wikimemory 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Josh Vanderberg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# Wikimemory
+
+Wikimemory is a personal, remotely hosted memory service for Claude, Codex, and
+other MCP clients. It preserves research, project state, technical decisions, and
+reusable context in an auditable revision store that the owner can browse and
+search from the web.
+
+It includes remote HTTP MCP with OAuth/PKCE, passkey identity, append-only revision
+storage, full-text search, a React browse/search/history UI, multi-passkey controls,
+sanitized exports, and version-matched client skills. The server does not call an
+LLM; Claude or Codex performs synthesis while Wikimemory provides deterministic,
+auditable storage and retrieval.
+
+## Quick start
+
+Requirements: Node.js 22+, npm, a Cloudflare account, and a passkey-capable browser
+or password manager. No Google Cloud project or OAuth application is required.
+
+```sh
+npx wrangler login
+npx wikimemory install
+```
+
+The installer previews the exact Cloudflare account, Worker, D1 database, and KV
+namespace before creating anything. Open its one-time URL to register the owner
+passkey, then connect a client and install its memory skills:
+
+```sh
+npx wikimemory connect codex
+npx wikimemory skills install codex
+
+# or
+npx wikimemory connect claude
+npx wikimemory skills install claude
+```
+
+Use the same remote MCP from Claude web or mobile by adding the printed HTTPS `/mcp`
+URL as a custom connector. See the complete [installation guide](docs/installation.md)
+for recovery, passkey management, upgrades, and safe uninstall.
+
+## Local development without a checkout
+
+```sh
+npx wikimemory dev
+```
+
+This starts the packaged Worker, React app, D1, and KV through local Wrangler
+emulation. State persists under `./.wikimemory/dev`; production passkey identity is
+replaced with a clearly marked fake local owner while OAuth, PKCE, scopes, tokens,
+and MCP transport remain real.
+
+## Lifecycle commands
+
+```sh
+npx wikimemory status
+npx wikimemory upgrade
+npx wikimemory recover
+npx wikimemory passkeys list
+npx wikimemory uninstall       # preview only
+```
+
+Parallel installations use `--deployment NAME`. Non-secret lifecycle state lives
+under `~/.config/wikimemory/deployments/NAME/`. Uninstall requires an explicit apply
+step and exact Worker-name confirmation because deleting D1 permanently destroys the
+stored memory.
+
+## V1 in one picture
+
+```text
+Claude / Codex ---- Streamable HTTP MCP ----+
+                                             |
+Browser ------------ HTTPS web app ---------+--> Cloudflare Worker --> D1
+                                             |
+Passkey ------------ owner authentication --+
+```
+
+Cloudflare is the recommended V1 host because Workers, D1, and KV all have free
+tier allowances large enough for typical personal use; the
+[paid Workers plan](https://developers.cloudflare.com/workers/platform/pricing/)
+starts at $5/month if those limits are exceeded. Memory is protected by access control and
+Cloudflare-managed encryption, but it is **not end-to-end encrypted from Cloudflare**.
+Do not store credentials or material you are unwilling to entrust to the host.
+
+## Design documents
+
+- [V1 product specification](docs/v1-spec.md)
+- [Architecture](docs/architecture.md)
+- [Security and threat model](docs/security.md)
+- [Data model](docs/data-model.md)
+- [MCP contract](docs/mcp-contract.md)
+- [Local development and testing](docs/testing.md)
+- [Installation and client connection](docs/installation.md)
+- [Export formats and privacy](docs/export-format.md)
+- [Pasteable agent instructions](docs/manual-agent-instructions.md)
+- [Implementation plan](docs/implementation-plan.md)
+- [Independent design review and dispositions](docs/design-review-2026-07-18.md)
+
+## V1 boundaries
+
+V1 is a personal, bring-your-own-Cloudflare deployment with one workspace and
+passkey owner authentication. It includes a React web application with explicit
+owner administration, remote MCP,
+local emulation, portable export, agent skills, and an installation skill.
+
+Multi-tenant SaaS, vector search, attachments, built-in chat, offline operation,
+manual document editing, scheduled backups, monitoring infrastructure, custom
+domains, and permanent staging infrastructure are not V1 features.
+
+## License
+
+MIT

package/dist/npm-cli/scripts/cli-options.js

@@ -0,0 +1,29 @@
+import { deploymentPaths } from "./deployment-record.js";
+export function deploymentArguments(args) {
+    let deployment = "wikimemory";
+    const remaining = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === "--deployment") {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith("--"))
+                throw new Error("--deployment requires a value");
+            deploymentPaths(value);
+            deployment = value;
+            index += 1;
+        }
+        else if (argument !== undefined)
+            remaining.push(argument);
+    }
+    return { deployment, remaining };
+}
+export function installArguments(deployment, args) {
+    const result = [...args];
+    if (!result.includes("--worker-name"))
+        result.push("--worker-name", deployment);
+    if (!result.includes("--database-name"))
+        result.push("--database-name", deployment);
+    if (!result.includes("--kv-name"))
+        result.push("--kv-name", `${deployment}-oauth`);
+    return result;
+}

package/dist/npm-cli/scripts/cli.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { mkdir } from "node:fs/promises";
+import process from "node:process";
+import { WIKIMEMORY_VERSION } from "../src/version.js";
+import { deploymentArguments, installArguments } from "./cli-options.js";
+import { deploymentPaths } from "./deployment-record.js";
+import { packageRoot } from "./package-root.js";
+const [command, ...args] = process.argv.slice(2);
+function usage() {
+    return `Wikimemory ${WIKIMEMORY_VERSION}\n\nUsage:\n  wikimemory install [--deployment NAME] [installer options]\n  wikimemory recover [--deployment NAME]\n  wikimemory dev [wrangler dev options]\n  wikimemory status [--deployment NAME]\n  wikimemory upgrade [--deployment NAME] [--yes]\n  wikimemory passkeys [--deployment NAME] list|add|revoke\n  wikimemory connect [--deployment NAME] codex|claude\n  wikimemory skills install codex|claude\n  wikimemory uninstall [--deployment NAME] [--apply]\n  wikimemory --version`;
+}
+async function main() {
+    if (command === undefined || command === "--help" || command === "help") {
+        console.log(usage());
+        return;
+    }
+    if (command === "--version" || command === "version") {
+        console.log(WIKIMEMORY_VERSION);
+        return;
+    }
+    const root = packageRoot();
+    if (command === "dev") {
+        const { runDev } = await import("./dev.js");
+        await runDev(root, args);
+        return;
+    }
+    if (command === "skills") {
+        if (args[0] !== "install" || args.length !== 2)
+            throw new Error("Usage: wikimemory skills install codex|claude");
+        const { installSkills } = await import("./client-tools.js");
+        await installSkills(root, args[1]);
+        return;
+    }
+    const parsed = deploymentArguments(args);
+    const paths = deploymentPaths(parsed.deployment);
+    if (command === "install" || command === "recover") {
+        await mkdir(paths.directory, { recursive: true, mode: 0o700 });
+        process.env["WIKIMEMORY_PACKAGE_ROOT"] = root;
+        process.env["WIKIMEMORY_STATE_DIR"] = paths.directory;
+        process.env["WIKIMEMORY_PACKAGED"] = "1";
+        const { runSetup } = await import("./setup.js");
+        const setupArguments = installArguments(parsed.deployment, parsed.remaining);
+        await runSetup(command === "recover" ? ["--recover", ...setupArguments] : setupArguments);
+    }
+    else if (command === "upgrade") {
+        const { runUpgrade } = await import("./upgrade.js");
+        await runUpgrade(["--deployment", parsed.deployment, ...parsed.remaining]);
+    }
+    else if (command === "status") {
+        if (parsed.remaining.length !== 0)
+            throw new Error("Usage: wikimemory status [--deployment NAME]");
+        const { runStatus } = await import("./status.js");
+        await runStatus(parsed.deployment);
+    }
+    else if (command === "passkeys") {
+        process.env["WIKIMEMORY_STATE_DIR"] = paths.directory;
+        process.env["WIKIMEMORY_PACKAGED"] = "1";
+        const { runPasskeys } = await import("./passkeys.js");
+        await runPasskeys(parsed.remaining);
+    }
+    else if (command === "connect") {
+        if (parsed.remaining.length !== 1)
+            throw new Error("Usage: wikimemory connect [--deployment NAME] codex|claude");
+        const { connectClient } = await import("./client-tools.js");
+        await connectClient(parsed.deployment, parsed.remaining[0]);
+    }
+    else if (command === "uninstall") {
+        process.env["WIKIMEMORY_STATE_DIR"] = paths.directory;
+        process.env["WIKIMEMORY_PACKAGED"] = "1";
+        const { runUninstall } = await import("./uninstall.js");
+        await runUninstall(parsed.remaining);
+    }
+    else
+        throw new Error(`Unknown command: ${command}`);
+}
+main().catch((error) => {
+    console.error(`Wikimemory failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+    process.exitCode = 1;
+});

package/dist/npm-cli/scripts/client-tools.js

@@ -0,0 +1,57 @@
+import { spawn } from "node:child_process";
+import { cp, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { deploymentRecordPath, readDeploymentRecord } from "./deployment-record.js";
+function client(value) {
+    if (value === "codex" || value === "claude")
+        return value;
+    throw new Error("Client must be codex or claude");
+}
+async function run(command, args) {
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: "inherit" });
+        child.on("error", reject);
+        child.on("close", (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`${command} exited with status ${code ?? "unknown"}`));
+        });
+    });
+}
+export async function connectClient(deployment, selected) {
+    const target = client(selected);
+    const record = await readDeploymentRecord(deploymentRecordPath(deployment));
+    const endpoint = `${record.origin}/mcp`;
+    if (target === "codex") {
+        await run("codex", ["mcp", "add", deployment, "--url", endpoint]);
+        await run("codex", ["mcp", "login", deployment, "--scopes", "memory:read,memory:write"]);
+    }
+    else {
+        await run("claude", [
+            "mcp",
+            "add",
+            "--transport",
+            "http",
+            "--scope",
+            "user",
+            deployment,
+            endpoint
+        ]);
+        await run("claude", ["mcp", "login", deployment]);
+    }
+}
+export async function installSkills(packageRoot, selected) {
+    const target = client(selected);
+    const destinationRoot = join(homedir(), target === "codex" ? ".codex" : ".claude", "skills");
+    await mkdir(destinationRoot, { recursive: true, mode: 0o700 });
+    const names = ["wikimemory-recall", "wikimemory-ingest", "wikimemory-lint", "wikimemory-install"];
+    for (const name of names) {
+        await cp(join(packageRoot, "skills", name), join(destinationRoot, name), {
+            recursive: true,
+            force: true
+        });
+    }
+    console.log(`Installed ${names.length} Wikimemory skills for ${target}. Restart the client.`);
+}

package/dist/npm-cli/scripts/deployment-record.js

@@ -0,0 +1,72 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+const DEPLOYMENT_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/u;
+export const DEPLOYMENT_RECORD_SCHEMA = z
+    .object({
+    formatVersion: z.literal(1),
+    accountId: z.string().min(1),
+    workerName: z.string().regex(DEPLOYMENT_NAME),
+    databaseName: z.string().min(1),
+    databaseId: z.string().min(1),
+    kvName: z.string().min(1),
+    kvId: z.string().min(1),
+    origin: z.url().refine((value) => value.startsWith("https://")),
+    installedVersion: z.string().regex(/^\d+\.\d+\.\d+$/u)
+})
+    .strict();
+const PRODUCTION_CONFIG_SCHEMA = z.object({
+    name: z.string(),
+    account_id: z.string(),
+    vars: z.object({ APP_BASE_URL: z.url() }),
+    d1_databases: z.array(z.object({
+        binding: z.literal("DB"),
+        database_name: z.string(),
+        database_id: z.string()
+    })),
+    kv_namespaces: z.array(z.object({ binding: z.literal("OAUTH_KV"), id: z.string() }))
+});
+export function deploymentRecordPath(deployment = "wikimemory") {
+    return deploymentPaths(deployment).record;
+}
+export function deploymentPaths(deployment = "wikimemory") {
+    if (!DEPLOYMENT_NAME.test(deployment))
+        throw new Error("Invalid deployment name");
+    const configRoot = process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config");
+    const directory = join(configRoot, "wikimemory", "deployments", deployment);
+    return {
+        directory,
+        record: join(directory, "deployment.json"),
+        config: join(directory, "wrangler.jsonc"),
+        installProgress: join(directory, "install-progress.json"),
+        uninstallProgress: join(directory, "uninstall-progress.json"),
+        passkeyClient: join(directory, "passkey-client.json")
+    };
+}
+export function deploymentRecordFromConfig(configText, installedVersion, kvName) {
+    const config = PRODUCTION_CONFIG_SCHEMA.parse(JSON.parse(configText));
+    const database = config.d1_databases.at(0);
+    const namespace = config.kv_namespaces.at(0);
+    if (database === undefined || namespace === undefined)
+        throw new Error("Production config is missing Wikimemory storage bindings");
+    return DEPLOYMENT_RECORD_SCHEMA.parse({
+        formatVersion: 1,
+        accountId: config.account_id,
+        workerName: config.name,
+        databaseName: database.database_name,
+        databaseId: database.database_id,
+        kvName,
+        kvId: namespace.id,
+        origin: config.vars.APP_BASE_URL,
+        installedVersion
+    });
+}
+export async function readDeploymentRecord(path) {
+    return DEPLOYMENT_RECORD_SCHEMA.parse(JSON.parse(await readFile(path, "utf8")));
+}
+export async function writeDeploymentRecord(record, path = deploymentRecordPath(record.workerName)) {
+    const valid = DEPLOYMENT_RECORD_SCHEMA.parse(record);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(valid, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+}

package/dist/npm-cli/scripts/dev.js

@@ -0,0 +1,49 @@
+import { spawn } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+export function localConfig(packageRoot) {
+    return `${JSON.stringify({
+        $schema: join(packageRoot, "node_modules", "wrangler", "config-schema.json"),
+        name: "wikimemory-local",
+        main: join(packageRoot, "src", "index.ts"),
+        compatibility_date: "2026-07-18",
+        compatibility_flags: ["nodejs_compat"],
+        assets: {
+            directory: join(packageRoot, "dist", "web"),
+            binding: "ASSETS",
+            not_found_handling: "single-page-application"
+        },
+        vars: { APP_ENV: "local" },
+        d1_databases: [
+            {
+                binding: "DB",
+                database_name: "wikimemory",
+                database_id: "00000000-0000-0000-0000-000000000001",
+                migrations_dir: join(packageRoot, "migrations")
+            }
+        ],
+        kv_namespaces: [{ binding: "OAUTH_KV", id: "00000000000000000000000000000001" }]
+    }, null, 2)}\n`;
+}
+async function runWrangler(args, inherited = false) {
+    await new Promise((resolvePromise, reject) => {
+        const child = spawn("npx", ["wrangler", ...args], {
+            stdio: inherited ? "inherit" : ["ignore", "inherit", "inherit"]
+        });
+        child.on("error", reject);
+        child.on("close", (code) => {
+            if (code === 0)
+                resolvePromise();
+            else
+                reject(new Error(`Wrangler exited with status ${code ?? "unknown"}`));
+        });
+    });
+}
+export async function runDev(packageRoot, args) {
+    const stateDirectory = resolve(".wikimemory", "dev");
+    await mkdir(stateDirectory, { recursive: true });
+    const configPath = join(stateDirectory, "wrangler.jsonc");
+    await writeFile(configPath, localConfig(packageRoot), "utf8");
+    await runWrangler(["d1", "migrations", "apply", "wikimemory", "--local", "--config", configPath]);
+    await runWrangler(["dev", "--config", configPath, ...args], true);
+}

package/dist/npm-cli/scripts/lifecycle-runtime.js

@@ -0,0 +1,38 @@
+import { join } from "node:path";
+import { deploymentRecordPath } from "./deployment-record.js";
+const packaged = process.env["WIKIMEMORY_PACKAGED"] === "1";
+const stateRoot = process.env["WIKIMEMORY_STATE_DIR"] ?? ".";
+export const packageRoot = process.env["WIKIMEMORY_PACKAGE_ROOT"] ?? ".";
+export const setupRuntime = {
+    packaged,
+    executable: packaged ? "wikimemory install" : "npm run setup --",
+    config: join(stateRoot, packaged ? "wrangler.jsonc" : "wrangler.production.jsonc"),
+    progress: join(stateRoot, packaged ? "install-progress.json" : ".wikimemory-installer.json")
+};
+export const uninstallRuntime = {
+    packaged,
+    executable: packaged ? "wikimemory uninstall" : "npm run uninstall --",
+    config: setupRuntime.config,
+    installProgress: setupRuntime.progress,
+    uninstallProgress: join(stateRoot, packaged ? "uninstall-progress.json" : ".wikimemory-uninstall.json"),
+    record: join(stateRoot, "deployment.json")
+};
+export const passkeyRuntime = {
+    config: setupRuntime.config,
+    client: join(stateRoot, packaged ? "passkey-client.json" : ".wikimemory-cli.json")
+};
+export function installedRecordPath(workerName) {
+    return packaged ? join(stateRoot, "deployment.json") : deploymentRecordPath(workerName);
+}
+export async function removePackagedDeploymentRecord() {
+    if (!packaged)
+        return;
+    const { unlink } = await import("node:fs/promises");
+    try {
+        await unlink(uninstallRuntime.record);
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+}

package/dist/npm-cli/scripts/package-root.js

@@ -0,0 +1,15 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+export function packageRoot(moduleUrl = import.meta.url) {
+    let candidate = dirname(fileURLToPath(moduleUrl));
+    for (let depth = 0; depth < 6; depth += 1) {
+        if (existsSync(join(candidate, "release-manifest.json")))
+            return candidate;
+        const parent = dirname(candidate);
+        if (parent === candidate)
+            break;
+        candidate = parent;
+    }
+    throw new Error("Could not locate the Wikimemory package root");
+}

package/dist/npm-cli/scripts/passkeys.js

@@ -0,0 +1,197 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { z } from "zod";
+import { passkeyRuntime } from "./lifecycle-runtime.js";
+import { configuredOrigin } from "./setup.js";
+const PRODUCTION_CONFIG = passkeyRuntime.config;
+const CLI_STATE = passkeyRuntime.client;
+const CALLBACK = "http://127.0.0.1:45831/callback";
+const CLIENT_SCHEMA = z.object({ clientId: z.string().min(1) });
+const DCR_SCHEMA = z.object({ client_id: z.string().min(1) });
+const TOKEN_SCHEMA = z.object({ access_token: z.string().min(1), token_type: z.string() });
+const PASSKEY_SCHEMA = z.object({
+    credentialRef: z.string(),
+    label: z.string(),
+    deviceType: z.enum(["singleDevice", "multiDevice"]),
+    backedUp: z.boolean(),
+    createdAt: z.string(),
+    lastUsedAt: z.string().nullable()
+});
+const LIST_SCHEMA = z.object({ passkeys: z.array(PASSKEY_SCHEMA) });
+const ADD_SCHEMA = z.object({ registrationUrl: z.url(), expiresAt: z.string() });
+const REVOKE_SCHEMA = z.object({
+    revoked: z.string(),
+    sessionCleanupComplete: z.boolean()
+});
+function command(args) {
+    if (args[0] === "list" && args.length === 1)
+        return { kind: "list" };
+    if (args[0] === "add" && args[1] === "--name" && args[2] !== undefined && args.length === 3)
+        return { kind: "add", label: args[2] };
+    if (args[0] === "revoke" &&
+        args[1] !== undefined &&
+        args.length === 2 &&
+        /^[a-f0-9]{64}$/u.test(args[1]))
+        return { kind: "revoke", credentialRef: args[1] };
+    const executable = passkeyRuntime.config.endsWith("wrangler.jsonc")
+        ? "wikimemory passkeys"
+        : "npm run passkeys --";
+    throw new Error(`Usage: ${executable} list\n       ${executable} add --name "Backup key"\n       ${executable} revoke CREDENTIAL_REF`);
+}
+async function clientId(origin) {
+    try {
+        return CLIENT_SCHEMA.parse(JSON.parse(await readFile(CLI_STATE, "utf8"))).clientId;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    const response = await fetch(`${origin}/oauth/register`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            client_name: "Wikimemory owner CLI",
+            redirect_uris: [CALLBACK],
+            grant_types: ["authorization_code"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none"
+        })
+    });
+    if (!response.ok)
+        throw new Error(`OAuth client registration failed with HTTP ${response.status}`);
+    const registered = DCR_SCHEMA.parse(await response.json());
+    await writeFile(CLI_STATE, `${JSON.stringify({ clientId: registered.client_id }, null, 2)}\n`, {
+        encoding: "utf8",
+        flag: "wx"
+    });
+    return registered.client_id;
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    const executable = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(executable, args, { detached: true, stdio: "ignore" });
+    child.unref();
+}
+async function authorizationCode(authorizeUrl, expectedState) {
+    return await new Promise((resolve, reject) => {
+        const server = createServer((request, response) => {
+            const url = new URL(request.url ?? "/", CALLBACK);
+            if (url.pathname !== "/callback") {
+                response.writeHead(404).end("Not found");
+                return;
+            }
+            const state = url.searchParams.get("state");
+            const code = url.searchParams.get("code");
+            const error = url.searchParams.get("error");
+            if (state !== expectedState || code === null || error !== null) {
+                response
+                    .writeHead(400, { "content-type": "text/plain; charset=utf-8" })
+                    .end("Wikimemory CLI authorization failed. Return to the terminal.");
+                server.close();
+                reject(new Error(error ?? "OAuth callback validation failed"));
+                return;
+            }
+            response
+                .writeHead(200, {
+                "content-type": "text/plain; charset=utf-8",
+                "cache-control": "no-store"
+            })
+                .end("Wikimemory CLI authorized. You can close this tab.");
+            server.close();
+            resolve(code);
+        });
+        server.on("error", reject);
+        server.listen(45831, "127.0.0.1", () => {
+            openBrowser(authorizeUrl);
+        });
+    });
+}
+async function accessToken(origin, client) {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = randomBytes(24).toString("base64url");
+    const resource = `${origin}/mcp`;
+    const authorize = new URL(`${origin}/authorize`);
+    authorize.search = new URLSearchParams({
+        response_type: "code",
+        client_id: client,
+        redirect_uri: CALLBACK,
+        scope: "memory:admin",
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        resource
+    }).toString();
+    console.log("Opening your browser for passkey authorization…");
+    const code = await authorizationCode(authorize.toString(), state);
+    const response = await fetch(`${origin}/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: client,
+            code,
+            redirect_uri: CALLBACK,
+            code_verifier: verifier,
+            resource
+        })
+    });
+    if (!response.ok)
+        throw new Error(`OAuth token exchange failed with HTTP ${response.status}`);
+    return TOKEN_SCHEMA.parse(await response.json()).access_token;
+}
+export async function runPasskeys(args) {
+    const selected = command(args);
+    const origin = configuredOrigin(await readFile(PRODUCTION_CONFIG, "utf8"));
+    if (origin === null || origin === "https://bootstrap.invalid")
+        throw new Error("A deployed wrangler.production.jsonc is required");
+    const token = await accessToken(origin, await clientId(origin));
+    const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+    if (selected.kind === "list") {
+        const response = await fetch(`${origin}/api/passkeys`, { headers });
+        if (!response.ok)
+            throw new Error(`Passkey listing failed with HTTP ${response.status}`);
+        const result = LIST_SCHEMA.parse(await response.json());
+        for (const passkey of result.passkeys) {
+            console.log(`${passkey.credentialRef}  ${passkey.label}\n  ${passkey.deviceType}, ${passkey.backedUp ? "backed up" : "not backed up"}, created ${passkey.createdAt}${passkey.lastUsedAt === null ? "" : `, last used ${passkey.lastUsedAt}`}`);
+        }
+    }
+    else if (selected.kind === "add") {
+        const response = await fetch(`${origin}/api/passkeys`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ label: selected.label })
+        });
+        if (!response.ok)
+            throw new Error(`Passkey registration failed with HTTP ${response.status}`);
+        const result = ADD_SCHEMA.parse(await response.json());
+        console.log(`Opening the one-use registration page (expires ${result.expiresAt})…`);
+        openBrowser(result.registrationUrl);
+    }
+    else {
+        const response = await fetch(`${origin}/api/passkeys`, {
+            method: "DELETE",
+            headers,
+            body: JSON.stringify({ credentialRef: selected.credentialRef })
+        });
+        if (!response.ok)
+            throw new Error(`Passkey revocation failed with HTTP ${response.status}: ${await response.text()}`);
+        const result = REVOKE_SCHEMA.parse(await response.json());
+        console.log(`Revoked ${result.revoked}.`);
+        console.log(result.sessionCleanupComplete
+            ? "Sessions created by that credential were also removed."
+            : "Session cleanup could not be confirmed, but those sessions are blocked because the passkey no longer exists.");
+    }
+}
+const entrypoint = process.argv[1];
+if (entrypoint !== undefined && import.meta.url === pathToFileURL(entrypoint).href) {
+    runPasskeys(process.argv.slice(2)).catch((error) => {
+        console.error(`Passkey command failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+        process.exitCode = 1;
+    });
+}