@scalar/cli 2.0.0 → 2.1.0

package/chunks/chunk-5BISXQX4.js

@@ -0,0 +1,447 @@
+import { createRequire as $$cR } from "node:module"; const require = $$cR(import.meta.url);
+import {
+  config
+} from "./chunk-OAXFCOJV.js";
+import {
+  roleSchema
+} from "./chunk-4DGQIAJX.js";
+import {
+  emailSchema,
+  entitySchema,
+  nanoidSchema,
+  timestampSchema
+} from "./chunk-ISGLWBXZ.js";
+import {
+  external_exports,
+  zod_default
+} from "./chunk-H2WRMLYY.js";
+import {
+  isUrl
+} from "./chunk-IX7LJ3AD.js";
+import {
+  output
+} from "./chunk-X4QLDBB5.js";
+
+// src/helpers/node-version.ts
+import semver from "semver";
+function checkNodeVersion() {
+  const currentVersion = process.version;
+  if (!semver.satisfies(currentVersion, ">=24")) {
+    output.error().title("Node.js version incompatible").message(
+      `Current Node.js version: ${currentVersion}
+Minimum required version: ${">=24"}
+Please upgrade your Node.js version and try again.
+Visit https://nodejs.org to download the latest version.`
+    ).exit("error");
+  }
+}
+
+// ../../packages/entities/dist/token/token.js
+var accessTokenPayloadSchema = external_exports.object({
+  userIndex: external_exports.string(),
+  userUid: external_exports.string().brand(),
+  // Brand only — `.brand()` keeps the runtime `z.string()` validation (no
+  // `.min()`), so parsed tokens stay byte-identical while gaining the Team brand.
+  teamUid: external_exports.string().brand(),
+  email: emailSchema.nullable(),
+  role: roleSchema.optional(),
+  exp: external_exports.number().int()
+}).meta({ id: "access-token-payload" });
+var healthTokenPayloadSchema = external_exports.object({
+  svc: external_exports.string().optional(),
+  iat: external_exports.number().int().optional(),
+  exp: external_exports.number().int()
+}).meta({ id: "health-token-payload" });
+var edgeCacheSyncTokenPayloadSchema = external_exports.object({
+  svc: external_exports.literal("watcher-edge-cache-sync"),
+  iat: external_exports.number().int().optional(),
+  exp: external_exports.number().int()
+}).meta({
+  id: "edge-cache-sync-token-payload"
+});
+var refreshTokenPayloadSchema = external_exports.object({
+  uid: external_exports.string(),
+  teamUid: external_exports.string().nullable(),
+  type: external_exports.string(),
+  familyId: external_exports.string(),
+  userIndex: external_exports.string(),
+  exp: external_exports.number()
+}).meta({ id: "refresh-token-payload" });
+var personalTokenPayloadSchema = external_exports.object({
+  uid: external_exports.string(),
+  teamUid: external_exports.string(),
+  userIndex: external_exports.string(),
+  iat: external_exports.number(),
+  exp: external_exports.number()
+}).meta({ id: "personal-token-payload" });
+var exchangeTokenSchema = external_exports.object({
+  uid: external_exports.string(),
+  accessToken: external_exports.string(),
+  refreshToken: external_exports.string(),
+  expiry: external_exports.number(),
+  teamUid: external_exports.string()
+}).meta({ id: "exchange-token" });
+var socialOauthProviderSchema = external_exports.enum(["google", "microsoft"]).meta({ id: "social-oauth-provider" });
+var hostingExchangeTokenSchema = external_exports.object({
+  email: emailSchema,
+  aud: external_exports.url(),
+  /** Identity provider uid, present when minted from a SAML assertion */
+  idp: nanoidSchema.optional(),
+  /**
+   * The social provider that authenticated the email, present only for
+   * OAuth logins. Absent means SAML, where the team's IdP is the authority.
+   * OAuth proves email ownership only, so the consumer must re-check the
+   * resource's email allowlists and that this provider is enabled before
+   * creating a session.
+   */
+  provider: socialOauthProviderSchema.optional(),
+  teamUid: nanoidSchema,
+  exp: external_exports.number()
+}).meta({ id: "hosting-exchange-token" });
+var hostingLoginTokenSchema = entitySchema.extend({
+  email: emailSchema,
+  host: external_exports.string(),
+  redirect: external_exports.string().optional(),
+  loginPortalUid: external_exports.string().optional(),
+  exp: timestampSchema
+}).meta({ id: "hosting-login-token" });
+var docsAgentTokenSchema = external_exports.object({
+  uid: external_exports.string(),
+  publishUid: external_exports.string(),
+  projectUid: external_exports.string(),
+  teamUid: external_exports.string(),
+  mcpServerId: external_exports.string(),
+  mcpInstallationId: external_exports.string(),
+  iat: external_exports.number(),
+  exp: external_exports.number()
+}).meta({ id: "docs-agent-token" });
+
+// ../../packages/entities/dist/token/payload.js
+var tokenResponseSchema = external_exports.object({
+  refreshToken: external_exports.string(),
+  accessToken: external_exports.string()
+}).meta({ id: "token-response" });
+
+// ../../packages/entities/dist/token/refresh.js
+var refreshTokenRecordSchema = external_exports.object({
+  uid: external_exports.string(),
+  /** Associate a refresh token with a team */
+  teamUid: external_exports.string().nullable(),
+  /** Token expiry in unix milliseconds */
+  expiry: external_exports.number().int(),
+  /** Tracks if a token has been used. No refresh token should be reused */
+  used: external_exports.boolean(),
+  /**
+   * When the token was consumed by a rotation, in unix milliseconds.
+   * Reuse within a short grace window after this moment is treated as a
+   * benign client race (parallel tabs); reuse after it revokes the family.
+   */
+  usedAt: external_exports.number().int().optional(),
+  /** family id is used to remove all tokens for a family in the event of a reuse */
+  familyId: external_exports.string(),
+  /** Unique lookup for the user */
+  userIndex: external_exports.string()
+}).meta({ id: "refresh-token-record" });
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/runtime/base64url.js
+import { Buffer as Buffer2 } from "node:buffer";
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_INT32 = 2 ** 32;
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/runtime/base64url.js
+function normalize(input) {
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  return encoded;
+}
+var decode = (input) => new Uint8Array(Buffer2.from(normalize(input), "base64url"));
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/util/errors.js
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/lib/is_object.js
+function isObjectLike(value) {
+  return typeof value === "object" && value !== null;
+}
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/util/base64url.js
+var decode2 = decode;
+
+// ../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/esm/util/decode_jwt.js
+function decodeJwt(jwt) {
+  if (typeof jwt !== "string")
+    throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+  const { 1: payload, length } = jwt.split(".");
+  if (length === 5)
+    throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+  if (length !== 3)
+    throw new JWTInvalid("Invalid JWT");
+  if (!payload)
+    throw new JWTInvalid("JWTs must contain a payload");
+  let decoded;
+  try {
+    decoded = decode2(payload);
+  } catch {
+    throw new JWTInvalid("Failed to base64url decode the payload");
+  }
+  let result;
+  try {
+    result = JSON.parse(decoder.decode(decoded));
+  } catch {
+    throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+  }
+  if (!isObject(result))
+    throw new JWTInvalid("Invalid JWT Claims Set");
+  return result;
+}
+
+// ../../packages/tokens/dist/error.js
+function TokenError(msg, code) {
+  const err = new Error(msg);
+  err.code = code;
+  return err;
+}
+
+// ../../packages/tokens/dist/index.js
+function validatePayload(data, schema) {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    console.error("Invalid token payload:");
+    console.error(result.error.issues);
+    throw TokenError("Invalid token payload", "invalid-payload");
+  }
+  return result.data;
+}
+function decode3(token, schema = external_exports.any()) {
+  return validatePayload(decodeJwt(token), schema);
+}
+
+// src/helpers/metadata.ts
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+var SCALAR_METADATA_FILE_NAME = ".scalar-config";
+var METADATA_FILE_PATH = path.join(
+  os.homedir(),
+  SCALAR_METADATA_FILE_NAME
+);
+var authSchema = external_exports.union([
+  external_exports.object({
+    accessToken: external_exports.string(),
+    refreshToken: external_exports.string()
+  }),
+  external_exports.object({
+    accessToken: external_exports.string(),
+    personalToken: external_exports.string()
+  })
+]);
+var metadataSchema = external_exports.object({
+  lastUpdateCheck: external_exports.number(),
+  lastKnownVersion: external_exports.string(),
+  auth: authSchema.nullable().default(null)
+});
+var metadataCache = null;
+var getMetadataMtimeMs = async () => (await fs.stat(METADATA_FILE_PATH).catch(() => null))?.mtimeMs ?? null;
+var writeQueue = Promise.resolve();
+var setMetadata = async (metadata) => {
+  const write = writeQueue.then(async () => {
+    const currentMetadata = await getMetadata();
+    const updatedMetadata = { ...currentMetadata, ...metadata };
+    const tmpPath = `${METADATA_FILE_PATH}.${process.pid}.tmp`;
+    await fs.writeFile(tmpPath, JSON.stringify(updatedMetadata));
+    await fs.rename(tmpPath, METADATA_FILE_PATH);
+    metadataCache = {
+      mtimeMs: await getMetadataMtimeMs(),
+      data: updatedMetadata
+    };
+  });
+  writeQueue = write.catch(() => {
+  });
+  return write;
+};
+var fileExists = async (path3) => !!await fs.stat(path3).catch(() => false);
+var readMetadataFile = async () => {
+  const metadata = await fileExists(METADATA_FILE_PATH) ? await fs.readFile(METADATA_FILE_PATH, { encoding: "utf-8" }) : "{}";
+  try {
+    return metadataSchema.partial().parse(JSON.parse(metadata));
+  } catch {
+    return {};
+  }
+};
+var getMetadata = async () => {
+  const mtimeMs = await getMetadataMtimeMs();
+  if (metadataCache && metadataCache.mtimeMs === mtimeMs) {
+    return metadataCache.data;
+  }
+  const data = await readMetadataFile();
+  metadataCache = { mtimeMs, data };
+  return data;
+};
+
+// src/helpers/auth.ts
+var eventListeners = [];
+var addEventListener = (callback) => {
+  eventListeners.push(callback);
+};
+var fireCallbacks = (auth) => eventListeners.forEach((callback) => callback(auth));
+var setAuthData = async (authData) => {
+  await setMetadata({ auth: authData });
+  fireCallbacks(authData);
+};
+var getAuthData = async (opts) => {
+  const { noExit } = opts ?? {};
+  const { auth } = await getMetadata();
+  if (!auth) {
+    if (noExit) throw new Error("Authorization required");
+    return output.error().title("Authorization required").message("Please login before running this command.").exit("error");
+  }
+  const { email, role, teamUid, exp } = decode3(
+    auth.accessToken,
+    accessTokenPayloadSchema
+  );
+  const isExpired = exp * 1e3 < Date.now();
+  if (!isExpired) {
+    return { ...auth, email, role, teamUid, addEventListener };
+  }
+  try {
+    if ("refreshToken" in auth) {
+      const updatedAuth2 = await refreshToken(auth.refreshToken);
+      return { ...updatedAuth2, email, role, teamUid, addEventListener };
+    }
+    const updatedAuth = await generateAccessByPersonalToken({
+      personalToken: auth.personalToken
+    });
+    return { ...updatedAuth, email, role, teamUid, addEventListener };
+  } catch {
+    if (noExit) throw new Error("Session expired, please login again.");
+    return output.error().title("Expired session").message("Session expired, please login again.").exit("error");
+  }
+};
+var clearAuthData = async () => {
+  await setMetadata({ auth: null });
+};
+var refreshTokenResponseSchema = zod_default.object({
+  accessToken: zod_default.string(),
+  refreshToken: zod_default.string()
+});
+var refreshToken = async (token, teamUid) => {
+  const result = await fetch(`${config.services.api}/core/login/refresh`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    credentials: "include",
+    body: JSON.stringify({
+      refreshToken: token,
+      teamUid
+    }),
+    // Fail fast instead of hanging every authed command on a slow network
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (result.ok) {
+    const { accessToken, refreshToken: refreshToken2 } = refreshTokenResponseSchema.parse(
+      await result.json()
+    );
+    await setAuthData({ accessToken, refreshToken: refreshToken2 });
+    return { accessToken, refreshToken: refreshToken2 };
+  }
+  throw Error("Could not refresh token");
+};
+
+// src/helpers/watch-file.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+import chokidar from "chokidar";
+var watchFile = async (file, callback, options) => {
+  if (isUrl(file)) {
+    setInterval(callback, 5e3);
+    return;
+  }
+  const absoluteFilePath = path2.join(process.cwd(), file);
+  if (!fs2.existsSync(absoluteFilePath)) {
+    throw new Error(`File ${absoluteFilePath} does not exist`);
+  }
+  output.info().title(`Watch ${file}`).print();
+  const watcher = chokidar.watch(file, { persistent: true });
+  watcher.on("change", () => {
+    callback();
+  });
+  if (options?.immediate) {
+    callback();
+  }
+  return {
+    unsubscribe: () => watcher.close()
+  };
+};
+
+// src/domains/auth/login/helpers/personal-token-generate-access.ts
+var generateAccessByPersonalToken = async ({
+  personalToken
+}) => {
+  const result = await fetch(
+    `${config.services.api}/core/login/personal-token/access`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        personalToken
+      })
+    }
+  );
+  if (!result.ok) {
+    const data = await result.json();
+    throw new Error(
+      data.message ?? "Could not generate an access token from the provided personal token"
+    );
+  }
+  const { accessToken } = external_exports.object({ accessToken: external_exports.string() }).parse(await result.json());
+  await setAuthData({ accessToken, personalToken });
+  return { accessToken, personalToken };
+};
+
+export {
+  checkNodeVersion,
+  tokenResponseSchema,
+  accessTokenPayloadSchema,
+  decode3 as decode,
+  generateAccessByPersonalToken,
+  setMetadata,
+  getMetadata,
+  setAuthData,
+  getAuthData,
+  clearAuthData,
+  refreshToken,
+  watchFile
+};