@xano/sdk 1.0.0

package/dist/chunk-ELP2HMXC.js

@@ -0,0 +1,432 @@
+import {
+  confirm
+} from "./chunk-65HWOMGV.js";
+import {
+  ProfileNotFoundError,
+  describeRefreshAnswer,
+  environmentCredentialVars
+} from "./chunk-ET4Y4XCB.js";
+import {
+  yesRerun
+} from "./chunk-T5KELPAR.js";
+import {
+  OpenIdProvider,
+  assertCredentialFileRemovable,
+  assertHttpsOrigin,
+  clearCredential,
+  clearCredentialUnderLock,
+  credentialFileFlag,
+  describeProfile,
+  dropProfile,
+  emptyCredentialFile,
+  globalAuthFilePath,
+  localAuthFilePath,
+  loginCommand,
+  profileNames,
+  projectAuthFilePath,
+  readCredentialFile,
+  readProfile,
+  removeEmptyProjectCacheDir,
+  resolveAuthFilePath,
+  resolveScope,
+  withCredentialLock,
+  writeOrRemoveCredentialFile
+} from "./chunk-XW6KISBB.js";
+import {
+  findProjectPointer,
+  resolveProjectProfile
+} from "./chunk-5FBYXK5P.js";
+import {
+  resolveActiveProfile
+} from "./chunk-QXTKSOFI.js";
+import {
+  UsageError,
+  detail,
+  hostLabel,
+  info,
+  isMachineOutput,
+  quotedNames,
+  safeText,
+  success,
+  warn,
+  writeJson
+} from "./chunk-PTHVMXZI.js";
+import {
+  suggestAll
+} from "./chunk-UTI5G6OJ.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+
+// src/emit/logout-command.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+async function runLogoutCommand(args) {
+  if (args.all && args.profile !== void 0) {
+    throw new UsageError(
+      `\`--all\` clears every stored profile, so it cannot be scoped to \`--profile ${args.profile}\`. Drop \`--all\` to sign out of that one profile, or drop \`--profile\` to sign out of all of them.`,
+      { hintFor: { command: "logout" } }
+    );
+  }
+  const authFilePath = resolveAuthFilePath(args, "write");
+  const targetsGlobal = authFilePath === globalAuthFilePath();
+  let file;
+  try {
+    file = readCredentialFile(authFilePath);
+  } catch (err) {
+    warn(`Could not read ${authFilePath} (${err instanceof Error ? err.message : String(err)}).`, "logout.unreadable");
+    const removedFile2 = clearCredential(authFilePath);
+    if (removedFile2) removeEmptyProjectCacheDir(authFilePath);
+    if (removedFile2) {
+      success("Removed the unreadable credential file.");
+      detail(`Removed ${authFilePath}`);
+    }
+    if (isMachineOutput(args)) {
+      writeJson({
+        verb: "logout",
+        path: authFilePath,
+        removed: [],
+        remaining: [],
+        alreadyGone: false,
+        removedUnreadableFile: removedFile2,
+        removedFile: removedFile2,
+        // An unreadable file names no session to revoke.
+        ...revokeFields({ revoked: null })
+      });
+    }
+    return;
+  }
+  const names = file === null ? [] : profileNames(file);
+  if (file === null || names.length === 0) {
+    if (!args.all) refuseIfOnlyInProjectFile(args, authFilePath, activeProfile(args, file ?? emptyCredentialFile()), names);
+    info(`Not signed in (no credential at ${authFilePath}). Nothing to do.`);
+    noteEnvCredential();
+    if (isMachineOutput(args)) writeLogoutDocument(authFilePath, [], [], { alreadyGone: true });
+    return;
+  }
+  const warnShared = (what) => {
+    if (targetsGlobal) {
+      warn(`Clearing ${what} in the shared credential file ${authFilePath} \u2014 this affects every project that reuses it.`, "logout.shared-file");
+    }
+  };
+  if (args.all) {
+    const pin2 = pinnedBy(authFilePath, names);
+    if (!await confirmRemoveAll(args, authFilePath, names, pin2)) {
+      return declined(args, authFilePath, names, pin2);
+    }
+    warnShared("every credential");
+    let revokes = [];
+    const removedFile2 = await clearCredentialUnderLock(authFilePath, async (current) => {
+      revokes = await Promise.all(
+        profileNames(current).flatMap((name) => {
+          const record = revocableRecord(current, name, authFilePath);
+          return record === void 0 ? [] : [revokeProfileSession(args, record, name).then((outcome) => ({ profile: name, outcome }))];
+        })
+      );
+    });
+    if (removedFile2) removeEmptyProjectCacheDir(authFilePath);
+    success(`Signed out of ${names.length} ${names.length === 1 ? "profile" : "profiles"}.`);
+    detail(`Removed ${authFilePath}`);
+    const tokens = names.filter((name) => file.profiles[name]?.type === "token");
+    if (tokens.length > 0) {
+      detail(
+        `${tokens.length === 1 ? `The meta API token behind "${safeText(tokens[0])}" is` : `The meta API tokens behind ${quotedNames(tokens)} are`} still valid \u2014 revoke ${tokens.length === 1 ? "it" : "them"} at the source if you need ${tokens.length === 1 ? "it" : "them"} dead.`
+      );
+    }
+    if (envCredentialVars().length === 0) {
+      const again = names.length === 1 ? names[0] : file.default ?? names[0];
+      detail(`No profiles are left \u2014 run \`${signInAgain(authFilePath, again, file.profiles[again])}\` to sign in again.`);
+    }
+    notePinLeft(pin2, authFilePath, file.profiles[pin2?.profile ?? ""]);
+    noteEnvCredential();
+    if (isMachineOutput(args)) {
+      writeLogoutDocument(authFilePath, names, [], {
+        clearedDefault: file.default !== void 0,
+        removedFile: removedFile2,
+        revoke: combineRevokes(revokes),
+        pin: pin2
+      });
+    }
+    return;
+  }
+  const selection = activeProfile(args, file);
+  let saved;
+  try {
+    saved = readProfile(file, selection.name, authFilePath);
+  } catch {
+    saved = null;
+  }
+  if (saved === null && !Object.prototype.hasOwnProperty.call(file.profiles, selection.name)) {
+    refuseIfOnlyInProjectFile(args, authFilePath, selection, names);
+    refuseNearMiss(args, authFilePath, file, selection, names);
+    info(
+      `Profile "${selection.name}" is not signed in at ${authFilePath}. Nothing to do. Signed in as: ${quotedNames(names)}.`
+    );
+    noteEnvCredential();
+    if (isMachineOutput(args)) writeLogoutDocument(authFilePath, [], names, { alreadyGone: true });
+    return;
+  }
+  const pin = pinnedBy(authFilePath, [selection.name]);
+  const orphansDefault = file.default === selection.name && names.length > 1 ? authFilePath : void 0;
+  if (!await confirmDanglingRemoval(args, "logout", selection.name, pin, orphansDefault)) {
+    return declined(args, authFilePath, names, pin);
+  }
+  warnShared(`profile "${selection.name}"`);
+  let wasDefault = false;
+  let removedFile = false;
+  let revoke = { revoked: null };
+  const left = await withCredentialLock(authFilePath, async (current) => {
+    wasDefault = current.default === selection.name;
+    const revocable = revocableRecord(current, selection.name, authFilePath);
+    if (revocable !== void 0) revoke = await revokeProfileSession(args, revocable, selection.name);
+    removedFile = writeOrRemoveCredentialFile(authFilePath, dropProfile(current, selection.name));
+    return profileNames(current);
+  });
+  if (removedFile) removeEmptyProjectCacheDir(authFilePath);
+  if (saved?.type === "token") {
+    success(`Removed the meta API token credential "${selection.name}" (${hostLabel(saved.instance_base_url)})`);
+    detail("The token itself is still valid \u2014 revoke it at its source if you need it dead.");
+  } else if (saved === null) {
+    success(`Removed the unreadable profile "${selection.name}".`);
+  } else {
+    success(`Signed out of profile "${selection.name}" (${hostLabel(saved.instance)})`);
+  }
+  reportWhatIsLeft(authFilePath, selection.name, left, wasDefault, file.profiles[selection.name]);
+  notePinLeft(pin, authFilePath, file.profiles[selection.name]);
+  if (isMachineOutput(args)) {
+    writeLogoutDocument(authFilePath, [selection.name], left, { clearedDefault: wasDefault, removedFile, revoke, pin });
+  }
+}
+function pinnedBy(authFilePath, removing) {
+  if (authFilePath !== resolve(projectAuthFilePath())) return void 0;
+  const pin = findProjectPointer(process.cwd());
+  return pin !== void 0 && removing.includes(pin.profile) ? pin : void 0;
+}
+async function confirmDanglingRemoval(args, verb, name, pin, orphansDefaultIn) {
+  if (args.yes || pin === void 0 && orphansDefaultIn === void 0) return true;
+  const where = orphansDefaultIn === void 0 ? "" : orphansDefaultIn === globalAuthFilePath() ? "this machine" : orphansDefaultIn;
+  const is = [
+    orphansDefaultIn === void 0 ? void 0 : where === "this machine" ? "this machine's default" : `the default in ${where}`,
+    pin === void 0 ? void 0 : `the one ${pin.path} pins this project to`
+  ].filter(Boolean).join(" and ");
+  const costs = [
+    orphansDefaultIn === void 0 ? void 0 : `leaves ${where} with no default`,
+    pin === void 0 ? void 0 : `keeps ${pin.path} naming it, so every command here fails until ${verb === "logout" ? "it is signed in again" : "it is stored again or another profile is pinned"}`
+  ].filter(Boolean).join(" and ");
+  const doing = verb === "logout" ? "Signing out of it" : "Deleting it";
+  const { rerun, note } = yesRerun(args, verb === "logout" ? "logout" : "profile delete");
+  return confirm(
+    `Profile "${pin?.profile ?? name}" is ${is}. ${doing} ${costs}. ${verb === "logout" ? "Sign out" : "Delete it"} anyway?`,
+    { flag: "--yes", refusal: { details: { removed: false, profile: pin?.profile ?? name }, rerun, note } }
+  );
+}
+async function confirmRemoveAll(args, path, names, pin) {
+  assertCredentialFileRemovable(path);
+  if (args.yes) return true;
+  const which = names.length === 1 ? `the one profile ("${safeText(names[0])}")` : `all ${names.length} profiles (${quotedNames(names)})`;
+  const pinCost = pin === void 0 ? "" : ` ${pin.path} keeps pinning this project to "${pin.profile}", so every command here fails until it is signed in again.`;
+  const { rerun, note } = yesRerun(args, "logout");
+  return confirm(`Signing out of ${which} removes ${path}.${pinCost} Sign out of every profile?`, {
+    flag: "--yes",
+    refusal: { details: { removed: false, profiles: [...names] }, rerun, note }
+  });
+}
+function declined(args, authFilePath, names, pin) {
+  info("Nothing was removed.");
+  if (isMachineOutput(args)) writeLogoutDocument(authFilePath, [], names, { declined: true, ...pin === void 0 ? {} : { pin } });
+}
+function notePinLeft(pin, path, record) {
+  if (pin === void 0) return;
+  warn(
+    `${pin.path} still pins this project to "${pin.profile}", which is signed out now. Sign in again with \`${signInAgain(path, pin.profile, record)}\`, or pin another profile with \`xanosdk profile use <name>\`.`,
+    "logout.pin-signed-out"
+  );
+}
+function writeLogoutDocument(path, removed, remaining, outcome = {}) {
+  writeJson({
+    verb: "logout",
+    path,
+    removed,
+    remaining,
+    clearedDefault: outcome.clearedDefault ?? false,
+    alreadyGone: outcome.alreadyGone ?? false,
+    removedFile: outcome.removedFile ?? false,
+    // A confirmation of a pinned profile's sign-out answered no.
+    declined: outcome.declined ?? false,
+    // The `xano.profile.json` still pinning a profile this run signed out of —
+    // kept, since it is committed; null when none does.
+    pinnedBy: outcome.pin?.path ?? null,
+    environmentCredential: envCredentialVars(),
+    // `revoked`: whether the removed session was ended on the server — null when
+    // there was none to end (a meta API token, nothing removed). `false` means it
+    // may still be live, with the reason in `revokeError`.
+    ...revokeFields(outcome.revoke ?? { revoked: null })
+  });
+}
+function envCredentialVars() {
+  return environmentCredentialVars().vars;
+}
+function noteEnvCredential() {
+  const { vars, complete } = environmentCredentialVars();
+  if (vars.length === 0) return;
+  const them = vars.length === 1 ? "it" : "them";
+  const set = `${vars.join(", ")} ${vars.length === 1 ? "is" : "are"} still set in this environment`;
+  warn(
+    complete ? `${set} \u2014 commands keep authenticating with ${them}. Unset ${them} to sign out fully.` : `${set} \u2014 it is an incomplete credential, so commands fail on it rather than using a stored profile. Unset ${them}.`,
+    "logout.env-still-set"
+  );
+}
+function refuseIfOnlyInProjectFile(args, authFilePath, selection, names) {
+  if (args.local || authFilePath !== globalAuthFilePath()) return;
+  const local = localAuthFilePath();
+  if (local === authFilePath || !existsSync(local)) return;
+  let held;
+  try {
+    held = readCredentialFile(local);
+  } catch {
+    return;
+  }
+  if (held === null || !Object.prototype.hasOwnProperty.call(held.profiles, selection.name)) return;
+  throw new ProfileNotFoundError(
+    `Profile "${selection.name}" is not in ${authFilePath}, the file \`logout\` clears by default \u2014 it is stored in this project's ${local}. Run \`xanosdk logout --local -p ${selection.name}\` to sign out of it there.`,
+    selection,
+    names
+  );
+}
+function refuseNearMiss(args, authFilePath, file, selection, names) {
+  const nearAll = suggestAll(selection.name, names);
+  if (nearAll.length === 0) return;
+  const again = `${args.json === true ? " --json" : ""}${authFilePath === resolve(projectAuthFilePath()) ? "" : credentialFileFlag(authFilePath)}`;
+  const confirms = (n) => pinnedBy(authFilePath, [n]) !== void 0 || file.default === n && names.length > 1;
+  const err = new ProfileNotFoundError(
+    [
+      `Profile "${selection.name}" is not signed in at ${authFilePath} \u2014 nothing was signed out. Signed in as: ${quotedNames(names)}.`,
+      ...nearAll.map(
+        (n) => `Did you mean "${safeText(n)}"? \`xanosdk logout --profile ${shellQuote(n)}${again}\` signs it out${confirms(n) ? ", after asking to confirm" : ""}.`
+      )
+    ].join("\n"),
+    selection,
+    names
+  );
+  Object.defineProperty(err, "suggestion", { value: nearAll[0], enumerable: true });
+  if (nearAll.length > 1) Object.defineProperty(err, "suggestions", { value: nearAll, enumerable: true });
+  throw err;
+}
+function activeProfile(args, file) {
+  return resolveActiveProfile({
+    flag: args.profile,
+    fileDefault: file.default,
+    readPointer: () => resolveProjectProfile(process.cwd())
+  });
+}
+function afterFailedRevoke(context) {
+  switch (context) {
+    case "logout":
+      return "Removing the local copy anyway.";
+    case "replace":
+      return "It was replaced here anyway \u2014 the replaced session stays valid on the server until it expires.";
+    case "minted":
+      return "It was never stored, so nothing here holds it \u2014 the unused session stays valid on the server until it expires.";
+  }
+}
+async function revokeProfileSession(args, saved, profile, context = "logout") {
+  if (!saved.refresh_token) return { revoked: null };
+  const whose = context === "logout" ? `profile "${profile}"'s refresh token` : context === "replace" ? `the session profile "${profile}" held before` : `the session this sign-in minted for profile "${profile}"`;
+  try {
+    assertHttpsOrigin(saved.auth_host, "The stored sign-in server (`auth_host`)");
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    warn(`Did not revoke ${whose}: ${why} The token was not sent. ${afterFailedRevoke(context)}`, "logout.revoke-failed");
+    return { revoked: false, error: oneLine(`The token was not sent: ${why}`) };
+  }
+  const provider = new OpenIdProvider({
+    authHost: saved.auth_host,
+    scope: saved.scope ?? resolveScope(args),
+    clientId: saved.client_id
+  });
+  try {
+    await provider.revoke(saved.refresh_token);
+    return { revoked: true };
+  } catch (err) {
+    return { revoked: false, error: await warnRevokeFailed(whose, saved.auth_host, err, context) };
+  }
+}
+function revokeFields(outcome) {
+  return { revoked: outcome.revoked, revokeError: outcome.revoked === false ? outcome.error : null };
+}
+function combineRevokes(outcomes) {
+  const tried = outcomes.filter((o) => o.outcome.revoked !== null);
+  if (tried.length === 0) return { revoked: null };
+  const failed = tried.flatMap((o) => o.outcome.revoked === false ? [`"${o.profile}": ${o.outcome.error}`] : []);
+  return failed.length === 0 ? { revoked: true } : { revoked: false, error: failed.join("; ") };
+}
+function oneLine(text) {
+  return text.replace(/\s*\n\s*/g, " ").trim();
+}
+async function warnRevokeFailed(whose, authHost, err, context) {
+  const answer = await describeRefreshAnswer(err);
+  const message = err instanceof Error ? err.message : String(err);
+  warn(
+    `Could not revoke ${whose} at ${hostLabel(authHost)} ` + (answer === void 0 ? `(${message})` : `(the server answered ${answer})`) + `. ${afterFailedRevoke(context)}`,
+    "logout.revoke-failed"
+  );
+  return oneLine(
+    answer === void 0 ? `${hostLabel(authHost)}: ${message}` : `${hostLabel(authHost)} answered ${answer}`
+  );
+}
+function revocableRecord(file, name, path) {
+  if (!Object.prototype.hasOwnProperty.call(file.profiles, name)) return void 0;
+  const described = describeProfile(file, name, path);
+  if ("record" in described) return described.record.type === "oauth" ? described.record : void 0;
+  return salvageRevocable(file.profiles[name]);
+}
+function salvageRevocable(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const r = raw;
+  const has = (k) => typeof r[k] === "string" && r[k] !== "";
+  if (!has("refresh_token") || !has("client_id") || !has("auth_host")) return void 0;
+  return {
+    type: "oauth",
+    refresh_token: r.refresh_token,
+    client_id: r.client_id,
+    auth_host: r.auth_host,
+    scope: typeof r.scope === "string" ? r.scope : void 0
+  };
+}
+function signInAgain(path, name, record) {
+  const r = typeof record === "object" && record !== null ? record : {};
+  if (r.type === "token" && typeof r.instance_base_url === "string" && typeof r.workspace_id === "number") {
+    return `xanosdk profile add ${shellQuote(name)}${credentialFileFlag(path)} --instance ${shellQuote(r.instance_base_url)} --workspace-id ${r.workspace_id}`;
+  }
+  return loginCommand(name, { path, origin: typeof r.auth_host === "string" ? r.auth_host : void 0 });
+}
+function reportWhatIsLeft(path, removed, left, wasDefault, record) {
+  detail(`Removed profile "${removed}" from ${path}`);
+  const fileFlag = credentialFileFlag(path);
+  if (left.length === 0) {
+    detail(`It was the last profile, so ${path} was removed.`);
+    if (envCredentialVars().length === 0) {
+      detail(`No profiles are left \u2014 run \`${signInAgain(path, removed, record)}\` to sign in again.`);
+    }
+  } else if (wasDefault) {
+    detail(
+      `${path === globalAuthFilePath() ? "This machine has" : `${path} has`} no default now. Signed in as: ${quotedNames(left)} \u2014 set one with \`xanosdk profile set-default ${left.length === 1 ? left[0] : "<name>"}${fileFlag}\`.`
+    );
+  } else {
+    detail(`Still signed in as: ${quotedNames(left)}.`);
+  }
+  noteEnvCredential();
+}
+
+export {
+  runLogoutCommand,
+  confirmDanglingRemoval,
+  revokeProfileSession,
+  revokeFields,
+  combineRevokes,
+  warnRevokeFailed,
+  revocableRecord,
+  salvageRevocable,
+  signInAgain
+};
+//# sourceMappingURL=chunk-ELP2HMXC.js.map

package/dist/chunk-ERVIASGL.js

@@ -0,0 +1,21 @@
+// src/kinds/def-brand.ts
+var DEF_KIND = /* @__PURE__ */ Symbol.for("xanosdk.def.kind");
+function brandDef(def, kind) {
+  if (typeof def !== "object" || def === null) return def;
+  try {
+    Object.defineProperty(def, DEF_KIND, { value: kind, enumerable: false, configurable: true });
+  } catch {
+  }
+  return def;
+}
+function defKindOf(def) {
+  if (typeof def !== "object" || def === null) return void 0;
+  const kind = def[DEF_KIND];
+  return typeof kind === "string" ? kind : void 0;
+}
+
+export {
+  brandDef,
+  defKindOf
+};
+//# sourceMappingURL=chunk-ERVIASGL.js.map