      )
+    );
+  }
+  /**
+   * Appends turns, and by default extracts memories from them.
+   *
+   * Check `extracting` on the result. With no queue configured the turns are
+   * stored and never become memory, and the API says so in `note` rather than
+   * reporting a success - a caller that ignores it believes a memory is on its
+   * way that never arrives.
+   *
+   * `system` and `tool` turns are stored but never extracted: a system prompt
+   * is configuration, and remembering it would file our own instructions as
+   * the user's facts.
+   *
+   * Give this an `idempotencyKey`. Appending the same turn twice is the most
+   * likely duplicate in the whole API - a client reconnecting after a dropped
+   * response has no other way to tell whether its last write landed.
+   */
+  async append(id, params, options) {
+    return this.#http.post(
+      `/api/v1/conversations/${encodeURIComponent(id)}/messages`,
+      params,
+      options
+    );
+  }
+};
+var Integrations = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  list(params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        "/api/v1/integrations",
+        pageQuery(params, cursor, {
+          ...params.provider !== void 0 ? { provider: params.provider } : {},
+          ...params.status !== void 0 ? { status: params.status } : {}
+        }),
+        options
+      )
+    );
+  }
+  /** Providers that can be connected at all. Not the user's own connections. */
+  async available(options) {
+    return this.#http.get("/api/v1/integrations/available", void 0, options);
+  }
+  async get(id, options) {
+    return this.#http.get(
+      `/api/v1/integrations/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+  async connect(params, options) {
+    return this.#http.post(
+      "/api/v1/integrations/connect",
+      params,
+      options
+    );
+  }
+  async update(id, params, options) {
+    return this.#http.patch(
+      `/api/v1/integrations/${encodeURIComponent(id)}`,
+      params,
+      options
+    );
+  }
+  /**
+   * Asks for a sync now rather than waiting for the schedule. Answers 202.
+   *
+   * `full` re-reads everything and is deliberately opt-in: on a large Drive
+   * that is thousands of documents and a real bill. The incremental default is
+   * what should run almost always.
+   */
+  async sync(id, params = {}, options) {
+    return this.#http.post(
+      `/api/v1/integrations/${encodeURIComponent(id)}/sync`,
+      params,
+      options
+    );
+  }
+  /**
+   * Destroys the credentials. The row stays.
+   *
+   * History still has to attribute the memories this connection produced, and
+   * deleting the row would leave them pointing at nothing.
+   */
+  async disconnect(id, options) {
+    return this.#http.delete(
+      `/api/v1/integrations/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+};
+var Health = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  async live(options) {
+    return this.#http.get("/health/live", void 0, options);
+  }
+  async ready(options) {
+    return this.#http.get("/health/ready", void 0, options);
+  }
+};
+var PersistMemory = class {
+  memories;
+  search;
+  spaces;
+  sources;
+  documents;
+  jobs;
+  entities;
+  graph;
+  conflicts;
+  conversations;
+  integrations;
+  health;
+  #http;
+  constructor(options) {
+    this.#http = new HttpClient(options);
+    this.memories = new Memories(this.#http);
+    this.search = new Search(this.#http);
+    this.spaces = new Spaces(this.#http);
+    this.sources = new Sources(this.#http);
+    this.documents = new Documents(this.#http);
+    this.jobs = new Jobs(this.#http);
+    this.entities = new Entities(this.#http);
+    this.graph = new Graph(this.#http);
+    this.conflicts = new Conflicts(this.#http);
+    this.conversations = new Conversations(this.#http);
+    this.integrations = new Integrations(this.#http);
+    this.health = new Health(this.#http);
+  }
+  /**
+   * An escape hatch for an endpoint this package has not caught up with.
+   *
+   * Typed as `unknown` on purpose: a caller reaching past the typed surface is
+   * taking responsibility for the shape, and handing them `any` would let that
+   * responsibility spread silently through their codebase.
+   */
+  async request(method, path, body, options) {
+    if (method === "GET") return this.#http.get(path, void 0, options);
+    if (method === "POST") return this.#http.post(path, body, options);
+    if (method === "PATCH") return this.#http.patch(path, body, options);
+    return this.#http.delete(path, body, options);
+  }
+  /** Never the key. See `HttpClient.toJSON`, which this delegates to. */
+  toJSON() {
+    return this.#http.toJSON();
+  }
+  [Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.#http.toJSON();
+  }
+};
+
+// src/args.ts
+function parseArgs(argv) {
+  const words = [];
+  const flags = {};
+  const rest = [];
+  let index = 0;
+  while (index < argv.length) {
+    const token = argv[index];
+    if (token === "--") {
+      rest.push(...argv.slice(index + 1));
+      break;
+    }
+    if (token.startsWith("--")) {
+      const body = token.slice(2);
+      const equals = body.indexOf("=");
+      if (equals !== -1) {
+        flags[body.slice(0, equals)] = body.slice(equals + 1);
+        index += 1;
+        continue;
+      }
+      if (body.startsWith("no-")) {
+        flags[body.slice(3)] = false;
+        index += 1;
+        continue;
+      }
+      const next = argv[index + 1];
+      if (next !== void 0 && !next.startsWith("-")) {
+        flags[body] = next;
+        index += 2;
+        continue;
+      }
+      flags[body] = true;
+      index += 1;
+      continue;
+    }
+    if (token.startsWith("-") && token.length > 1) {
+      const body = token.slice(1);
+      const next = argv[index + 1];
+      if (next !== void 0 && !next.startsWith("-")) {
+        flags[body] = next;
+        index += 2;
+        continue;
+      }
+      flags[body] = true;
+      index += 1;
+      continue;
+    }
+    words.push(token);
+    index += 1;
+  }
+  return { words, flags, rest };
+}
+function stringFlag(args, ...names) {
+  for (const name of names) {
+    const value = args.flags[name];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function boolFlag(args, ...names) {
+  for (const name of names) {
+    const value = args.flags[name];
+    if (typeof value === "boolean") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+  }
+  return false;
+}
+function numberFlag(args, ...names) {
+  for (const name of names) {
+    const value = args.flags[name];
+    if (value === void 0 || typeof value === "boolean") continue;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed)) return "invalid";
+    return parsed;
+  }
+  return void 0;
+}
+function listFlag(args, ...names) {
+  const raw = stringFlag(args, ...names);
+  if (raw === void 0) return void 0;
+  const items = raw.split(",").map((one) => one.trim()).filter((one) => one.length > 0);
+  return items.length > 0 ? items : void 0;
+}
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var DEFAULT_API_URL = "https://api.persistmemory.com";
+var DEFAULT_PROFILE = "default";
+function pathsFor(home = homedir()) {
+  const dir = process.env["PERSISTMEMORY_HOME"] ?? join(home, ".persistmemory");
+  return {
+    dir,
+    config: join(dir, "config.json"),
+    credentials: join(dir, "credentials.json")
+  };
+}
+function readConfig(paths) {
+  const empty = { current: DEFAULT_PROFILE, profiles: {} };
+  if (!existsSync(paths.config)) return empty;
+  try {
+    const parsed = JSON.parse(readFileSync(paths.config, "utf8"));
+    return {
+      current: typeof parsed.current === "string" ? parsed.current : DEFAULT_PROFILE,
+      profiles: typeof parsed.profiles === "object" && parsed.profiles ? parsed.profiles : {}
+    };
+  } catch {
+    return empty;
+  }
+}
+function readCredentials(paths) {
+  if (!existsSync(paths.credentials)) return {};
+  try {
+    return JSON.parse(readFileSync(paths.credentials, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeSecurely(path, contents, mode) {
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, contents, { mode });
+  chmodSync(temporary, mode);
+  renameSync(temporary, path);
+}
+function writeConfig(paths, config) {
+  mkdirSync(paths.dir, { recursive: true, mode: 448 });
+  writeSecurely(paths.config, `${JSON.stringify(config, null, 2)}
+`, 384);
+}
+function writeCredentials(paths, credentials) {
+  mkdirSync(paths.dir, { recursive: true, mode: 448 });
+  writeSecurely(paths.credentials, `${JSON.stringify(credentials, null, 2)}
+`, 384);
+}
+function resolve(args) {
+  const env = args.env ?? process.env;
+  const config = readConfig(args.paths);
+  const profile = args.profileFlag ?? env["PERSISTMEMORY_PROFILE"] ?? config.current ?? DEFAULT_PROFILE;
+  const stored = config.profiles[profile];
+  const apiUrl = args.apiUrlFlag ?? env["PERSISTMEMORY_API_URL"] ?? stored?.apiUrl ?? DEFAULT_API_URL;
+  const fromFlag = args.apiKeyFlag;
+  const fromEnv = env["PERSISTMEMORY_API_KEY"];
+  const clientId = stored?.clientId;
+  if (fromFlag) {
+    return {
+      profile,
+      apiUrl,
+      credential: { kind: "api-key", token: fromFlag },
+      ...clientId ? { clientId } : {},
+      fromEnvironment: true
+    };
+  }
+  if (fromEnv) {
+    return {
+      profile,
+      apiUrl,
+      credential: { kind: "api-key", token: fromEnv },
+      ...clientId ? { clientId } : {},
+      fromEnvironment: true
+    };
+  }
+  const credential = readCredentials(args.paths)[profile];
+  return {
+    profile,
+    apiUrl,
+    ...credential ? { credential } : {},
+    ...clientId ? { clientId } : {},
+    fromEnvironment: false
+  };
+}
+function saveLogin(args) {
+  const config = readConfig(args.paths);
+  writeConfig(args.paths, {
+    // Logging in makes that profile the current one. Anything else means a
+    // person logs in, runs a command, and is told they are not logged in.
+    current: args.profile,
+    profiles: {
+      ...config.profiles,
+      [args.profile]: {
+        apiUrl: args.apiUrl,
+        ...args.account ? { account: args.account } : {},
+        // Kept from the existing profile when this login did not register a
+        // new client, so an --api-key login does not erase the browser
+        // client id and force a re-registration on the next `pm auth login`.
+        ...args.clientId ?? config.profiles[args.profile]?.clientId ? { clientId: args.clientId ?? config.profiles[args.profile]?.clientId } : {}
+      }
+    }
+  });
+  writeCredentials(args.paths, {
+    ...readCredentials(args.paths),
+    [args.profile]: args.credential
+  });
+}
+function clearLogin(paths, profile) {
+  const credentials = readCredentials(paths);
+  if (!(profile in credentials)) return false;
+  delete credentials[profile];
+  writeCredentials(paths, credentials);
+  return true;
+}
+function maskToken(token) {
+  if (token.length <= 8) return "*".repeat(token.length);
+  return `${token.slice(0, 4)}\u2026${token.slice(-4)}`;
+}
+
+// src/output.ts
+var OUTPUT_FORMATS = ["table", "json", "yaml", "csv", "tsv"];
+function isOutputFormat(value) {
+  return OUTPUT_FORMATS.includes(value);
+}
+function render(rows, columns, options) {
+  switch (options.format) {
+    case "json":
+      return JSON.stringify(rows, null, 2);
+    case "yaml":
+      return toYaml(rows);
+    case "csv":
+      return delimited(rows, columns, ",");
+    case "tsv":
+      return delimited(rows, columns, "	");
+    default:
+      return table(rows, columns, options.width);
+  }
+}
+function renderOne(row, fields, options) {
+  if (options.format === "json") return JSON.stringify(row, null, 2);
+  if (options.format === "yaml") return toYaml(row);
+  if (options.format === "csv" || options.format === "tsv") {
+    return delimited([row], fields, options.format === "csv" ? "," : "	");
+  }
+  const width = Math.max(...fields.map((field) => field.header.length));
+  return fields.map((field) => `${field.header.padEnd(width)}  ${field.value(row)}`).join("\n");
+}
+function table(rows, columns, width = process.stdout.columns || 120) {
+  if (rows.length === 0) return "";
+  const cells = rows.map((row) => columns.map((column) => oneLine(column.value(row))));
+  const widths = columns.map(
+    (column, index) => Math.max(column.header.length, ...cells.map((row) => (row[index] ?? "").length))
+  );
+  const separator = 2;
+  let total = widths.reduce((sum, one) => sum + one + separator, -separator);
+  while (total > width && Math.max(...widths) > 8) {
+    const widest = widths.indexOf(Math.max(...widths));
+    widths[widest] = widths[widest] - 1;
+    total -= 1;
+  }
+  const line = (values) => values.map((value, index) => clip(value, widths[index]).padEnd(widths[index])).join("  ").trimEnd();
+  return [
+    line(columns.map((column) => column.header.toUpperCase())),
+    ...cells.map((row) => line(row))
+  ].join("\n");
+}
+function delimited(rows, columns, separator) {
+  const escape = (value) => {
+    const flat = oneLine(value);
+    if (!flat.includes(separator) && !flat.includes('"') && !flat.includes("\n")) return flat;
+    return `"${flat.replace(/"/g, '""')}"`;
+  };
+  return [
+    columns.map((column) => escape(column.header)).join(separator),
+    ...rows.map((row) => columns.map((column) => escape(column.value(row))).join(separator))
+  ].join("\n");
+}
+function toYaml(value, indent = 0) {
+  const pad = " ".repeat(indent);
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "boolean" || typeof value === "number") return String(value);
+  if (typeof value === "string") return yamlString(value);
+  if (Array.isArray(value)) {
+    if (value.length === 0) return "[]";
+    return value.map((item) => {
+      const rendered = toYaml(item, indent + 2);
+      return isBlock(item) ? `${pad}-
+${rendered}` : `${pad}- ${rendered}`;
+    }).join("\n");
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0) return "{}";
+    return entries.map(([key, item]) => {
+      const rendered = toYaml(item, indent + 2);
+      return isBlock(item) ? `${pad}${key}:
+${rendered}` : `${pad}${key}: ${rendered}`;
+    }).join("\n");
+  }
+  return String(value);
+}
+function isBlock(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  return typeof value === "object" && value !== null && Object.keys(value).length > 0;
+}
+function yamlString(value) {
+  if (value === "") return '""';
+  if (value.includes("\n")) {
+    return `|-
+${value.split("\n").map((line) => `  ${line}`).join("\n")}`;
+  }
+  const ambiguous = /^(y|Y|yes|Yes|YES|n|N|no|No|NO|true|True|TRUE|false|False|FALSE|on|On|ON|off|Off|OFF|null|Null|NULL|~)$/.test(
+    value
+  ) || /^[-+]?[0-9]/.test(value) || /^[\s#&*!|>'"%@`{}[\],]/.test(value) || value.includes(": ") || value.endsWith(":");
+  return ambiguous ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
+}
+function oneLine(value) {
+  return value.replace(/\s*\n\s*/g, " ").trim();
+}
+function clip(value, width) {
+  if (value.length <= width) return value;
+  return width <= 1 ? value.slice(0, width) : `${value.slice(0, width - 1)}\u2026`;
+}
+function shortDate(iso) {
+  if (!iso) return "";
+  const at = new Date(iso);
+  return Number.isNaN(at.getTime()) ? "" : iso.slice(0, 16).replace("T", " ");
+}
+
+// src/help.ts
+var VERSION = "0.1.0";
+var HELP = `
+  pm \u2014 PersistMemory from your terminal
+
+  Memory that persists across every model, tool and session you use.
+
+  GETTING STARTED
+
+    pm auth login                    sign in with your browser
+    pm                               start a session and just ask
+    pm remember "we chose Postgres"  capture something
+    pm search "what did we choose"   ask for it back
+
+  COMMANDS
+
+    auth login                       sign in through the browser
+    auth login --api-key             sign in with a key, for CI and headless machines
+
+    agent --root <dir>               answer file requests from your assistants,
+                                     reading only inside the folders you name
+    auth status                      who am I, and does the server still accept it
+    auth logout                      forget the stored credential
+
+    chat                             start an interactive session
+    chat --resume <id>               pick up an earlier session
+
+    remember <text>                  capture text
+    remember -                       capture whatever is piped in
+    remember --file <path>           capture a file's contents
+
+    search <query>                   search your memory
+    list memories                    the most recent memories
+    list spaces                      your Spaces
+    get memory <id>                  one memory, in full
+
+    status                           is the service healthy
+    requests                         file requests waiting for you to approve
+
+  FLAGS
+
+    --output table|json|yaml|csv|tsv  how to print (default: table on a
+                                      terminal, json when piped)
+    --profile <name>                  use a named account
+    --api-url <url>                   talk to a different server
+    --limit <n>                       how many results
+    --space <a,b>                     restrict to Spaces
+    --quiet                           suppress notices
+    --version                         print the version
+    --help                            print this
+
+  ENVIRONMENT
+
+    PERSISTMEMORY_API_KEY            a key, taking precedence over any stored
+                                     login. This is what CI should set.
+    PERSISTMEMORY_API_URL            the server to talk to
+    PERSISTMEMORY_PROFILE            which stored profile to use
+    PERSISTMEMORY_HOME               where config, credentials and session
+                                     transcripts live (default: ~/.persistmemory)
+    PERSISTMEMORY_CLIENT_ID          override the OAuth client id, for a
+                                     self-hosted deployment
+
+  Docs: https://persistmemory.com/docs/cli
+`;
+
+// src/auth/oauth.ts
+import { spawn } from "node:child_process";
+import { timingSafeEqual } from "node:crypto";
+
+// src/auth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+function createPkce() {
+  const verifier = base64Url(randomBytes(32));
+  return {
+    verifier,
+    challenge: base64Url(createHash("sha256").update(verifier).digest()),
+    // Never "plain". OAuth 2.1 removes it, and a plain challenge is the
+    // verifier, which defends against nothing.
+    method: "S256"
+  };
+}
+function randomState() {
+  return base64Url(randomBytes(24));
+}
+function base64Url(bytes) {
+  return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/auth/loopback.ts
+import { createServer } from "node:http";
+var CALLBACK_PATH = "/callback";
+async function startLoopback(options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
+  let resolveCallback;
+  let rejectCallback;
+  const received = new Promise((resolve5, reject) => {
+    resolveCallback = resolve5;
+    rejectCallback = reject;
+  });
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      response.writeHead(404, { "content-type": "text/plain" });
+      response.end("Not found");
+      return;
+    }
+    const callback = {
+      ...url.searchParams.get("code") ? { code: url.searchParams.get("code") } : {},
+      ...url.searchParams.get("state") ? { state: url.searchParams.get("state") } : {},
+      ...url.searchParams.get("error") ? { error: url.searchParams.get("error") } : {},
+      ...url.searchParams.get("error_description") ? { errorDescription: url.searchParams.get("error_description") } : {}
+    };
+    response.writeHead(200, {
+      "content-type": "text/html; charset=utf-8",
+      // This page is one-use and holds a result; nothing should keep it.
+      "cache-control": "no-store",
+      // It never loads anything, so it is not allowed to.
+      "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'"
+    });
+    response.end(donePage(callback));
+    resolveCallback?.(callback);
+  });
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve5);
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new Error("could not determine the port the callback listener bound to");
+  }
+  const timer = setTimeout(() => {
+    rejectCallback?.(
+      new Error("timed out waiting for the browser. Run `pm auth login` again, or use --api-key.")
+    );
+  }, timeoutMs);
+  timer.unref?.();
+  return {
+    port: address.port,
+    redirectUri: `http://127.0.0.1:${address.port}${CALLBACK_PATH}`,
+    async waitForCallback() {
+      try {
+        return await received;
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+    close() {
+      clearTimeout(timer);
+      server.close();
+    }
+  };
+}
+function donePage(callback) {
+  const failed = Boolean(callback.error) || !callback.code;
+  const title = failed ? "Sign-in failed" : "You are signed in";
+  const detail = failed ? escapeHtml(callback.errorDescription ?? callback.error ?? "No authorization code was returned.") : "You can close this tab and go back to your terminal.";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${title}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.6 ui-sans-serif, system-ui, -apple-system, sans-serif;
+         display: grid; place-items: center; min-height: 100vh; margin: 0; }
+  main { max-width: 30rem; padding: 2rem; text-align: center; }
+  h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+  p { margin: 0; opacity: .8; }
+</style></head>
+<body><main><h1>${title}</h1><p>${detail}</p></main></body></html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// src/auth/oauth.ts
+async function protectedResource(apiUrl, deps) {
+  try {
+    const url = new URL("/.well-known/oauth-protected-resource", apiUrl).toString();
+    const response = await deps.fetch(url, { headers: { accept: "application/json" } });
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    const servers = body["authorization_servers"];
+    const resource = body["resource"];
+    if (!Array.isArray(servers) || typeof servers[0] !== "string") return void 0;
+    if (typeof resource !== "string") return void 0;
+    return { issuer: servers[0], resource };
+  } catch {
+    return void 0;
+  }
+}
+async function discover(apiUrl, deps) {
+  const guarded = await protectedResource(apiUrl, deps);
+  const issuerUrl = guarded?.issuer ?? apiUrl;
+  const url = new URL("/.well-known/oauth-authorization-server", issuerUrl).toString();
+  const response = await deps.fetch(url, { headers: { accept: "application/json" } });
+  if (!response.ok) {
+    throw new Error(
+      `${issuerUrl} does not look like a PersistMemory API: discovery answered ${response.status}.`
+    );
+  }
+  const body = await response.json();
+  const required = (key) => {
+    const value = body[key];
+    if (typeof value !== "string") {
+      throw new Error(`the server's metadata is missing "${key}"`);
+    }
+    return value;
+  };
+  return {
+    issuer: required("issuer"),
+    authorizationEndpoint: required("authorization_endpoint"),
+    tokenEndpoint: required("token_endpoint"),
+    // Carried through so the authorize request can name it. Absent when the
+    // API is its own resource, in which case the server uses its default.
+    ...guarded?.resource ? { resource: guarded.resource } : {},
+    ...typeof body["registration_endpoint"] === "string" ? { registrationEndpoint: body["registration_endpoint"] } : {},
+    ...Array.isArray(body["scopes_supported"]) ? { scopesSupported: body["scopes_supported"].map(String) } : {}
+  };
+}
+async function registerClient(server, redirectUri, scope, deps) {
+  if (!server.registrationEndpoint) {
+    throw new Error(
+      "this server does not offer dynamic client registration. Use `pm auth login --api-key` instead."
+    );
+  }
+  const response = await deps.fetch(server.registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "PersistMemory CLI",
+      client_uri: "https://persistmemory.com/docs/cli",
+      // Registered WITHOUT a port. The server compares loopback redirects
+      // ignoring the port (RFC 8252 §7.3), so registering the one we happened
+      // to bind this time would be noise — and would break the next login,
+      // which binds a different one.
+      redirect_uris: ["http://127.0.0.1/callback"],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`could not register with ${server.issuer}: ${await describe(response)}`);
+  }
+  const body = await response.json();
+  if (typeof body.client_id !== "string") {
+    throw new Error("the server registered this client but returned no client_id");
+  }
+  return body.client_id;
+}
+var CLI_CLIENT_ID = "persistmemory-cli";
+async function knownClient(server, clientId, deps) {
+  try {
+    const probe = new URL(server.authorizationEndpoint);
+    probe.searchParams.set("client_id", clientId);
+    probe.searchParams.set("response_type", "code");
+    const response = await deps.fetch(probe.toString(), {
+      method: "GET",
+      redirect: "manual"
+    });
+    if (response.status >= 500) return false;
+    const body = await response.text().catch(() => "");
+    return !body.includes("invalid_client");
+  } catch {
+    return false;
+  }
+}
+async function loginWithBrowser(args) {
+  const { deps } = args;
+  const print = deps.print ?? (() => void 0);
+  const server = await discover(args.apiUrl, deps);
+  const listener = await startLoopback(
+    args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {}
+  );
+  try {
+    const clientId = args.clientId ?? process.env["PERSISTMEMORY_CLIENT_ID"] ?? (await knownClient(server, CLI_CLIENT_ID, deps) ? CLI_CLIENT_ID : await registerClient(server, listener.redirectUri, args.scope, deps));
+    const pkce = createPkce();
+    const state = randomState();
+    const authorize = new URL(server.authorizationEndpoint);
+    authorize.searchParams.set("response_type", "code");
+    authorize.searchParams.set("client_id", clientId);
+    authorize.searchParams.set("redirect_uri", listener.redirectUri);
+    authorize.searchParams.set("scope", args.scope);
+    authorize.searchParams.set("state", state);
+    authorize.searchParams.set("code_challenge", pkce.challenge);
+    authorize.searchParams.set("code_challenge_method", pkce.method);
+    if (server.resource) authorize.searchParams.set("resource", server.resource);
+    print("Opening your browser to sign in.");
+    print(`If it does not open, visit:
+
+  ${authorize.toString()}
+`);
+    await (deps.openBrowser ?? openBrowser)(authorize.toString()).catch(() => void 0);
+    const callback = await listener.waitForCallback();
+    if (callback.error) {
+      throw new Error(
+        `sign-in was refused: ${callback.errorDescription ?? callback.error}`
+      );
+    }
+    if (!callback.code) {
+      throw new Error("the browser came back without an authorization code");
+    }
+    if (!callback.state || !safeEqual(callback.state, state)) {
+      throw new Error("the browser came back with the wrong state \u2014 sign-in was not completed");
+    }
+    const credential = await redeem({
+      server,
+      clientId,
+      code: callback.code,
+      verifier: pkce.verifier,
+      redirectUri: listener.redirectUri,
+      deps
+    });
+    return { credential, clientId };
+  } finally {
+    listener.close();
+  }
+}
+async function redeem(args) {
+  const form = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: args.code,
+    redirect_uri: args.redirectUri,
+    client_id: args.clientId,
+    code_verifier: args.verifier,
+    // Restated at redemption. The server compares it against the resource the
+    // code was authorized for and refuses a mismatch, which is what stops a
+    // code issued for one service being redeemed for a token against another.
+    ...args.server.resource ? { resource: args.server.resource } : {}
+  });
+  const response = await args.deps.fetch(args.server.tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: form.toString()
+  });
+  if (!response.ok) {
+    throw new Error(`the server refused to issue a token: ${await describe(response)}`);
+  }
+  return toCredential(await response.json());
+}
+async function refresh(args) {
+  const server = await discover(args.apiUrl, args.deps);
+  const response = await args.deps.fetch(server.tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: args.refreshToken,
+      client_id: args.clientId
+    }).toString()
+  });
+  if (!response.ok) {
+    throw new Error(`could not renew the session: ${await describe(response)}`);
+  }
+  const credential = toCredential(await response.json());
+  return credential.refreshToken ? credential : { ...credential, refreshToken: args.refreshToken };
+}
+function toCredential(body) {
+  const token = body["access_token"];
+  if (typeof token !== "string") {
+    throw new Error("the server's token response contained no access_token");
+  }
+  const expiresIn = body["expires_in"];
+  const expiresAt = typeof expiresIn === "number" && Number.isFinite(expiresIn) ? new Date(Date.now() + expiresIn * 1e3).toISOString() : void 0;
+  return {
+    kind: "oauth",
+    token,
+    ...typeof body["refresh_token"] === "string" ? { refreshToken: body["refresh_token"] } : {},
+    ...expiresAt ? { expiresAt } : {},
+    ...typeof body["scope"] === "string" ? { scope: body["scope"] } : {}
+  };
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+async function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  await new Promise((resolve5, reject) => {
+    const child = spawn(command, args, {
+      stdio: "ignore",
+      // Detached so closing the terminal does not close the browser, and so
+      // this process can exit without waiting for it.
+      detached: true
+    });
+    child.once("error", reject);
+    child.unref();
+    resolve5();
+  });
+}
+async function describe(response) {
+  try {
+    const body = await response.json();
+    const error = body["error"];
+    const description = body["error_description"];
+    if (typeof description === "string") return `${String(error ?? response.status)} \u2014 ${description}`;
+    if (typeof error === "string") return error;
+  } catch {
+  }
+  return `HTTP ${response.status}`;
+}
+
+// src/session.ts
+var NotSignedIn = class extends Error {
+  constructor() {
+    super(
+      "not signed in. Run `pm auth login`, or set PERSISTMEMORY_API_KEY for a non-interactive session."
+    );
+    this.name = "NotSignedIn";
+  }
+};
+var RENEW_BEFORE_MS = 6e4;
+function isExpired(credential, now = Date.now()) {
+  if (credential.kind !== "oauth" || !credential.expiresAt) return false;
+  const at = Date.parse(credential.expiresAt);
+  return Number.isFinite(at) && at - RENEW_BEFORE_MS <= now;
+}
+async function clientFor(resolved, deps) {
+  const credential = await currentCredential(resolved, deps);
+  return new PersistMemory({
+    apiKey: credential.token,
+    baseUrl: resolved.apiUrl,
+    ...deps.userAgent ? { userAgent: deps.userAgent } : {},
+    fetch: deps.fetch
+  });
+}
+async function currentCredential(resolved, deps) {
+  const credential = resolved.credential;
+  if (!credential) throw new NotSignedIn();
+  if (!isExpired(credential, deps.now?.() ?? Date.now())) return credential;
+  if (!credential.refreshToken || !resolved.clientId) {
+    throw new Error("your session has expired. Run `pm auth login` to sign in again.");
+  }
+  const renewed = await refresh({
+    apiUrl: resolved.apiUrl,
+    clientId: resolved.clientId,
+    refreshToken: credential.refreshToken,
+    deps
+  });
+  writeCredentials(deps.paths, {
+    ...readCredentials(deps.paths),
+    [resolved.profile]: renewed
+  });
+  return renewed;
+}
+
+// src/context.ts
+import { createInterface } from "node:readline";
+var ETX = "";
+var DELETE = "\x7F";
+var BACKSPACE = "\b";
+async function readSecretFromTty(prompt) {
+  const input = process.stdin;
+  if (!input.isTTY) {
+    return new Promise((resolve5) => {
+      const readline = createInterface({ input });
+      readline.once("line", (line) => {
+        readline.close();
+        resolve5(line.trim());
+      });
+      readline.once("close", () => resolve5(""));
+    });
+  }
+  process.stdout.write(prompt);
+  const previouslyRaw = input.isRaw ?? false;
+  input.setRawMode?.(true);
+  input.resume();
+  input.setEncoding("utf8");
+  return new Promise((resolve5) => {
+    let value = "";
+    const finish = () => {
+      input.removeListener("data", onData);
+      input.setRawMode?.(previouslyRaw);
+      input.pause();
+      process.stdout.write("\n");
+      resolve5(value.trim());
+    };
+    const onData = (chunk) => {
+      for (const character of chunk) {
+        switch (character) {
+          case "\r":
+          case "\n":
+            finish();
+            return;
+          case ETX:
+            input.setRawMode?.(previouslyRaw);
+            process.stdout.write("\n");
+            process.exit(130);
+            return;
+          case DELETE:
+          case BACKSPACE:
+            value = value.slice(0, -1);
+            break;
+          default:
+            if (character >= " ") value += character;
+        }
+      }
+    };
+    input.on("data", onData);
+  });
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/commands/agent.ts
+import { hostname } from "node:os";
+import { homedir as homedir2 } from "node:os";
+import { resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+
+// src/files.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname, isAbsolute, join as join2, relative, resolve as resolve2 } from "node:path";
+var OutsideWorkspace = class extends Error {
+  constructor(path) {
+    super(`${path} is outside the directory this session was started in.`);
+    this.name = "OutsideWorkspace";
+  }
+};
+var TooLarge = class extends Error {
+  constructor(path, bytes, limit) {
+    super(`${path} is ${Math.round(bytes / 1024)} KB, over the ${Math.round(limit / 1024)} KB limit.`);
+    this.name = "TooLarge";
+  }
+};
+var MAX_READ_BYTES = 512 * 1024;
+function realLocation(absolute) {
+  let existing = absolute;
+  const trailing = [];
+  while (!existsSync2(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing) return absolute;
+    trailing.unshift(existing.slice(parent.length + 1));
+    existing = parent;
+  }
+  try {
+    return join2(realpathSync(existing), ...trailing);
+  } catch {
+    return absolute;
+  }
+}
+function within(root, path) {
+  const absolute = isAbsolute(path) ? path : resolve2(root, path);
+  const real = realLocation(absolute);
+  const realRoot = realLocation(resolve2(root));
+  const rel = relative(realRoot, real);
+  if (rel !== "" && (rel.startsWith("..") || isAbsolute(rel))) {
+    throw new OutsideWorkspace(path);
+  }
+  return real;
+}
+function readWithin(root, path) {
+  const absolute = within(root, path);
+  const stats = statSync(absolute);
+  if (!stats.isFile()) throw new Error(`${path} is not a file.`);
+  if (stats.size > MAX_READ_BYTES) throw new TooLarge(path, stats.size, MAX_READ_BYTES);
+  return {
+    path: absolute,
+    text: readFileSync2(absolute, "utf8"),
+    bytes: stats.size
+  };
+}
+function proposeWrite(root, path, contents) {
+  const absolute = within(root, path);
+  let existing;
+  try {
+    const stats = statSync(absolute);
+    if (stats.isFile() && stats.size <= MAX_READ_BYTES) {
+      existing = readFileSync2(absolute, "utf8");
+    }
+  } catch {
+  }
+  return {
+    path: absolute,
+    contents,
+    ...existing !== void 0 ? { existing } : {}
+  };
+}
+function commitWrite(write2, confirmed) {
+  if (!confirmed) throw new Error("refusing to write without confirmation");
+  writeFileSync2(write2.path, write2.contents, "utf8");
+}
+function summarise(write2, maxLines = 40) {
+  if (write2.existing === void 0) {
+    const lines = write2.contents.split("\n");
+    const head = lines.slice(0, maxLines).map((line) => `+ ${line}`);
+    if (lines.length > maxLines) head.push(`  \u2026 ${lines.length - maxLines} more lines`);
+    return `create ${write2.path} (${lines.length} lines)
+${head.join("\n")}`;
+  }
+  if (write2.existing === write2.contents) return `${write2.path} is already exactly this.`;
+  const before = write2.existing.split("\n");
+  const after = write2.contents.split("\n");
+  const changes = [];
+  let start = 0;
+  while (start < before.length && start < after.length && before[start] === after[start]) {
+    start += 1;
+  }
+  let end = 0;
+  while (end < before.length - start && end < after.length - start && before[before.length - 1 - end] === after[after.length - 1 - end]) {
+    end += 1;
+  }
+  const removed = before.slice(start, before.length - end);
+  const added = after.slice(start, after.length - end);
+  for (const line of removed.slice(0, maxLines)) changes.push(`- ${line}`);
+  if (removed.length > maxLines) changes.push(`  \u2026 ${removed.length - maxLines} more removed`);
+  for (const line of added.slice(0, maxLines)) changes.push(`+ ${line}`);
+  if (added.length > maxLines) changes.push(`  \u2026 ${added.length - maxLines} more added`);
+  return [
+    `edit ${write2.path} (line ${start + 1}: -${removed.length} +${added.length})`,
+    ...changes
+  ].join("\n");
+}
+
+// src/commands/agent.ts
+async function said(response, fallback) {
+  const body = await response.json().catch(() => void 0);
+  const message2 = typeof body === "object" && body !== null && "error" in body ? body.error?.message : void 0;
+  return message2 ?? `${fallback} (${response.status})`;
+}
+function locate(roots, requested) {
+  const expanded = requested.startsWith("~") ? resolve3(homedir2(), requested.slice(1).replace(/^[/\\]/, "")) : requested;
+  for (const root of roots) {
+    try {
+      return within(root, expanded);
+    } catch (error) {
+      if (!(error instanceof OutsideWorkspace)) throw error;
+    }
+  }
+  throw new Error(`${requested} is not inside any allowed folder (${roots.join(", ")})`);
+}
+async function answer(context, apiUrl, token, roots, request) {
+  let located;
+  try {
+    located = locate(roots, request.path);
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : "refused" };
+  }
+  let bytes;
+  try {
+    const stats = statSync2(located);
+    if (!stats.isFile()) return { ok: false, error: `${request.path} is not a file.` };
+    if (stats.size > MAX_READ_BYTES) {
+      return {
+        ok: false,
+        error: new TooLarge(request.path, stats.size, MAX_READ_BYTES).message
+      };
+    }
+    bytes = readFileSync3(located);
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : "could not read it" };
+  }
+  const grant = await fetch(`${apiUrl}/api/v1/agent/upload-url`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      // The name the person asked for, not the resolved path. The resolved one
+      // says where this machine keeps things, which the server has no business
+      // recording.
+      //
+      // No content type is sent: this machine has a path, not a declaration.
+      // The server resolves it from the name against the one table that knows
+      // which types it can read, and tells us below what it decided.
+      filename: request.path.split("/").pop() ?? "file"
+    })
+  });
+  if (!grant.ok) {
+    return { ok: false, error: await said(grant, "could not get an upload url") };
+  }
+  const { uploadUrl, contentType } = await grant.json();
+  const put = await fetch(uploadUrl, {
+    method: "PUT",
+    // The type the grant was signed for. Anything else is refused.
+    headers: { "content-type": contentType },
+    body: new Uint8Array(bytes)
+  });
+  if (!put.ok) return { ok: false, error: `upload refused (${put.status})` };
+  const stored = await put.json().catch(() => ({}));
+  if (!stored.attachToken) return { ok: false, error: "the upload returned no reference" };
+  return { ok: true, attachToken: stored.attachToken, bytes: bytes.length };
+}
+async function agentCommand(context) {
+  const credential = context.resolved.credential;
+  if (!credential) {
+    context.error("Sign in first: pm auth login");
+    return 1;
+  }
+  const roots = (listFlag(context.args, "root") ?? []).map(
+    (one) => resolve3(one.startsWith("~") ? resolve3(homedir2(), one.slice(1).replace(/^[/\\]/, "")) : one)
+  );
+  if (roots.length === 0) {
+    context.error(
+      "Say which folders this machine may read from, and nothing outside them will be:"
+    );
+    context.error("  pm agent --root ~/notes --root ~/projects");
+    return 1;
+  }
+  for (const root of roots) {
+    try {
+      if (!statSync2(root).isDirectory()) {
+        context.error(`${root} is not a folder.`);
+        return 1;
+      }
+    } catch {
+      context.error(`${root} does not exist.`);
+      return 1;
+    }
+  }
+  const apiUrl = context.resolved.apiUrl.replace(/\/+$/, "");
+  const name = hostname();
+  const asked = numberFlag(context.args, "interval");
+  if (asked === "invalid") {
+    context.error("--interval takes a number of seconds.");
+    return 1;
+  }
+  const every = Math.max(2, asked ?? 5) * 1e3;
+  context.print(`Answering as ${name}, from: ${roots.join(", ")}`);
+  context.print("Nothing outside those folders can be read. Ctrl-C to stop.");
+  let running = true;
+  const stop = () => {
+    running = false;
+    context.print("\nStopping. The current request will finish first.");
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+  const call = async (path, body) => fetch(`${apiUrl}/api/v1/agent/${path}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${credential.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  let complaint;
+  const complain = (message2) => {
+    if (complaint === message2) return;
+    complaint = message2;
+    context.error(`  ${message2}`);
+  };
+  const working = () => {
+    if (complaint !== void 0) {
+      complaint = void 0;
+      context.print("  connected again");
+    }
+  };
+  while (running) {
+    try {
+      const beat = await call("heartbeat", { hostname: name, platform: process.platform });
+      if (!beat.ok) {
+        complain(await said(beat, "the service refused this machine"));
+      } else {
+        working();
+        const state = await beat.json();
+        if (state.status === "disabled") {
+          context.print("This machine is switched off after going quiet. Ask an operator to re-enable it.");
+          await new Promise((r) => setTimeout(r, 6e4));
+          continue;
+        }
+        if (state.released > 0) {
+          context.print(`Reconnected. ${state.released} request(s) were waiting.`);
+        }
+      }
+      const claimed = await call("claim", { hostname: name, limit: 5 });
+      if (!claimed.ok) {
+        complain(await said(claimed, "could not pick up work"));
+      } else {
+        const { items } = await claimed.json();
+        for (const request of items) {
+          context.print(`Reading ${request.path}`);
+          const outcome = await answer(context, apiUrl, credential.token, roots, request);
+          const done = await call(
+            `complete/${encodeURIComponent(request.id)}`,
+            outcome.ok ? { result: { attachToken: outcome.attachToken } } : { error: outcome.error }
+          );
+          if (!done.ok) {
+            context.error(`  stored, but the service did not record it: ${await said(done, "refused")}`);
+            continue;
+          }
+          context.print(outcome.ok ? `  sent ${outcome.bytes} bytes` : `  refused: ${outcome.error}`);
+        }
+      }
+    } catch (error) {
+      context.error(`  ${error instanceof Error ? error.message : "connection failed"}`);
+    }
+    if (running) await new Promise((r) => setTimeout(r, every));
+  }
+  return 0;
+}
+
+// src/commands/requests.ts
+async function requestsCommand(context) {
+  const credential = context.resolved.credential;
+  if (!credential) {
+    context.error("Sign in first: pm auth login");
+    return 1;
+  }
+  const apiUrl = context.resolved.apiUrl.replace(/\/+$/, "");
+  const response = await fetch(`${apiUrl}/api/v1/agent/awaiting`, {
+    headers: { authorization: `Bearer ${credential.token}` }
+  });
+  if (response.status === 403) {
+    context.error(
+      "This credential cannot see the approval queue. It is visible only to you, signed in, at /dashboard/requests."
+    );
+    return 3;
+  }
+  if (!response.ok) {
+    context.error(`Could not read the queue (${response.status}).`);
+    return 1;
+  }
+  const { items } = await response.json();
+  if (items.length === 0) {
+    context.print("Nothing is waiting. No app or chat has asked for a file from your computers.");
+    return 0;
+  }
+  context.print(
+    `${items.length} request${items.length === 1 ? "" : "s"} waiting. Nothing has been read.`
+  );
+  context.print("");
+  for (const one of items) {
+    context.print(`  ${one.path}`);
+    context.print(`    asked by ${one.askedBy ?? "something"} \xB7 ${one.id}`);
+    context.print("");
+  }
+  context.print("Approve or refuse them while signed in, at /dashboard/requests.");
+  context.print("They cannot be approved from here \u2014 see `pm help requests`.");
+  return 0;
+}
+
+// src/commands/auth.ts
+async function authCommand(context) {
+  const action = context.args.words[1] ?? "status";
+  switch (action) {
+    case "login":
+      return login(context);
+    case "logout":
+      return logout(context);
+    case "status":
+      return status(context);
+    default:
+      context.error(`Unknown command "pm auth ${action}". Try login, logout or status.`);
+      return 2;
+  }
+}
+var SCOPE = "memory:read memory:capture memory:write usage:read";
+async function login(context) {
+  const { flags } = context;
+  const profile = flags.profile ?? DEFAULT_PROFILE;
+  const apiUrl = context.resolved.apiUrl;
+  if (flags.apiKey !== void 0) {
+    const key = flags.apiKey === true ? await context.readSecret("API key: ") : flags.apiKey;
+    if (!key) {
+      context.error("No API key was given.");
+      return 2;
+    }
+    saveLogin({
+      paths: context.paths,
+      profile,
+      apiUrl,
+      credential: { kind: "api-key", token: key }
+    });
+    context.print(`Signed in to ${apiUrl} as profile "${profile}" with an API key.`);
+    return 0;
+  }
+  try {
+    const { credential, clientId } = await loginWithBrowser({
+      apiUrl,
+      scope: SCOPE,
+      clientId: context.resolved.clientId,
+      deps: context.oauth
+    });
+    saveLogin({
+      paths: context.paths,
+      profile,
+      apiUrl,
+      credential,
+      clientId
+    });
+    context.print(`
+Signed in to ${apiUrl} as profile "${profile}".`);
+    return 0;
+  } catch (error) {
+    context.error(message(error));
+    return 1;
+  }
+}
+function logout(context) {
+  const profile = context.flags.profile ?? context.resolved.profile;
+  const forgotten = clearLogin(context.paths, profile);
+  context.print(
+    forgotten ? `Signed out of profile "${profile}".` : `Profile "${profile}" was not signed in.`
+  );
+  if (process.env["PERSISTMEMORY_API_KEY"]) {
+    context.print(
+      "PERSISTMEMORY_API_KEY is still set in this shell, and takes precedence. Unset it to finish signing out."
+    );
+  }
+  return 0;
+}
+async function status(context) {
+  const config = readConfig(context.paths);
+  const resolved = context.resolved;
+  if (!resolved.credential) {
+    context.print(`Not signed in. Run \`pm auth login\`.
+
+  api url  ${resolved.apiUrl}`);
+    return 1;
+  }
+  const lines = [
+    `  profile   ${resolved.profile}${config.current === resolved.profile ? " (current)" : ""}`,
+    `  api url   ${resolved.apiUrl}`,
+    `  method    ${resolved.credential.kind === "api-key" ? "API key" : "browser sign-in"}`,
+    `  token     ${maskToken(resolved.credential.token)}`
+  ];
+  if (resolved.fromEnvironment) {
+    lines.push("  source    PERSISTMEMORY_API_KEY (overrides the stored profile)");
+  }
+  if (resolved.credential.expiresAt) {
+    lines.push(`  expires   ${resolved.credential.expiresAt}`);
+  }
+  if (resolved.credential.scope) {
+    lines.push(`  scope     ${resolved.credential.scope}`);
+  }
+  context.print(lines.join("\n"));
+  try {
+    await currentCredential(resolved, context.session);
+    const client = await context.client();
+    await client.health.ready();
+    context.print("\n  The server accepted this credential.");
+    return 0;
+  } catch (error) {
+    context.print(`
+  The server did NOT accept this credential: ${message(error)}`);
+    return 1;
+  }
+}
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/commands/session.ts
+import { createInterface as createInterface2 } from "node:readline";
+import { randomUUID } from "node:crypto";
+import { relative as relative2 } from "node:path";
+
+// src/events.ts
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "node:fs";
+import { join as join3 } from "node:path";
+function openSessionLog(paths, id) {
+  const directory = join3(paths.dir, "sessions");
+  mkdirSync2(directory, { recursive: true, mode: 448 });
+  const path = join3(directory, `${id}.jsonl`);
+  return {
+    id,
+    path,
+    append(event) {
+      try {
+        appendFileSync(path, `${JSON.stringify(event)}
+`, { mode: 384 });
+      } catch {
+      }
+    },
+    read() {
+      if (!existsSync3(path)) return [];
+      return readFileSync4(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+        try {
+          return [JSON.parse(line)];
+        } catch {
+          return [];
+        }
+      });
+    }
+  };
+}
+function turnsFrom(events) {
+  const turns = [];
+  for (const event of events) {
+    if (event.kind === "prompt") turns.push({ role: "user", content: event.text });
+    if (event.kind === "reply") turns.push({ role: "assistant", content: event.text });
+  }
+  return turns;
+}
+function totalUsage(events) {
+  let turns = 0;
+  let inputTokens = 0;
+  let outputTokens = 0;
+  for (const event of events) {
+    if (event.kind !== "reply") continue;
+    turns += 1;
+    inputTokens += event.usage?.inputTokens ?? 0;
+    outputTokens += event.usage?.outputTokens ?? 0;
+  }
+  return { turns, inputTokens, outputTokens };
+}
+
+// src/commands/session.ts
+var HELP2 = `
+  Commands
+
+    /read <path>          read a file into the conversation
+    /capture <path>       read a file AND remember it
+    /write <path>         write the last reply to a file (asks first)
+    /remember <text>      remember something directly
+    /usage                what this session has cost
+    /new                  start a fresh conversation
+    /exit                 leave (Ctrl-D also works)
+
+  Anything else is a question, answered from your memory.
+`;
+async function sessionCommand(context) {
+  const resumeId = stringFlag(context.args, "resume");
+  const id = resumeId ?? randomUUID();
+  const log = openSessionLog(context.paths, id);
+  const state = { turns: [], attached: [] };
+  if (resumeId) {
+    const previous = log.read();
+    state.turns = turnsFrom(previous);
+    if (state.turns.length === 0) {
+      context.error(`No session "${resumeId}" to resume.`);
+      return 1;
+    }
+    context.print(`Resumed session ${resumeId} \u2014 ${state.turns.length} turns.`);
+  }
+  try {
+    await context.client();
+  } catch (error) {
+    context.error(error instanceof Error ? error.message : String(error));
+    return 3;
+  }
+  log.append({
+    kind: "session.started",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    cwd: process.cwd(),
+    apiUrl: context.resolved.apiUrl,
+    profile: context.resolved.profile
+  });
+  context.print(`
+  PersistMemory \u2014 session ${id.slice(0, 8)}`);
+  context.print(`  Ask anything. /help for commands, /exit to leave.
+`);
+  const readline = createInterface2({ input: process.stdin, output: process.stdout });
+  const ask = (prompt) => new Promise((resolve5) => {
+    readline.question(prompt, resolve5);
+    readline.once("close", () => resolve5(void 0));
+  });
+  const root = process.cwd();
+  let running = true;
+  while (running) {
+    const line = await ask("> ");
+    if (line === void 0) break;
+    const input = line.trim();
+    if (input === "") continue;
+    try {
+      running = await handleInput({ input, context, state, log, root, ask });
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      log.append({ kind: "error", at: (/* @__PURE__ */ new Date()).toISOString(), message: message2 });
+      context.error(`  ${message2}`);
+    }
+  }
+  readline.close();
+  const totals = totalUsage(log.read());
+  log.append({ kind: "session.ended", at: (/* @__PURE__ */ new Date()).toISOString(), turns: totals.turns });
+  context.print(
+    `
+  ${totals.turns} turn${totals.turns === 1 ? "" : "s"}` + (totals.inputTokens + totals.outputTokens > 0 ? `, ${totals.inputTokens + totals.outputTokens} tokens` : "") + `
+  Transcript: ${log.path}
+  Resume with: pm chat --resume ${id}
+`
+  );
+  return 0;
+}
+async function handleInput(args) {
+  const { input, context, state, log, root } = args;
+  if (!input.startsWith("/")) {
+    await answer2(args);
+    return true;
+  }
+  const [command, ...rest] = input.slice(1).split(/\s+/);
+  const argument = rest.join(" ").trim();
+  switch (command) {
+    case "exit":
+    case "quit":
+      return false;
+    case "help":
+      context.print(HELP2);
+      return true;
+    case "usage": {
+      const totals = totalUsage(log.read());
+      context.print(
+        `  ${totals.turns} turns, ${totals.inputTokens} in / ${totals.outputTokens} out tokens`
+      );
+      return true;
+    }
+    case "new":
+      delete state.conversationId;
+      state.turns = [];
+      state.attached = [];
+      delete state.lastReply;
+      context.print("  Starting a fresh conversation.");
+      return true;
+    case "read":
+    case "capture": {
+      if (!argument) {
+        context.error(`  /${command} needs a path.`);
+        return true;
+      }
+      const file = readWithin(root, argument);
+      state.attached.push({ path: file.path, text: file.text });
+      log.append({
+        kind: "file.read",
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        path: file.path,
+        bytes: file.bytes
+      });
+      context.print(`  read ${relative2(root, file.path)} (${Math.round(file.bytes / 1024)} KB)`);
+      if (command === "capture") {
+        const client = await context.client();
+        const result = await client.memories.remember(
+          { text: file.text, title: relative2(root, file.path) },
+          { idempotencyKey: `cli:capture:${file.path}:${file.bytes}` }
+        );
+        log.append({
+          kind: "file.captured",
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          path: file.path,
+          jobId: result.jobId
+        });
+        context.print(`  queued for extraction (job ${result.jobId})`);
+      }
+      return true;
+    }
+    case "remember": {
+      if (!argument) {
+        context.error("  /remember needs something to remember.");
+        return true;
+      }
+      const client = await context.client();
+      const result = await client.memories.remember({ text: argument });
+      context.print(`  queued for extraction (job ${result.jobId})`);
+      return true;
+    }
+    case "write":
+      await write({ ...args, path: argument });
+      return true;
+    default:
+      context.error(`  Unknown command /${command ?? ""}. Try /help.`);
+      return true;
+  }
+}
+async function answer2(args) {
+  const { input, context, state, log } = args;
+  const attached = state.attached.map((file) => `--- ${file.path} ---
+${file.text}`).join("\n\n");
+  const content = attached ? `${attached}
+
+---
+
+${input}` : input;
+  log.append({ kind: "prompt", at: (/* @__PURE__ */ new Date()).toISOString(), text: input });
+  state.turns.push({ role: "user", content });
+  const client = await context.client();
+  const response = await client.request("POST", "/api/v1/chat", {
+    messages: state.turns.slice(-20),
+    ...state.conversationId ? { conversationId: state.conversationId } : {}
+  });
+  const reply = response.message.content;
+  state.turns.push({ role: "assistant", content: reply });
+  state.lastReply = reply;
+  if (response.conversationId) state.conversationId = response.conversationId;
+  state.attached = [];
+  log.append({
+    kind: "reply",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    text: reply,
+    citations: response.citations?.length ?? 0,
+    ...response.diagnostics?.usage ? { usage: response.diagnostics.usage } : {},
+    ...response.diagnostics?.model ? { model: response.diagnostics.model } : {}
+  });
+  context.print(`
+${reply}
+`);
+  if (response.citations?.length) {
+    const historical = response.citations.filter((one) => one.historical).length;
+    context.print(
+      `  from ${response.citations.length} memor${response.citations.length === 1 ? "y" : "ies"}` + // Never omitted. A superseded memory presented as current is the most
+      // damaging thing this system can do.
+      (historical > 0 ? `, ${historical} no longer current` : "")
+    );
+  }
+  if (response.diagnostics?.degraded && !context.flags.quiet) {
+    context.error("  Note: answered without the semantic index, so this may be narrower than usual.");
+  }
+}
+async function write(args) {
+  const { context, state, log, root } = args;
+  if (!args.path) {
+    context.error("  /write needs a path.");
+    return;
+  }
+  if (!state.lastReply) {
+    context.error("  Nothing to write yet \u2014 ask something first.");
+    return;
+  }
+  const proposed = proposeWrite(root, args.path, `${state.lastReply}
+`);
+  context.print("");
+  context.print(summarise(proposed));
+  context.print("");
+  const reply = (await args.ask("  Write it? [y/N] "))?.trim().toLowerCase();
+  const approved = reply === "y" || reply === "yes";
+  log.append({
+    kind: "file.write",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    path: proposed.path,
+    approved,
+    ...approved ? { bytes: Buffer.byteLength(proposed.contents) } : {}
+  });
+  if (!approved) {
+    context.print("  Not written.");
+    return;
+  }
+  commitWrite(proposed, true);
+  context.print(`  Wrote ${relative2(root, proposed.path)}.`);
+}
+
+// src/commands/memory.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+var memoryColumns = [
+  { header: "id", value: (m) => m.id },
+  { header: "type", value: (m) => m.type },
+  { header: "title", value: (m) => m.title },
+  { header: "confidence", value: (m) => m.confidence.toFixed(2) },
+  { header: "updated", value: (m) => shortDate(m.updatedAt) }
+];
+var memoryFields = [
+  { header: "id", value: (m) => m.id },
+  { header: "type", value: (m) => m.type },
+  { header: "state", value: (m) => m.state },
+  { header: "title", value: (m) => m.title },
+  { header: "content", value: (m) => m.content },
+  { header: "confidence", value: (m) => m.confidence.toFixed(2) },
+  { header: "importance", value: (m) => m.importance.toFixed(2) },
+  { header: "entities", value: (m) => m.entities.map((e) => e.name).join(", ") },
+  { header: "spaces", value: (m) => (m.spaceIds ?? []).join(", ") },
+  { header: "version", value: (m) => String(m.version) },
+  { header: "created", value: (m) => shortDate(m.createdAt) },
+  { header: "updated", value: (m) => shortDate(m.updatedAt) }
+];
+async function rememberCommand(context) {
+  const positional = context.args.words.slice(1);
+  const file = stringFlag(context.args, "file", "f");
+  let text;
+  if (file) {
+    try {
+      text = readFileSync5(file, "utf8");
+    } catch {
+      context.error(`Could not read ${file}.`);
+      return 1;
+    }
+  } else if (positional[0] === "-" || positional.length === 0 && !process.stdin.isTTY) {
+    text = await readStdin();
+  } else {
+    text = positional.join(" ");
+  }
+  if (text.trim() === "") {
+    context.error("Nothing to remember. Pass text, a --file, or pipe something in.");
+    return 2;
+  }
+  const client = await context.client();
+  const spaceIds = listFlag(context.args, "space", "spaces");
+  const title = stringFlag(context.args, "title");
+  const result = await client.memories.remember(
+    {
+      text,
+      ...title ? { title } : {},
+      ...spaceIds ? { spaceIds } : {}
+    },
+    {
+      /**
+       * A key derived from the CONTENT, not a random one.
+       *
+       * The SDK will not retry a POST without one, and a random value per
+       * attempt would defeat the point: a request that timed out after the
+       * server accepted it would be captured twice. Same text, same key, one
+       * memory — which is what a person re-running a failed command expects.
+       */
+      idempotencyKey: `cli:remember:${hash(text)}`
+    }
+  );
+  if (context.flags.output !== "table") {
+    context.print(renderOne(result, [
+      { header: "status", value: (r) => r.status },
+      { header: "jobId", value: (r) => r.jobId },
+      { header: "note", value: (r) => r.note }
+    ], { format: context.flags.output }));
+    return 0;
+  }
+  context.print(`Accepted for processing. Job ${result.jobId}.`);
+  context.print(result.note);
+  return 0;
+}
+async function searchCommand(context) {
+  const query = context.args.words.slice(1).join(" ").trim();
+  if (query === "") {
+    context.error('Nothing to search for. Try `pm search "what did we decide about Postgres"`.');
+    return 2;
+  }
+  const limit = numberFlag(context.args, "limit", "n");
+  if (limit === "invalid") {
+    context.error("--limit must be a number.");
+    return 2;
+  }
+  const client = await context.client();
+  const spaceIds = listFlag(context.args, "space", "spaces");
+  const response = await client.search.query({
+    query,
+    ...limit !== void 0 ? { limit } : {},
+    ...spaceIds ? { spaceIds } : {},
+    ...stringFlag(context.args, "as-of") ? { asOf: stringFlag(context.args, "as-of") } : {}
+  });
+  if (context.flags.output === "json" || context.flags.output === "yaml") {
+    context.print(renderOne(response, [], { format: context.flags.output }));
+    return 0;
+  }
+  const columns = [
+    { header: "score", value: (r) => r.score.toFixed(3) },
+    { header: "type", value: (r) => r.memory.type },
+    { header: "title", value: (r) => r.memory.title },
+    { header: "content", value: (r) => r.memory.content },
+    { header: "id", value: (r) => r.memory.id }
+  ];
+  if (response.results.length === 0) {
+    context.print(`Nothing found for "${response.query}".`);
+  } else {
+    context.print(render(response.results, columns, { format: context.flags.output }));
+  }
+  if (response.diagnostics.degraded && !context.flags.quiet) {
+    const notice = response.diagnostics.notice ?? `search ran without ${(response.diagnostics.unavailable ?? ["some capabilities"]).join(", ")}`;
+    context.error(`
+Note: these results are narrower than usual \u2014 ${notice}`);
+  }
+  return 0;
+}
+async function listMemoriesCommand(context) {
+  const limit = numberFlag(context.args, "limit", "n");
+  if (limit === "invalid") {
+    context.error("--limit must be a number.");
+    return 2;
+  }
+  const client = await context.client();
+  const page = client.memories.list({
+    ...limit !== void 0 ? { limit } : {},
+    ...listFlag(context.args, "type") ? { type: listFlag(context.args, "type") } : {},
+    ...listFlag(context.args, "space", "spaces") ? { spaceIds: listFlag(context.args, "space", "spaces") } : {}
+  });
+  const rows = context.args.flags["all"] ? await page.all(limit ?? 1e3) : (await page.first()).data;
+  if (rows.length === 0) {
+    context.print("No memories yet.");
+    return 0;
+  }
+  context.print(render(rows, memoryColumns, { format: context.flags.output }));
+  return 0;
+}
+async function getMemoryCommand(context) {
+  const id = context.args.words[2];
+  if (!id) {
+    context.error("Which memory? Try `pm get memory <id>`.");
+    return 2;
+  }
+  const client = await context.client();
+  const memory = await client.memories.get(id);
+  context.print(renderOne(memory, memoryFields, { format: context.flags.output }));
+  return 0;
+}
+async function listSpacesCommand(context) {
+  const client = await context.client();
+  const { data } = await client.spaces.list().first();
+  if (data.length === 0) {
+    context.print("No Spaces yet.");
+    return 0;
+  }
+  const columns = [
+    { header: "id", value: (s) => s.id },
+    { header: "name", value: (s) => s.name },
+    { header: "kind", value: (s) => s.kind },
+    { header: "memories", value: (s) => s.memoryCount === void 0 ? "" : String(s.memoryCount) },
+    { header: "created", value: (s) => shortDate(s.createdAt) }
+  ];
+  context.print(render(data, columns, { format: context.flags.output }));
+  return 0;
+}
+async function statusCommand(context) {
+  const client = await context.client();
+  const health = await client.health.ready();
+  context.print(
+    renderOne(health, [{ header: "status", value: (h) => JSON.stringify(h) }], {
+      format: context.flags.output === "table" ? "yaml" : context.flags.output
+    })
+  );
+  return 0;
+}
+function hash(text) {
+  let value = 2166136261;
+  for (let index = 0; index < text.length; index += 1) {
+    value ^= text.charCodeAt(index);
+    value = Math.imul(value, 16777619) >>> 0;
+  }
+  return value.toString(16).padStart(8, "0");
+}
+
+// src/index.ts
+async function run(deps) {
+  const args = parseArgs(deps.argv);
+  const print = deps.stdout ?? ((line) => process.stdout.write(`${line}
+`));
+  const error = deps.stderr ?? ((line) => process.stderr.write(`${line}
+`));
+  if (boolFlag(args, "version", "v")) {
+    print(VERSION);
+    return 0;
+  }
+  if (boolFlag(args, "help", "h")) {
+    print(HELP);
+    return 0;
+  }
+  const flags = globalFlags(args, deps);
+  if (flags === "invalid-output") {
+    error(`--output must be one of table, json, yaml, csv, tsv.`);
+    return 2;
+  }
+  if (flags === "invalid-limit") {
+    error("--limit must be a number.");
+    return 2;
+  }
+  const paths = deps.paths ?? pathsFor();
+  const resolved = resolve({
+    paths,
+    profileFlag: flags.profile,
+    apiUrlFlag: flags.apiUrl,
+    // A prompted key is not known yet; only a literal one participates here.
+    apiKeyFlag: typeof flags.apiKey === "string" ? flags.apiKey : void 0,
+    ...deps.env ? { env: deps.env } : {}
+  });
+  const fetchImpl = deps.fetch ?? globalThis.fetch;
+  const oauth = {
+    fetch: fetchImpl,
+    ...deps.openBrowser ? { openBrowser: deps.openBrowser } : {},
+    print
+  };
+  const session = { ...oauth, paths, userAgent: `persistmemory-cli/${VERSION}` };
+  const context = {
+    args,
+    flags,
+    paths,
+    resolved,
+    oauth,
+    session,
+    client: () => clientFor(resolved, session),
+    print,
+    error,
+    readSecret: deps.readSecret ?? readSecretFromTty
+  };
+  if (args.words.length === 0) {
+    if (!(deps.isTty ?? process.stdin.isTTY ?? false)) {
+      print(HELP);
+      return 0;
+    }
+    return sessionCommand(context);
+  }
+  try {
+    return await dispatch(context);
+  } catch (caught) {
+    return report(caught, error);
+  }
+}
+async function dispatch(context) {
+  const [verb, noun] = context.args.words;
+  switch (verb) {
+    case "auth":
+      return authCommand(context);
+    case "agent":
+      return agentCommand(context);
+    case "chat":
+    case "session":
+      return sessionCommand(context);
+    case "remember":
+      return rememberCommand(context);
+    case "search":
+      return searchCommand(context);
+    case "status":
+      return statusCommand(context);
+    case "requests":
+      return requestsCommand(context);
+    /**
+     * `pm <verb> <noun>`, the grammar the Harness CLI uses.
+     *
+     * Worth copying rather than inventing: a person who has typed
+     * `list pipelines` can guess `list memories` without opening the help, and
+     * a consistent grammar is what lets a tool grow past the handful of
+     * commands anybody can memorise.
+     */
+    case "list":
+      if (noun === "memories" || noun === "memory") return listMemoriesCommand(context);
+      if (noun === "spaces" || noun === "space") return listSpacesCommand(context);
+      context.error(`Cannot list "${noun ?? ""}". Try memories or spaces.`);
+      return 2;
+    case "get":
+      if (noun === "memory") return getMemoryCommand(context);
+      context.error(`Cannot get "${noun ?? ""}". Try memory.`);
+      return 2;
+    default:
+      context.error(`Unknown command "${verb ?? ""}". Run \`pm --help\`.`);
+      return 2;
+  }
+}
+function globalFlags(args, deps) {
+  const requested = stringFlag(args, "output", "o");
+  if (requested !== void 0 && !isOutputFormat(requested)) return "invalid-output";
+  const limit = numberFlag(args, "limit", "n");
+  if (limit === "invalid") return "invalid-limit";
+  const isTty = deps.isTty ?? process.stdout.isTTY ?? false;
+  const output = requested ?? (isTty ? "table" : "json");
+  const apiKey = args.flags["api-key"];
+  const profile = stringFlag(args, "profile", "p");
+  const apiUrl = stringFlag(args, "api-url");
+  return {
+    ...profile !== void 0 ? { profile } : {},
+    ...apiUrl !== void 0 ? { apiUrl } : {},
+    ...apiKey === true || typeof apiKey === "string" ? { apiKey } : {},
+    output,
+    quiet: boolFlag(args, "quiet", "q"),
+    ...limit !== void 0 ? { limit } : {}
+  };
+}
+function report(caught, error) {
+  if (caught instanceof NotSignedIn) {
+    error(caught.message);
+    return 3;
+  }
+  if (caught instanceof PersistMemoryError) {
+    error(caught.message);
+    return caught.status === 401 || caught.status === 403 ? 3 : 1;
+  }
+  error(caught instanceof Error ? caught.message : String(caught));
+  return 1;
+}
+export {
+  PersistMemory,
+  run
+};
+//# sourceMappingURL=index.js.map