nolo-cli 0.213.0 → 0.223.0-alpha.1

package/chunk-DVQH4BTR.js

@@ -0,0 +1,1137 @@
+import {
+  _appendRetiredStateBatch,
+  loadMemoryVNextCatalog
+} from "./chunk-XI2BWJM5.js";
+import {
+  resolveMachineId
+} from "./chunk-S73EPYNC.js";
+import {
+  getDefaultCliLocalRuntimeDb
+} from "./chunk-N5Z2V73W.js";
+import {
+  createMemoryKey,
+  createMemoryOwnerIndexKey,
+  createMemorySubjectKindIndexKey,
+  memoryOwnerRange
+} from "./chunk-SYTHYBMI.js";
+import {
+  asTrimmedNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
+import {
+  buildCliRuntimeEnv,
+  clearProfileAuthToken,
+  getCurrentProfile,
+  getDefaultProfileConfigPath,
+  getProfileTokens,
+  loadProfileConfig,
+  saveDefaultProfile
+} from "./chunk-R5GO3YZP.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  resolveAuthTokenFromEnv
+} from "./chunk-2THCNKE4.js";
+import {
+  DEFAULT_NOLO_SERVER_URL
+} from "./chunk-OLZBQWZU.js";
+
+// packages/core/crypto.ts
+import nacl from "tweetnacl";
+
+// node_modules/js-base64/base64.mjs
+var version = "3.9.6";
+var VERSION = version;
+var _TD = typeof TextDecoder === "function" ? new TextDecoder("utf-8", { ignoreBOM: true }) : void 0;
+var _TE = typeof TextEncoder === "function" ? new TextEncoder() : void 0;
+var b64ch = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
+var b64chs = Array.prototype.slice.call(b64ch);
+var b64tab = ((a) => {
+  let tab = {};
+  a.forEach((c, i) => tab[c] = i);
+  return tab;
+})(b64chs);
+var b64re = /^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?|[A-Za-z\d+\/]{3}=?)?$/;
+var _fromCC = String.fromCharCode.bind(String);
+var _U8Afrom = typeof Uint8Array.from === "function" ? Uint8Array.from.bind(Uint8Array) : (it) => new Uint8Array(Array.prototype.slice.call(it, 0));
+var _mkUriSafe = (src) => src.replace(/=/g, "").replace(/[+\/]/g, (m0) => m0 == "+" ? "-" : "_");
+var _tidyB64 = (s) => s.replace(/[^A-Za-z0-9\+\/]/g, "");
+var btoaPolyfill = (bin) => {
+  let u32, c0, c1, c2, asc = "";
+  const pad = bin.length % 3;
+  for (let i = 0; i < bin.length; ) {
+    if ((c0 = bin.charCodeAt(i++)) > 255 || (c1 = bin.charCodeAt(i++)) > 255 || (c2 = bin.charCodeAt(i++)) > 255)
+      throw new TypeError("invalid character found");
+    u32 = c0 << 16 | c1 << 8 | c2;
+    asc += b64chs[u32 >> 18 & 63] + b64chs[u32 >> 12 & 63] + b64chs[u32 >> 6 & 63] + b64chs[u32 & 63];
+  }
+  return pad ? asc.slice(0, pad - 3) + "===".substring(pad) : asc;
+};
+var _btoa = typeof btoa === "function" ? (bin) => btoa(bin) : btoaPolyfill;
+var _fromUint8Array = typeof Uint8Array.prototype.toBase64 === "function" ? Function.prototype.call.bind(Uint8Array.prototype.toBase64) : (u8a) => {
+  const maxargs = 4096;
+  let strs = [];
+  for (let i = 0, l = u8a.length; i < l; i += maxargs) {
+    strs.push(_fromCC.apply(null, u8a.subarray(i, i + maxargs)));
+  }
+  return _btoa(strs.join(""));
+};
+var fromUint8Array = (u8a, urlsafe = false) => urlsafe ? _mkUriSafe(_fromUint8Array(u8a)) : _fromUint8Array(u8a);
+var cb_utob = (c) => {
+  if (c.length < 2) {
+    var cc = c.charCodeAt(0);
+    return cc < 128 ? c : cc < 2048 ? _fromCC(192 | cc >>> 6) + _fromCC(128 | cc & 63) : _fromCC(224 | cc >>> 12 & 15) + _fromCC(128 | cc >>> 6 & 63) + _fromCC(128 | cc & 63);
+  } else {
+    var cc = 65536 + (c.charCodeAt(0) - 55296) * 1024 + (c.charCodeAt(1) - 56320);
+    return _fromCC(240 | cc >>> 18 & 7) + _fromCC(128 | cc >>> 12 & 63) + _fromCC(128 | cc >>> 6 & 63) + _fromCC(128 | cc & 63);
+  }
+};
+var re_utob = /[\uD800-\uDBFF][\uDC00-\uDFFF]|[^\x00-\x7F]/g;
+var utob = (u) => u.replace(re_utob, cb_utob);
+var _encode = _TE ? (s) => _fromUint8Array(_TE.encode(s)) : (s) => _btoa(utob(s));
+var encode = (src, urlsafe = false) => urlsafe ? _mkUriSafe(_encode(src)) : _encode(src);
+var encodeURI = (src) => encode(src, true);
+var re_btou = /[\xC0-\xDF][\x80-\xBF]|[\xE0-\xEF][\x80-\xBF]{2}|[\xF0-\xF7][\x80-\xBF]{3}/g;
+var cb_btou = (cccc) => {
+  switch (cccc.length) {
+    case 4:
+      var cp = (7 & cccc.charCodeAt(0)) << 18 | (63 & cccc.charCodeAt(1)) << 12 | (63 & cccc.charCodeAt(2)) << 6 | 63 & cccc.charCodeAt(3), offset = cp - 65536;
+      return _fromCC((offset >>> 10) + 55296) + _fromCC((offset & 1023) + 56320);
+    case 3:
+      return _fromCC((15 & cccc.charCodeAt(0)) << 12 | (63 & cccc.charCodeAt(1)) << 6 | 63 & cccc.charCodeAt(2));
+    default:
+      return _fromCC((31 & cccc.charCodeAt(0)) << 6 | 63 & cccc.charCodeAt(1));
+  }
+};
+var btou = (b) => b.replace(re_btou, cb_btou);
+var atobPolyfill = (asc) => {
+  asc = asc.replace(/\s+/g, "");
+  if (!b64re.test(asc))
+    throw new TypeError("malformed base64.");
+  asc += "==".slice(2 - (asc.length & 3));
+  let u24, r1, r2;
+  let binArray = [];
+  for (let i = 0; i < asc.length; ) {
+    u24 = b64tab[asc.charAt(i++)] << 18 | b64tab[asc.charAt(i++)] << 12 | (r1 = b64tab[asc.charAt(i++)]) << 6 | (r2 = b64tab[asc.charAt(i++)]);
+    if (r1 === 64) {
+      binArray.push(_fromCC(u24 >> 16 & 255));
+    } else if (r2 === 64) {
+      binArray.push(_fromCC(u24 >> 16 & 255, u24 >> 8 & 255));
+    } else {
+      binArray.push(_fromCC(u24 >> 16 & 255, u24 >> 8 & 255, u24 & 255));
+    }
+  }
+  return binArray.join("");
+};
+var _atob = typeof atob === "function" ? (asc) => atob(_tidyB64(asc)) : atobPolyfill;
+var _toUint8Array = typeof Uint8Array.fromBase64 === "function" ? (a) => Uint8Array.fromBase64(a) : (a) => _U8Afrom(_atob(a).split("").map((c) => c.charCodeAt(0)));
+var toUint8Array = (a) => _toUint8Array(_unURI(a));
+var _decode = _TD ? (a) => _TD.decode(_toUint8Array(a)) : (a) => btou(_atob(a));
+var _unURI = (a) => _tidyB64(a.replace(/[-_]/g, (m0) => m0 == "-" ? "+" : "/"));
+var decode = (src) => _decode(_unURI(src));
+var isValid = (src) => {
+  if (typeof src !== "string")
+    return false;
+  const s = src.replace(/\s+/g, "").replace(/={0,2}$/, "");
+  if (s.length % 4 === 1)
+    return false;
+  return !/[^\s0-9a-zA-Z\+/]/.test(s) || !/[^\s0-9a-zA-Z\-_]/.test(s);
+};
+var _noEnum = (v) => {
+  return {
+    value: v,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  };
+};
+var extendString = function() {
+  const _add = (name, body) => Object.defineProperty(String.prototype, name, _noEnum(body));
+  _add("fromBase64", function() {
+    return decode(this);
+  });
+  _add("toBase64", function(urlsafe) {
+    return encode(this, urlsafe);
+  });
+  _add("toBase64URI", function() {
+    return encode(this, true);
+  });
+  _add("toBase64URL", function() {
+    return encode(this, true);
+  });
+  _add("toUint8Array", function() {
+    return toUint8Array(this);
+  });
+};
+var extendUint8Array = function() {
+  const _add = (name, body) => Object.defineProperty(Uint8Array.prototype, name, _noEnum(body));
+  _add("toBase64", function(urlsafe) {
+    return fromUint8Array(this, urlsafe);
+  });
+  _add("toBase64URI", function() {
+    return fromUint8Array(this, true);
+  });
+  _add("toBase64URL", function() {
+    return fromUint8Array(this, true);
+  });
+};
+var extendBuiltins = () => {
+  extendString();
+  extendUint8Array();
+};
+var gBase64 = {
+  version,
+  VERSION,
+  atob: _atob,
+  atobPolyfill,
+  btoa: _btoa,
+  btoaPolyfill,
+  fromBase64: decode,
+  toBase64: encode,
+  encode,
+  encodeURI,
+  encodeURL: encodeURI,
+  utob,
+  btou,
+  decode,
+  isValid,
+  fromUint8Array,
+  toUint8Array,
+  extendString,
+  extendUint8Array,
+  extendBuiltins
+};
+
+// packages/core/authToken.ts
+var parseToken = (token) => {
+  try {
+    const [payloadBase64] = token.split(".");
+    return JSON.parse(gBase64.decode(payloadBase64));
+  } catch {
+    return null;
+  }
+};
+
+// packages/core/accountSession/accountSessionCore.ts
+var isAccountIdentity = (value) => typeof value === "object" && value !== null && typeof value.userId === "string" && value.userId.length > 0;
+var parseUserToken = (token) => {
+  if (typeof token !== "string" || !token.trim()) return null;
+  const parsed = parseToken(token);
+  return isAccountIdentity(parsed) ? parsed : null;
+};
+var parseStoredTokenEntries = (tokens) => {
+  if (!Array.isArray(tokens)) return [];
+  const seenUserIds = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const token of tokens) {
+    const account = parseUserToken(token);
+    if (!account || seenUserIds.has(account.userId)) continue;
+    seenUserIds.add(account.userId);
+    entries.push({ token, account });
+  }
+  return entries;
+};
+var compactUniqueAccounts = (accounts) => {
+  if (!Array.isArray(accounts)) return [];
+  const seenUserIds = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const account of accounts) {
+    if (!isAccountIdentity(account) || seenUserIds.has(account.userId)) continue;
+    seenUserIds.add(account.userId);
+    result.push(account);
+  }
+  return result;
+};
+var mergeAccountState = (existingAccount, nextAccount) => {
+  if (!existingAccount || existingAccount.userId !== nextAccount.userId) {
+    return nextAccount;
+  }
+  return {
+    ...existingAccount,
+    ...nextAccount
+  };
+};
+var SSR_SNAPSHOT = Object.freeze({
+  accounts: [],
+  activeAccountId: null,
+  activeToken: null,
+  initialized: false,
+  transition: "idle"
+});
+var AccountSessionCore = class {
+  snapshot;
+  sessionGeneration = 0;
+  tokenByUserId = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  constructor(initial) {
+    const accounts = compactUniqueAccounts(initial?.accounts ?? []);
+    const rawActiveId = initial?.activeAccountId ?? null;
+    const rawActiveToken = initial?.activeToken ?? null;
+    const parsedActive = rawActiveToken ? parseUserToken(rawActiveToken) : null;
+    const hasValidPair = typeof rawActiveId === "string" && rawActiveId.length > 0 && parsedActive !== null && parsedActive.userId === rawActiveId && accounts.some((account) => account.userId === rawActiveId);
+    this.snapshot = {
+      sessionGeneration: this.sessionGeneration,
+      accounts,
+      activeAccountId: hasValidPair ? rawActiveId : null,
+      activeToken: hasValidPair ? rawActiveToken : null,
+      initialized: initial?.initialized ?? false,
+      transition: initial?.transition ?? "idle"
+    };
+    if (hasValidPair && rawActiveId && rawActiveToken) {
+      this.tokenByUserId.set(rawActiveId, rawActiveToken);
+    }
+  }
+  getSnapshot = () => {
+    return this.snapshot;
+  };
+  getServerSnapshot = () => {
+    return SSR_SNAPSHOT;
+  };
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  };
+  emit() {
+    for (const listener of this.listeners) {
+      listener();
+    }
+  }
+  setSnapshot(next, forceAdvanceSession = false) {
+    if (forceAdvanceSession || next.activeAccountId !== this.snapshot.activeAccountId || next.activeToken !== this.snapshot.activeToken) {
+      this.sessionGeneration += 1;
+    }
+    this.snapshot = { ...next, sessionGeneration: this.sessionGeneration };
+    this.emit();
+  }
+  initializeFromTokens(tokens, preferredActiveAccountId) {
+    const entries = parseStoredTokenEntries(tokens);
+    this.tokenByUserId.clear();
+    for (const entry of entries) {
+      this.tokenByUserId.set(entry.account.userId, entry.token);
+    }
+    if (entries.length === 0) {
+      this.setSnapshot({
+        accounts: [],
+        activeAccountId: null,
+        activeToken: null,
+        initialized: true,
+        transition: "idle"
+      });
+      return;
+    }
+    const preferredEntry = preferredActiveAccountId ? entries.find((e) => e.account.userId === preferredActiveAccountId) : null;
+    const activeEntry = preferredEntry ?? entries[0];
+    const accounts = entries.map((entry) => {
+      const existing = this.snapshot.accounts.find(
+        (a) => a.userId === entry.account.userId
+      );
+      return mergeAccountState(existing, entry.account);
+    });
+    const activeAccount = accounts.find(
+      (a) => a.userId === activeEntry.account.userId
+    ) ?? activeEntry.account;
+    const orderedAccounts = [
+      activeAccount,
+      ...accounts.filter((a) => a.userId !== activeAccount.userId)
+    ];
+    this.setSnapshot({
+      accounts: orderedAccounts,
+      activeAccountId: activeAccount.userId,
+      activeToken: activeEntry.token,
+      initialized: true,
+      transition: "idle"
+    });
+  }
+  beginTransition(transition) {
+    if (this.snapshot.transition === transition) return;
+    this.setSnapshot({
+      ...this.snapshot,
+      transition
+    });
+  }
+  /**
+   * Activate `token` as the active account and complete the current transition.
+   *
+   * @returns true when the token was valid and the session moved to it.
+   *   Returns false for an invalid token WITHOUT completing the transition or
+   *   touching the active identity — callers (the session service) are
+   *   responsible for explicitly calling failTransition in that case.
+   */
+  activateToken(token, accountOverride) {
+    const parsed = parseUserToken(token);
+    if (!parsed) {
+      return false;
+    }
+    this.tokenByUserId.set(parsed.userId, token);
+    const merged = mergeAccountState(
+      this.snapshot.accounts.find((a) => a.userId === parsed.userId),
+      { ...parsed, ...accountOverride }
+    );
+    const otherAccounts = this.snapshot.accounts.filter(
+      (a) => a.userId !== merged.userId
+    );
+    const nextAccounts = [merged, ...otherAccounts];
+    this.setSnapshot({
+      accounts: nextAccounts,
+      activeAccountId: merged.userId,
+      activeToken: token,
+      initialized: true,
+      transition: "idle"
+    }, true);
+    return true;
+  }
+  completeTransition() {
+    if (this.snapshot.transition === "idle" && this.snapshot.initialized) return;
+    this.setSnapshot({
+      ...this.snapshot,
+      initialized: true,
+      transition: "idle"
+    });
+  }
+  failTransition() {
+    if (this.snapshot.transition === "idle" && this.snapshot.initialized) return;
+    this.setSnapshot({
+      ...this.snapshot,
+      initialized: true,
+      transition: "idle"
+    });
+  }
+  removeAccount(userId) {
+    this.tokenByUserId.delete(userId);
+    const remainingAccounts = this.snapshot.accounts.filter(
+      (a) => a.userId !== userId
+    );
+    if (this.snapshot.activeAccountId === userId) {
+      const nextActive = remainingAccounts.find(
+        (a) => Boolean(this.tokenByUserId.get(a.userId))
+      );
+      if (nextActive) {
+        const nextActiveToken = this.tokenByUserId.get(nextActive.userId);
+        this.setSnapshot({
+          accounts: remainingAccounts,
+          activeAccountId: nextActive.userId,
+          activeToken: nextActiveToken,
+          initialized: true,
+          transition: "idle"
+        });
+      } else {
+        this.setSnapshot({
+          accounts: remainingAccounts,
+          activeAccountId: null,
+          activeToken: null,
+          initialized: true,
+          transition: "idle"
+        });
+      }
+    } else {
+      this.setSnapshot({
+        ...this.snapshot,
+        accounts: remainingAccounts,
+        transition: "idle"
+      });
+    }
+  }
+  replaceActiveToken(token) {
+    const parsed = parseUserToken(token);
+    if (!parsed) return;
+    if (this.snapshot.activeAccountId && this.snapshot.activeAccountId !== parsed.userId) {
+      return;
+    }
+    this.tokenByUserId.set(parsed.userId, token);
+    const existing = this.snapshot.accounts.find(
+      (a) => a.userId === parsed.userId
+    );
+    const merged = mergeAccountState(existing, parsed);
+    const otherAccounts = this.snapshot.accounts.filter(
+      (a) => a.userId !== parsed.userId
+    );
+    this.setSnapshot({
+      accounts: [merged, ...otherAccounts],
+      activeAccountId: parsed.userId,
+      activeToken: token,
+      initialized: true,
+      transition: "idle"
+    });
+  }
+  updateAccount(account) {
+    const existingIndex = this.snapshot.accounts.findIndex(
+      (a) => a.userId === account.userId
+    );
+    if (existingIndex === -1) return;
+    const existing = this.snapshot.accounts[existingIndex];
+    const merged = mergeAccountState(existing, { ...existing, ...account });
+    const nextAccounts = [...this.snapshot.accounts];
+    nextAccounts[existingIndex] = merged;
+    this.setSnapshot({
+      ...this.snapshot,
+      accounts: nextAccounts
+    });
+  }
+  deductActiveBalance(cost) {
+    if (!this.snapshot.activeAccountId || typeof cost !== "number" || cost <= 0) {
+      return;
+    }
+    const activeId = this.snapshot.activeAccountId;
+    const existing = this.snapshot.accounts.find((a) => a.userId === activeId);
+    if (!existing || typeof existing.balance !== "number") return;
+    this.updateAccount({
+      userId: activeId,
+      balance: existing.balance - cost
+    });
+  }
+  reset() {
+    this.tokenByUserId.clear();
+    this.setSnapshot({
+      accounts: [],
+      activeAccountId: null,
+      activeToken: null,
+      initialized: false,
+      transition: "idle"
+    });
+  }
+};
+var createAccountSessionCore = (initial) => new AccountSessionCore(initial);
+
+// packages/core/deviceAuthorization.ts
+var fail = (code) => {
+  throw new Error(code);
+};
+function deviceAuthorizationOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fail("invalid_origin");
+  }
+  if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) return fail("invalid_origin");
+  return url.origin;
+}
+function parseDeviceAuthorizationStart(data, origin) {
+  if (typeof data.deviceCode !== "string" || !data.deviceCode || data.deviceCode.length > 512 || typeof data.userCode !== "string" || !/^[A-Z0-9]{8}$/.test(data.userCode) || data.verificationUri !== `${origin}/cli/authorize` || data.verificationUriComplete !== `${origin}/cli/authorize?code=${data.userCode}` || typeof data.expiresIn !== "number" || !Number.isFinite(data.expiresIn) || data.expiresIn <= 0 || typeof data.interval !== "number" || !Number.isFinite(data.interval) || data.interval <= 0) return fail("invalid_response");
+  return data;
+}
+function parseDeviceAuthorizationPoll(status, data, origin) {
+  if (status === 202 && data.status === "pending" && data.error === "authorization_pending") return { status: "pending" };
+  if (status < 200 || status >= 300) return fail(data.error === "expired_token" ? "expired" : "authorization_failed");
+  if (status === 202 || data.status !== "approved" || data.serverUrl !== origin || typeof data.token !== "string" || typeof data.userId !== "string" || !data.userId || parseUserToken(data.token)?.userId !== data.userId) return fail("invalid_response");
+  return { status: "approved", token: data.token, serverUrl: origin, userId: data.userId };
+}
+function createDeviceAuthorizationProtocol(options) {
+  const origin = deviceAuthorizationOrigin(options.origin);
+  const now = options.now ?? Date.now;
+  let deadline = now() + 6e5;
+  const check = () => {
+    if (options.signal?.aborted) fail("cancelled");
+    if (now() >= deadline) fail("expired");
+  };
+  const bounded = async (work, timeoutMs) => {
+    check();
+    const abort = new AbortController();
+    let timer;
+    let onAbort;
+    const interruption = new Promise((_, reject) => {
+      onAbort = () => {
+        abort.abort();
+        reject(new Error("cancelled"));
+      };
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      timer = setTimeout(() => {
+        abort.abort();
+        reject(new Error(now() >= deadline ? "expired" : "request_timeout"));
+      }, Math.max(1, Math.min(timeoutMs, deadline - now())));
+    });
+    try {
+      const result = await Promise.race([interruption, work(abort.signal)]);
+      check();
+      return result;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+    }
+  };
+  const post = (endpoint, body) => bounded(async (signal) => {
+    const response = await (options.fetch ?? globalThis.fetch)(`${origin}/api/v1/users/cli-login/${endpoint}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal,
+      redirect: "error",
+      credentials: "omit",
+      cache: "no-store"
+    });
+    if (endpoint === "start" && !response.ok) return fail("start_failed");
+    const data = await response.json();
+    if (!data || typeof data !== "object" || Array.isArray(data)) return fail("invalid_response");
+    return { response, data };
+  }, options.requestTimeoutMs && Number.isFinite(options.requestTimeoutMs) && options.requestTimeoutMs > 0 ? Math.min(options.requestTimeoutMs, 15e3) : 15e3);
+  return {
+    check,
+    get deadline() {
+      return deadline;
+    },
+    async start(clientName) {
+      const { response, data } = await post("start", { clientName });
+      if (!response.ok) return fail("start_failed");
+      const start = parseDeviceAuthorizationStart(data, origin);
+      deadline = Math.min(deadline, now() + Math.min(start.expiresIn, 600) * 1e3);
+      return start;
+    },
+    async poll(deviceCode) {
+      const { response, data } = await post("poll", { deviceCode });
+      return parseDeviceAuthorizationPoll(response.status, data, origin);
+    },
+    async wait(intervalSeconds) {
+      const delay = Math.min(Math.max(1e3, intervalSeconds * 1e3), 3e4, deadline - now());
+      await bounded((signal) => options.sleep ? options.sleep(delay) : new Promise((resolve) => {
+        const onAbort = () => clearTimeout(timer);
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve();
+        }, delay);
+        signal.addEventListener("abort", onAbort, { once: true });
+      }), delay + 50);
+    },
+    run: bounded
+  };
+}
+
+// packages/cli/authCommands.ts
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { spawn } from "node:child_process";
+
+// packages/ai/memory/delete.ts
+var VNEXT_STATE_ID_PREFIX = "vnext-state-";
+var toVNextMemoryItem = (state, owner) => ({
+  id: `${VNEXT_STATE_ID_PREFIX}${state.id}`,
+  ownerType: owner.ownerType,
+  ownerId: owner.ownerId,
+  visibility: "private",
+  subjectType: "user",
+  subjectId: owner.ownerId,
+  kind: "semantic",
+  content: state.text.trim(),
+  createdAt: state.createdAt,
+  lastActivatedAt: state.createdAt,
+  activationCount: 1,
+  importance: 0.9,
+  confidence: 0.9,
+  resident: state.facet === "preference" || state.facet === "style"
+});
+var matchesVNextFilters = (state, idSet, contentSub) => {
+  if (!idSet && !contentSub) return false;
+  if (idSet && !idSet.has(`${VNEXT_STATE_ID_PREFIX}${state.id}`)) return false;
+  if (contentSub && !state.text.toLowerCase().includes(contentSub)) return false;
+  return true;
+};
+function hasExplicitDeleteFilters(filters) {
+  return Boolean(
+    filters.ids && filters.ids.length > 0 || typeof filters.contentSubstring === "string" && filters.contentSubstring.trim().length > 0 || filters.tags && filters.tags.length > 0 || typeof filters.sourceDialogId === "string" && filters.sourceDialogId.trim().length > 0 || typeof filters.patternKeyPrefix === "string" && filters.patternKeyPrefix.trim().length > 0 || filters.facets && filters.facets.length > 0 || typeof filters.subjectId === "string" && filters.subjectId.trim().length > 0
+  );
+}
+function generateMemoryDeletionToken(ownerId, itemIds) {
+  const sorted = [...itemIds].sort().join(",");
+  const seed = `${ownerId}:${sorted}`;
+  let hash = 0;
+  for (let i = 0; i < seed.length; i++) {
+    hash = (hash << 5) - hash + seed.charCodeAt(i) | 0;
+  }
+  return `tok-${Math.abs(hash).toString(36)}-${itemIds.length}`;
+}
+var normalizeSet = (values) => {
+  if (!Array.isArray(values) || values.length === 0) return null;
+  const normalized = asTrimmedNonEmptyStringArray(values);
+  return normalized.length > 0 ? new Set(normalized) : null;
+};
+var matchesFilters = (item, filters) => {
+  const idSet = normalizeSet(filters.ids);
+  if (idSet && !idSet.has(item.id)) return false;
+  const kindSet = normalizeSet(filters.kinds);
+  if (kindSet && !kindSet.has(item.kind)) return false;
+  const facetSet = normalizeSet(filters.facets);
+  if (facetSet && (!item.facet || !facetSet.has(item.facet))) return false;
+  if (filters.subjectType && item.subjectType !== filters.subjectType) return false;
+  if (filters.subjectId && item.subjectId !== filters.subjectId) return false;
+  const prefix = asTrimmedString(filters.patternKeyPrefix);
+  if (prefix && !(item.patternKey ?? "").startsWith(prefix)) return false;
+  if (filters.sourceDialogId && item.sourceDialogId !== filters.sourceDialogId) {
+    return false;
+  }
+  const tagSet = normalizeSet(filters.tags);
+  if (tagSet) {
+    const itemTags = new Set(asTrimmedNonEmptyStringArray(item.tags));
+    for (const tag of tagSet) {
+      if (!itemTags.has(tag)) return false;
+    }
+  }
+  const contentSub = asTrimmedString(filters.contentSubstring);
+  if (contentSub && !(item.content ?? "").toLowerCase().includes(contentSub.toLowerCase())) {
+    return false;
+  }
+  return true;
+};
+var deleteMemoryItemWithIndexesInBatch = (batch, item) => {
+  batch.del(createMemoryKey(item.ownerType, item.ownerId, item.id));
+  batch.del(
+    createMemoryOwnerIndexKey(
+      item.ownerType,
+      item.ownerId,
+      item.createdAt,
+      item.id
+    )
+  );
+  batch.del(
+    createMemorySubjectKindIndexKey(
+      item.subjectType,
+      item.subjectId,
+      item.kind,
+      item.createdAt,
+      item.id
+    )
+  );
+};
+var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
+  if (!hasExplicitDeleteFilters(filters)) {
+    throw new Error(
+      "At least one filter is required; delete operation will not delete all memory implicitly."
+    );
+  }
+  const range = memoryOwnerRange(owner.ownerType, owner.ownerId);
+  const matchedItems = [];
+  const limit = typeof filters.limit === "number" && filters.limit > 0 ? filters.limit : Number.POSITIVE_INFINITY;
+  for await (const [, value] of db.iterator({
+    gte: range.start,
+    lte: range.end,
+    reverse: true
+  })) {
+    const memoryId = typeof value?.memoryId === "string" ? value.memoryId : "";
+    if (!memoryId) continue;
+    const item = await db.get(createMemoryKey(owner.ownerType, owner.ownerId, memoryId)).catch(() => null);
+    if (!item) continue;
+    if (!matchesFilters(item, filters)) continue;
+    matchedItems.push(item);
+    if (matchedItems.length >= limit) break;
+  }
+  const idSet = normalizeSet(filters.ids);
+  const contentSub = asTrimmedString(filters.contentSubstring).toLowerCase();
+  const vnextStateIdsToRetire = [];
+  const vnextStatesToRetire = [];
+  const vnextMatchedItems = [];
+  let vnextPrincipalId = null;
+  const hasScopingFilters = Boolean(
+    normalizeSet(filters.kinds) || normalizeSet(filters.facets) || normalizeSet(filters.tags) || asTrimmedString(filters.subjectType) || asTrimmedString(filters.subjectId) || asTrimmedString(filters.patternKeyPrefix) || asTrimmedString(filters.sourceDialogId)
+  );
+  const canMatchVNext = !hasScopingFilters && (contentSub.length > 0 || idSet !== null && [...idSet].some((id) => id.startsWith(VNEXT_STATE_ID_PREFIX)));
+  if (canMatchVNext) {
+    vnextPrincipalId = `${owner.ownerType}:${encodeURIComponent(owner.ownerId)}`;
+    const catalog = await loadMemoryVNextCatalog(db, vnextPrincipalId);
+    for (const state of catalog.states) {
+      if (matchedItems.length >= limit) break;
+      if (state.retiredAt) continue;
+      if (!matchesVNextFilters(state, idSet, contentSub)) continue;
+      vnextStateIdsToRetire.push(state.id);
+      vnextStatesToRetire.push(state);
+      const projected = toVNextMemoryItem(state, owner);
+      vnextMatchedItems.push(projected);
+      matchedItems.push(projected);
+    }
+  }
+  if (matchedItems.length === 0) {
+    return { deletedCount: 0, deletedIds: [], retiredIds: [], matchedItems: [] };
+  }
+  const token = generateMemoryDeletionToken(
+    owner.ownerId,
+    matchedItems.map((i) => i.id)
+  );
+  if (filters.dryRun) {
+    return {
+      deletedCount: 0,
+      deletedIds: [],
+      retiredIds: [],
+      matchedItems,
+      deletionToken: token
+    };
+  }
+  if (filters.deletionToken && filters.deletionToken !== token) {
+    throw new Error(
+      "deletionToken mismatch: target set differs from preview; preview exact intended targets again."
+    );
+  }
+  const vnextMatchedIdSet = new Set(
+    vnextStateIdsToRetire.map((stateId) => `${VNEXT_STATE_ID_PREFIX}${stateId}`)
+  );
+  const legacyItems = matchedItems.filter((item) => !vnextMatchedIdSet.has(item.id));
+  const shouldRetireVNext = vnextStatesToRetire.length > 0;
+  if (legacyItems.length > 0 || shouldRetireVNext) {
+    const batch = db.batch();
+    for (const item of legacyItems) {
+      deleteMemoryItemWithIndexesInBatch(batch, item);
+    }
+    if (shouldRetireVNext) {
+      const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+      for (const state of vnextStatesToRetire) {
+        _appendRetiredStateBatch(batch, { ...state, retiredAt: nowIso });
+      }
+    }
+    await batch.write();
+  }
+  return {
+    deletedCount: matchedItems.length,
+    deletedIds: matchedItems.map((item) => item.id),
+    retiredIds: vnextMatchedItems.map((item) => item.id),
+    matchedItems,
+    deletionToken: token
+  };
+};
+
+// packages/cli/client/memoryRekey.ts
+async function scanLocalMemoryItems(localDb, machineId) {
+  const range = memoryOwnerRange("user", machineId);
+  const refs = [];
+  for await (const [, value] of localDb.iterator({
+    gte: range.start,
+    lte: range.end,
+    reverse: true
+  })) {
+    refs.push(value ?? {});
+  }
+  const items = await Promise.all(
+    refs.map(
+      (ref) => typeof ref?.memoryId === "string" ? localDb.get(createMemoryKey("user", machineId, ref.memoryId)).catch(() => null) : Promise.resolve(null)
+    )
+  );
+  return items.filter((item) => !!item);
+}
+async function performLocalMemoryRekey(args) {
+  const { localDb, authToken, serverUrl, machineId } = args;
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const items = await scanLocalMemoryItems(localDb, machineId);
+  if (items.length === 0) {
+    return { migrated: 0, merged: 0 };
+  }
+  const snapshotIds = items.map((item) => item.id);
+  const response = await fetchImpl(`${serverUrl}/api/memory/rekey`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ items }),
+    signal: AbortSignal?.timeout?.(3e4)
+  }).catch((e) => {
+    if (e?.name === "TimeoutError" || e?.name === "AbortError") {
+      throw new Error("memory rekey upload timed out (30s)");
+    }
+    throw e;
+  });
+  if (!response.ok) {
+    let detail = "";
+    try {
+      const body2 = await response.json();
+      detail = body2?.error?.message ?? "";
+    } catch {
+    }
+    throw new Error(
+      `memory rekey upload failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`
+    );
+  }
+  const body = await response.json().catch(() => ({}));
+  const migrated = typeof body?.migratedCount === "number" ? body.migratedCount : 0;
+  const merged = typeof body?.mergedCount === "number" ? body.mergedCount : 0;
+  await deleteMemoriesForOwnerFromDb(
+    localDb,
+    { ownerType: "user", ownerId: machineId },
+    { ids: snapshotIds }
+  );
+  return { migrated, merged };
+}
+
+// packages/cli/authCommands.ts
+var LOGIN_HELP_TEXT = `Log in to Nolo and save a local profile.
+
+Usage:
+  nolo login [--server <url>] [--no-browser] [--token <jwt>] [--manual]
+
+Options:
+  --server <url>   Nolo server URL (default: ${DEFAULT_NOLO_SERVER_URL})
+  --no-browser     Print the authorization URL instead of opening a browser
+  --token <jwt>    Save a token directly without browser authorization
+  --manual         Prompt to paste a token interactively
+
+By default, opens the Nolo website and polls until authorization completes.
+In SSH sessions, use --no-browser and open the printed URL on a machine with a browser
+where you are already logged into Nolo.
+
+Note: nolo login only authorizes your Nolo platform account. To let your agents
+call third-party models using your own subscriptions, you also need:
+  nolo auth antigravity   # Google Antigravity (Gemini 3, Claude, GPT-OSS)
+  nolo auth claude        # Claude Pro/Max
+  nolo auth chatgpt       # ChatGPT Plus / OpenAI Codex
+  nolo auth xai           # xAI Grok (SuperGrok)
+  nolo auth cloudflare    # Cloudflare OAuth (email routing, etc.)
+See "nolo auth <provider> --help" for details.
+`;
+var LOGOUT_HELP_TEXT = `Log out of Nolo by clearing the saved auth token.
+
+Usage:
+  nolo logout
+
+Keeps other profile settings such as server URL and default agent preferences.
+Does not unset AUTH_TOKEN or other auth-related environment variables.
+`;
+var WHOAMI_HELP_TEXT = `Show the current login state.
+
+Usage:
+  nolo whoami
+`;
+function wantsHelp(args) {
+  return args.includes("--help") || args.includes("-h");
+}
+function formatDuration(ms) {
+  const totalSec = Math.max(0, Math.ceil(ms / 1e3));
+  const minutes = Math.floor(totalSec / 60);
+  const seconds = totalSec % 60;
+  if (minutes > 0) return `${minutes}m ${seconds}s`;
+  return `${seconds}s`;
+}
+function formatTokenPreview(token) {
+  const trimmed = token.trim();
+  if (!trimmed) return "";
+  return `${trimmed.slice(0, 8)}...`;
+}
+function getArg(args, flag) {
+  const index = args.indexOf(flag);
+  return index >= 0 ? args[index + 1] : void 0;
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var defaultOpenBrowser = async (url) => {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url.replace(/&/g, "^&")] : [url];
+  try {
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+};
+async function saveTokenLogin(args) {
+  if (!args.authToken.trim()) {
+    args.error.error("No auth token provided.");
+    return 1;
+  }
+  saveDefaultProfile(args.configPath, {
+    serverUrl: args.serverUrl,
+    authToken: args.authToken.trim()
+  });
+  args.output.log(`Saved profile default -> ${args.serverUrl}`);
+  try {
+    const localDb = await getDefaultCliLocalRuntimeDb();
+    const machineId = resolveMachineId();
+    const result = await performLocalMemoryRekey({
+      localDb,
+      authToken: args.authToken.trim(),
+      serverUrl: args.serverUrl,
+      machineId
+    });
+    if (result.migrated > 0 || result.merged > 0) {
+      args.output.log(
+        `[nolo] Migrated ${result.migrated} local memor${result.migrated === 1 ? "y" : "ies"} to your account` + (result.merged > 0 ? ` (${result.merged} merged with existing)` : "") + "."
+      );
+    }
+  } catch (error) {
+    args.error.error(
+      `[nolo] Local memory migration skipped: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  return 0;
+}
+async function runWebLogin(args) {
+  try {
+    const protocol = createDeviceAuthorizationProtocol({ origin: args.serverUrl, fetch: args.fetchImpl, now: args.now, sleep: args.sleep });
+    const start = await protocol.start("nolo-cli");
+    args.output.log("Open this URL to authorize nolo-cli:");
+    args.output.log(start.verificationUriComplete);
+    args.output.log(`Code: ${start.userCode}`);
+    if (!args.noBrowser) {
+      const opened = await protocol.run(() => Promise.resolve(args.openBrowser(start.verificationUriComplete)), 15e3);
+      if (!opened) {
+        args.output.log("Could not open a browser automatically. Paste the URL above.");
+      }
+    }
+    const deadline = protocol.deadline;
+    const timeoutMs = deadline - args.now();
+    const statusLogIntervalMs = 15e3;
+    let lastStatusLogAt = 0;
+    args.output.log(
+      `[nolo] Waiting for browser authorization (${formatDuration(timeoutMs)} remaining)...`
+    );
+    while (args.now() <= deadline) {
+      const poll = await protocol.poll(start.deviceCode);
+      if (poll.status === "pending") {
+        const currentTime = args.now();
+        if (lastStatusLogAt > 0 && currentTime - lastStatusLogAt >= statusLogIntervalMs) {
+          const remainingMs = Math.max(0, deadline - currentTime);
+          args.output.log(
+            `[nolo] Still waiting... (${formatDuration(remainingMs)} remaining)`
+          );
+          lastStatusLogAt = currentTime;
+        } else if (lastStatusLogAt === 0) {
+          lastStatusLogAt = currentTime;
+        }
+        await protocol.wait(start.interval);
+        continue;
+      }
+      if (poll.status === "approved") {
+        const approvedServer = poll.serverUrl;
+        protocol.check();
+        return saveTokenLogin({
+          configPath: args.configPath,
+          serverUrl: approvedServer,
+          authToken: poll.token,
+          output: args.output,
+          error: args.error
+        });
+      }
+    }
+    args.error.error("Web login timed out. Run `nolo login` again or use --token.");
+    return 1;
+  } catch (error) {
+    args.error.error(error instanceof Error && error.message === "expired" ? "Web login timed out. Run `nolo login` again or use --token." : `Web login failed: ${error instanceof Error ? error.message : "authorization_failed"}. Use --token to paste a token manually.`);
+    return 1;
+  }
+}
+async function runLoginCommand(args, deps = {}) {
+  const outputTarget = deps.output ?? console;
+  const errorTarget = deps.error ?? console;
+  if (wantsHelp(args)) {
+    outputTarget.log(LOGIN_HELP_TEXT);
+    return 0;
+  }
+  const configPath = deps.configPath ?? getDefaultProfileConfigPath();
+  const serverArg = getArg(args, "--server");
+  const tokenArg = getArg(args, "--token");
+  const noBrowser = args.includes("--no-browser");
+  const serverUrl = (serverArg || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
+  if (tokenArg) {
+    return saveTokenLogin({
+      configPath,
+      serverUrl,
+      authToken: tokenArg,
+      output: outputTarget,
+      error: errorTarget
+    });
+  }
+  if (args.includes("--manual")) {
+    const rl = createInterface({ input, output });
+    const question = deps.question ?? ((prompt) => rl.question(prompt));
+    try {
+      const authToken = await question("paste auth token: ");
+      return saveTokenLogin({
+        configPath,
+        serverUrl,
+        authToken,
+        output: outputTarget,
+        error: errorTarget
+      });
+    } finally {
+      rl.close();
+    }
+  }
+  return runWebLogin({
+    configPath,
+    serverUrl,
+    fetchImpl: deps.fetchImpl ?? fetch,
+    openBrowser: deps.openBrowser ?? defaultOpenBrowser,
+    sleep: deps.sleep ?? defaultSleep,
+    now: deps.now ?? Date.now,
+    output: outputTarget,
+    error: errorTarget,
+    noBrowser
+  });
+}
+function runWhoamiCommand(deps = {}) {
+  const output2 = deps.output ?? console;
+  if (wantsHelp(deps.args ?? [])) {
+    output2.log(WHOAMI_HELP_TEXT);
+    return 0;
+  }
+  const env = deps.env ?? process.env;
+  const config = loadProfileConfig(deps.configPath);
+  const profile = getCurrentProfile(config);
+  const profileToken = getProfileTokens(config)[0]?.trim() ?? "";
+  const envToken = resolveAuthTokenFromEnv(env);
+  if (!profileToken && !envToken) {
+    output2.log("Not logged in. Run: nolo login");
+    output2.log(
+      'Or skip login entirely: nolo run "<task>" (local Codex) | nolo auth <provider> (your own subscription)'
+    );
+    return 1;
+  }
+  const runtimeEnv = buildCliRuntimeEnv(env, config);
+  const explicitServer = env.NOLO_SERVER || env.NOLO_SERVER_URL || env.BASE_URL;
+  if (!profileToken && envToken) {
+    output2.log("profile: not logged in (no saved token)");
+    if (profile?.serverUrl) {
+      output2.log(`profile server: ${profile.serverUrl}`);
+    }
+    output2.log(`effective server: ${runtimeEnv.NOLO_SERVER ?? resolveServerUrlFallback(profile)}`);
+    output2.log(`server source: ${explicitServer ? "env" : profile?.serverUrl ? "profile" : "default"}`);
+    output2.log(`env token: ${formatTokenPreview(envToken)} (source: environment)`);
+    return 0;
+  }
+  const effectiveServer = runtimeEnv.NOLO_SERVER ?? profile.serverUrl;
+  const effectiveToken = runtimeEnv.AUTH_TOKEN ?? profileToken;
+  output2.log(`profile: ${config.currentProfile}`);
+  output2.log(`profile server: ${profile.serverUrl}`);
+  output2.log(`effective server: ${effectiveServer}`);
+  output2.log(`server source: ${explicitServer ? "env" : "profile"}`);
+  output2.log(`token: ${formatTokenPreview(effectiveToken)} (source: ${envToken && envToken !== profileToken ? "environment" : "profile"})`);
+  if (envToken && envToken !== profileToken) {
+    output2.log(`profile token: ${formatTokenPreview(profileToken)} (source: profile, overridden by environment)`);
+  }
+  return 0;
+}
+function resolveServerUrlFallback(profile) {
+  return profile?.serverUrl ?? DEFAULT_NOLO_SERVER_URL;
+}
+function runLogoutCommand(deps = {}) {
+  const output2 = deps.output ?? console;
+  if (wantsHelp(deps.args ?? [])) {
+    output2.log(LOGOUT_HELP_TEXT);
+    return 0;
+  }
+  const env = deps.env ?? process.env;
+  const configPath = deps.configPath ?? getDefaultProfileConfigPath();
+  if (!clearProfileAuthToken(configPath)) {
+    output2.log("Not logged in.");
+    return 0;
+  }
+  output2.log("Logged out.");
+  if (resolveAuthTokenFromEnv(env)) {
+    output2.log(
+      "Note: AUTH_TOKEN in the environment is unchanged and may still authenticate commands."
+    );
+  }
+  return 0;
+}
+
+export {
+  parseUserToken,
+  parseStoredTokenEntries,
+  createAccountSessionCore,
+  createDeviceAuthorizationProtocol,
+  LOGIN_HELP_TEXT,
+  LOGOUT_HELP_TEXT,
+  WHOAMI_HELP_TEXT,
+  defaultOpenBrowser,
+  saveTokenLogin,
+  runLoginCommand,
+  runWhoamiCommand,
+  runLogoutCommand
+};