nolo-cli 0.210.0-alpha.2 → 0.212.0-alpha.1

package/{chunk-C2XZM3K4.js → chunk-HIRC32DV.js}

@@ -1,13 +1,14 @@
+import {
+  resolveRuntimeAuthToken,
+  resolveRuntimeServerUrl
+} from "./chunk-HRMJUN5J.js";
 import {
   isAgentRunTerminalStatus,
   normalizeRunTitle
 } from "./chunk-PJNFNEJE.js";
 import {
   findPowerShellExecutable
-} from "./chunk-XPHZK3PJ.js";
-import {
-  resolvePlatformAuthToken
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-JNKSDZFS.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
@@ -1073,22 +1074,6 @@ function reserveHostMemory(deps) {
   throw new Error("[host-memory-reservation] exclusive lock required");
 }
 
-// packages/cli/client/localRuntimeHelpers.ts
-var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
-var remoteDialogSyncTimeoutMsForTest;
-function setRemoteDialogSyncTimeoutForTest(ms) {
-  remoteDialogSyncTimeoutMsForTest = ms;
-}
-function remoteDialogSyncTimeout() {
-  return remoteDialogSyncTimeoutMsForTest ?? REMOTE_DIALOG_SYNC_TIMEOUT_MS;
-}
-function resolveRuntimeServerUrl(env) {
-  return (env?.NOLO_SERVER_URL || env?.NOLO_SERVER || env?.BASE_URL || "").replace(/\/+$/, "");
-}
-function resolveRuntimeAuthToken(env) {
-  return resolvePlatformAuthToken(env ?? {});
-}
-
 // packages/cli/agentRunResultFile.ts
 function resolveResultServerMeta(input) {
   const serverUrl = resolveRuntimeServerUrl(input.env);
@@ -3152,10 +3137,6 @@ export {
   createShellApprovalChild,
   readHostMemory,
   assertHostMemoryAdmission,
-  setRemoteDialogSyncTimeoutForTest,
-  remoteDialogSyncTimeout,
-  resolveRuntimeServerUrl,
-  resolveRuntimeAuthToken,
   resolveResultServerMeta,
   recordRunResultHeaderMeta,
   getRunResultHeaderMeta,

package/{chunk-QQM464AL.js → chunk-HPFCI4SK.js}

@@ -1,11 +1,11 @@
 import {
   selectCurrentServer,
   selectRemoteServers
-} from "./chunk-BSISWVB4.js";
+} from "./chunk-4I7ERB7F.js";
 import {
   noloDeleteRequest,
   noloWriteRequest
-} from "./chunk-X4F26D5K.js";
+} from "./chunk-P5L7CXOC.js";
 import {
   normalizeTimeFields
 } from "./chunk-AGP3YSEC.js";
@@ -21,7 +21,7 @@ import {
   sanitizeShareData,
   shareKey,
   toNonEmptyString
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
 
 // packages/share/action.ts
 var generateToken = () => {

package/chunk-HRMJUN5J.js

@@ -0,0 +1,26 @@
+import {
+  resolvePlatformAuthToken
+} from "./chunk-TCZHTTUU.js";
+
+// packages/cli/client/localRuntimeHelpers.ts
+var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
+var remoteDialogSyncTimeoutMsForTest;
+function setRemoteDialogSyncTimeoutForTest(ms) {
+  remoteDialogSyncTimeoutMsForTest = ms;
+}
+function remoteDialogSyncTimeout() {
+  return remoteDialogSyncTimeoutMsForTest ?? REMOTE_DIALOG_SYNC_TIMEOUT_MS;
+}
+function resolveRuntimeServerUrl(env) {
+  return (env?.NOLO_SERVER_URL || env?.NOLO_SERVER || env?.BASE_URL || "").replace(/\/+$/, "");
+}
+function resolveRuntimeAuthToken(env) {
+  return resolvePlatformAuthToken(env ?? {});
+}
+
+export {
+  setRemoteDialogSyncTimeoutForTest,
+  remoteDialogSyncTimeout,
+  resolveRuntimeServerUrl,
+  resolveRuntimeAuthToken
+};

package/{chunk-HD3WR3TD.js → chunk-IAPCBNEE.js}

@@ -206,7 +206,7 @@ async function readDocFunc(args, thunkApi) {
     throw new Error(`\u65E0\u6548\u7684\u9875\u9762 ID: ${id}\u3002\u9875\u9762 ID \u901A\u5E38\u4EE5 "page-" \u5F00\u5934\u3002`);
   }
   try {
-    const { readAction } = await import("./read-DIIQBOOO.js");
+    const { readAction } = await import("./read-4VZQODSN.js");
     const pageData = await readAction({ dbKey: id }, thunkApi);
     if (!pageData) {
       throw new Error(`\u672A\u627E\u5230 ID \u4E3A ${id} \u7684\u9875\u9762\u3002`);

package/{chunk-XDMGY5IU.js → chunk-IF45XG7K.js}

@@ -1,12 +1,22 @@
-import {
-  buildLocalAgentLookupKeys,
-  classifyAgentApiKeyRef,
-  formatUnsupportedAgentApiKeyRefMessage,
-  shouldReadAgentKeyRemotely
-} from "./chunk-7AUQ3WCW.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";
+import {
+  createHostCredentialBrokerChain,
+  createStrictHostCredentialBroker
+} from "./chunk-FHU44LN3.js";
+import {
+  buildAgentRuntimeAgentLookupKeys,
+  shouldFetchAgentRuntimeRecordRemotely
+} from "./chunk-25JZEIXN.js";
+import {
+  buildAgentApiKeyCredentialRef,
+  migrateAgentSecrets
+} from "./chunk-2QHFH3DR.js";
+import {
+  assertCredentialRef,
+  createFileCredentialBroker
+} from "./chunk-OQHIVPG4.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -23,16 +33,85 @@ import {
 } from "./chunk-4O22PGNQ.js";
 import {
   createAgentKey
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
+
+// packages/agent-runtime/sessionCredentialBroker.ts
+function createSessionMemoryCredentialBroker() {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    get(ref) {
+      return store.get(assertCredentialRef(ref)) ?? null;
+    },
+    put(ref, secret) {
+      const safe = assertCredentialRef(ref);
+      const value = typeof secret === "string" ? secret.trim() : "";
+      if (!value) throw new Error("Cannot store an empty credential secret.");
+      store.set(safe, value);
+    },
+    delete(ref) {
+      store.delete(assertCredentialRef(ref));
+    },
+    has(ref) {
+      return store.has(assertCredentialRef(ref));
+    },
+    size() {
+      return store.size;
+    }
+  };
+}
+var sharedSessionBroker;
+function getSharedSessionCredentialBroker() {
+  if (!sharedSessionBroker) sharedSessionBroker = createSessionMemoryCredentialBroker();
+  return sharedSessionBroker;
+}
 
 // packages/cli/agentRecordHelpers.ts
 import { readFileSync } from "node:fs";
 
+// packages/agent-runtime/oauthProviderRefs.ts
+var OAUTH_PROVIDER_REFS = [
+  "chatgpt",
+  "xai",
+  "antigravity",
+  "claude",
+  "cursor",
+  "devin"
+];
+var METERED_API_KEY_REF_PREFIX = "api-key:";
+var normalizeRef = (ref) => typeof ref === "string" ? ref.trim().toLowerCase() : "";
+var isKnownOAuthProviderRef = (ref) => OAUTH_PROVIDER_REFS.includes(normalizeRef(ref));
+var isMeteredApiKeyRef = (ref) => {
+  const trimmed = typeof ref === "string" ? ref.trim() : "";
+  return trimmed.length > METERED_API_KEY_REF_PREFIX.length && trimmed.slice(0, METERED_API_KEY_REF_PREFIX.length).toLowerCase() === METERED_API_KEY_REF_PREFIX;
+};
+var OAUTH_PROVIDER_REF_LIST_COPY = OAUTH_PROVIDER_REFS.join(" / ");
+function classifyAgentApiKeyRef(raw) {
+  const trimmed = typeof raw === "string" ? raw.trim() : "";
+  if (!trimmed) return { ok: true, kind: "empty" };
+  if (isKnownOAuthProviderRef(trimmed)) {
+    return {
+      ok: true,
+      kind: "oauth-provider",
+      provider: normalizeRef(trimmed)
+    };
+  }
+  if (isMeteredApiKeyRef(trimmed)) return { ok: true, kind: "metered-api-key" };
+  return { ok: false, kind: "unsupported-oauth-provider", ref: trimmed };
+}
+function formatUnsupportedAgentApiKeyRefMessage(raw) {
+  const shown = typeof raw === "string" ? raw.trim() : "";
+  return `apiKeyRef "${shown}" \u4E0D\u662F\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u8BB0\u5F55\u672A\u5199\u5165\u3002\u5408\u6CD5\u53D6\u503C\uFF1AOAuth provider ref\uFF08${OAUTH_PROVIDER_REF_LIST_COPY}\uFF09\uFF0C\u6216\u8BA1\u91CF/\u8BBE\u5907 broker ref\uFF08\u4EE5 "${METERED_API_KEY_REF_PREFIX}" \u5F00\u5934\uFF0C\u5982 ${METERED_API_KEY_REF_PREFIX}agent-...\uFF09\u3002\u6539\u6CD5\uFF1A\u628A apiKeyRef \u6539\u6210\u4E0A\u9762\u67D0\u4E2A\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u6216\u6539\u7528 ${METERED_API_KEY_REF_PREFIX}<id>\uFF1B\u82E5\u8981\u7528\u81EA\u5E26 API key\uFF0C\u8BF7\u6E05\u7A7A apiKeyRef \u5E76\u586B\u5199 apiKey\u3002`;
+}
+
 // packages/core/agentHandle.ts
 function normalizeAgentHandle(value) {
   return typeof value === "string" && value.trim() ? value.trim().toLowerCase().replace(/\s+/g, " ") : void 0;
 }
 
+// packages/cli/client/localAgentRecords.ts
+var buildLocalAgentLookupKeys = buildAgentRuntimeAgentLookupKeys;
+var shouldReadAgentKeyRemotely = shouldFetchAgentRuntimeRecordRemotely;
+
 // packages/cli/agentRecordHelpers.ts
 var PROVIDER_COPY_FIELDS = [
   "apiSource",
@@ -243,6 +322,7 @@ function assertSupportedAgentApiKeyRef(record) {
 }
 async function writeAgentRecord(args) {
   assertSupportedAgentApiKeyRef(args.record);
+  const remoteRecord = args.remoteIncludeApiKey === false ? Object.fromEntries(Object.entries(args.record).filter(([field]) => field !== "apiKey")) : args.record;
   const res = await fetchWithTransportFallback(`${args.serverUrl}/api/v1/db/write/`, {
     method: "POST",
     headers: {
@@ -253,7 +333,7 @@ async function writeAgentRecord(args) {
       customKey: args.agentKey,
       userId: args.userId,
       data: {
-        ...args.record,
+        ...remoteRecord,
         dbKey: args.agentKey
       }
     })
@@ -494,6 +574,72 @@ function normalizeAgentRecordForOutput(agentKey, authToken, agent) {
     record: sanitizedRecord
   };
 }
+var INBOUND_CRED_REF_PREFIX = "$nolo_cred:";
+var VAULT_REF_PATTERN = /^vault-cred-[A-Za-z0-9]+$/;
+function detectVaultCredentialId(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  const candidate = trimmed.startsWith(INBOUND_CRED_REF_PREFIX) ? trimmed.slice(INBOUND_CRED_REF_PREFIX.length).trim() : trimmed;
+  return VAULT_REF_PATTERN.test(candidate) ? candidate : null;
+}
+var hostCredentialBrokerOverride;
+var credentialStorageWarnings = [];
+var CREDENTIAL_STORE_SESSION_FALLBACK_WARNING = "\u7CFB\u7EDF\u5B89\u5168\u533A\u4E0D\u53EF\u7528\uFF0C\u672C\u6B21\u4F1A\u8BDD\u5185\u6709\u6548\uFF0C\u672A\u6301\u4E45\u5316\uFF1B\u91CD\u542F\u540E\u9700\u91CD\u65B0\u63D0\u4F9B\u8BE5\u51ED\u636E\u3002";
+var CREDENTIAL_STORE_FALLBACK_WARNING = "\u7CFB\u7EDF\u5B89\u5168\u533A\u4E0D\u53EF\u7528\uFF0C\u5DF2\u56DE\u9000\u5230\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF080600 \u660E\u6587\uFF09\u3002\u5EFA\u8BAE\u542F\u7528\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF08Linux: Secret Service / gnome-keyring\uFF09\u3002";
+function resolveStrictCredentialBroker(broker) {
+  return broker ?? hostCredentialBrokerOverride ?? createStrictHostCredentialBroker();
+}
+var legacyReadNoticed = /* @__PURE__ */ new Set();
+function resolveHostCredentialBroker(broker) {
+  if (broker || hostCredentialBrokerOverride) return resolveStrictCredentialBroker(broker);
+  return createHostCredentialBrokerChain({
+    strict: createStrictHostCredentialBroker(),
+    session: getSharedSessionCredentialBroker(),
+    legacy: createFileCredentialBroker({ migration: { enableLegacyMigration: true } }),
+    notifySessionFallback: () => {
+      try {
+        process.stderr.write(`[nolo] Warning: ${CREDENTIAL_STORE_SESSION_FALLBACK_WARNING}
+`);
+      } catch {
+      }
+    },
+    notifyLegacyHit: (ref) => {
+      if (legacyReadNoticed.has(ref)) return;
+      legacyReadNoticed.add(ref);
+      try {
+        process.stderr.write(
+          `[nolo] Warning: \u51ED\u636E "${ref}" \u6765\u81EA\u9057\u7559\u672C\u5730\u660E\u6587\u5B58\u50A8\uFF08\u53EA\u8BFB\u56DE\u9000\uFF09\u3002\u5EFA\u8BAE\u91CD\u65B0\u5F55\u5165\u8BE5 API key \u4EE5\u8FC1\u5165\u7CFB\u7EDF\u5B89\u5168\u533A\u3002
+`
+        );
+      } catch {
+      }
+    }
+  });
+}
+async function storeAgentCredential(args) {
+  const broker = resolveStrictCredentialBroker(args.broker);
+  const credentialRef = buildAgentApiKeyCredentialRef(args.agentKey);
+  await migrateAgentSecrets({
+    agent: { key: args.agentKey, apiKey: args.secret, apiKeyRef: credentialRef },
+    broker
+  });
+  if (!await broker.has(credentialRef)) {
+    throw new Error(`failed to store the credential in the host credential store (${credentialRef}).`);
+  }
+  return { credentialRef };
+}
+async function bindVaultCredentialToAgent(args) {
+  const broker = resolveHostCredentialBroker(args.broker);
+  const secret = await broker.get(args.vaultId);
+  if (!secret) {
+    throw new Error(
+      `--api-key received a vault credential id (${args.vaultId}) but no secret is stored for it on this device. Re-paste the key in the chat so the runtime can isolate it again, or ask the user to run \`nolo secret set <name> --prompt\`.`
+    );
+  }
+  return await storeAgentCredential({ agentKey: args.agentKey, secret, broker: args.broker });
+}
+async function readBoundAgentCredential(credentialRef, broker) {
+  return await resolveHostCredentialBroker(broker).get(credentialRef);
+}
 function parseAgentUpdateArgs(args) {
   const agentInput = readOption(args, "--agent") ?? readOption(args, "--id") ?? args[0]?.trim();
   if (!agentInput || agentInput === "--help" || agentInput === "-h") return null;
@@ -552,13 +698,57 @@ function parseAgentUpdateArgs(args) {
   }
   return { agentInput, updates, promptDoc, copyProviderFrom, verify, verifyPrompt, presetId };
 }
+function looksLikePlaintextApiKey(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (trimmed.length < 12) return false;
+  if (/^(?:api-key:|vault-cred-)/i.test(trimmed)) return false;
+  const verdict = classifyAgentApiKeyRef(trimmed);
+  if (verdict.ok && verdict.kind !== "empty") return false;
+  return true;
+}
+async function applyVaultCredentialBinding(updates, agentKey, broker, fallbackProviderUrl, preservePlaintextApiKey) {
+  const vaultId = detectVaultCredentialId(updates.apiKey);
+  if (!vaultId) {
+    const rawApiKey = updates.apiKey;
+    if (!looksLikePlaintextApiKey(rawApiKey)) return;
+    try {
+      const { credentialRef: credentialRef2 } = await storeAgentCredential({
+        agentKey,
+        secret: String(rawApiKey).trim(),
+        broker
+      });
+      delete updates.apiKey;
+      updates.credentialRef = credentialRef2;
+      updates.apiKeyRef = credentialRef2;
+      if (preservePlaintextApiKey && typeof rawApiKey === "string") {
+        updates.apiKey = rawApiKey;
+      }
+      return;
+    } catch {
+      credentialStorageWarnings.push(CREDENTIAL_STORE_FALLBACK_WARNING);
+      process.stderr.write(`[nolo] Warning: ${CREDENTIAL_STORE_FALLBACK_WARNING}
+`);
+      return;
+    }
+  }
+  delete updates.apiKey;
+  const target = typeof updates.customProviderUrl === "string" && updates.customProviderUrl.trim() ? updates.customProviderUrl.trim() : (fallbackProviderUrl ?? "").trim();
+  if (!target) {
+    throw new Error(
+      "--api-key received a vault credential id, but no provider target was given. Pass --custom-provider-url <base> (or --preset <id>) so the credential has a known destination."
+    );
+  }
+  const { credentialRef } = await bindVaultCredentialToAgent({ agentKey, vaultId, broker });
+  updates.credentialRef = credentialRef;
+  updates.apiKeyRef = credentialRef;
+}
 async function buildCreatedAgentRecord(args) {
   const serverUrl = args.cliArgs ? resolveServerUrl(args.cliArgs, args.env) : resolveServerUrl(args.env);
   const userId = parseUserIdFromAuthToken(args.authToken);
   const resolvedAgentInput = resolveCliAgentKeyInput(args.parsed.agentInput);
   const agentKey = resolvedAgentInput.startsWith("agent-") ? resolvedAgentInput : createAgentKey.private(userId || "local", resolvedAgentInput);
   if (args.parsed.presetId) {
-    const { resolveProviderPresetFields } = await import("./providerPresetApply-ZYMLQA46.js");
+    const { resolveProviderPresetFields } = await import("./providerPresetApply-YXGV6NXB.js");
     const fields = resolveProviderPresetFields(args.parsed.presetId);
     if (fields.kind === "manual") {
       throw new Error(
@@ -617,6 +807,13 @@ async function buildCreatedAgentRecord(args) {
   if (args.parsed.updates.customProviderUrl && !args.parsed.updates.apiSource) {
     args.parsed.updates.apiSource = "custom";
   }
+  await applyVaultCredentialBinding(
+    args.parsed.updates,
+    agentKey,
+    args.credentialBroker,
+    void 0,
+    !args.hostApproval?.gateId
+  );
   const nextRecord = {
     ...args.parsed.updates,
     dbKey: agentKey,
@@ -686,6 +883,15 @@ async function buildUpdatedAgentRecord(args) {
     }
     args.parsed.updates.prompt = promptBody;
   }
+  await applyVaultCredentialBinding(
+    args.parsed.updates,
+    agentKey,
+    args.credentialBroker,
+    typeof currentRecord?.customProviderUrl === "string" ? currentRecord.customProviderUrl : void 0,
+    // update 的来源判定与 create 一致：宿主代执行 → 严格（删明文只留 ref）；
+    // 用户自己终端敲 → 保持既有行为（明文照旧写进记录）。
+    !args.hostApproval?.gateId
+  );
   const nextRecord = {
     ...currentRecord,
     ...args.parsed.updates,
@@ -701,6 +907,9 @@ async function buildUpdatedAgentRecord(args) {
 }
 
 export {
+  getSharedSessionCredentialBroker,
+  OAUTH_PROVIDER_REFS,
+  buildLocalAgentLookupKeys,
   fetchWithTransportFallback,
   readAgentRecord,
   readDbRecord,
@@ -713,6 +922,8 @@ export {
   agentRecordHasConfiguredCredential,
   sanitizeAgentRecordForCliOutput,
   normalizeAgentRecordForOutput,
+  CREDENTIAL_STORE_SESSION_FALLBACK_WARNING,
+  readBoundAgentCredential,
   parseAgentUpdateArgs,
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord

package/{chunk-NLT32XBZ.js → chunk-IIQ6JGRI.js}

@@ -1,9 +1,9 @@
 import {
   selectCurrentServer
-} from "./chunk-BSISWVB4.js";
+} from "./chunk-4I7ERB7F.js";
 import {
   patch
-} from "./chunk-UMEGDH6A.js";
+} from "./chunk-BFM34N54.js";
 import {
   getIsDesktopApp
 } from "./chunk-AGP3YSEC.js";

package/{chunk-OP7PTBAJ.js → chunk-IJXYFTV7.js}

@@ -3,10 +3,10 @@ import {
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-27E2CBBY.js";
+} from "./chunk-7OCO4TDT.js";
 import {
   defaultOpenBrowser
-} from "./chunk-XE4Q46FF.js";
+} from "./chunk-3CGG2PAL.js";
 import {
   ANTHROPIC_OAUTH_AUTHORIZE_URL,
   ANTHROPIC_OAUTH_CALLBACK_PORT,
@@ -50,7 +50,7 @@ import {
   startCallbackServer,
   validateXAIEndpoint,
   xaiOAuthDiscovery
-} from "./chunk-SN5XE6GQ.js";
+} from "./chunk-RPQXPZZF.js";
 import {
   extractGoogleValidationLink
 } from "./chunk-BMQ2MJUK.js";
@@ -60,11 +60,7 @@ import {
   detectLocalDevinCredentials,
   extractDevinToken,
   fetchAntigravityCloudCodeCompletion
-} from "./chunk-NTSRCTUX.js";
-import {
-  createOAuthTokenStore,
-  resolveFreshAccessToken
-} from "./chunk-G7Y4GXTY.js";
+} from "./chunk-CTPXME7U.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -81,6 +77,10 @@ import {
 import {
   t
 } from "./chunk-3RQVYR4B.js";
+import {
+  createOAuthTokenStore,
+  resolveFreshAccessToken
+} from "./chunk-G7Y4GXTY.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";

package/{chunk-IIHY4ZAI.js → chunk-INSBKSBB.js}

@@ -1,15 +1,19 @@
 import {
-  formatISO
-} from "./chunk-ZRAU6T47.js";
+  require_formatISO
+} from "./chunk-WPORQFYN.js";
 import {
   getActiveDialogKey
 } from "./chunk-OWYYDMGJ.js";
 import {
   patch,
   selectById
-} from "./chunk-UMEGDH6A.js";
+} from "./chunk-BFM34N54.js";
+import {
+  __toESM
+} from "./chunk-4VNS5WPM.js";
 
 // packages/chat/dialog/actions/setDialogExtraReferencesAction.ts
+var import_formatISO = __toESM(require_formatISO());
 var setDialogExtraReferencesAction = async (extraReferences, thunkApi) => {
   const { dispatch, getState } = thunkApi;
   const state = getState();
@@ -29,7 +33,7 @@ var setDialogExtraReferencesAction = async (extraReferences, thunkApi) => {
       dbKey: currentDialogKey,
       changes: {
         extraReferences: extraReferences ?? [],
-        updatedAt: formatISO(/* @__PURE__ */ new Date())
+        updatedAt: (0, import_formatISO.default)(/* @__PURE__ */ new Date())
       }
     })
   ).unwrap();

package/{chunk-PAFTGNWA.js → chunk-JIT6FSXJ.js}

@@ -7,7 +7,7 @@ import {
   scheduleExistingRecordReplication,
   shouldReplaceLocalWithRemoteRecord,
   shouldReplicateLocalRecord
-} from "./chunk-UCPAVEQB.js";
+} from "./chunk-PYRUW7XN.js";
 import {
   fetchFromClientDb,
   fetchFromServer,

package/{chunk-WTKYP6QO.js → chunk-JTDORD5P.js}

@@ -1,12 +1,12 @@
-import {
-  isDevinOAuthAgent
-} from "./chunk-5ZUL4CUO.js";
 import {
   getModelContextWindow
-} from "./chunk-BTYQAODF.js";
+} from "./chunk-CZM5YTZ7.js";
 import {
   normalizeTimingMs
 } from "./chunk-H57T64RA.js";
+import {
+  isDevinOAuthAgent
+} from "./chunk-5ZUL4CUO.js";
 import {
   BUILTIN_NOLO_AGENT_KEY
 } from "./chunk-LOEO7LRC.js";
@@ -16,7 +16,7 @@ import {
 import {
   isPageKey,
   isTableMetaKey
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
 import {
   isDialogRecordKey
 } from "./chunk-XJWWBO34.js";

package/{chunk-ECX3NKRD.js → chunk-JY5NGFFH.js}

@@ -3051,6 +3051,16 @@ var createTokenStatsAppliedKey = Object.assign(
     })
   }
 );
+var createUsageBackupKey = Object.assign(
+  (userId, dateKey, nowMs) => createKey("usage", "backup", userId, dateKey, nowMs),
+  {
+    /** 某个用户的全部日聚合备份范围：usage-backup-<userId>-* */
+    rangeOfUser: (userId) => ({
+      start: createKey("usage", "backup", userId, ""),
+      end: createKey("usage", "backup", userId, "\uFFFF")
+    })
+  }
+);
 var isTokenStatsKey = (key) => {
   const parts = splitKey(key);
   return parts.length >= 2 && parts[0] === "token" && parts[1] === "stats";
@@ -3509,6 +3519,7 @@ export {
   createTokenDialogBackfillKey,
   createTokenStatsKey,
   createTokenStatsAppliedKey,
+  createUsageBackupKey,
   isTokenStatsKey,
   DIALOG_AGENT_LIST_INDEX_PREFIX,
   parseDialogUpdatedAtMs,