Fixed
- Browser OAuth login actually works now. Turso redirects to
/?jwt=<JWT>&username=<USERNAME> without echoing our state parameter, so the strict check rejected every real login with Invalid state parameter. A missing state is now accepted with a warning (the token is still validated against the Turso API afterwards); only a present-but-mismatched state is rejected as a CSRF attempt. Verified end-to-end with a live login.
Tests
- Extended
tests/cloud/phase1_cloud.test.js: new case for the real Turso callback shape (no state → 200), alongside the existing match → 200 / mismatch → 400 cases.
Docs / CLI polish
setup now accepts --api-token and --token as aliases for --api-key (previously silently ignored); login already accepted all three, usage lines unified.setup usage now documents [--api-key <TOKEN>]; uninstall help uses the same npx -y @lotargo/memory_plugin form as the README and landing.
Upgrade
npm i -g @lotargo/memory_plugin@1.6.10
