nolo-cli 0.7.0 → 0.8.0-alpha.11

package/chunk-4CQLVGRV.js

@@ -0,0 +1,50 @@
+import {
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+
+// packages/cli/cliSpaceHelpers.ts
+function normalizeSpaceIdInput(rawInput) {
+  const raw = rawInput.trim();
+  if (!raw) return "";
+  let candidate = raw;
+  if (raw.startsWith("http://") || raw.startsWith("https://")) {
+    const match = new URL(raw).pathname.match(/^\/space\/([^/?#]+)/);
+    if (!match?.[1]) return "";
+    candidate = decodeURIComponent(match[1]);
+  }
+  return candidate.startsWith("space-") ? candidate.slice("space-".length) : candidate;
+}
+function buildSpaceLookup(rawInput) {
+  const spaceId = normalizeSpaceIdInput(rawInput);
+  return {
+    spaceId,
+    spaceKey: spaceId ? `space-${spaceId}` : ""
+  };
+}
+function getSpaceContentKeys(spaceRecord) {
+  const keys = /* @__PURE__ */ new Set();
+  const contents = spaceRecord?.contents;
+  if (!contents || typeof contents !== "object") return keys;
+  for (const [entryKey, value] of Object.entries(contents)) {
+    const trimmedEntryKey = asOptionalTrimmedString(entryKey);
+    if (trimmedEntryKey) {
+      keys.add(trimmedEntryKey);
+    }
+    if (isRecord(value)) {
+      const contentKey = asOptionalTrimmedString(value.contentKey);
+      if (contentKey) {
+        keys.add(contentKey);
+      }
+    }
+  }
+  return keys;
+}
+
+export {
+  normalizeSpaceIdInput,
+  buildSpaceLookup,
+  getSpaceContentKeys
+};

package/chunk-4IJYA27C.js

@@ -0,0 +1,342 @@
+import {
+  generatePkcePair,
+  startCallbackServer
+} from "./chunk-EHLHSX7R.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
+
+// packages/cli/oauth/flows/cloudflare.ts
+var CLOUDFLARE_OAUTH_AUTH_ENDPOINT = "https://dash.cloudflare.com/oauth2/auth";
+var CLOUDFLARE_OAUTH_TOKEN_ENDPOINT = "https://dash.cloudflare.com/oauth2/token";
+var CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+var CLOUDFLARE_OAUTH_REDIRECT_HOST = "127.0.0.1";
+var CLOUDFLARE_OAUTH_REDIRECT_PORT = 56122;
+var CLOUDFLARE_OAUTH_REDIRECT_PATH = "/callback";
+var ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+var DEFAULT_SCOPE = "account:read zone:read zone:edit user:read user:edit";
+function generateState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+function getClientId(args) {
+  const value = args?.clientId?.trim() || process.env.CLOUDFLARE_OAUTH_CLIENT_ID?.trim();
+  if (!value) {
+    throw new Error(
+      "Cloudflare OAuth client ID is required. Set CLOUDFLARE_OAUTH_CLIENT_ID or pass --client-id."
+    );
+  }
+  return value;
+}
+function getScope(args) {
+  return args?.scope?.trim() || process.env.CLOUDFLARE_OAUTH_SCOPE?.trim() || DEFAULT_SCOPE;
+}
+function buildCloudflareAuthorizeUrl(opts) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope,
+    code_challenge: opts.codeChallenge,
+    code_challenge_method: "S256",
+    state: opts.state
+  });
+  return `${CLOUDFLARE_OAUTH_AUTH_ENDPOINT}?${params.toString()}`;
+}
+async function exchangeCloudflareToken(fetchImpl, code, redirectUri, verifier, clientId) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: verifier
+  });
+  const response = await fetchImpl(CLOUDFLARE_OAUTH_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body,
+    signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).trim();
+    } catch {
+    }
+    throw new Error(
+      `Cloudflare token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  const data = await response.json();
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new Error("Cloudflare token exchange response missing access_token");
+  }
+  return {
+    accessToken: data.access_token,
+    refreshToken: typeof data.refresh_token === "string" ? data.refresh_token : void 0,
+    expiresIn: asOptionalFiniteNumber(data.expires_in),
+    scope: typeof data.scope === "string" ? data.scope : void 0,
+    idToken: typeof data.id_token === "string" ? data.id_token : void 0
+  };
+}
+async function runCloudflareOAuthLogin(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const clientId = getClientId(deps);
+  const scope = getScope(deps);
+  const redirectUri = `http://${CLOUDFLARE_OAUTH_REDIRECT_HOST}:${CLOUDFLARE_OAUTH_REDIRECT_PORT}${CLOUDFLARE_OAUTH_REDIRECT_PATH}`;
+  let handle;
+  try {
+    handle = await startCallbackServer({
+      port: CLOUDFLARE_OAUTH_REDIRECT_PORT,
+      hostname: CLOUDFLARE_OAUTH_REDIRECT_HOST,
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    throw new Error(
+      `Failed to start Cloudflare OAuth callback server on ${CLOUDFLARE_OAUTH_REDIRECT_PORT}: ${toErrorMessage(err)}`
+    );
+  }
+  try {
+    const state = generateState();
+    const pkce = await generatePkcePair();
+    const authUrl = buildCloudflareAuthorizeUrl({
+      redirectUri,
+      codeChallenge: pkce.challenge,
+      state,
+      clientId,
+      scope
+    });
+    output.log(
+      `Open the following URL in your browser to authorize Cloudflare access:
+  ${authUrl}
+
+Requested scopes: ${scope}`
+    );
+    if (deps.openBrowser) {
+      try {
+        await deps.openBrowser(authUrl);
+      } catch (err) {
+        error.error(
+          `Failed to open browser automatically: ${toErrorMessage(err)}`
+        );
+      }
+    }
+    const callback = await handle.waitForCode();
+    const token = await exchangeCloudflareToken(
+      fetchImpl,
+      callback.code,
+      redirectUri,
+      pkce.verifier,
+      clientId
+    );
+    const now = (deps.now ?? Date.now)();
+    const expiresIn = token.expiresIn;
+    return {
+      provider: "cloudflare",
+      accessToken: token.accessToken,
+      refreshToken: token.refreshToken,
+      expiresAt: typeof expiresIn === "number" ? now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS : void 0,
+      scope: token.scope,
+      idToken: token.idToken,
+      obtainedAt: now
+    };
+  } finally {
+    await handle.close();
+  }
+}
+async function createCloudflareApiToken(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const response = await fetchImpl(`${CLOUDFLARE_API_BASE}/user/tokens`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${input.accessToken}`
+    },
+    body: JSON.stringify({
+      name: input.name,
+      policies: input.policies
+    }),
+    signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).trim();
+    } catch {
+    }
+    throw new Error(
+      `Cloudflare API token creation failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  const data = await response.json();
+  const tokenValue = data.result?.value;
+  if (typeof tokenValue !== "string" || !tokenValue) {
+    throw new Error(
+      "Cloudflare API token creation response did not contain a token value"
+    );
+  }
+  return tokenValue;
+}
+async function listCloudflarePermissionGroups(accessToken, fetchImpl = fetch) {
+  const response = await fetchImpl(
+    `${CLOUDFLARE_API_BASE}/user/tokens/permission_groups`,
+    {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      },
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+    }
+  );
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).trim();
+    } catch {
+    }
+    throw new Error(
+      `Cloudflare permission groups lookup failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  const data = await response.json();
+  if (!Array.isArray(data.result)) {
+    throw new Error("Cloudflare permission groups response missing result array");
+  }
+  return data.result.filter(
+    (group) => typeof group.id === "string" && typeof group.name === "string" && Array.isArray(group.permissions)
+  ).map((group) => ({
+    id: group.id,
+    name: group.name,
+    permissions: group.permissions
+  }));
+}
+async function findCloudflareZoneIdByName(accessToken, zoneName, fetchImpl = fetch) {
+  const response = await fetchImpl(
+    `${CLOUDFLARE_API_BASE}/zones?name=${encodeURIComponent(zoneName)}`,
+    {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      },
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+    }
+  );
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).trim();
+    } catch {
+    }
+    throw new Error(
+      `Cloudflare zone lookup failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  const data = await response.json();
+  if (!Array.isArray(data.result)) {
+    throw new Error("Cloudflare zone lookup response missing result array");
+  }
+  const zone = data.result.find((z) => z.name === zoneName);
+  return zone?.id ?? null;
+}
+async function generateCloudflareEmailRoutingToken(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const zoneId = await findCloudflareZoneIdByName(
+    input.accessToken,
+    input.zoneName,
+    fetchImpl
+  );
+  if (!zoneId) {
+    throw new Error(`Cloudflare zone "${input.zoneName}" not found`);
+  }
+  const groups = await listCloudflarePermissionGroups(
+    input.accessToken,
+    fetchImpl
+  );
+  const emailRoutingGroup = groups.find(
+    (g) => g.name.toLowerCase().includes("email routing")
+  );
+  if (!emailRoutingGroup) {
+    throw new Error(
+      "Cloudflare Email Routing Edit permission group not found for this account."
+    );
+  }
+  const token = await createCloudflareApiToken({
+    name: input.tokenName ?? `nolo-email-routing-${input.zoneName}-${Date.now()}`,
+    policies: [buildEmailRoutingPolicy(zoneId, [emailRoutingGroup.id])],
+    accessToken: input.accessToken,
+    fetchImpl
+  });
+  return { token, zoneId };
+}
+function buildEmailRoutingPolicy(zoneId, emailRoutingPermissionGroupIds) {
+  if (emailRoutingPermissionGroupIds.length === 0) {
+    throw new Error(
+      "Email routing permission group IDs are required. Resolve them with listCloudflarePermissionGroups."
+    );
+  }
+  return {
+    effect: "allow",
+    resources: {
+      "com.cloudflare.api.account": "*",
+      "com.cloudflare.api.zone": zoneId
+    },
+    permission_groups: emailRoutingPermissionGroupIds.map((id) => ({ id }))
+  };
+}
+
+// packages/cli/oauth/envFile.ts
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
+function upsertEnvVariable(filePath, key, value) {
+  const normalizedPath = resolve(filePath);
+  let content = "";
+  if (existsSync(normalizedPath)) {
+    content = readFileSync(normalizedPath, "utf8");
+  }
+  const lines = content.length > 0 ? content.split("\n") : [];
+  const keyPrefix = `${key}=`;
+  let replaced = false;
+  const newLines = lines.map((line) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(keyPrefix) || trimmed.startsWith(`${key} =`)) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) {
+    if (newLines.length > 0 && newLines[newLines.length - 1] !== "") {
+      newLines.push("");
+    }
+    newLines.push(`${key}=${value}`);
+  }
+  writeFileSync(normalizedPath, newLines.join("\n"), "utf8");
+}
+function parseFlagWithOptionalValue(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return void 0;
+  const next = args[index + 1];
+  if (next && !next.startsWith("--")) {
+    return next;
+  }
+  return true;
+}
+
+export {
+  runCloudflareOAuthLogin,
+  generateCloudflareEmailRoutingToken,
+  upsertEnvVariable,
+  parseFlagWithOptionalValue
+};

package/chunk-4SN6J65J.js

@@ -0,0 +1,38 @@
+// packages/core/localOrigins.ts
+var DEFAULT_LOCAL_HOST = "127.0.0.1";
+var DEFAULT_LOCAL_API_PORT = "38123";
+var DEFAULT_LOCAL_API_ORIGIN = `http://${DEFAULT_LOCAL_HOST}:${DEFAULT_LOCAL_API_PORT}`;
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "localhost",
+  "::1"
+]);
+function isLoopbackHostname(hostname) {
+  if (typeof hostname !== "string") return false;
+  let normalized = hostname.trim().toLowerCase();
+  if (!normalized) return false;
+  if (normalized.startsWith("[") && normalized.endsWith("]")) {
+    normalized = normalized.slice(1, -1);
+  }
+  return LOOPBACK_HOSTNAMES.has(normalized);
+}
+function isLoopbackUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  try {
+    return isLoopbackHostname(new URL(value).hostname);
+  } catch {
+    return false;
+  }
+}
+var LOCAL_SERVER_URL_PATTERN = /^https?:\/\/(?:(?:\d{1,3}\.){3}\d{1,3}|localhost|nolotus\.local)(?::\d+)?$/i;
+function isLocalServerUrl(value) {
+  if (typeof value !== "string") return false;
+  return LOCAL_SERVER_URL_PATTERN.test(value.trim());
+}
+
+export {
+  DEFAULT_LOCAL_API_ORIGIN,
+  isLoopbackHostname,
+  isLoopbackUrl,
+  isLocalServerUrl
+};

package/chunk-4VNS5WPM.js

@@ -0,0 +1,42 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __require,
+  __commonJS,
+  __export,
+  __toESM
+};