@xano/sdk 1.0.0

package/dist/profile-command-AH3PIM4X.js

@@ -0,0 +1,800 @@
+import {
+  confirmDanglingRemoval,
+  revocableRecord,
+  revokeFields,
+  revokeProfileSession,
+  signInAgain
+} from "./chunk-ELP2HMXC.js";
+import {
+  promptLine,
+  readStdin
+} from "./chunk-65HWOMGV.js";
+import {
+  ensureGitignoredOrWarn
+} from "./chunk-YHEFQUQB.js";
+import "./chunk-DAD3ONIS.js";
+import {
+  projectDirFrom
+} from "./chunk-6NNTNXN7.js";
+import {
+  ProfileNotFoundError,
+  credentialRejected,
+  environmentCredentialVars,
+  notSignedIn,
+  warnIfReadableByOthers
+} from "./chunk-ET4Y4XCB.js";
+import {
+  readEphemeralState
+} from "./chunk-5QU2P5CA.js";
+import "./chunk-ZYJP6BOO.js";
+import "./chunk-QO6BVGS5.js";
+import "./chunk-JZGVVJSI.js";
+import {
+  pipedYes,
+  retryCommand
+} from "./chunk-T5KELPAR.js";
+import "./chunk-622HUCZT.js";
+import "./chunk-NAQDMEHV.js";
+import "./chunk-5A2PLKZB.js";
+import "./chunk-AHJWCYQO.js";
+import "./chunk-DX4QR4B2.js";
+import "./chunk-6QXLMMT3.js";
+import "./chunk-ZFDZKNGG.js";
+import "./chunk-FWD7AL6N.js";
+import "./chunk-2GNFDZA2.js";
+import "./chunk-JTUKLCXS.js";
+import "./chunk-4KHEMC32.js";
+import "./chunk-ROY4YAEQ.js";
+import "./chunk-TLQE7ZN3.js";
+import "./chunk-WRBKLYSJ.js";
+import "./chunk-3LDULPRE.js";
+import {
+  addProfileHint,
+  assertCredentialFileWritable,
+  assertHttpsOrigin,
+  assertInstanceOrigin,
+  buildTokenCredential,
+  credentialFileFlag,
+  describeProfile,
+  dropProfile,
+  emptyCredentialFile,
+  globalAuthFilePath,
+  isSafeIdText,
+  loginCommand,
+  profileNames,
+  projectAuthFilePath,
+  readCredentialFile,
+  readProfile,
+  removeEmptyProjectCacheDir,
+  resolveAuthFilePath,
+  withCredentialLock,
+  writeCredentialFile,
+  writeOrRemoveCredentialFile
+} from "./chunk-XW6KISBB.js";
+import "./chunk-AWQ7BQTQ.js";
+import "./chunk-EUUUMY7J.js";
+import {
+  fetchOrExplain,
+  httpFailure,
+  redirectedUnresolvedHost
+} from "./chunk-YLDALTWZ.js";
+import {
+  POINTER_FILE,
+  findPointerFile,
+  findProjectPointer,
+  projectRootFor,
+  resolveProjectProfile,
+  writePointerFile
+} from "./chunk-5FBYXK5P.js";
+import "./chunk-LLNZGEFK.js";
+import {
+  DEFAULT_PROFILE,
+  assertValidProfileName,
+  describeProfileSelection,
+  resolveActiveProfile
+} from "./chunk-QXTKSOFI.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import "./chunk-UCQ2VUTG.js";
+import "./chunk-DGWHAVRG.js";
+import {
+  UsageError,
+  detail,
+  formatFields,
+  info,
+  isMachineOutput,
+  missingArgument,
+  printHuman,
+  quotedNames,
+  safeText,
+  stdoutStyle,
+  step,
+  success,
+  unknownSubcommand,
+  warn,
+  writeJson
+} from "./chunk-PTHVMXZI.js";
+import "./chunk-GSGDWJB5.js";
+import {
+  suggest,
+  suggestAll
+} from "./chunk-UTI5G6OJ.js";
+import "./chunk-2EZ3ZJZZ.js";
+import "./chunk-6MR5TI5V.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+import "./chunk-XNCP4KYO.js";
+import "./chunk-TFFGOFVZ.js";
+import "./chunk-NZOWWHU5.js";
+import "./chunk-4BW2SG2N.js";
+import "./chunk-CIMQZRRE.js";
+import "./chunk-OHX6MIUZ.js";
+import "./chunk-36JUQZVQ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/emit/profile-command.ts
+import { resolve } from "path";
+async function runProfileCommand(args) {
+  switch (args.subcommand) {
+    case "list":
+      return listProfiles(args);
+    case "show":
+      return showProfile(args);
+    case "use":
+      return useProfile(args);
+    case "set-default":
+      return setDefaultProfile(args);
+    case "add":
+      return addProfile(args);
+    case "delete":
+      return deleteProfile(args);
+    default:
+      throw unknownSubcommand("profile", args.subcommand);
+  }
+}
+function profileFilePath(args) {
+  return resolveAuthFilePath(args, "read");
+}
+function openFile(args) {
+  const path = profileFilePath(args);
+  const file = readCredentialFile(path);
+  if (file !== null) warnIfReadableByOthers(path);
+  return { path, file: file ?? emptyCredentialFile() };
+}
+function activeSelection(args, file, path) {
+  return resolveActiveProfile({
+    flag: args.profile,
+    fileDefault: file.default,
+    defaultIn: path === globalAuthFilePath() ? void 0 : path,
+    readPointer: () => resolveProjectProfile(process.cwd())
+  });
+}
+function isDefaultProfile(file, name) {
+  return (file.default ?? DEFAULT_PROFILE) === name;
+}
+function environmentsFor(profile) {
+  const state = readEphemeralState(projectDirFrom(process.cwd()) ?? process.cwd());
+  return Object.entries(state.environments).filter(([key]) => key.startsWith(`${profile}/`)).map(([key, record]) => {
+    const [, host = "", workspace = ""] = key.split("/");
+    return { name: record.name, host, workspace };
+  });
+}
+function profileReaching(profiles, host, workspace) {
+  for (const [profile, raw] of Object.entries(profiles)) {
+    const record = raw;
+    const instance = record?.instance ?? record?.instance_base_url;
+    if (typeof instance !== "string" || String(record?.workspace_id) !== workspace) continue;
+    try {
+      if (new URL(instance).host === host) return profile;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function requiredName(args, verb) {
+  const name = args.positionals[0];
+  if (name === void 0) {
+    throw missingArgument("name", { command: "profile", subcommand: verb });
+  }
+  validName(name, verb);
+  return name;
+}
+function validName(name, verb) {
+  try {
+    assertValidProfileName(name, `xanosdk profile ${verb}`);
+  } catch (err) {
+    throw new UsageError(err instanceof Error ? err.message : String(err), {
+      hintFor: { command: "profile", subcommand: verb }
+    });
+  }
+}
+function defaultOf(path) {
+  return path === globalAuthFilePath() ? "this machine's default" : `the default profile in ${path}`;
+}
+function assertAnyProfiles(file, path) {
+  if (profileNames(file).length > 0) return;
+  throw new ProfileNotFoundError(`No credential profiles are stored in ${path}. ${signInLine(path)}`);
+}
+function existingName(file, name, path, verb) {
+  if (hasProfile(file, name)) return;
+  const have = profileNames(file);
+  const near = suggest(name, have);
+  const err = new ProfileNotFoundError(
+    `No credential profile "${name}" in ${path}.` + (have.length === 0 ? "" : ` Stored profiles: ${quotedNames(have)}.`) + (near === void 0 ? "" : ` Did you mean "${safeText(near)}"? \`xanosdk profile ${verb} ${shellQuote(near)}${credentialFileFlag(path)}\`.`) + ` Add it with ${addProfileHint(name, { path })}.`
+  );
+  if (near !== void 0) Object.defineProperty(err, "suggestion", { value: near, enumerable: true });
+  throw err;
+}
+function hasProfile(file, name) {
+  return Object.prototype.hasOwnProperty.call(file.profiles, name);
+}
+function storedNamesLine(file, path) {
+  const have = profileNames(file);
+  return have.length === 0 ? signInLine(path) : `Stored profiles: ${quotedNames(have)}.`;
+}
+function signInLine(path) {
+  const flag = credentialFileFlag(path);
+  return `Run \`xanosdk login${flag}\` to sign in, or \`xanosdk profile add <name>${flag}\` to store a meta API token.`;
+}
+function usableName(file, name, path, verb) {
+  const described = describeProfile(file, name, path);
+  let problem = "error" in described ? described.error : void 0;
+  if ("record" in described) {
+    const r = described.record;
+    try {
+      assertHttpsOrigin(r.type === "token" ? r.instance_base_url : r.instance, "Its instance");
+    } catch (err) {
+      problem = err.message;
+    }
+  }
+  if (problem === void 0) return;
+  const raw = file.profiles[name];
+  const fix = raw?.type === "token" ? `\`xanosdk profile add ${name}${credentialFileFlag(path)} --instance <url> --workspace-id <id> --force\`` : `\`${loginCommand(name, { path }, ["--force"])}\``;
+  throw new UsageError(
+    `Profile "${name}" cannot be used, so it was not made ${defaultOf(path)}: ${problem.replace(/\s+$/, "")}
+Repair it with ${fix}, or pick another from \`xanosdk profile list${credentialFileFlag(path)}\`.`,
+    { hintFor: { command: "profile", subcommand: verb } }
+  );
+}
+function rowsFor(file, path, activeName) {
+  return profileNames(file).map((name) => {
+    const base = { name, isDefault: isDefaultProfile(file, name), isActive: activeName === name };
+    const described = describeProfile(file, name, path);
+    if ("error" in described) return { ...base, invalid: described.error };
+    const record = described.record;
+    return {
+      ...base,
+      instance: record.type === "token" ? record.instance_base_url : record.instance,
+      workspaceId: record.workspace_id,
+      credentialType: record.type
+    };
+  });
+}
+async function listProfiles(args) {
+  const { path, file } = openFile(args);
+  const envCredential = environmentCredentialVars();
+  const env = envCredential.complete ? envCredential.vars : void 0;
+  const active = activeSelection(args, file, path);
+  const rows = rowsFor(file, path, env === void 0 ? active.name : void 0);
+  if (isMachineOutput(args) && env !== void 0) {
+    writeJson({
+      path,
+      default: file.default ?? null,
+      active: null,
+      source: "environment",
+      environmentCredential: true,
+      environmentVariables: env,
+      profiles: rows
+    });
+    return;
+  }
+  if (isMachineOutput(args)) {
+    const stored = hasProfile(file, active.name);
+    noteMissingSelection(file, active, path);
+    writeJson({
+      path,
+      default: file.default ?? null,
+      active: stored ? active.name : null,
+      source: active.source,
+      ...stored || active.source === "implicit" ? {} : { missing: active.name },
+      profiles: rows
+    });
+    return;
+  }
+  const envLine = () => {
+    if (env !== void 0) {
+      info(`The environment credential (${env.join(", ")}) is in use; stored profiles are ignored.`);
+    }
+  };
+  if (rows.length === 0) {
+    info(`No credential profiles are stored in ${path}.`);
+    if (env !== void 0) return envLine();
+    detail(signInLine(path));
+    noteMissingSelection(file, active, path);
+    return;
+  }
+  const s = stdoutStyle();
+  const meta = (row) => `workspace ${row.workspaceId} \xB7 ${row.credentialType}`;
+  const valid = rows.filter((row) => row.invalid === void 0);
+  const instanceWidth = Math.max(0, ...valid.map((row) => String(row.instance).length));
+  const metaWidth = Math.max(0, ...valid.map((row) => meta(row).length));
+  printHuman(
+    "\n" + formatFields(
+      rows.map((row) => {
+        const marks = [row.isActive ? s.green("active") : void 0, row.isDefault ? s.dim("default") : void 0].filter(Boolean).join(s.dim(", "));
+        const body = row.invalid !== void 0 ? s.yellow(`invalid \u2014 ${row.invalid}`) : marks === "" ? `${String(row.instance).padEnd(instanceWidth)}  ${s.dim(meta(row))}` : `${String(row.instance).padEnd(instanceWidth)}  ${s.dim(meta(row).padEnd(metaWidth))}`;
+        return [row.name, marks === "" ? body : `${body} ${s.dim("(")}${marks}${s.dim(")")}`];
+      })
+    )
+  );
+  detail(`From ${path}`);
+  if (env !== void 0) return envLine();
+  noteMissingSelection(file, active, path);
+}
+function noteMissingSelection(file, active, path) {
+  if (active.source === "implicit" || hasProfile(file, active.name)) return;
+  warn(
+    `${describeProfileSelection(active)} is selected here but not stored in ${path}, so no profile is active \u2014 commands here fail until it is added or another is selected.`,
+    "profile.missing"
+  );
+}
+async function showProfile(args) {
+  const { path, file } = openFile(args);
+  if (args.positionals[0] !== void 0) assertAnyProfiles(file, path);
+  if (args.positionals[0] === void 0 && environmentCredentialVars().complete) return showEnvironmentCredential(args);
+  const active = activeSelection(args, file, path);
+  const name = args.positionals[0] ?? active.name;
+  validName(name, "show");
+  if (args.positionals[0] === void 0 && !hasProfile(file, name)) throw notSignedIn(path, file, active);
+  existingName(file, name, path, "show");
+  const record = readProfile(file, name, path);
+  const view = {
+    name,
+    path,
+    // Deliberately no token field of any kind, in either mode. The command that
+    // displays a credential is the last place one should reach a CI log.
+    credentialType: record.type,
+    instance: record.type === "token" ? record.instance_base_url : record.instance,
+    workspaceId: record.workspace_id,
+    isDefault: isDefaultProfile(file, name),
+    isActive: active.name === name,
+    ...record.type === "oauth" ? { expiresAt: record.expires_at, scope: record.scope ?? null } : {}
+  };
+  if (isMachineOutput(args)) {
+    writeJson(view);
+    return;
+  }
+  const s = stdoutStyle();
+  printHuman(
+    "\n" + formatFields([
+      ["Profile", s.bold(name) + (view.isActive ? s.dim(" (active)") : "")],
+      ["Instance", s.bold(s.cyan(view.instance))],
+      ["Workspace", String(view.workspaceId)],
+      ["Credential", record.type === "token" ? "meta API token" : "OAuth"],
+      ["Default", view.isDefault ? "yes" : "no"]
+    ])
+  );
+  detail(`From ${path}`);
+}
+function showEnvironmentCredential(args) {
+  const { vars } = environmentCredentialVars();
+  const instance = readEnvVar("XANO_INSTANCE_URL") ?? null;
+  const workspace = readEnvVar("XANO_WORKSPACE_ID");
+  const view = {
+    name: null,
+    source: "environment",
+    environmentVariables: vars,
+    credentialType: vars.includes("XANO_META_TOKEN") ? "token" : "oauth",
+    instance,
+    workspaceId: workspace === void 0 || !isSafeIdText(workspace) ? workspace ?? null : Number(workspace),
+    isActive: true
+  };
+  if (isMachineOutput(args)) {
+    writeJson(view);
+    return;
+  }
+  const s = stdoutStyle();
+  printHuman(
+    "\n" + formatFields([
+      ["Credential", `${view.credentialType === "token" ? "meta API token" : "OAuth"} ${s.dim("(environment, active)")}`],
+      ...instance === null ? [] : [["Instance", s.bold(s.cyan(instance))]],
+      ...workspace === void 0 ? [] : [["Workspace", workspace]]
+    ])
+  );
+  detail(`From ${vars.join(", ")} \u2014 stored profiles are ignored while they are set.`);
+}
+async function useProfile(args) {
+  const name = requiredName(args, "use");
+  const { path, file } = openFile(args);
+  existingName(file, name, path, "use");
+  const root = projectRootFor(process.cwd());
+  if (root === void 0) {
+    throw new UsageError(
+      `\`profile use\` pins a project, and ${process.cwd()} is not inside one \u2014 no package.json, .git or ${POINTER_FILE} above it short of the home directory. Run it from the project's directory, or make "${name}" this machine's default with \`xanosdk profile set-default ${name}${credentialFileFlag(path)}\`.`
+    );
+  }
+  const written = writePointerFile(root, name);
+  success(`This project now uses profile "${name}".`);
+  detail(`Wrote ${written} \u2014 commit it so the rest of the project uses it too.`);
+  detail(
+    `It holds a profile name and no credentials. To change ${defaultOf(path)} instead, run \`xanosdk profile set-default ${name}${credentialFileFlag(path)}\`.`
+  );
+  if (isMachineOutput(args)) writeJson({ verb: "use", profile: name, pointer: written });
+}
+async function setDefaultProfile(args) {
+  const name = requiredName(args, "set-default");
+  const path = profileFilePath(args);
+  existingName(readCredentialFile(path) ?? emptyCredentialFile(), name, path, "set-default");
+  let changed = false;
+  await withCredentialLock(path, (file) => {
+    existingName(file, name, path, "set-default");
+    usableName(file, name, path, "set-default");
+    changed = file.default !== name;
+    if (!changed) return;
+    file.default = name;
+    writeCredentialFile(path, file);
+  });
+  const pointer = pinOtherThan(name);
+  if (changed) {
+    success(`Profile "${name}" is now ${defaultOf(path)}.`);
+    if (path === globalAuthFilePath()) detail(`Set in ${path}.`);
+  } else {
+    info(`Profile "${name}" is already ${defaultOf(path)} \u2014 nothing changed.`);
+  }
+  if (pointer !== void 0) warnPinWins(pointer, name, path);
+  if (isMachineOutput(args)) {
+    writeJson({ verb: "set-default", profile: name, path, changed, shadowedByPointer: pointer ?? null });
+  }
+}
+function warnPinWins(pointer, name, path) {
+  warn(
+    `This project pins its own profile in ${pointer}, which still wins here. Run \`xanosdk profile use ${name}${credentialFileFlag(path)}\` to change the project too.`,
+    "profile.project-pin-wins"
+  );
+}
+function pinOtherThan(name) {
+  try {
+    const pin = findProjectPointer(process.cwd());
+    return pin !== void 0 && pin.profile !== name ? pin.path : void 0;
+  } catch {
+    return findPointerFile(process.cwd());
+  }
+}
+async function addProfile(args) {
+  const name = requiredName(args, "add");
+  const path = profileFilePath(args);
+  const credential = (token) => buildTokenCredential(
+    {
+      instance: args.instance,
+      // The raw string is passed through on a bad parse so the rejection quotes
+      // what was typed rather than `NaN` — the env triple's reason, unchanged.
+      workspaceId: args.workspaceId !== void 0 && isSafeIdText(args.workspaceId) ? Number(args.workspaceId.trim()) : args.workspaceId,
+      token
+    },
+    {
+      at: `for \`xanosdk profile add ${name}\``,
+      labels: { instance: "--instance", workspace: "--workspace-id", token: "the token" },
+      fix: `Pipe the token alone, on one line: \`printf %s "$TOKEN" | ${retryCommand(args, { command: `profile add ${name}` }).command}\`.`
+    }
+  );
+  try {
+    if (typeof args.instance === "string") {
+      assertInstanceOrigin(args.instance.trim(), `\`--instance\` for \`xanosdk profile add ${name}\``);
+    }
+    credential("x");
+  } catch (err) {
+    throw new UsageError(err instanceof Error ? err.message : String(err), {
+      hintFor: { command: "profile", subcommand: "add" }
+    });
+  }
+  assertCredentialFileWritable(path);
+  const existingFile = readCredentialFile(path) ?? emptyCredentialFile();
+  const displaced = Object.prototype.hasOwnProperty.call(existingFile.profiles, name);
+  if (displaced && !args.force) {
+    throw new UsageError(
+      `Profile "${name}" already exists in ${path}. Pass \`--force\` to replace it, or choose another name. Run \`xanosdk profile show ${name}${credentialFileFlag(path)}\` to see what it addresses.`
+    );
+  }
+  const record = credential(await readToken(name, args));
+  await verifyToken(record, name);
+  await verifyWorkspace(record, name);
+  let isFirst = false;
+  let isDefault = false;
+  await withCredentialLock(path, async (file) => {
+    const replaced = revocableRecord(file, name, path);
+    if (replaced !== void 0) {
+      step(`Revoking the session that profile "${name}" held\u2026`);
+      await revokeProfileSession(args, replaced, name, "replace");
+    }
+    isFirst = profileNames(file).length === 0;
+    file.profiles[name] = record;
+    if (isFirst) file.default = name;
+    isDefault = isDefaultProfile(file, name);
+    writeCredentialFile(path, file);
+  });
+  const gitignored = ensureGitignoredOrWarn(path);
+  if (args.local) warnIfLocalShadowsPin(path, name);
+  success(`Stored profile "${name}" \u2014 ${record.instance_base_url}, workspace ${record.workspace_id}.`);
+  detail(`Saved to ${path}`);
+  const fileFlag = credentialFileFlag(path);
+  if (isFirst) detail(`It is ${defaultOf(path)}, since it is the only profile stored.`);
+  else if (isDefault) detail(`It is still ${defaultOf(path)}.`);
+  else {
+    const pin = projectRootFor(process.cwd()) === void 0 ? "" : `, or pin this project with \`xanosdk profile use ${name}${fileFlag}\``;
+    detail(`Select it with \`--profile ${name}${fileFlag}\`${pin}.`);
+  }
+  if (isMachineOutput(args)) {
+    writeJson({
+      verb: "add",
+      profile: name,
+      path,
+      instance: record.instance_base_url,
+      workspaceId: record.workspace_id,
+      isDefault,
+      replaced: displaced,
+      gitignored
+    });
+  }
+}
+function warnIfLocalShadowsPin(localPath, added) {
+  const pin = findProjectPointer(process.cwd());
+  if (pin === void 0 || pin.profile === added) return;
+  const local = readCredentialFile(localPath);
+  if (local === null || profileNames(local).includes(pin.profile)) return;
+  const sharedPath = globalAuthFilePath();
+  let shared = null;
+  try {
+    shared = readCredentialFile(sharedPath);
+  } catch {
+    return;
+  }
+  if (shared === null || !profileNames(shared).includes(pin.profile)) return;
+  warn(
+    `This project pins profile "${pin.profile}" (${pin.path}), which is in ${sharedPath} but not in ${localPath}. Commands here now read ${localPath} instead, so "${pin.profile}" no longer resolves.`,
+    "profile.local-shadows-pin",
+    [
+      `Undo with \`xanosdk profile delete ${added} --local\`, or re-pin to the new profile with \`xanosdk profile use ${added} --local\`.`
+    ]
+  );
+}
+async function readToken(name, args) {
+  const stdin = await readStdin();
+  if (stdin !== void 0) {
+    const piped = stdin.trim();
+    if (piped === "") {
+      throw new UsageError(
+        `\`xanosdk profile add ${name}\` reads the meta API token from stdin when it is not a terminal, and stdin was empty. Pipe the token in (\`printf %s "$TOKEN" | ${retryCommand(args, { command: `profile add ${name}` }).command}\`), or run it in a terminal to be asked for it.`,
+        { hintFor: { command: "profile", subcommand: "add" } }
+      );
+    }
+    return piped;
+  }
+  return promptLine(`Meta API token for profile "${name}":`, {
+    mask: true,
+    noTtyHint: "A token must not be passed as a flag \u2014 it would land in the process list and the shell history. Pipe it on stdin instead, or for automation set XANO_INSTANCE_URL / XANO_WORKSPACE_ID / XANO_META_TOKEN."
+  });
+}
+var VERIFY_TIMEOUT_MS = 3e4;
+async function verifyToken(record, name) {
+  const url = new URL("/api:meta/auth/me", record.instance_base_url).href;
+  const res = await fetchOrExplain(
+    url,
+    {
+      headers: { Authorization: `Bearer ${record.meta_api_token}` },
+      signal: AbortSignal.timeout(VERIFY_TIMEOUT_MS)
+    },
+    `profile add ${name}`,
+    VERIFY_TIMEOUT_MS
+  ).catch((err) => {
+    if (errorCodeIn(err) !== "ENOTFOUND" || redirectedUnresolvedHost(err, url) !== void 0) {
+      return unansweredProfileRead(err, name).then((e) => Promise.reject(e));
+    }
+    throw new UsageError(
+      `profile add ${name}: the host of ${record.instance_base_url} does not resolve (ENOTFOUND), so nothing was stored. Check the \`--instance\` URL \u2014 it is your instance's origin, e.g. https://x8ki-letl-twmt.n7.xano.io.`,
+      { hintFor: { command: "profile", subcommand: "add" } }
+    );
+  });
+  const text = await res.text();
+  if (res.status === 401 || res.status === 403) {
+    throw credentialRejected(
+      new Error(
+        `${record.instance_base_url} rejected the token for profile "${name}" (HTTP ${res.status}), so nothing was stored. Check it is a meta API token issued by that instance and that it has not expired or been revoked.`
+      ),
+      {
+        profile: name,
+        credentialType: "token",
+        instance: record.instance_base_url,
+        workspaceId: record.workspace_id,
+        signIn: null
+      }
+    );
+  }
+  if (!res.ok) throw await unansweredVerify(res, text, name);
+}
+async function unansweredVerify(res, text, name) {
+  const failed = Object.assign(new Error(httpFailure(`profile add ${name}`, res, text)), { status: res.status });
+  return await unansweredProfileRead(failed, name);
+}
+async function unansweredProfileRead(err, name) {
+  const { isUnansweredLookup, LookupFailedError, unansweredCause } = await import("./source-resolve-S2XA3XZF.js");
+  if (!isUnansweredLookup(err)) {
+    if (err instanceof Error && !(err instanceof UsageError) && !/Nothing was stored\.$/.test(err.message)) {
+      err.message = `${err.message}
+Nothing was stored.`;
+    }
+    return err;
+  }
+  const message = (err instanceof Error ? err.message : String(err)).trim();
+  const head = (message.split("\n")[0] ?? message).trim().replace(/[.:]$/, "");
+  const failed = new LookupFailedError(
+    `Could not verify the token for profile "${name}" \u2014 ${head}. ${unansweredCause(err)} \u2014 nothing was stored`,
+    "unreachable",
+    "workspace"
+  );
+  failed.cause = err;
+  return failed;
+}
+function errorCodeIn(err) {
+  for (let e = err, depth = 0; e !== void 0 && e !== null && depth < 5; depth++) {
+    const code = e.code;
+    if (typeof code === "string") return code;
+    e = e.cause;
+  }
+  return void 0;
+}
+async function verifyWorkspace(record, name) {
+  const url = new URL("/api:meta/workspace", record.instance_base_url).href;
+  const res = await fetchOrExplain(
+    url,
+    {
+      headers: { Authorization: `Bearer ${record.meta_api_token}` },
+      signal: AbortSignal.timeout(VERIFY_TIMEOUT_MS)
+    },
+    `profile add ${name}`,
+    VERIFY_TIMEOUT_MS
+  ).catch(async (err) => Promise.reject(await unansweredProfileRead(err, name)));
+  const text = await res.text();
+  if (!res.ok) throw await unansweredVerify(res, text, name);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`profile add ${name}: could not parse the workspace list as JSON.
+Nothing was stored.`);
+  }
+  const all = Array.isArray(parsed) ? parsed : [];
+  if (all.some((w) => w.id === record.workspace_id)) return;
+  const visible = all.filter((w) => typeof w.id === "number").map((w) => typeof w.name === "string" ? `${String(w.id)} (${w.name})` : String(w.id));
+  throw new UsageError(
+    `The token for profile "${name}" cannot see workspace ${record.workspace_id} on ${record.instance_base_url}, so nothing was stored. ` + (visible.length === 0 ? "It can see no workspace at all." : `The workspace ids it can see: ${visible.join(", ")}.`) + ` Re-run with one of them as \`--workspace-id\`.`,
+    { hintFor: { command: "profile", subcommand: "add" } }
+  );
+}
+async function deleteProfile(args) {
+  const name = requiredName(args, "delete");
+  const path = profileFilePath(args);
+  const file = readCredentialFile(path) ?? emptyCredentialFile();
+  if (!hasProfile(file, name)) {
+    const nearAll = suggestAll(name, profileNames(file));
+    if (nearAll.length > 0) {
+      const pinned = path === resolve(projectAuthFilePath()) ? findProjectPointer(process.cwd())?.profile : void 0;
+      const confirms = (n) => file.default === n && profileNames(file).length > 1 || pinned === n;
+      const again = `${args.json === true ? " --json" : ""}${credentialFileFlag(path)}`;
+      const meant = nearAll.map(
+        (n) => `Did you mean "${safeText(n)}"? \`xanosdk profile delete ${shellQuote(n)}${again}\` deletes it${confirms(n) ? ", after asking to confirm" : ""}.`
+      );
+      const err = new ProfileNotFoundError(
+        [`No credential profile "${name}" in ${path} \u2014 nothing was deleted. ${storedNamesLine(file, path)}`, ...meant].join("\n")
+      );
+      Object.defineProperty(err, "suggestion", { value: nearAll[0], enumerable: true });
+      if (nearAll.length > 1) Object.defineProperty(err, "suggestions", { value: nearAll, enumerable: true });
+      throw err;
+    }
+    warn(`No credential profile "${name}" in ${path} \u2014 nothing to delete. ${storedNamesLine(file, path)}`, "profile.not-found");
+    if (isMachineOutput(args)) {
+      writeJson({
+        verb: "delete",
+        profile: name,
+        path,
+        deleted: false,
+        alreadyGone: true,
+        remaining: profileNames(file),
+        clearedDefault: false,
+        pinnedBy: null,
+        orphanedEnvironments: [],
+        removedFile: false,
+        ...revokeFields({ revoked: null })
+      });
+    }
+    return;
+  }
+  const pointer = findProjectPointer(process.cwd());
+  const isProjectFile = path === resolve(projectAuthFilePath());
+  const isDefault = file.default === name;
+  const isPinned = isProjectFile && pointer?.profile === name;
+  const onMachineFile = path === resolve(globalAuthFilePath());
+  const orphansDefault = isDefault && profileNames(file).length > 1 ? path : void 0;
+  if (!await confirmDanglingRemoval(args, "delete", name, isPinned ? pointer : void 0, orphansDefault)) {
+    info("Nothing was deleted.");
+    return;
+  }
+  let removedFile = false;
+  let revoke = { revoked: null };
+  let wasToken = false;
+  let removedRecord;
+  let remaining = {};
+  const left = await withCredentialLock(path, async (current) => {
+    const revocable = revocableRecord(current, name, path);
+    removedRecord = current.profiles[name];
+    wasToken = current.profiles[name]?.type === "token";
+    if (revocable !== void 0) {
+      step(`Revoking the session for "${name}"\u2026`);
+      revoke = await revokeProfileSession(args, revocable, name);
+    }
+    removedFile = writeOrRemoveCredentialFile(path, dropProfile(current, name));
+    remaining = { ...current.profiles };
+    return profileNames(current);
+  });
+  if (removedFile) removeEmptyProjectCacheDir(path);
+  if (isPinned && pointer !== void 0) {
+    warn(
+      `${pointer.path} still pins this project to "${name}", which no longer exists. Pin another profile with \`xanosdk profile use <name>\`, or store "${name}" again with \`${signInAgain(path, name, removedRecord)}\`.`,
+      "profile.pin-deleted"
+    );
+  }
+  const orphaned = isProjectFile ? environmentsFor(name) : [];
+  const unreachable = [];
+  for (const orphan of orphaned) {
+    const reacher = profileReaching(remaining, orphan.host, orphan.workspace);
+    if (reacher !== void 0) {
+      info(
+        `The environment "${orphan.name}" was deployed under "${name}"; "${reacher}" reaches the same workspace, so \`xanosdk ephemeral delete ${orphan.name} --profile ${reacher}${pipedYes()}\` still removes it.`
+      );
+      continue;
+    }
+    unreachable.push(orphan.name);
+    warn(
+      `The environment "${orphan.name}" was deployed under "${name}", and no stored profile reaches it now. It expires on its own; \`xanosdk ephemeral delete ${orphan.name}${pipedYes()}\`, run under a profile for workspace ${orphan.workspace} on ${orphan.host}, removes it and this project's record of it now.`,
+      "profile.orphan-ephemeral"
+    );
+  }
+  success(`Deleted profile "${name}".`);
+  if (wasToken) detail("The meta API token itself is still valid \u2014 revoke it at its source if you need it dead.");
+  const fileFlag = credentialFileFlag(path);
+  if (removedFile) detail(`It was the last profile, so ${path} was removed.`);
+  if (left.length === 0) {
+    const shared = isProjectFile ? readCredentialFile(globalAuthFilePath()) : null;
+    const sharedNames = shared === null ? [] : profileNames(shared);
+    detail(
+      sharedNames.length > 0 ? `No profiles are left in ${path} \u2014 commands here now read ${globalAuthFilePath()} (${quotedNames(sharedNames)}). To store one in this project again, run \`${signInAgain(path, name, removedRecord)}\`.` : `No profiles are left \u2014 run \`${signInAgain(path, name, removedRecord)}\` to sign in again.`
+    );
+  } else if (isDefault) {
+    detail(
+      `${onMachineFile ? "This machine has" : `${path} has`} no default now. Signed in as: ${quotedNames(left)} \u2014 set one with \`xanosdk profile set-default ${left.length === 1 ? left[0] : "<name>"}${fileFlag}\`.`
+    );
+  }
+  if (isMachineOutput(args)) {
+    writeJson({
+      verb: "delete",
+      profile: name,
+      path,
+      deleted: true,
+      alreadyGone: false,
+      remaining: left,
+      clearedDefault: isDefault,
+      // The `xano.profile.json` still pinning the deleted name — kept, since it
+      // is committed; null when none does. The key `logout` carries.
+      pinnedBy: isPinned ? pointer?.path ?? null : null,
+      // Only those no remaining profile reaches: the rest are still deletable as they are.
+      orphanedEnvironments: unreachable,
+      removedFile,
+      ...revokeFields(revoke)
+    });
+  }
+}
+export {
+  runProfileCommand
+};
+//# sourceMappingURL=profile-command-AH3PIM4X.js.map