@roxyon/api-client 0.1.0

package/dist/index.cjs

@@ -0,0 +1,856 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AccountApi: () => AccountApi,
+  ApplicationsApi: () => ApplicationsApi,
+  AuthApi: () => AuthApi,
+  DEFAULT_APP: () => DEFAULT_APP,
+  DEFAULT_BAAS_URL: () => DEFAULT_BAAS_URL,
+  DEFAULT_CONSOLE_URL: () => DEFAULT_CONSOLE_URL,
+  DomainsApi: () => DomainsApi,
+  LUMEN_BUILD: () => LUMEN_BUILD,
+  RUNTIMES: () => RUNTIMES,
+  Roxyon: () => Roxyon,
+  RoxyonApiError: () => RoxyonApiError,
+  RoxyonClient: () => RoxyonClient,
+  SitesApi: () => SitesApi,
+  SubscriptionsApi: () => SubscriptionsApi,
+  TokensApi: () => TokensApi,
+  assertOk: () => assertOk,
+  envFromStored: () => envFromStored,
+  formatEnv: () => formatEnv,
+  isAuthError: () => isAuthError,
+  parseEnv: () => parseEnv,
+  rxError: () => rxError,
+  toQueryString: () => toQueryString
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+function rxError(r) {
+  if (r === null || r === void 0) return "No response from the server.";
+  if (typeof r !== "object") return "";
+  const body = r;
+  if (typeof body.error === "string" && body.error) return body.error;
+  const rows = body.results;
+  if (Array.isArray(rows)) {
+    for (const row of rows) {
+      if (row && typeof row === "object" && typeof row.error === "string") {
+        const msg = row.error;
+        if (msg) return msg;
+      }
+    }
+  }
+  return "";
+}
+var RoxyonApiError = class extends Error {
+  code;
+  type;
+  status;
+  body;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "RoxyonApiError";
+    this.code = opts.code;
+    this.type = opts.type;
+    this.status = opts.status;
+    this.body = opts.body;
+  }
+};
+var AUTH_CODES = /* @__PURE__ */ new Set([101, 141, 209, 1060, 1063, 401]);
+var AUTH_HINTS = [
+  "invalid session",
+  "session token",
+  "unauthorized",
+  "not authorized",
+  "invalid token",
+  "expired",
+  "log in again"
+];
+function isAuthError(err) {
+  if (err instanceof RoxyonApiError) {
+    if (err.status === 401 || err.status === 403) return true;
+    if (err.code !== void 0 && AUTH_CODES.has(err.code)) return true;
+  }
+  const msg = (err instanceof Error ? err.message : typeof err === "string" ? err : rxError(err)).toLowerCase();
+  return AUTH_HINTS.some((h) => msg.includes(h));
+}
+function erroringNode(r) {
+  if (!r || typeof r !== "object") return void 0;
+  const body = r;
+  if (typeof body.error === "string" && body.error) return body;
+  if (Array.isArray(body.results)) {
+    for (const row of body.results) {
+      if (row && typeof row === "object" && row.error) return row;
+    }
+  }
+  return void 0;
+}
+function assertOk(r) {
+  const msg = rxError(r);
+  if (msg) {
+    const node = erroringNode(r);
+    throw new RoxyonApiError(msg, { code: node?.code, type: node?.type, body: r });
+  }
+  return r;
+}
+
+// src/account.ts
+var AccountApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  cache;
+  context(opts = {}) {
+    if (!this.cache || opts.fresh) this.cache = this.fetch();
+    return this.cache;
+  }
+  async fetch() {
+    const r = await this.client.console(
+      "GET",
+      "/account/context",
+      { tolerateHttpError: true }
+    );
+    if (!r?.ok || !r.user?.id) {
+      throw new RoxyonApiError(r?.error || "Could not load the account context.", { body: r });
+    }
+    return {
+      user: r.user,
+      scopes: r.scopes ?? [],
+      subscriptions: r.subscriptions ?? [],
+      domains: r.domains ?? []
+    };
+  }
+  /** `GET /account/apps` — the account's applications (list, PAT-safe). */
+  async apps() {
+    const r = await this.client.console("GET", "/account/apps", { tolerateHttpError: true });
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not list applications.", { body: r });
+    return r.applications ?? [];
+  }
+  /** One application by id, PAT-safe (filters {@link apps}). */
+  async getApp(id) {
+    return (await this.apps()).find((a) => a.id === id);
+  }
+  /** Pick the subscription to deploy against — the preferred one, else the only/first. */
+  async resolveSubscription(preferred) {
+    const { subscriptions } = await this.context();
+    if (subscriptions.length === 0) {
+      throw new RoxyonApiError("This account has no subscriptions.");
+    }
+    if (preferred) {
+      const hit = subscriptions.find((s) => s.id === preferred || s.name === preferred);
+      if (hit) return hit;
+    }
+    return subscriptions[0];
+  }
+};
+
+// src/applications.ts
+var ApplicationsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(subscriptionId) {
+    const r = await this.client.get("/Applications", {
+      fields: "objectId,Name,Status,DesiredState,SourcePath,Runtime,RuntimeVersion,Preset,ConfigRevision,AppliedRevision,LastError,Env,RepoUrl,Subscription",
+      limit: -1,
+      order: "Name",
+      where: { Subscription: subscriptionId }
+    });
+    return r.results ?? [];
+  }
+  async get(id) {
+    const r = await this.client.get("/Applications", {
+      fields: "objectId,Name,Status,DesiredState,SourcePath,Runtime,RuntimeVersion,Preset,ConfigRevision,AppliedRevision,LastError,Env,RepoUrl,Subscription",
+      limit: 1,
+      where: { objectId: id }
+    });
+    return r.results?.[0];
+  }
+  /** Create the application + its web process + a route, matching `createNew()`. */
+  async create(input) {
+    const appRes = assertOk(
+      await this.client.post("/Applications", {
+        Subscription: input.subscription,
+        Name: input.name,
+        Preset: input.preset,
+        SourcePath: input.sourcePath,
+        Runtime: input.runtime,
+        RuntimeVersion: input.runtimeVersion,
+        Env: JSON.stringify(input.env ?? {}),
+        Status: "pending",
+        DesiredState: "running",
+        ConfigRevision: 1,
+        AppliedRevision: 0,
+        LastError: ""
+      })
+    );
+    const appId = appRes.results?.[0]?.objectId;
+    if (!appId) throw new RoxyonApiError("No application id returned.", { body: appRes });
+    const procRes = assertOk(
+      await this.client.post("/ApplicationProcesses", {
+        Application: appId,
+        Type: "web",
+        Port: 0,
+        // allocated by the backend at deploy time
+        Command: input.command,
+        Status: "pending"
+      })
+    );
+    const procId = procRes.results?.[0]?.objectId ?? "";
+    const routeRes = assertOk(
+      await this.client.post("/ApplicationRoutes", {
+        Application: appId,
+        Domain: input.domainId,
+        Path: "/",
+        Enabled: input.public ? 1 : 0
+      })
+    );
+    const routeId = routeRes.results?.[0]?.objectId ?? "";
+    return { application: appId, process: procId, route: routeId };
+  }
+  // ---- console endpoints (session token or PAT) ----
+  /** Read an application's environment. `GET /applications/env`. */
+  async getEnv(applicationId) {
+    const r = await this.client.console("GET", "/applications/env", {
+      query: { application: applicationId },
+      tolerateHttpError: true
+    });
+    if (!r?.ok)
+      throw new RoxyonApiError(r?.error || "Could not read the environment.", { body: r });
+    return r.env ?? {};
+  }
+  /**
+   * Merge `set` and delete `remove`, bumping `ConfigRevision`. `PORT`/`HOST` are
+   * ignored (platform-managed). `POST /applications/env`. Returns the new env.
+   */
+  async setEnv(applicationId, changes) {
+    const r = await this.client.console("POST", "/applications/env", {
+      query: { application: applicationId },
+      body: { set: changes.set ?? {}, remove: changes.remove ?? [] },
+      tolerateHttpError: true
+    });
+    if (!r?.ok)
+      throw new RoxyonApiError(r?.error || "Could not update the environment.", { body: r });
+    return { env: r.env ?? {}, changed: r.changed ?? [], configRevision: r.configRevision ?? 0 };
+  }
+  /** Rebuild from the latest source and restart. `POST /applications/action`. */
+  async deploy(applicationId) {
+    const r = await this.client.console("POST", "/applications/action", {
+      body: { application: applicationId, action: "deploy" },
+      tolerateHttpError: true
+    });
+    if (r?.error) throw new RoxyonApiError(r.error);
+  }
+  /** Bounce the process only — no rebuild. `POST /applications/action`. */
+  async restart(applicationId) {
+    const r = await this.client.console("POST", "/applications/action", {
+      body: { application: applicationId, action: "restart" },
+      tolerateHttpError: true
+    });
+    if (r?.error) throw new RoxyonApiError(r.error);
+  }
+  /**
+   * Tail the app's journal. `POST /applications/logs` returns one block per
+   * process (`{ type, unit, output }`); this flattens them to lines, each
+   * prefixed with the process type when there is more than one.
+   */
+  async logs(applicationId, lines = 100) {
+    const r = await this.client.console("POST", "/applications/logs", {
+      body: { application: applicationId, lines },
+      tolerateHttpError: true
+    });
+    if (r?.error) throw new RoxyonApiError(r.error);
+    const procs = r?.processes ?? [];
+    const multi = procs.length > 1;
+    const out = [];
+    for (const p of procs) {
+      const body = (p.output ?? "").split("\n").filter(Boolean);
+      for (const line of body) out.push(multi ? `[${p.type ?? "web"}] ${line}` : line);
+    }
+    return out;
+  }
+  /** Connect a git remote for push-to-deploy. `POST /applications/repo/connect`. */
+  async repoConnect(applicationId, repoUrl, branch = "main") {
+    const r = await this.client.console("POST", "/applications/repo/connect", {
+      body: { application: applicationId, repoUrl, branch },
+      tolerateHttpError: true
+    });
+    if (r?.error) throw new RoxyonApiError(r.error);
+    return r;
+  }
+  /**
+   * Upload a gzipped tarball of the project source. The endpoint lands it in the
+   * application's `SourcePath` and bumps `ConfigRevision` (the reconciler then
+   * builds it in a release dir exactly as for a git deploy).
+   *
+   * `POST /applications/deploy` — NEW endpoint (see `backend/` in this repo).
+   */
+  async uploadSource(target, tarball) {
+    const query = typeof target === "string" ? { application: target } : {
+      host: target.host,
+      folder: target.folder ?? "",
+      runtime: target.runtime,
+      ...target.runtimeVersion ? { runtimeVersion: target.runtimeVersion } : {},
+      ...target.preset ? { preset: target.preset } : {},
+      ...target.command ? { command: target.command } : {},
+      public: target.public === false ? "0" : "1"
+    };
+    const r = await this.client.console("POST", "/applications/deploy", {
+      query,
+      headers: { "content-type": "application/gzip" },
+      body: tarball,
+      tolerateHttpError: true
+    });
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Upload failed.", { body: r });
+    return r;
+  }
+};
+
+// src/auth.ts
+var AuthApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Best-effort device/step-up precheck. `/_account/login-precheck` is a console
+   * cloud function that may be gated behind the REST key (not reachable from a
+   * public client) — in that case this resolves to `{}` and login falls back to
+   * `/Auth/login`, which is itself the security boundary and re-checks the
+   * device. Only a definitive `{ ok: false }` / `stepUpRequired` is acted on.
+   */
+  async precheck(email, password, metadata = {}) {
+    try {
+      const r = await this.client.post(
+        "/_account/login-precheck",
+        { Email: email, Password: password, metadata },
+        { tolerateHttpError: true }
+      );
+      if (r?.code === 401 || r?.error && /rest api key/i.test(r.error)) return {};
+      return r ?? {};
+    } catch {
+      return {};
+    }
+  }
+  /**
+   * Full login. Returns a session token on success, or `stepUpRequired` with a
+   * `challengeId` when an OTP code is needed next.
+   */
+  async login(email, password, metadata = {}) {
+    const pre = await this.precheck(email, password, metadata);
+    if (pre.ok === false && pre.error && !pre.stepUpRequired) {
+      throw new RoxyonApiError(pre.error, { type: "CredentialsError" });
+    }
+    if (pre.stepUpRequired) {
+      return { sessionToken: "", stepUpRequired: true, challengeId: pre.challengeId };
+    }
+    const grant = await this.client.post("/Auth/login", { Email: email, Password: password, metadata }, { tolerateHttpError: true });
+    if (grant?.stepUpRequired || grant?.challengeId && !grant.session_token) {
+      return { sessionToken: "", stepUpRequired: true, challengeId: grant.challengeId };
+    }
+    if (!grant?.session_token) {
+      throw new RoxyonApiError(grant?.error || "Wrong email or password.", {
+        type: "CredentialsError"
+      });
+    }
+    this.client.setSessionToken(grant.session_token);
+    return {
+      sessionToken: grant.session_token,
+      refreshToken: grant.refresh_token,
+      expiresIn: grant.expires_in
+    };
+  }
+  /** Complete an OTP step-up with the code the user received. */
+  async verifyOtp(challengeId, code) {
+    const grant = await this.client.post(
+      "/Auth/login/otp-verify",
+      { challengeId, code },
+      { tolerateHttpError: true }
+    );
+    if (grant?.status !== "authenticated" || !grant.session_token) {
+      throw new RoxyonApiError(grant?.error || "That code did not verify.", {
+        type: "OtpError",
+        body: grant
+      });
+    }
+    this.client.setSessionToken(grant.session_token);
+    return {
+      sessionToken: grant.session_token,
+      refreshToken: grant.refresh_token,
+      expiresIn: grant.expires_in
+    };
+  }
+  /** Start an OTP-only sign-in (no password). Returns a `challengeId`. */
+  async startOtp(email) {
+    const r = await this.client.post(
+      "/Auth/login/otp",
+      { Email: email },
+      { tolerateHttpError: true }
+    );
+    if (!r?.challengeId) {
+      throw new RoxyonApiError(r?.error || "Could not start OTP sign-in.", { body: r });
+    }
+    return { challengeId: r.challengeId };
+  }
+  /** The currently authenticated user. Requires a session token on the client. */
+  async me() {
+    const user = await this.client.post("/Auth/me", {});
+    if (!user?.objectId) {
+      throw new RoxyonApiError(user?.error || "Not signed in.", { status: 401, body: user });
+    }
+    return user;
+  }
+  async logout() {
+    await this.client.post("/Auth/logout", {}, { tolerateHttpError: true }).catch(() => void 0);
+    this.client.setSessionToken(void 0);
+  }
+};
+
+// src/constants.ts
+var DEFAULT_BAAS_URL = "https://www.beaapis.com/1";
+var DEFAULT_CONSOLE_URL = "https://console.roxyon.com";
+var DEFAULT_APP = {
+  appId: "jAtp2zHGU3FbnrQWrToALFakd_vbiY0ywihn4Hj54lw",
+  javascriptKey: "w2Y9USRg0COtNe-fUqOaC1OOOlNCnV2BG8GZF80w4x8"
+};
+var H = {
+  appId: "x-bea-application-id",
+  jsKey: "x-bea-javascript-key",
+  restKey: "x-bea-authorization",
+  sessionToken: "x-bea-session-token",
+  accessToken: "x-bea-access-token",
+  refreshToken: "x-bea-refresh-token"
+};
+
+// src/query.ts
+function encode(k, v) {
+  return `${encodeURIComponent(k)}=${encodeURIComponent(v)}`;
+}
+function walk(value, prefix, out) {
+  if (value === null || value === void 0) return;
+  if (Array.isArray(value)) {
+    value.forEach((item, i) => walk(item, `${prefix}[${i}]`, out));
+    return;
+  }
+  if (typeof value === "object") {
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "in" || key === "nin" || key === "notIn") {
+        const joined = Array.isArray(child) ? child.join(",") : String(child);
+        out.push(encode(`${prefix}[${key === "notIn" ? "nin" : key}]`, joined));
+        continue;
+      }
+      walk(child, `${prefix}[${key}]`, out);
+    }
+    return;
+  }
+  out.push(encode(prefix, String(value)));
+}
+function toQueryString(query) {
+  if (!query) return "";
+  const out = [];
+  for (const [key, value] of Object.entries(query)) {
+    walk(value, key, out);
+  }
+  return out.join("&");
+}
+
+// src/client.ts
+var RoxyonClient = class {
+  baseUrl;
+  consoleUrl;
+  appId;
+  javascriptKey;
+  restKey;
+  _fetch;
+  sessionToken;
+  anon;
+  constructor(opts = {}) {
+    this.baseUrl = (opts.baseUrl ?? DEFAULT_BAAS_URL).replace(/\/+$/, "");
+    this.consoleUrl = (opts.consoleUrl ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");
+    this.appId = opts.appId ?? DEFAULT_APP.appId;
+    this.javascriptKey = opts.javascriptKey ?? DEFAULT_APP.javascriptKey;
+    this.restKey = opts.restKey;
+    this.sessionToken = opts.sessionToken;
+    this._fetch = opts.fetch ?? globalThis.fetch;
+    if (typeof this._fetch !== "function") {
+      throw new Error("No fetch implementation available (need Node >= 20 or pass opts.fetch).");
+    }
+  }
+  getSessionToken() {
+    return this.sessionToken;
+  }
+  setSessionToken(token) {
+    this.sessionToken = token;
+  }
+  /** Mint (or reuse) an anonymous access token from the public app credentials. */
+  async anonToken() {
+    if (this.anon?._expiresAt && this.anon._expiresAt > Date.now() + 5e3) {
+      return this.anon;
+    }
+    const res = await this._fetch(`${this.baseUrl}/Auth`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        [H.appId]: this.appId,
+        [H.jsKey]: this.javascriptKey
+      },
+      body: JSON.stringify({ scope: "public" })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (!json.access_token && !json.session_token) {
+      throw new RoxyonApiError("Could not obtain an anonymous BaaS token.", {
+        status: res.status,
+        body: json
+      });
+    }
+    json._expiresAt = Date.now() + (json.expires_in ? json.expires_in * 1e3 : 36e5);
+    this.anon = json;
+    return json;
+  }
+  /** A Personal Access Token (`roxp_…`) authenticates the console endpoints via
+   * `Authorization: Bearer`; it is not a BaaS session token. */
+  get isPat() {
+    return this.sessionToken?.startsWith("roxp_") ?? false;
+  }
+  async authHeaders(skipAuth, isConsole) {
+    const base = { [H.appId]: this.appId };
+    if (skipAuth) return base;
+    if (this.isPat) {
+      return isConsole ? { ...base, authorization: `Bearer ${this.sessionToken}` } : base;
+    }
+    if (this.sessionToken) return { ...base, [H.sessionToken]: this.sessionToken };
+    if (this.restKey) return { ...base, [H.restKey]: this.restKey };
+    const anon = await this.anonToken();
+    if (anon.session_token) return { ...base, [H.sessionToken]: anon.session_token };
+    return { ...base, [H.accessToken]: anon.access_token ?? "" };
+  }
+  /** A raw BaaS request. `path` is relative to {@link baseUrl} (leading `/`). */
+  async request(method, path, opts = {}) {
+    return this.rawRequest(this.baseUrl, method, path, opts);
+  }
+  /** A request against the console app endpoints ({@link consoleUrl}). */
+  async console(method, path, opts = {}) {
+    return this.rawRequest(this.consoleUrl, method, path, opts);
+  }
+  async rawRequest(root, method, path, opts) {
+    const qs = toQueryString(opts.query);
+    const url = `${root}${path.startsWith("/") ? path : `/${path}`}${qs ? `?${qs}` : ""}`;
+    const headers = {
+      ...await this.authHeaders(opts.skipAuth ?? false, root === this.consoleUrl),
+      ...opts.headers
+    };
+    const hasBody = method !== "GET" && method !== "HEAD" && opts.body !== void 0;
+    let body;
+    if (hasBody) {
+      if (typeof opts.body === "string" || opts.body instanceof Uint8Array || opts.body instanceof ArrayBuffer || typeof FormData !== "undefined" && opts.body instanceof FormData) {
+        body = opts.body;
+      } else {
+        headers["content-type"] = headers["content-type"] ?? "application/json";
+        body = JSON.stringify(opts.body);
+      }
+    }
+    let res;
+    try {
+      res = await this._fetch(url, { method, headers, body, signal: opts.signal });
+    } catch (cause) {
+      throw new RoxyonApiError(`Network error calling ${method} ${url}`, { body: cause });
+    }
+    const text = await res.text();
+    let json;
+    try {
+      json = text ? JSON.parse(text) : {};
+    } catch {
+      json = { error: text || `HTTP ${res.status}`, _raw: text };
+    }
+    if (!res.ok && !opts.tolerateHttpError) {
+      const msg = json && typeof json === "object" && "error" in json && json.error || `HTTP ${res.status} calling ${method} ${path}`;
+      throw new RoxyonApiError(String(msg), { status: res.status, body: json });
+    }
+    return json;
+  }
+  get(path, query, opts) {
+    return this.request("GET", path, { ...opts, query });
+  }
+  post(path, body, opts) {
+    return this.request("POST", path, { ...opts, body });
+  }
+  put(path, body, opts) {
+    return this.request("PUT", path, { ...opts, body });
+  }
+  del(path, body, opts) {
+    return this.request("DELETE", path, { ...opts, body });
+  }
+};
+
+// src/domains.ts
+var DomainsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list(subscriptionId) {
+    const r = await this.client.get("/Domains", {
+      fields: "objectId,Name",
+      limit: -1,
+      order: "Name",
+      where: { Subscription: subscriptionId }
+    });
+    return r.results ?? [];
+  }
+};
+
+// src/sites.ts
+var SitesApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async deploy(host, folder, tarball) {
+    const r = await this.client.console("POST", "/sites/deploy", {
+      query: { host, folder },
+      headers: { "content-type": "application/gzip" },
+      body: tarball,
+      tolerateHttpError: true
+    });
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Static deploy failed.", { body: r });
+    return r;
+  }
+};
+
+// src/subscriptions.ts
+var SubscriptionsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** All subscriptions the signed-in user has a Privilege on. */
+  async list(userId) {
+    const r = await this.client.get("/Privileges", {
+      where: { User: userId },
+      fields: "objectId,Type,Subscription",
+      limit: -1,
+      include: [
+        {
+          className: "Subscriptions",
+          field: "Subscription",
+          fields: "objectId,Name,Status,Username,Node,Datacenter"
+        }
+      ]
+    });
+    if (!Array.isArray(r.results)) {
+      throw new RoxyonApiError(r.error || "Could not load subscriptions.", {
+        status: 401,
+        body: r
+      });
+    }
+    const subs = [];
+    for (const priv of r.results) {
+      const sub = priv._Subscription?.results?.[0];
+      if (sub) subs.push(sub);
+    }
+    return subs;
+  }
+  /**
+   * Resolve the subscription to act on. Prefers an exact `objectId` or `Name`
+   * match against `preferred`; otherwise the first active subscription; otherwise
+   * the first one. Throws when the account has none.
+   */
+  async resolve(userId, preferred) {
+    const subs = await this.list(userId);
+    if (subs.length === 0) {
+      throw new RoxyonApiError(
+        "This account has no active subscription \u2014 add a plan in the console first."
+      );
+    }
+    if (preferred) {
+      const hit = subs.find(
+        (s) => s.objectId === preferred || s.Name === preferred || s.Username === preferred
+      );
+      if (hit) return hit;
+      throw new RoxyonApiError(`No subscription matches "${preferred}".`);
+    }
+    return subs.find((s) => s.Status === "active") ?? subs[0];
+  }
+};
+
+// src/tokens.ts
+var TokensApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async list() {
+    const r = await this.client.console(
+      "GET",
+      "/account/tokens",
+      { tolerateHttpError: true }
+    );
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not list tokens.", { body: r });
+    return r.tokens ?? [];
+  }
+  async create(name, opts = {}) {
+    const r = await this.client.console(
+      "POST",
+      "/account/tokens",
+      {
+        body: {
+          name,
+          scopes: opts.scopes ?? ["deploy", "logs"],
+          ...opts.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}
+        },
+        tolerateHttpError: true
+      }
+    );
+    if (!r?.ok || !r.token) {
+      throw new RoxyonApiError(r?.error || "Could not create the token.", { body: r });
+    }
+    return { token: r.token, name: r.name, scopes: r.scopes, expiresAt: r.expiresAt ?? null };
+  }
+  async revoke(id) {
+    const r = await this.client.console(
+      "DELETE",
+      "/account/tokens",
+      { query: { id }, tolerateHttpError: true }
+    );
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not revoke the token.", { body: r });
+  }
+};
+
+// src/env.ts
+function parseEnv(text) {
+  const out = {};
+  for (let line of String(text || "").split(/\r?\n/)) {
+    line = line.trim();
+    if (!line || line.startsWith("#")) continue;
+    line = line.replace(/^export\s+/, "");
+    const eq = line.indexOf("=");
+    if (eq < 1) continue;
+    const k = line.slice(0, eq).trim();
+    let v = line.slice(eq + 1).trim();
+    if (v.length >= 2 && (v[0] === '"' || v[0] === "'") && v[v.length - 1] === v[0]) {
+      v = v.slice(1, -1);
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) out[k] = v;
+  }
+  return out;
+}
+function formatEnv(obj) {
+  if (!obj || typeof obj !== "object") return "";
+  return Object.keys(obj).map((k) => `${k}=${obj[k] == null ? "" : String(obj[k])}`).join("\n");
+}
+function envFromStored(jsonStr) {
+  if (!jsonStr) return {};
+  try {
+    const obj = JSON.parse(jsonStr);
+    return obj && typeof obj === "object" ? obj : {};
+  } catch {
+    return {};
+  }
+}
+
+// src/runtimes.ts
+var RUNTIMES = {
+  node: {
+    versions: ["23.11.1", "22.23.1", "20.20.2", "18.20.8"],
+    defaultVersion: "20.20.2",
+    presets: [
+      ["nextjs", "Next.js"],
+      ["nuxt", "Nuxt"],
+      ["node", "No framework"]
+    ],
+    command: "npm run start"
+  },
+  python: {
+    versions: ["3.11"],
+    defaultVersion: "3.11",
+    presets: [["python", "No framework"]],
+    command: "gunicorn app:app"
+  },
+  php: {
+    versions: ["8.4", "8.3", "8.2", "8.1", "7.4"],
+    defaultVersion: "8.4",
+    presets: [
+      ["swoole", "Swoole"],
+      ["php", "No framework"]
+    ],
+    command: "php8.4 server.php"
+  }
+};
+var LUMEN_BUILD = {
+  command: "lm build --serverless",
+  /** Directory `lm build --serverless` writes to, relative to the project root. */
+  outDir: "dist"
+};
+
+// src/index.ts
+var Roxyon = class {
+  client;
+  auth;
+  account;
+  tokens;
+  subscriptions;
+  domains;
+  applications;
+  sites;
+  constructor(options = {}) {
+    this.client = options instanceof RoxyonClient ? options : new RoxyonClient(options);
+    this.auth = new AuthApi(this.client);
+    this.account = new AccountApi(this.client);
+    this.tokens = new TokensApi(this.client);
+    this.subscriptions = new SubscriptionsApi(this.client);
+    this.domains = new DomainsApi(this.client);
+    this.applications = new ApplicationsApi(this.client);
+    this.sites = new SitesApi(this.client);
+  }
+  get sessionToken() {
+    return this.client.getSessionToken();
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AccountApi,
+  ApplicationsApi,
+  AuthApi,
+  DEFAULT_APP,
+  DEFAULT_BAAS_URL,
+  DEFAULT_CONSOLE_URL,
+  DomainsApi,
+  LUMEN_BUILD,
+  RUNTIMES,
+  Roxyon,
+  RoxyonApiError,
+  RoxyonClient,
+  SitesApi,
+  SubscriptionsApi,
+  TokensApi,
+  assertOk,
+  envFromStored,
+  formatEnv,
+  isAuthError,
+  parseEnv,
+  rxError,
+  toQueryString
+});
+//# sourceMappingURL=index.cjs.map