nolo-cli 0.8.0-alpha.2 → 0.8.0-alpha.21

package/authCommand-EB5JSOX5.js

@@ -0,0 +1,581 @@
+import {
+  defaultOpenBrowser
+} from "./chunk-VVX233PH.js";
+import "./chunk-6HYVJV7B.js";
+import {
+  generateCloudflareEmailRoutingToken,
+  parseFlagWithOptionalValue,
+  runCloudflareOAuthLogin,
+  upsertEnvVariable
+} from "./chunk-4IJYA27C.js";
+import {
+  generatePkcePair,
+  runAntigravityOAuthLogin,
+  runCursorOAuthLogin,
+  runOpenAiCodexBrowserPkce,
+  runOpenAiCodexDeviceCode,
+  runXaiOAuthDeviceCode,
+  runXaiOAuthLogin,
+  startCallbackServer
+} from "./chunk-EHLHSX7R.js";
+import "./chunk-JBTJAPUF.js";
+import {
+  buildEnvFromProfile,
+  loadProfileConfig
+} from "./chunk-ROWQEJRP.js";
+import "./chunk-ISNCLGUZ.js";
+import "./chunk-OLZBQWZU.js";
+import {
+  createOAuthTokenStore
+} from "./chunk-JZPBVBIY.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import "./chunk-H33743XH.js";
+import "./chunk-LM6IYQ3F.js";
+import "./chunk-O4BU24WZ.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-4SN6J65J.js";
+import "./chunk-LCBAMY2M.js";
+import "./chunk-3EUW3WEO.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-CF7PE763.js";
+import "./chunk-G3SUCT4W.js";
+import "./chunk-KUG52IAP.js";
+import "./chunk-4VNS5WPM.js";
+
+// packages/cli/oauth/flows/anthropic.ts
+import { randomBytes } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+var ANTHROPIC_OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var ANTHROPIC_OAUTH_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var ANTHROPIC_OAUTH_TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+var ANTHROPIC_OAUTH_CALLBACK_PORT = 54545;
+var ANTHROPIC_OAUTH_REDIRECT_URI = `http://localhost:${ANTHROPIC_OAUTH_CALLBACK_PORT}/callback`;
+var ANTHROPIC_OAUTH_SCOPES = [
+  "org:create_api_key",
+  "user:profile",
+  "user:inference",
+  "user:sessions:claude_code",
+  "user:mcp_servers",
+  "user:file_upload"
+];
+var ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+function buildAnthropicAuthorizeUrl(args) {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: ANTHROPIC_OAUTH_CLIENT_ID,
+    response_type: "code",
+    redirect_uri: args.redirectUri ?? ANTHROPIC_OAUTH_REDIRECT_URI,
+    scope: ANTHROPIC_OAUTH_SCOPES.join(" "),
+    code_challenge: args.challenge,
+    code_challenge_method: "S256",
+    state: args.state
+  });
+  return `${ANTHROPIC_OAUTH_AUTHORIZE_URL}?${params.toString()}`;
+}
+function parseManualAuthorization(raw, expectedState) {
+  const value = raw.trim();
+  if (!value) throw new Error("No authorization code was provided.");
+  try {
+    const url = new URL(value);
+    const code2 = url.searchParams.get("code")?.trim();
+    const state = url.searchParams.get("state")?.trim();
+    if (code2 && state === expectedState) return { code: code2, state };
+    throw new Error("Claude OAuth state verification failed.");
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("state verification")) {
+      throw error;
+    }
+  }
+  const separator = value.lastIndexOf("#");
+  if (separator < 0) return { code: value, state: expectedState };
+  const code = value.slice(0, separator).trim();
+  const returnedState = value.slice(separator + 1).trim();
+  if (!code || returnedState !== expectedState) {
+    throw new Error("Claude OAuth state verification failed.");
+  }
+  return { code, state: returnedState };
+}
+function tokenError(payload, status) {
+  const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${status}`;
+  return `Claude OAuth token exchange failed: ${detail}`;
+}
+async function exchangeAnthropicAuthorizationCode(args) {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const response = await fetchImpl(ANTHROPIC_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      client_id: ANTHROPIC_OAUTH_CLIENT_ID,
+      code: args.code,
+      state: args.state,
+      redirect_uri: args.redirectUri ?? ANTHROPIC_OAUTH_REDIRECT_URI,
+      code_verifier: args.verifier
+    }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(tokenError(payload, response.status));
+  if (typeof payload.access_token !== "string" || !payload.access_token) {
+    throw new Error("Claude OAuth token exchange response missing access_token.");
+  }
+  const now = args.now?.() ?? Date.now();
+  const expiresIn = typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? payload.expires_in : void 0;
+  const accountId = typeof payload.account?.uuid === "string" ? payload.account.uuid : void 0;
+  const email = typeof payload.account?.email_address === "string" ? payload.account.email_address : void 0;
+  const organizationId = typeof payload.organization?.uuid === "string" ? payload.organization.uuid : void 0;
+  const organizationName = typeof payload.organization?.name === "string" ? payload.organization.name : void 0;
+  return {
+    provider: "claude",
+    accessToken: payload.access_token,
+    ...typeof payload.refresh_token === "string" && payload.refresh_token ? { refreshToken: payload.refresh_token } : {},
+    ...expiresIn !== void 0 ? { expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS } : {},
+    ...typeof payload.scope === "string" ? { scope: payload.scope } : {},
+    ...accountId ? { accountId } : {},
+    ...email || organizationId || organizationName ? { metadata: { email, organizationId, organizationName } } : {},
+    obtainedAt: now
+  };
+}
+async function defaultReadLine(prompt) {
+  const terminal = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await terminal.question(prompt);
+  } finally {
+    terminal.close();
+  }
+}
+async function runAnthropicOAuthLogin(deps = {}) {
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const state = randomBytes(24).toString("base64url");
+  const pkce = generatePkcePair();
+  const preferredCallbackPort = deps.callbackPort ?? ANTHROPIC_OAUTH_CALLBACK_PORT;
+  const callbackServerFactory = deps.callbackServerFactory ?? startCallbackServer;
+  const callback = deps.manualCode ? null : await callbackServerFactory({
+    port: preferredCallbackPort,
+    hostname: "127.0.0.1",
+    timeoutMs: 5 * 6e4,
+    fallbackToRandomPort: true
+  });
+  const redirectUri = callback ? `http://localhost:${callback.port}/callback` : `http://localhost:${preferredCallbackPort}/callback`;
+  const authUrl = buildAnthropicAuthorizeUrl({
+    state,
+    challenge: pkce.challenge,
+    redirectUri
+  });
+  output.log(
+    `Open this URL to authorize Claude Pro/Max:
+  ${authUrl}`
+  );
+  if (callback && callback.port !== preferredCallbackPort) {
+    output.log(
+      `Port ${preferredCallbackPort} is busy; using callback port ${callback.port}.`
+    );
+  }
+  if (deps.openBrowser) {
+    try {
+      await deps.openBrowser(authUrl);
+    } catch (cause) {
+      error.error(`Could not open the browser automatically: ${String(cause)}`);
+    }
+  }
+  let code = "";
+  let returnedState = state;
+  if (deps.manualCode) {
+    const raw = await (deps.readLine ?? defaultReadLine)(
+      "Paste the final callback URL or authorization code: "
+    );
+    ({ code, state: returnedState } = parseManualAuthorization(raw, state));
+  } else {
+    if (!callback) throw new Error("Claude OAuth callback server did not start.");
+    try {
+      const result = await callback.waitForCode();
+      if (result.state !== state) {
+        throw new Error("Claude OAuth state verification failed.");
+      }
+      code = result.code;
+      returnedState = result.state;
+    } finally {
+      await callback.close().catch(() => void 0);
+    }
+  }
+  return exchangeAnthropicAuthorizationCode({
+    code,
+    state: returnedState,
+    verifier: pkce.verifier,
+    redirectUri,
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+    ...deps.now ? { now: deps.now } : {}
+  });
+}
+
+// packages/cli/oauth/authCommand.ts
+var SYNC_HELP_LINE = `  --sync-to-server  After local save, push the credential to your nolo server.
+  --sync-only       Push ~/.nolo/credentials/<provider>.json to the server without re-login.`;
+var CHATGPT_HELP_TEXT = `Authorize nolo-cli to call the OpenAI Codex / ChatGPT Plus API on your behalf.
+
+This authorizes model API access only. It does NOT log you into the Nolo platform.
+To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
+
+Usage:
+  nolo auth chatgpt [--browser] [--no-browser] [--sync-to-server] [--help]
+
+Options:
+  --browser         Use the local browser PKCE flow instead of the device-code flow.
+  --no-browser      Print the authorization URL only (device-code flow).
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+
+The default flow is device-code, which works headless: open the printed URL on any
+machine with a browser where you are already logged into ChatGPT. After approval, the
+access and refresh tokens are stored in ~/.nolo/credentials/chatgpt.json.
+
+Agents can reference the stored token by setting apiKeyRef: "chatgpt" with
+apiSource: "custom" and provider: "openai".
+`;
+var XAI_HELP_TEXT = `Authorize nolo-cli to call the xAI Grok API via your SuperGrok subscription.
+
+This authorizes model API access only. It does NOT log you into the Nolo platform.
+To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
+
+Usage:
+  nolo auth xai [--browser] [--device-code] [--no-browser] [--sync-to-server] [--help]
+
+Default (interactive desktop): OIDC PKCE loopback on 127.0.0.1:56121.
+Headless / SSH / Docker: use --device-code or --no-browser (RFC 8628 device
+authorization; no localhost callback). After approval, tokens are stored in
+~/.nolo/credentials/xai.json.
+
+The OAuth client_id is the same fixed value used by NousResearch/hermes-agent
+(MIT), oh-my-pi, and OpenClaw; xAI does not publish a public client registration flow.
+
+Options:
+  --browser         Use the browser PKCE loopback flow (default for xAI).
+  --device-code     Use RFC 8628 device authorization (headless-friendly).
+  --no-browser      Same as --device-code for xAI (no loopback listener).
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+
+Agents can reference the stored token by setting apiKeyRef: "xai" with
+apiSource: "custom" and provider: "xai".
+`;
+var ANTIGRAVITY_HELP_TEXT = `Authorize nolo-cli to call Google Antigravity (Gemini 3, Claude, GPT-OSS) via your Google account.
+
+This authorizes model API access only. It does NOT log you into the Nolo platform.
+To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
+
+Usage:
+  nolo auth antigravity [--browser] [--no-browser] [--sync-to-server] [--help]
+
+Opens a browser to https://accounts.google.com (OIDC PKCE loopback on 127.0.0.1:51121).
+After approval, the flow provisions a Cloud Code Assist project and stores the
+access and refresh tokens in ~/.nolo/credentials/antigravity.json.
+
+The OAuth client_id/secret are the same base64-decoded values used by
+oh-my-pi; Google does not publish a public Cloud Code Assist client registration.
+
+Options:
+  --browser         Use the browser PKCE flow (default for antigravity).
+  --no-browser      Print the authorization URL only.
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+
+Agents can reference the stored token by setting apiKeyRef: "antigravity" with
+apiSource: "custom" and provider: "google-antigravity".
+`;
+var CLAUDE_HELP_TEXT = `Authorize nolo-cli to call Anthropic Claude with your Claude Pro/Max subscription.
+
+This authorizes model API access only. It does NOT log you into the Nolo platform.
+To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
+
+Usage:
+  nolo auth claude [--browser] [--no-browser] [--sync-to-server] [--help]
+
+The default flow returns to a loopback callback on localhost:54545. With
+--no-browser, paste the final callback URL or authorization code into the
+terminal. Tokens are stored in ~/.nolo/credentials/claude.json.
+
+Options:
+  --browser         Open the Anthropic authorization page (default).
+  --no-browser      Print the authorization URL without opening a browser.
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+
+Agents can reference the stored token with apiKeyRef: "claude", provider:
+"anthropic", and model such as "claude-sonnet-5".
+`;
+var CURSOR_HELP_TEXT = `Authorize nolo-cli to call Cursor models via your Cursor Pro subscription.
+
+This authorizes model API access only. It does NOT log you into the Nolo
+platform. To manage agents, docs, spaces, and other Nolo resources, run
+"nolo login" first.
+
+Usage: nolo auth cursor [--no-browser] [--sync-to-server] [--help]
+
+The flow opens https://cursor.com/loginDeepControl in your browser and polls
+https://api2.cursor.sh/auth/poll until you approve. There is no loopback
+callback \u2014 this is a poll-based device flow, so it works in headless / SSH /
+Docker environments too.
+
+After approval, tokens are stored in ~/.nolo/credentials/cursor.json.
+Agents can reference the stored token with apiKeyRef: "cursor".
+
+Options:
+  --no-browser      Print the authorization URL without opening a browser.
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+`;
+var CLOUDFLARE_HELP_TEXT = `Authorize nolo-cli to manage Cloudflare resources on your behalf.
+
+This authorizes Cloudflare API access only. It does NOT log you into the Nolo platform.
+To manage agents, docs, spaces, and other Nolo resources, run "nolo login" first.
+
+Usage:
+  nolo auth cloudflare [--client-id <id>] [--scope <scopes>] [--generate-token] [--zone-name <domain>] [--token-name <label>] [--browser] [--no-browser] [--sync-to-server] [--help]
+
+Opens a browser to https://dash.cloudflare.com (OAuth 2.0 PKCE loopback on
+127.0.0.1:56122). After approval, the OAuth access token is stored locally in
+~/.nolo/credentials/cloudflare.json.
+
+To use this flow you must first create a Cloudflare OAuth client in the
+Cloudflare Dashboard (Manage Account > OAuth clients) and obtain a client_id.
+You can also create the client via the Cloudflare API:
+  POST /accounts/{account_id}/oauth_clients
+
+Set the client ID via the environment variable:
+  CLOUDFLARE_OAUTH_CLIENT_ID
+
+Override requested scopes via:
+  CLOUDFLARE_OAUTH_SCOPE
+
+Default scopes: account:read zone:read zone:edit user:read user:edit
+
+With --generate-token, the command will also use the OAuth access token to
+programmatically create a long-lived Cloudflare API token scoped to the
+specified zone with the Email Routing Edit permission.
+
+Options:
+  --client-id <id>     Use this OAuth client ID for this run.
+  --scope <scopes>     Space-separated scopes (overrides env var for this run).
+  --generate-token     Also create a Zone:Email Routing:Edit API token.
+  --zone-name <domain> Zone domain for token generation (default: nolo.chat).
+  --token-name <label> Name for the generated API token.
+  --write-to-env [path] Append or update CLOUDFLARE_EMAIL_ROUTING_API_TOKEN in the env file (default: .env).
+  --browser            Use the browser PKCE flow (default for cloudflare).
+  --no-browser         Print the authorization URL only.
+${SYNC_HELP_LINE}
+  --help, -h           Show this help and exit.
+`;
+var HELP_BY_PROVIDER = {
+  chatgpt: CHATGPT_HELP_TEXT,
+  xai: XAI_HELP_TEXT,
+  antigravity: ANTIGRAVITY_HELP_TEXT,
+  claude: CLAUDE_HELP_TEXT,
+  cloudflare: CLOUDFLARE_HELP_TEXT,
+  cursor: CURSOR_HELP_TEXT
+};
+function resolveServerSyncConfig() {
+  const envServer = process.env.NOLO_SERVER?.trim() || process.env.NOLO_SERVER_URL?.trim() || process.env.BASE_URL?.trim() || "";
+  const envToken = process.env.AUTH_TOKEN?.trim() || process.env.NOLO_AUTH_TOKEN?.trim() || "";
+  if (envServer && envToken) {
+    return { serverOrigin: envServer.replace(/\/+$/, ""), authToken: envToken };
+  }
+  let profileServer = "";
+  let profileToken = "";
+  try {
+    const config = loadProfileConfig();
+    const profileEnv = buildEnvFromProfile(config);
+    profileServer = profileEnv.NOLO_SERVER?.trim() || "";
+    profileToken = profileEnv.AUTH_TOKEN?.trim() || "";
+  } catch {
+  }
+  const serverOrigin = (envServer || profileServer).replace(/\/+$/, "");
+  const authToken = envToken || profileToken;
+  if (serverOrigin && authToken) {
+    return { serverOrigin, authToken };
+  }
+  return null;
+}
+async function syncCredentialToServer(provider, credential, deps) {
+  const output = deps.output ?? console;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const syncConfig = (deps.resolveServerSyncConfig ?? resolveServerSyncConfig)();
+  if (!syncConfig) {
+    output.log(
+      `[nolo] Warning: --sync-to-server requires NOLO_SERVER and AUTH_TOKEN env vars, or a configured profile. Skipping server sync.`
+    );
+    return;
+  }
+  const { serverOrigin, authToken } = syncConfig;
+  const url = `${serverOrigin}/api/oauth/${provider}/sync`;
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${authToken}`
+      },
+      body: JSON.stringify({
+        accessToken: credential.accessToken,
+        refreshToken: credential.refreshToken,
+        expiresAt: credential.expiresAt,
+        scope: credential.scope,
+        idToken: credential.idToken,
+        accountId: credential.accountId,
+        email: credential.metadata?.email,
+        metadata: credential.metadata
+      })
+    });
+    if (res.ok) {
+      output.log(`[nolo] Synced to ${serverOrigin}`);
+    } else {
+      let errorDetail = "";
+      try {
+        const body = await res.json();
+        errorDetail = body?.error || "";
+      } catch {
+      }
+      output.log(
+        `[nolo] Warning: server sync failed (${res.status}${errorDetail ? `: ${errorDetail}` : ""}). Token saved locally.`
+      );
+    }
+  } catch (err) {
+    output.log(
+      `[nolo] Warning: server sync failed (${err?.message ?? "network error"}). Token saved locally.`
+    );
+  }
+}
+async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const tokenStore = deps.tokenStore ?? createOAuthTokenStore();
+  if (args.includes("--help") || args.includes("-h")) {
+    output.log(HELP_BY_PROVIDER[provider]);
+    return 0;
+  }
+  const useBrowser = args.includes("--browser");
+  const noBrowser = args.includes("--no-browser") || deps.noBrowserByDefault;
+  const syncOnly = args.includes("--sync-only");
+  const syncToServer = args.includes("--sync-to-server") || syncOnly;
+  const generateToken = args.includes("--generate-token");
+  const writeToEnvRaw = parseFlagWithOptionalValue(args, "--write-to-env");
+  const writeToEnvPath = typeof writeToEnvRaw === "string" ? writeToEnvRaw : writeToEnvRaw === true ? ".env" : void 0;
+  const openBrowser = noBrowser ? void 0 : deps.openBrowser ?? defaultOpenBrowser;
+  if (syncOnly) {
+    const credential = tokenStore.read(provider);
+    if (!credential) {
+      error.error(
+        `[nolo] No local ${provider} credential. Run: nolo auth ${provider}`
+      );
+      return 1;
+    }
+    await syncCredentialToServer(provider, credential, deps);
+    return 0;
+  }
+  const flowDeps = {
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+    ...deps.sleep ? { sleep: deps.sleep } : {},
+    ...deps.now ? { now: deps.now } : {},
+    ...deps.readLine ? { readLine: deps.readLine } : {},
+    ...noBrowser ? { manualCode: true } : {},
+    openBrowser,
+    output,
+    error
+  };
+  const clientIdFlag = args.find((arg, index) => arg === "--client-id" && index + 1 < args.length) ? args[args.indexOf("--client-id") + 1] : void 0;
+  const scopeFlag = args.find((arg, index) => arg === "--scope" && index + 1 < args.length) ? args[args.indexOf("--scope") + 1] : void 0;
+  const zoneNameFlag = args.find((arg, index) => arg === "--zone-name" && index + 1 < args.length) ? args[args.indexOf("--zone-name") + 1] : void 0;
+  const tokenNameFlag = args.find((arg, index) => arg === "--token-name" && index + 1 < args.length) ? args[args.indexOf("--token-name") + 1] : void 0;
+  try {
+    let credential;
+    if (provider === "chatgpt") {
+      credential = useBrowser ? await runOpenAiCodexBrowserPkce(flowDeps) : await runOpenAiCodexDeviceCode(flowDeps);
+    } else if (provider === "xai") {
+      const useDeviceCode = !useBrowser && (args.includes("--device-code") || noBrowser);
+      credential = useDeviceCode ? await runXaiOAuthDeviceCode(flowDeps) : await runXaiOAuthLogin(flowDeps);
+    } else if (provider === "claude") {
+      credential = await runAnthropicOAuthLogin(flowDeps);
+    } else if (provider === "cursor") {
+      credential = await runCursorOAuthLogin(flowDeps);
+    } else if (provider === "cloudflare") {
+      credential = await runCloudflareOAuthLogin({
+        ...flowDeps,
+        ...clientIdFlag ? { clientId: clientIdFlag } : {},
+        ...scopeFlag ? { scope: scopeFlag } : {}
+      });
+      if (generateToken) {
+        const zoneName = zoneNameFlag ?? process.env.CLOUDFLARE_ZONE_NAME ?? "nolo.chat";
+        const tokenName = tokenNameFlag ?? `nolo-email-routing-${zoneName}`;
+        const { token, zoneId } = await generateCloudflareEmailRoutingToken({
+          accessToken: credential.accessToken,
+          zoneName,
+          tokenName,
+          fetchImpl: deps.fetchImpl ?? fetch
+        });
+        output.log(
+          `[nolo] Generated Cloudflare API token for zone ${zoneName} (${zoneId}).
+Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
+  ${token}
+`
+        );
+        if (writeToEnvPath) {
+          upsertEnvVariable(
+            writeToEnvPath,
+            "CLOUDFLARE_EMAIL_ROUTING_API_TOKEN",
+            token
+          );
+          output.log(
+            `[nolo] Updated ${writeToEnvPath} with CLOUDFLARE_EMAIL_ROUTING_API_TOKEN.`
+          );
+        }
+      }
+    } else {
+      credential = await runAntigravityOAuthLogin(flowDeps);
+    }
+    tokenStore.write(provider, credential);
+    const accountLabel = credential.metadata?.email ?? credential.accountId ?? "";
+    output.log(
+      `[nolo] ${provider} authorization saved` + (accountLabel ? ` for ${accountLabel}` : "") + `.`
+    );
+    if (syncToServer) {
+      await syncCredentialToServer(provider, credential, deps);
+    }
+    return 0;
+  } catch (err) {
+    error.error(
+      `nolo auth ${provider} failed: ${toErrorMessage(err)}`
+    );
+    return 1;
+  }
+}
+async function runAuthChatgptCommand(args, ctx, deps) {
+  return runAuthProviderCommand("chatgpt", args, ctx, deps);
+}
+async function runAuthXaiCommand(args, ctx, deps) {
+  return runAuthProviderCommand("xai", args, ctx, deps);
+}
+async function runAuthAntigravityCommand(args, ctx, deps) {
+  return runAuthProviderCommand("antigravity", args, ctx, deps);
+}
+async function runAuthCloudflareCommand(args, ctx, deps) {
+  return runAuthProviderCommand("cloudflare", args, ctx, deps);
+}
+async function runAuthClaudeCommand(args, ctx, deps) {
+  return runAuthProviderCommand("claude", args, ctx, deps);
+}
+async function runAuthCursorCommand(args, ctx, deps) {
+  return runAuthProviderCommand("cursor", args, ctx, deps);
+}
+export {
+  resolveServerSyncConfig,
+  runAuthAntigravityCommand,
+  runAuthChatgptCommand,
+  runAuthClaudeCommand,
+  runAuthCloudflareCommand,
+  runAuthCursorCommand,
+  runAuthProviderCommand,
+  runAuthXaiCommand
+};

package/authCommands-XPEHTKSM.js

@@ -0,0 +1,35 @@
+import {
+  LOGIN_HELP_TEXT,
+  LOGOUT_HELP_TEXT,
+  WHOAMI_HELP_TEXT,
+  defaultOpenBrowser,
+  runLoginCommand,
+  runLogoutCommand,
+  runWhoamiCommand
+} from "./chunk-VVX233PH.js";
+import "./chunk-6HYVJV7B.js";
+import "./chunk-JBTJAPUF.js";
+import "./chunk-ROWQEJRP.js";
+import "./chunk-ISNCLGUZ.js";
+import "./chunk-OLZBQWZU.js";
+import "./chunk-H33743XH.js";
+import "./chunk-LM6IYQ3F.js";
+import "./chunk-O4BU24WZ.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-4SN6J65J.js";
+import "./chunk-LCBAMY2M.js";
+import "./chunk-3EUW3WEO.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-CF7PE763.js";
+import "./chunk-G3SUCT4W.js";
+import "./chunk-4VNS5WPM.js";
+export {
+  LOGIN_HELP_TEXT,
+  LOGOUT_HELP_TEXT,
+  WHOAMI_HELP_TEXT,
+  defaultOpenBrowser,
+  runLoginCommand,
+  runLogoutCommand,
+  runWhoamiCommand
+};