@xano/sdk 1.0.0

package/dist/chunk-AWEIIR2U.js

@@ -0,0 +1,218 @@
+import {
+  DEFAULT_BRANCH_LABEL
+} from "./chunk-TRJCALW3.js";
+import {
+  assertOneName
+} from "./chunk-ZIY7RNUT.js";
+import {
+  LookupFailedError,
+  isUnansweredLookup,
+  lookupFailed,
+  unansweredCause
+} from "./chunk-QCNYHBL7.js";
+import {
+  findRelease
+} from "./chunk-2ZUEE4EK.js";
+import {
+  contextFlags
+} from "./chunk-NAQDMEHV.js";
+import {
+  fetchOrExplain,
+  parseJsonAnswer,
+  safeHttpFailure
+} from "./chunk-YLDALTWZ.js";
+import {
+  UsageError,
+  safeText
+} from "./chunk-PTHVMXZI.js";
+
+// src/deploy/audit-log.ts
+var TIMEOUT_MS = 3e4;
+var PAGE_SIZE = 100;
+var MAX_PAGES = 20;
+function rowTime(v) {
+  if (typeof v === "number") return v;
+  if (typeof v !== "string") return void 0;
+  const t = Date.parse(v.replace(" ", "T").replace(/([+-]\d{2})(\d{2})$/, "$1:$2"));
+  return Number.isNaN(t) ? void 0 : t;
+}
+function asString(v) {
+  return typeof v === "string" && v !== "" ? v : void 0;
+}
+function obj(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+function pageRows(body) {
+  if (Array.isArray(body)) return body;
+  const items = obj(body)?.items;
+  return Array.isArray(items) ? items : [];
+}
+async function findReleaseSource(auth, opts) {
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    const rows = await readPage(auth, opts.workspaceId, page);
+    for (const row of rows) {
+      const entry = obj(row);
+      if (entry === void 0 || entry.type !== "release:create") continue;
+      const data = obj(entry.data);
+      if (asString(obj(data?.release)?.name) !== opts.releaseName) continue;
+      const source = obj(data?.source);
+      const tenantName = asString(source?.tenant_name);
+      if (tenantName === void 0) return null;
+      return {
+        tenantName,
+        tenantType: asString(source?.tenant_type),
+        records: source?.records === true
+      };
+    }
+    if (rows.length < PAGE_SIZE) break;
+    const oldest = rowTime(obj(rows.at(-1))?.created_at);
+    if (opts.notBefore !== void 0 && oldest !== void 0 && oldest < opts.notBefore) break;
+  }
+  return null;
+}
+async function readPage(auth, workspaceId, page) {
+  const path = `/api:meta/workspace/${workspaceId}/audit_log?page=${page}&per_page=${PAGE_SIZE}&include_data=true`;
+  const action = "confirm the release source";
+  const res = await fetchOrExplain(
+    new URL(path, auth.instance).href,
+    {
+      method: "GET",
+      headers: {
+        accept: "application/json",
+        Authorization: `Bearer ${auth.access_token}`
+      },
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    },
+    action,
+    TIMEOUT_MS
+  );
+  const text = await res.text();
+  if (!res.ok) {
+    throw auditLogHttpError(
+      res.status,
+      safeHttpFailure(action, res, text, {
+        boundWorkspaceId: auth.workspaceId,
+        instance: auth.instance,
+        profile: auth.profile,
+        addressedWorkspaceId: workspaceId,
+        credentialType: auth.credentialType,
+        // Always the credential's own instance — the audit log lives with the
+        // workspace the release landed in, never on a tenant's host.
+        tenantHost: false
+      })
+    );
+  }
+  const body = parseJsonAnswer(text, action, res.url, { safe: true });
+  return pageRows(body);
+}
+function auditLogHttpError(status, message) {
+  return Object.assign(new Error(message), { status });
+}
+
+// src/emit/release-common.ts
+var EXIT_RELEASE_REFUSED = 2;
+function requireName(args, verb) {
+  const name = args.positionals[0];
+  if (name === void 0 || name === "") {
+    throw new UsageError(
+      `\`xanosdk release ${verb}\` needs a release name. Run \`xanosdk release list${contextFlags()}\` to see them.`,
+      // One line and the pointer: the sentence says what to type.
+      { hintFor: { command: "release", subcommand: verb } }
+    );
+  }
+  assertOneName(name, "the release name", { args, helpFor: { command: "release", subcommand: verb } });
+  return name;
+}
+async function releaseOrigin(auth, release) {
+  if (release.copiedFrom !== void 0) {
+    const { source: source2, cut } = release.copiedFrom;
+    if (cut === void 0) return { kind: "copy", source: source2 };
+    return {
+      kind: "copy",
+      source: source2,
+      from: cut.type === "branch" ? { kind: "branch", label: cut.name } : { kind: "environment", ...cut }
+    };
+  }
+  if (typeof release.branch === "string" && release.branch !== "") return { kind: "branch", label: release.branch };
+  if (release.recordedOrigin !== void 0) {
+    return { kind: "environment", name: release.recordedOrigin.name, type: release.recordedOrigin.type };
+  }
+  const created = release.createdAt === void 0 ? NaN : Date.parse(release.createdAt);
+  const source = await findReleaseSource(auth, {
+    workspaceId: auth.workspaceId,
+    releaseName: release.name,
+    // A margin for clock skew between the record and the log row.
+    ...Number.isNaN(created) ? {} : { notBefore: created - 10 * 6e4 }
+  }).catch(() => null);
+  return source === null ? void 0 : { kind: "environment", name: source.tenantName, type: source.tenantType };
+}
+function passwordHashesWarning(release, columns, where, after = "the landing", origin, takesEntryFile = true) {
+  const head = `Release "${release}" carries seeded password hashes (${columns.join(", ")}). A password hash is keyed to the environment that made it \u2014 every workspace, ephemeral and tenant has its own key, and no release carries it \u2014 so `;
+  const fix = takesEntryFile ? `Deploy the entry file to seed them from plaintext, or reset those passwords after ${after}.` : `${where[0].toUpperCase()}${where.slice(1)} takes only a release, so they cannot be seeded from plaintext there: reset those passwords on it after ${after}, or land a release cut without that table's rows (\`release create\` without its \`--seed\` guid).`;
+  return origin === void 0 ? `${head}logins against these rows fail on ${where} as a bad password unless it is the environment the release was cut from, which is not recorded. ${fix}` : `${head}these verify only on ${origin}, and logins against these rows will fail on ${where} as a bad password. ${fix}`;
+}
+async function passwordOrigin(auth, release) {
+  const name = typeof release === "string" ? release : release.name;
+  const found = typeof release === "string" ? await findRelease(auth, { workspaceId: auth.workspaceId, name }).catch(() => null) : release;
+  let origin;
+  if (found !== null) {
+    origin = await releaseOrigin(auth, found);
+  } else {
+    const source = await findReleaseSource(auth, { workspaceId: auth.workspaceId, releaseName: name }).catch(
+      () => null
+    );
+    if (source !== null) origin = { kind: "environment", name: source.tenantName, type: source.tenantType };
+  }
+  if (origin === void 0) return void 0;
+  if (origin.kind === "copy") {
+    return {
+      name: void 0,
+      phrase: origin.from?.kind === "environment" ? `${describeOrigin(origin.from)} of the workspace the release was copied from` : "the workspace the release was copied from"
+    };
+  }
+  if (origin.kind === "branch") {
+    return {
+      name: void 0,
+      phrase: origin.label === DEFAULT_BRANCH_LABEL ? "the workspace that cut it" : `the workspace (${describeOrigin(origin)})`
+    };
+  }
+  return { name: origin.name, phrase: describeOrigin(origin) };
+}
+function describeOrigin(origin) {
+  if (origin.kind === "copy") {
+    const { release, workspaceId, host } = origin.source;
+    return `release ${safeText(JSON.stringify(release))} of workspace ${workspaceId} on ${safeText(host)} (copied${origin.from === void 0 ? "" : `; cut there from ${describeOrigin(origin.from)}`})`;
+  }
+  return origin.kind === "branch" ? `branch "${safeText(origin.label)}"` : `${origin.type ?? "environment"} "${safeText(origin.name)}"`;
+}
+function readUnanswered(kind, what, not, err) {
+  if (!isUnansweredLookup(err)) return err;
+  const first = ((err instanceof Error ? err.message : String(err)).split("\n")[0] ?? "").trim().replace(/[.:]$/, "");
+  const cause = unansweredCause(err);
+  return new LookupFailedError(
+    `Could not ${what}: ${first}. ${cause}, not ${not} \u2014 nothing was created or changed`,
+    "unreachable",
+    kind
+  );
+}
+async function lookupRelease(auth, name) {
+  try {
+    return await findRelease(auth, { workspaceId: auth.workspaceId, name });
+  } catch (err) {
+    if (isUnansweredLookup(err)) throw lookupFailed("release", name, err);
+    throw err;
+  }
+}
+
+export {
+  findReleaseSource,
+  EXIT_RELEASE_REFUSED,
+  requireName,
+  releaseOrigin,
+  passwordHashesWarning,
+  passwordOrigin,
+  describeOrigin,
+  readUnanswered,
+  lookupRelease
+};
+//# sourceMappingURL=chunk-AWEIIR2U.js.map

package/dist/chunk-AWQ7BQTQ.js

@@ -0,0 +1,73 @@
+// src/util/secrets.ts
+var secrets = /* @__PURE__ */ new Set();
+var REDACTED = "<redacted>";
+var MIN_SECRET_LENGTH = 8;
+function registerSecret(value) {
+  if (typeof value !== "string") return;
+  const forms = /* @__PURE__ */ new Set([value, value.trim()]);
+  let piece = "";
+  for (const ch of value) {
+    const code = ch.charCodeAt(0);
+    if (code <= 32 || code === 127 || /\s/.test(ch)) {
+      forms.add(piece);
+      piece = "";
+    } else piece += ch;
+  }
+  forms.add(piece);
+  for (const form of [...forms]) forms.add(JSON.stringify(form).slice(1, -1));
+  for (const form of forms) {
+    if (form.length >= MIN_SECRET_LENGTH) secrets.add(form);
+  }
+}
+function redactSecrets(text) {
+  if (secrets.size === 0) return text;
+  let out = text;
+  for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
+    if (out.includes(secret)) out = out.split(secret).join(REDACTED);
+  }
+  return out;
+}
+var dataWrites = /* @__PURE__ */ new WeakSet();
+function writeData(stream, data) {
+  dataWrites.add(stream);
+  try {
+    return stream.write(data);
+  } finally {
+    dataWrites.delete(stream);
+  }
+}
+function installSecretRedaction(stream) {
+  const original = stream.write.bind(stream);
+  stream.write = ((chunk, ...rest) => {
+    if (secrets.size > 0 && !dataWrites.has(stream)) {
+      if (typeof chunk === "string") chunk = redactSecrets(chunk);
+      else if (chunk instanceof Uint8Array) chunk = redactBytes(chunk);
+    }
+    return original(chunk, ...rest);
+  });
+}
+function redactBytes(chunk) {
+  const buf = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+  for (const secret of secrets) {
+    if (buf.includes(secret)) return Buffer.from(redactSecrets(buf.toString("utf8")), "utf8");
+  }
+  return chunk;
+}
+function tokenTextProblem(token) {
+  for (let i = 0; i < token.length; i++) {
+    const code = token.charCodeAt(i);
+    if (code >= 33 && code <= 126) continue;
+    const kind = code === 10 || code === 13 ? "a line break" : code === 32 || code === 9 ? "whitespace" : code < 32 || code === 127 ? "a control character" : "a non-ASCII character";
+    return `contains ${kind} at character ${i + 1} of ${token.length}`;
+  }
+  return void 0;
+}
+
+export {
+  registerSecret,
+  redactSecrets,
+  writeData,
+  installSecretRedaction,
+  tokenTextProblem
+};
+//# sourceMappingURL=chunk-AWQ7BQTQ.js.map

package/dist/chunk-BAUZOWGX.js

@@ -0,0 +1,393 @@
+import {
+  listOverrideEntries,
+  listReleaseEntries,
+  readEngineEntry,
+  readPin,
+  verifiedEngineExecutable
+} from "./chunk-6ELFRN3P.js";
+import {
+  clearEngineRecordsNamed,
+  listEngineRecords
+} from "./chunk-3M4LFYNQ.js";
+import {
+  assertLoopbackUrl,
+  engineCacheDir,
+  engineRunHome,
+  localEngineHome,
+  parseEngineHandshake,
+  parseEngineListing
+} from "./chunk-AM4FKL4J.js";
+import {
+  fetchOrExplain,
+  httpFailureError
+} from "./chunk-YLDALTWZ.js";
+
+// src/deploy/local-engine-process.ts
+import { spawn as nodeSpawn, spawnSync } from "child_process";
+import { appendFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs";
+import { dirname, join, sep } from "path";
+var HANDSHAKE_TIMEOUT_MS = 6e4;
+var MAX_HANDSHAKE_BYTES = 64 * 1024;
+var MAX_STDERR_BYTES = 64 * 1024;
+var ENGINE_ENV_ALLOWLIST = [
+  "HOME",
+  "PATH",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM"
+];
+var defaultSpawn = (executable, args, options) => nodeSpawn(executable, [...args], { ...options, windowsHide: true });
+var defaultRun = (executable, args, options) => {
+  const result = spawnSync(executable, [...args], { ...options, encoding: "utf8", windowsHide: true });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+};
+function redactSecrets(text) {
+  return text.replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g, "[redacted]").replace(/(\bkey=)[^&\s"']+/gi, "$1[redacted]").replace(/(\bBearer\s+)\S+/gi, "$1[redacted]");
+}
+function engineChildEnv(env = process.env) {
+  const built = {};
+  for (const key of ENGINE_ENV_ALLOWLIST) {
+    const value = env[key];
+    if (value !== void 0) built[key] = value;
+  }
+  built.PATH = env.PATH ?? "";
+  built.HOME = engineRunHome(env);
+  return built;
+}
+function engineLogPath(name, env = process.env) {
+  return join(localEngineHome(env), "logs", `${name}.log`);
+}
+function engineOwnLogs(env = process.env) {
+  const cache = engineCacheDir(env);
+  try {
+    for (const entry of readdirSync(cache, { withFileTypes: true })) {
+      const logs = join(cache, entry.name, "logs");
+      if (entry.isDirectory() && existsSync(logs)) return logs;
+    }
+  } catch {
+  }
+  return cache;
+}
+var FIRST_TTL_RELEASE = [0, 1, 15];
+function engineExpiresEphemerals(version) {
+  const parts = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version?.trim() ?? "")?.slice(1).map(Number);
+  if (parts === void 0) return false;
+  for (let i = 0; i < 3; i++) if (parts[i] !== FIRST_TTL_RELEASE[i]) return parts[i] > FIRST_TTL_RELEASE[i];
+  return true;
+}
+async function startEngine(opts) {
+  const env = opts.env ?? process.env;
+  const spawn = opts.spawn ?? defaultSpawn;
+  const executable = verifiedEngineExecutable(opts.entry, env);
+  const logPath = engineLogPath(opts.name, env);
+  mkdirSync(join(localEngineHome(env), "logs"), { recursive: true, mode: 448 });
+  mkdirSync(engineRunHome(env), { recursive: true, mode: 448 });
+  rmSync(logPath, { force: true });
+  let launcherPrinted = false;
+  const outputIsIn = () => {
+    const own = engineOwnLogs(env);
+    const where = [
+      ...existsSync(own) ? [`The engine's own log is the newest file in ${own}`] : [],
+      ...launcherPrinted ? [`What it printed while starting is in ${logPath}`] : []
+    ];
+    return where.join("; ").replace(/; What/, "; what");
+  };
+  const checkOutput = () => {
+    const where = outputIsIn();
+    return where === "" ? "It left no log to check \u2014 re-run it." : `${where} \u2014 check it, then re-run.`;
+  };
+  const child = spawn(
+    executable,
+    // `--ephemeral` for a throwaway backend, `--detach` so the launcher prints
+    // the handshake and exits while the engine keeps serving, `--name` so this
+    // project's engine is findable by the one handle everything matches on.
+    // `--ttl 0` because a project's engine is reused across deploys and holds
+    // its data and static site: the default one-hour lifetime would delete both.
+    ["--ephemeral", "--detach", "--name", opts.name, ...engineExpiresEphemerals(opts.version) ? ["--ttl", "0"] : []],
+    {
+      detached: true,
+      // stdin ignored: nothing here answers a prompt, and an inherited stdin is
+      // a detached process competing with the CLI for the terminal.
+      stdio: ["ignore", "pipe", "pipe"],
+      env: engineChildEnv(env)
+    }
+  );
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let stdout = "";
+    let stderr = "";
+    const timeoutMs = opts.timeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    const timer = setTimeout(() => {
+      fail(
+        new Error(
+          `The engine did not report itself started within ${Math.round(timeoutMs / 1e3)}s.
+` + checkOutput()
+        )
+      );
+    }, timeoutMs);
+    function finish(engine) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.unref();
+      resolve(engine);
+    }
+    function fail(err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child.kill();
+      } catch {
+      }
+      reject(err);
+    }
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+      if (stdout.length > MAX_HANDSHAKE_BYTES) {
+        fail(
+          new Error(
+            `The engine printed too much output without reporting itself started.
+` + checkOutput()
+          )
+        );
+        return;
+      }
+      try {
+        JSON.parse(stdout.trim());
+      } catch {
+        return;
+      }
+      try {
+        finish(parseEngineHandshake(stdout));
+      } catch (err) {
+        fail(err);
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      const text = redactSecrets(String(chunk));
+      if (stderr.length < MAX_STDERR_BYTES) stderr += text;
+      try {
+        appendFileSync(logPath, text, { mode: 384 });
+        launcherPrinted = true;
+      } catch {
+      }
+    });
+    child.on("error", (err) => {
+      fail(
+        new Error(
+          `The engine could not be started: ${err.message}
+Fetch a fresh copy with \`xanosdk local-engine cache clear\`, then deploy again (\`xanosdk deploy --local-engine\`).`
+        )
+      );
+    });
+    child.on("close", (code) => {
+      setImmediate(() => {
+        if (settled) return;
+        fail(new Error(bootFailure(opts.name, code, stderr.trim(), outputIsIn(), engineRunHome(env))));
+      });
+    });
+  });
+}
+function bootFailure(name, code, tail, outputIsIn, runHome) {
+  const reported = /\bexit status \d+/i.test(tail);
+  const head = `The engine ${name} exited${reported || code === null ? "" : ` (status ${code})`} instead of starting.`;
+  const lines = tail.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  let cause;
+  const denied = lines.find((l) => /permission denied|\bEACCES\b|operation not permitted|read-only file system/i.test(l));
+  if (denied !== void 0) {
+    const named = /(\/[^\s:"']+)\s*:\s*(?:permission denied|operation not permitted|read-only file system)/i.exec(denied)?.[1];
+    const dir = nearestExisting(named ?? join(runHome, "x"));
+    cause = dir === void 0 ? `It could not write its own files \u2014 make ${runHome} and everything under it writable (\`chmod -R u+w ${runHome}\`), then re-run.` : `It could not write under ${dir} \u2014 make it writable (\`chmod u+w ${dir}\`), then re-run.`;
+  } else if (lines.some((l) => /already (?:in use|taken|running|exists)|address in use|\bEADDRINUSE\b/i.test(l))) {
+    cause = `The name or port is already taken \u2014 stop the engine holding it with \`xanosdk local-engine stop ${name}\`, then re-run.`;
+  } else {
+    const last = [...lines].reverse().find((l) => /\berror\b|failed|denied|cannot|refused|not found|no such/i.test(l));
+    cause = last === void 0 ? "Check it, then re-run." : `Its last error: ${last}`;
+  }
+  return `${head}${tail === "" ? "" : `
+${tail}`}
+${outputIsIn === "" ? "" : `${outputIsIn}. `}${cause}`;
+}
+function nearestExisting(path) {
+  for (let dir = dirname(path); dirname(dir) !== dir; dir = dirname(dir)) {
+    if (existsSync(dir)) return dir;
+  }
+  return void 0;
+}
+function cachedEngineEntry(env, cwd = process.cwd(), exclude = /* @__PURE__ */ new Set()) {
+  const keep = (e) => e !== void 0 && !exclude.has(e.dir) ? e : void 0;
+  const pin = readPin(cwd);
+  if (typeof pin === "string") {
+    const pinned = keep(readEngineEntry({ version: pin }, env));
+    if (pinned !== void 0) return pinned;
+  }
+  return listReleaseEntries(env).find((e) => keep(e)) ?? listOverrideEntries(env).find((e) => keep(e));
+}
+function runVerb(args, opts) {
+  const env = opts.env ?? process.env;
+  const run = opts.run ?? defaultRun;
+  return run(verifiedEngineExecutable(opts.entry, env), args, { env: engineChildEnv(env) });
+}
+function listEngines(opts) {
+  const result = runVerb(["list", "--json"], opts);
+  if (result.status !== 0) {
+    throw new Error(
+      `The engine could not list what is running` + (result.stderr.trim() === "" ? `.` : `: ${redactSecrets(result.stderr.trim())}`) + `
+Re-run, and if it happens again fetch a fresh copy with \`xanosdk local-engine cache clear\`, then \`xanosdk deploy --local-engine\`.`
+    );
+  }
+  return parseEngineListing(result.stdout);
+}
+function engineVersionToken(output) {
+  const first = output.split("\n")[0].trim();
+  if (first === "") return void 0;
+  return /\bv?\d+\.\d+\.\d+\S*/.exec(first)?.[0] ?? first;
+}
+function engineVersion(opts) {
+  const result = runVerb(["version"], opts);
+  if (result.status !== 0) {
+    throw new Error(
+      `The engine could not report its version.
+Re-run with the engine's URL or an archive path on the flag to get a fresh one.`
+    );
+  }
+  return result.stdout.trim();
+}
+var LOGIN_LINK_TIMEOUT_MS = 1e4;
+var defaultLoginFetch = (url, init) => fetchOrExplain(url, init, "open a local engine", LOGIN_LINK_TIMEOUT_MS);
+async function mintEngineLoginLink(engine, opts = {}) {
+  assertLoopbackUrl(engine.loginLinkEndpoint, "The engine's sign-in route");
+  const doFetch = opts.fetch ?? defaultLoginFetch;
+  const res = await doFetch(engine.loginLinkEndpoint, {
+    method: "POST",
+    headers: {
+      // The enumeration's bearer, on a loopback url, and nowhere else.
+      authorization: `Bearer ${engine.token}`,
+      "content-type": "application/json"
+    },
+    // A body either way: the route reads one, and `{}` is the plain session.
+    body: JSON.stringify(opts.guest === true ? { guest_read_only: true } : {})
+  });
+  if (!res.ok) {
+    const body = redactSecrets(await res.text().catch(() => ""));
+    if (res.status === 401) {
+      throw new Error(
+        `The engine no longer accepts the credential it reported for "${engine.name}".
+It was most likely restarted since it was listed \u2014 run \`xanosdk local-engine list\` to see what is running, then try again.`
+      );
+    }
+    throw httpFailureError(`open a local engine`, res, body);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (typeof data._ti !== "string" || data._ti === "" || typeof data.url !== "string" || data.url === "") {
+    throw new Error(
+      `The engine did not return a one-time sign-in (\`_ti\`) and a url for "${engine.name}".
+That is not an engine this SDK knows how to drive \u2014 move to a current one with \`xanosdk local-engine update\`.`
+    );
+  }
+  assertLoopbackUrl(data.url, "The sign-in the engine returned");
+  return { _ti: data._ti, url: data.url };
+}
+function resolveRecordedEngine(record, running) {
+  const engine = running.find((e) => e.name === record.name);
+  if (engine === void 0) return { state: "stale" };
+  try {
+    assertLoopbackUrl(engine.url, "The engine recorded for this project");
+  } catch (err) {
+    return { state: "unusable", reason: err.message };
+  }
+  return { state: "live", engine };
+}
+function stopEngineNamed(name, opts) {
+  const result = runVerb(["stop", name], opts);
+  return {
+    name,
+    stopped: result.status === 0,
+    clearedProjects: clearEngineRecordsNamed(name, opts.env ?? process.env)
+  };
+}
+function stopAllEngines(opts) {
+  const env = opts.env ?? process.env;
+  const running = listEngines(opts);
+  const ours = new Set(listEngineRecords(env).map((r) => r.name));
+  const stopped = [];
+  const foreign = [];
+  for (const engine of running) {
+    if (ours.has(engine.name)) stopped.push(stopEngineNamed(engine.name, opts));
+    else foreign.push(engine.name);
+  }
+  return { stopped, foreign, orphans: stopOrphanedEngineProcesses(opts) };
+}
+var defaultProcessTable = () => {
+  if (process.platform === "win32") return [];
+  const result = spawnSync("ps", ["-axo", "pid=,ppid=,command="], { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0 || typeof result.stdout !== "string") return [];
+  return result.stdout.split("\n").flatMap((line) => {
+    const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    return m === null ? [] : [{ pid: Number(m[1]), ppid: Number(m[2]), command: m[3] }];
+  });
+};
+var defaultSignal = (pid, signal) => {
+  try {
+    process.kill(pid, signal);
+    return true;
+  } catch {
+    return false;
+  }
+};
+function findOrphanedEngineProcesses(opts = {}) {
+  const env = opts.env ?? process.env;
+  const runHome = `${engineRunHome(env)}${sep}`;
+  const home = `${localEngineHome(env)}${sep}`;
+  const rows = (opts.processes ?? defaultProcessTable)();
+  const byPid = new Map(rows.map((row) => [row.pid, row]));
+  const isEngine = (row) => row.command.startsWith(home) && !row.command.startsWith(runHome);
+  return rows.filter(
+    (row) => row.pid !== process.pid && row.command.includes(runHome) && !isEngine(row) && !(byPid.get(row.ppid)?.command.includes(home) ?? false)
+  );
+}
+function stopOrphanedEngineProcesses(opts = {}) {
+  const signal = opts.signal ?? defaultSignal;
+  const pids = findOrphanedEngineProcesses(opts).map((row) => row.pid).filter((pid) => signal(pid, "SIGTERM"));
+  const deadline = Date.now() + (opts.waitMs ?? 1e4);
+  let alive = pids.filter((pid) => signal(pid, 0));
+  const pause = new Int32Array(new SharedArrayBuffer(4));
+  while (alive.length > 0 && Date.now() < deadline) {
+    Atomics.wait(pause, 0, 0, 100);
+    alive = alive.filter((pid) => signal(pid, 0));
+  }
+  return { stopped: pids.filter((pid) => !alive.includes(pid)), stillRunning: alive };
+}
+
+export {
+  HANDSHAKE_TIMEOUT_MS,
+  MAX_HANDSHAKE_BYTES,
+  ENGINE_ENV_ALLOWLIST,
+  engineChildEnv,
+  engineLogPath,
+  engineOwnLogs,
+  engineExpiresEphemerals,
+  startEngine,
+  bootFailure,
+  cachedEngineEntry,
+  listEngines,
+  engineVersionToken,
+  engineVersion,
+  LOGIN_LINK_TIMEOUT_MS,
+  mintEngineLoginLink,
+  resolveRecordedEngine,
+  stopEngineNamed,
+  stopAllEngines,
+  findOrphanedEngineProcesses,
+  stopOrphanedEngineProcesses
+};
+//# sourceMappingURL=chunk-BAUZOWGX.js.map