@xano/sdk 1.0.0

package/dist/chunk-ET4Y4XCB.js

@@ -0,0 +1,865 @@
+import {
+  readEphemeralState
+} from "./chunk-5QU2P5CA.js";
+import {
+  OpenIdProvider,
+  addProfileHint,
+  assertHttpsOrigin,
+  assertNoUserinfo,
+  assertSignInOrigin,
+  buildTokenCredential,
+  credentialFileFlag,
+  decodeAudience,
+  dropProfile,
+  envOrigin,
+  globalAuthFilePath,
+  isSafeIdText,
+  localAuthFilePath,
+  loginCommand,
+  loginHint,
+  oauthErrorCode,
+  oauthErrorResponse,
+  profileNames,
+  readCredential,
+  readCredentialFile,
+  readProfile,
+  resolveAuthFilePath,
+  resolveAuthHost,
+  resolveOAuthErrorCode,
+  resolveScope,
+  withCredentialLock,
+  writeCredentialFile,
+  writeOrRemoveCredentialFile
+} from "./chunk-XW6KISBB.js";
+import {
+  registerSecret,
+  tokenTextProblem
+} from "./chunk-AWQ7BQTQ.js";
+import {
+  expandHome,
+  readPathEnvVar
+} from "./chunk-EUUUMY7J.js";
+import {
+  RATE_LIMIT_MAX_WAIT_S,
+  noteResolvedAuth,
+  retryAfterSeconds,
+  serverMessage
+} from "./chunk-YLDALTWZ.js";
+import {
+  POINTER_FILE,
+  findProjectPointer
+} from "./chunk-5FBYXK5P.js";
+import {
+  DEFAULT_PROFILE,
+  ENV_PROFILE,
+  assertValidProfileName,
+  describeProfileSelection,
+  profileSourceLabel,
+  resolveActiveProfile
+} from "./chunk-QXTKSOFI.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import {
+  EXIT_SOURCE_UNRESOLVABLE,
+  UsageError,
+  detail,
+  hostLabel,
+  info,
+  noteRunWarning,
+  quotedNames,
+  safeText,
+  warn
+} from "./chunk-PTHVMXZI.js";
+import {
+  suggest
+} from "./chunk-UTI5G6OJ.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+
+// src/auth/token.ts
+import { existsSync, statSync } from "fs";
+import { dirname, resolve as resolvePath } from "path";
+var EXPIRY_SKEW_MS = 3e4;
+function stampExpiry(raw) {
+  return {
+    access_token: raw.access_token,
+    refresh_token: raw.refresh_token,
+    scope: raw.scope,
+    expires_at: Date.now() + (raw.expires_in ?? 0) * 1e3
+  };
+}
+function refreshAccessToken(authHost, clientId, refreshToken, scope) {
+  const provider = new OpenIdProvider({ authHost, scope: scope ?? "", clientId });
+  return provider.refresh(refreshToken, { scope });
+}
+function isTransientRefreshError(err) {
+  if (oauthErrorCode(err) !== void 0) return false;
+  const res = oauthErrorResponse(err);
+  if (res === void 0) return true;
+  return res.status >= 500 || res.status === 429;
+}
+function unansweredRefresh(failure, err) {
+  const status = oauthErrorResponse(err)?.status;
+  return Object.assign(failure, { exitCode: 8 }, status === void 0 ? {} : { status });
+}
+async function refusedRefreshCredential(err) {
+  const code = await resolveOAuthErrorCode(err);
+  if (code === "invalid_grant") return "token";
+  if (code === "invalid_client" || code === "unauthorized_client") return "client";
+  return void 0;
+}
+async function describeRefreshFailure(err) {
+  const rfc = oauthErrorCode(err);
+  if (rfc !== void 0) {
+    const { status, error_description: description } = err ?? {};
+    const said = typeof description === "string" && description.trim() !== "" ? `: ${description.trim()}` : "";
+    return `the authorization server answered ${typeof status === "number" ? `HTTP ${status} \u2014 ` : ""}${rfc}${said}`;
+  }
+  const answer = await describeRefreshAnswer(err);
+  if (answer !== void 0) return `the authorization server answered ${answer}`;
+  return err instanceof Error ? err.message : String(err);
+}
+async function describeRefreshAnswer(err) {
+  const res = oauthErrorResponse(err);
+  if (res === void 0) return void 0;
+  const parts = [`HTTP ${res.status}`];
+  const code = await resolveOAuthErrorCode(err);
+  if (code !== void 0) parts.push(code);
+  else if (!res.bodyUsed) {
+    try {
+      const said = serverMessage(await res.clone().text());
+      if (said !== void 0) parts.push(said);
+    } catch {
+    }
+  }
+  return parts.join(" \u2014 ");
+}
+async function refreshWithRetry(authHost, clientId, refreshToken, scope) {
+  try {
+    return await refreshAccessToken(authHost, clientId, refreshToken, scope);
+  } catch (err) {
+    if (!isTransientRefreshError(err)) throw err;
+    const status = oauthErrorResponse(err)?.status;
+    if (status === 429) {
+      const wait = refreshRetryAfter(err) ?? 1;
+      if (wait > RATE_LIMIT_MAX_WAIT_S) throw err;
+      detail(`The authorization server is rate limiting (HTTP 429); retrying once in ${wait}s\u2026`);
+      await new Promise((r) => setTimeout(r, wait * 1e3));
+      return await refreshAccessToken(authHost, clientId, refreshToken, scope);
+    }
+    detail(
+      status === void 0 ? `Token refresh hit a network error; retrying once\u2026` : `The authorization server answered HTTP ${status}; retrying once\u2026`
+    );
+    return await refreshAccessToken(authHost, clientId, refreshToken, scope);
+  }
+}
+function retriedNote(err) {
+  return oauthErrorResponse(err)?.status === 429 && (refreshRetryAfter(err) ?? 1) > RATE_LIMIT_MAX_WAIT_S ? "" : ", even after one retry";
+}
+function refreshRetryAfter(err) {
+  return retryAfterSeconds(oauthErrorResponse(err)?.headers?.get?.("retry-after") ?? null);
+}
+function unansweredRefreshCause(err, authHost, fix) {
+  if (oauthErrorResponse(err)?.status === 429) {
+    const wait = refreshRetryAfter(err);
+    return `This is rate limiting, not an auth problem \u2014 ${wait === void 0 ? "wait a moment, then re-run the command" : `wait ${wait}s (its Retry-After), then re-run the command`}. ${fix} would not help.`;
+  }
+  return `This is a server-side error, not an auth problem \u2014 re-run the command. If it persists, ${authHost} is having trouble; ${fix.charAt(0).toLowerCase()}${fix.slice(1)} would not help.`;
+}
+var ENV_INSTANCE = "XANO_INSTANCE_URL";
+var ENV_WORKSPACE = "XANO_WORKSPACE_ID";
+var ENV_META_TOKEN = "XANO_META_TOKEN";
+function readEnvMetaCredential() {
+  const instance = readEnvVar(ENV_INSTANCE);
+  const workspace = readEnvVar(ENV_WORKSPACE);
+  const token = readEnvVar(ENV_META_TOKEN);
+  if (instance === void 0 && workspace === void 0 && token === void 0) return void 0;
+  const missing = [
+    instance === void 0 ? ENV_INSTANCE : void 0,
+    workspace === void 0 ? ENV_WORKSPACE : void 0,
+    token === void 0 ? ENV_META_TOKEN : void 0
+  ].filter((n) => n !== void 0);
+  if (missing.length > 0) {
+    const set = [ENV_INSTANCE, ENV_WORKSPACE, ENV_META_TOKEN].filter((n) => !missing.includes(n));
+    throw new UsageError(
+      `Incomplete meta credential in the environment: ${set.join(", ")} ${set.length === 1 ? "is" : "are"} set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not. All three are required \u2014 check for a misspelled secret name, or unset the rest to use a different credential.`
+    );
+  }
+  try {
+    return buildTokenCredential(
+      {
+        instance,
+        // Parsed here, not in the validator: pass the ORIGINAL string through on a
+        // bad parse so the rejection quotes what was actually set, not `NaN`.
+        workspaceId: isSafeIdText(workspace) ? Number(workspace.trim()) : workspace,
+        token
+      },
+      {
+        at: "in the environment",
+        labels: { instance: ENV_INSTANCE, workspace: ENV_WORKSPACE, token: ENV_META_TOKEN }
+      }
+    );
+  } catch (err) {
+    throw err instanceof UsageError ? err : new UsageError(err instanceof Error ? err.message : String(err));
+  }
+}
+function envMetaCredentialVarsSet() {
+  return [ENV_INSTANCE, ENV_WORKSPACE, ENV_META_TOKEN].filter(
+    (name) => readEnvVar(name) !== void 0
+  );
+}
+function environmentCredentialVars() {
+  const meta = envMetaCredentialVarsSet();
+  const refresh = readEnvVar("XANO_REFRESH_TOKEN") !== void 0;
+  const clientId = readEnvVar("XANO_CLIENT_ID") !== void 0;
+  const vars = refresh ? [...meta, "XANO_REFRESH_TOKEN"] : [...meta];
+  const complete = meta.length === 3 || meta.length === 0 && refresh && clientId;
+  return { vars, complete };
+}
+function noteDisplacedCredentials(args, variable) {
+  const configPath = expandHome(args.authFile) ?? readPathEnvVar("XANO_CONFIG");
+  if (configPath !== void 0 && existsSync(configPath)) {
+    info(
+      args.toProfile !== void 0 ? `Using the ${variable} credential from the environment for this run's sign-in \u2014 \`--to-profile\` still reads ${configPath}.` : `Using the ${variable} credential from the environment \u2014 ignoring ${configPath}.`
+    );
+  }
+  if (variable !== "XANO_REFRESH_TOKEN" && readEnvVar("XANO_REFRESH_TOKEN") !== void 0) {
+    info(`Using the ${variable} credential from the environment \u2014 ignoring XANO_REFRESH_TOKEN.`);
+  }
+  const profile = readEnvVar(ENV_PROFILE);
+  if (profile !== void 0) {
+    info(`Using the ${variable} credential from the environment \u2014 ignoring ${ENV_PROFILE}=${profile.trim()}.`);
+  }
+  const pin = pinnedProfile();
+  if (pin !== void 0) {
+    const message = `Using the ${variable} credential from the environment \u2014 ignoring ${pin.path}, which pins this project to profile "${pin.profile}".`;
+    info(message);
+    noteRunWarning("credential.env-overrides-pin", message);
+  }
+}
+function pinnedProfile() {
+  try {
+    return findProjectPointer(process.cwd());
+  } catch {
+    return void 0;
+  }
+}
+function storedProfile(args) {
+  try {
+    const path = resolveAuthFilePath(args);
+    const file = readCredentialFile(path);
+    const selection = resolveActiveProfile({
+      flag: args.profile,
+      fileDefault: file?.default,
+      readPointer: () => findProjectPointer(process.cwd())?.profile
+    });
+    const raw = file?.profiles[selection.name];
+    const kind = raw === void 0 ? "none" : raw.type === "token" || raw.type === "oauth" ? raw.type : "unknown";
+    return { name: selection.name, path, kind };
+  } catch {
+    return void 0;
+  }
+}
+function refuseUnusedOrigin(args, envMeta) {
+  const typed = args.authHost;
+  try {
+    assertNoUserinfo(typed, "`--origin`");
+  } catch (err) {
+    throw new UsageError(err instanceof Error ? err.message : String(err));
+  }
+  const lead = "`--origin` selects the OAuth host a sign-in (`login`) goes to and the one XANO_REFRESH_TOKEN is exchanged at, and this run does neither: ";
+  if (envMeta !== void 0) {
+    throw new UsageError(`${lead}it uses XANO_META_TOKEN, which never refreshes. Drop \`--origin\`.`);
+  }
+  const stored = storedProfile(args);
+  if (stored?.kind === "token") {
+    throw new UsageError(
+      `${lead}it uses a stored meta API token profile, which has no sign-in server and never refreshes. Drop \`--origin\`.`
+    );
+  }
+  const name = stored?.name ?? DEFAULT_PROFILE;
+  const target = { path: stored?.path, origin: typed };
+  let unusable;
+  try {
+    assertSignInOrigin(typed, "`--origin`");
+  } catch (err) {
+    unusable = err instanceof Error ? err.message : String(err);
+  }
+  if (stored?.kind === "none") {
+    throw new UsageError(
+      `${lead}no XANO_REFRESH_TOKEN is set, and no profile "${name}" is stored in ${stored.path}. ` + (unusable === void 0 ? `Drop \`--origin\`, or sign in through that server with \`${loginCommand(name, target)}\`.` : `Drop \`--origin\` \u2014 it could not be a sign-in server either: ${unusable}`)
+    );
+  }
+  throw new UsageError(
+    `${lead}it uses a stored profile, which refreshes at the sign-in server recorded with it. ` + (unusable === void 0 ? `Drop \`--origin\`; to change that profile's sign-in server, run \`${loginCommand(name, target, ["--force"])}\`.` : `Drop \`--origin\` \u2014 it could not be that profile's sign-in server either: ${unusable}`)
+  );
+}
+async function getAccessToken(args) {
+  const auth = await resolveAccessToken(args);
+  registerSecret(auth.access_token);
+  noteResolvedAuth(auth, args);
+  return auth;
+}
+async function resolveAccessToken(args) {
+  const envMeta = readEnvMetaCredential();
+  if (args.authHost !== void 0 && (envMeta !== void 0 || readEnvVar("XANO_REFRESH_TOKEN") === void 0)) {
+    refuseUnusedOrigin(args, envMeta);
+  }
+  if (envMeta) {
+    assertHttpsOrigin(envMeta.instance_base_url, ENV_INSTANCE);
+    refuseProfileDisplacedByEnv(args, ENV_META_TOKEN);
+    noteDisplacedCredentials(args, ENV_META_TOKEN);
+    return {
+      access_token: envMeta.meta_api_token,
+      instance: envMeta.instance_base_url,
+      workspaceId: envMeta.workspace_id,
+      credentialType: "token"
+    };
+  }
+  const envRefresh = readEnvVar("XANO_REFRESH_TOKEN");
+  if (envRefresh) {
+    registerSecret(envRefresh);
+    const malformed = tokenTextProblem(envRefresh.trim());
+    if (malformed !== void 0) {
+      throw new UsageError(
+        `XANO_REFRESH_TOKEN ${malformed}, which no request can carry. Set it to the refresh token alone \u2014 one line, nothing else.`
+      );
+    }
+    refuseProfileDisplacedByEnv(args, "XANO_REFRESH_TOKEN");
+    noteDisplacedCredentials(args, "XANO_REFRESH_TOKEN");
+    const authHost = resolveAuthHost(args);
+    try {
+      assertSignInOrigin(authHost, args.authHost === void 0 ? "XANO_ORIGIN" : "--origin");
+    } catch (err) {
+      throw new UsageError(err instanceof Error ? err.message : String(err));
+    }
+    const clientId = readEnvVar("XANO_CLIENT_ID");
+    if (!clientId) {
+      const searched = oauthSearchPaths(args);
+      const stored = storedOAuthProfiles(searched);
+      throw new UsageError(
+        `XANO_REFRESH_TOKEN is set but XANO_CLIENT_ID is not. A refresh token can only be exchanged by the client that minted it` + (stored.length > 0 ? ` \u2014 copy both values from the OAuth profile it came from (${stored.join("; ")}): its "refresh_token" and "client_id" fields.` : `, and no OAuth profile is stored here to copy one from (${searched.join(", ")}). Set XANO_CLIENT_ID to the "client_id" stored beside that refresh token where \`xanosdk login\` wrote it \u2014 or run \`xanosdk login\` to sign in and store a pair.`)
+      );
+    }
+    let set;
+    try {
+      set = await refreshWithRetry(authHost, clientId, envRefresh, resolveScope(args));
+    } catch (err) {
+      if (isTransientRefreshError(err)) {
+        const answer = await describeRefreshAnswer(err);
+        const message2 = await describeRefreshFailure(err);
+        throw unansweredRefresh(new Error(
+          answer === void 0 ? `XANO_REFRESH_TOKEN exchange could not reach the authorization server (${message2}), even after one retry. This is a transient network error, not an auth problem \u2014 re-run the command. If it persists, check connectivity to ${authHost}.` : `XANO_REFRESH_TOKEN exchange failed: the authorization server answered ${answer}${retriedNote(err)}. ` + unansweredRefreshCause(err, authHost, "Minting a new refresh token")
+        ), err);
+      }
+      const failure = `XANO_REFRESH_TOKEN exchange failed: ${await describeRefreshFailure(err)}`;
+      const mint = loginCommand(DEFAULT_PROFILE, { origin: authHost }, ["--force"]);
+      const refused = await refusedRefreshCredential(err);
+      const rejected = (message2) => credentialRejected(new Error(message2), {
+        profile: null,
+        credentialType: "oauth-refresh",
+        instance: null,
+        workspaceId: null,
+        signIn: null
+      });
+      if (refused === "client") {
+        throw rejected(
+          `${failure}
+XANO_CLIENT_ID is not a client the authorization server accepts for XANO_REFRESH_TOKEN \u2014 set both from the same OAuth profile (its "client_id" and "refresh_token" fields), or unset both to use a stored profile.`
+        );
+      }
+      const message = `${failure}
+The refresh token may be expired or already spent \u2014 refresh tokens rotate on use, so a single stored value is consumed on first exchange. Replace XANO_REFRESH_TOKEN (with the XANO_CLIENT_ID stored beside it), or unset both to use a stored profile. Mint a fresh one via \`${mint}\`.`;
+      throw refused === "token" ? rejected(message) : new Error(message);
+    }
+    const instance = decodeAudience(set.access_token);
+    if (!instance) {
+      throw new Error(
+        `Could not determine the target instance from the token minted by XANO_REFRESH_TOKEN (no readable \`aud\` claim). Mint a fresh refresh token via \`${loginCommand(DEFAULT_PROFILE, { origin: authHost }, ["--force"])}\`.`
+      );
+    }
+    assertHttpsOrigin(instance, "instance");
+    const { resolveScopedWorkspaceId } = await import("./workspace-2CLHU2LK.js");
+    const workspaceId = await resolveScopedWorkspaceId({ access_token: set.access_token, instance });
+    return { access_token: set.access_token, instance, workspaceId, credentialType: "oauth-refresh" };
+  }
+  const authFilePath = resolveAuthFilePath(args);
+  const file = readCredentialFile(authFilePath);
+  const { selection, pin } = resolveProfile(args, file, authFilePath);
+  const saved = file === null ? null : readProfile(file, selection.name, authFilePath);
+  if (!saved) {
+    throw notSignedIn(authFilePath, file, selection, args.authHost ?? envOrigin(), pin);
+  }
+  warnIfReadableByOthers(authFilePath);
+  warnIfLocalShadowsGlobal(args, authFilePath, saved, selection);
+  await warnIfUnpinnedMachineDefault(file, selection, pin, saved, authFilePath);
+  return fromStoredProfile(authFilePath, selection, saved);
+}
+async function resolveNamedProfile(name, args, flag = "--to-profile") {
+  try {
+    assertValidProfileName(name, flag);
+  } catch (err) {
+    throw new UsageError(err instanceof Error ? err.message : String(err));
+  }
+  const selection = { name, source: "flag", flag };
+  const authFilePath = resolveAuthFilePath(args);
+  const file = readCredentialFile(authFilePath);
+  const saved = file === null ? null : readProfile(file, name, authFilePath);
+  if (!saved) {
+    const available = file === null ? [] : profileNames(file);
+    const have = available.length === 0 ? `Nothing is signed in there.` : `Stored profiles there: ${quotedNames(available)}.`;
+    throw new ProfileNotFoundError(
+      `\`${flag} ${name}\` names no stored credential profile in ${authFilePath}. ${have} Run ${addProfileHint(name, { path: authFilePath })} to add it.`
+    );
+  }
+  warnIfReadableByOthers(authFilePath);
+  warnIfLocalShadowsGlobal(args, authFilePath, saved, selection);
+  return fromStoredProfile(authFilePath, selection, saved);
+}
+async function fromStoredProfile(authFilePath, selection, saved) {
+  if (saved.type === "token") {
+    assertHttpsOrigin(saved.instance_base_url, "instance_base_url");
+    return {
+      access_token: saved.meta_api_token,
+      instance: saved.instance_base_url,
+      workspaceId: saved.workspace_id,
+      credentialType: "token",
+      profile: selection
+    };
+  }
+  const instance = saved.instance;
+  assertStoredInstance(instance, authFilePath, selection);
+  if (Date.now() < saved.expires_at - EXPIRY_SKEW_MS) {
+    return {
+      access_token: saved.access_token,
+      instance,
+      workspaceId: saved.workspace_id,
+      credentialType: "oauth",
+      profile: selection
+    };
+  }
+  return refreshUnderLock(authFilePath, selection, saved);
+}
+function assertStoredInstance(instance, authFilePath, selection) {
+  try {
+    assertHttpsOrigin(instance, `The instance stored for profile "${selection.name}" in ${authFilePath}`);
+  } catch (err) {
+    const fix = loginCommand(selection.name, { path: authFilePath }, ["--force"]);
+    throw new StoredCredentialError(
+      `${err instanceof Error ? err.message : String(err)} Nothing was sent. Run \`${fix}\` to sign in again and replace the record.`,
+      selection,
+      instance,
+      fix,
+      { cause: err }
+    );
+  }
+}
+function resolveProfile(args, file, path) {
+  let pin;
+  let walked = false;
+  const readPin = () => {
+    if (!walked) {
+      walked = true;
+      pin = findProjectPointer(process.cwd());
+    }
+    return pin;
+  };
+  const selection = resolveActiveProfile({
+    flag: args.profile,
+    fileDefault: file?.default,
+    defaultIn: path === globalAuthFilePath() ? void 0 : path,
+    readPointer: () => readPin()?.profile
+  });
+  if (selection.source === "flag") {
+    let overridden;
+    try {
+      overridden = readPin();
+    } catch {
+      overridden = void 0;
+    }
+    if (overridden !== void 0 && overridden.profile !== selection.name) {
+      info(
+        `\`--profile ${selection.name}\` overrides ${overridden.path}, which pins this project to profile "${overridden.profile}".`
+      );
+    }
+  } else if (selection.source === "pointer") {
+    const env = readEnvVar(ENV_PROFILE)?.trim();
+    if (env !== void 0 && env !== selection.name && pin !== void 0) {
+      info(
+        `${pin.path} pins this project to profile "${selection.name}" \u2014 ignoring ${ENV_PROFILE}=${env}.`
+      );
+    }
+  }
+  return { selection, pin };
+}
+async function warnIfUnpinnedMachineDefault(file, selection, pin, saved, path) {
+  if (pin !== void 0) return;
+  if (selection.source !== "file-default" && selection.source !== "implicit") return;
+  const stored = file === null ? [] : profileNames(file);
+  if (stored.length < 2) return;
+  const { projectDirFrom } = await import("./xanosdk-project-S6DXJONQ.js");
+  if (projectDirFrom(process.cwd()) === void 0) return;
+  const target = targetOf(saved);
+  credentialWarning(
+    "credential.unpinned-profile",
+    `This project has no ${POINTER_FILE}, so this run acts as ${describeProfileSelection(selection)} \u2014 ${hostLabel(target.instance)}, workspace ${target.workspaceId}. ${stored.length} profiles are stored on this machine.`,
+    `Run \`xanosdk profile use ${selection.name}${credentialFileFlag(path)}\` to pin this project to that profile, or name another with \`--profile\`.`
+  );
+}
+var warnedReadable = /* @__PURE__ */ new Set();
+function warnIfReadableByOthers(path) {
+  if (process.platform === "win32" || warnedReadable.has(path)) return;
+  let mode;
+  try {
+    mode = statSync(path).mode;
+  } catch {
+    return;
+  }
+  if ((mode & 63) === 0) return;
+  warnedReadable.add(path);
+  credentialWarning(
+    "credential.readable-file",
+    `${path} can be read by other users of this machine, and it holds your Xano credentials.`,
+    `Run \`chmod 600 ${shellQuote(path)}\` to make it readable by you alone.`
+  );
+}
+function credentialWarning(code, message, remedy) {
+  warn(message, code, remedy === void 0 ? [] : [remedy]);
+}
+function refuseProfileDisplacedByEnv(args, variable) {
+  if (args.profile !== void 0) {
+    const { vars } = environmentCredentialVars();
+    const authFilePath = resolveAuthFilePath(args, "read");
+    let file = null;
+    try {
+      file = readCredentialFile(authFilePath);
+    } catch {
+    }
+    const stored = file === null ? [] : profileNames(file);
+    if (!stored.includes(args.profile)) {
+      const have = stored.length === 0 ? `Nothing is signed in there.` : `Stored profiles there: ${quotedNames(stored)}.`;
+      throw new ProfileNotFoundError(
+        `\`--profile ${args.profile}\` names no stored credential profile in ${authFilePath}. ${have} Run ${addProfileHint(args.profile, { path: authFilePath })} to add it \u2014 and \`unset ${vars.join(" ")}\` to act as it, since ${variable} in this environment outranks the credential file.`
+      );
+    }
+    throw new UsageError(
+      `\`--profile ${args.profile}\` selects a stored credential, but ${variable} is set in this environment and outranks the credential file \u2014 there is no profile for it to select. Run \`unset ${vars.join(" ")}\` to act as profile "${args.profile}", or drop \`--profile\` to use the environment credential.`
+    );
+  }
+}
+function storedOAuthProfiles(paths) {
+  const found = [];
+  for (const path of [...new Set(paths)]) {
+    try {
+      const file = readCredentialFile(path);
+      if (file === null) continue;
+      for (const name of profileNames(file)) {
+        if (file.profiles[name]?.type === "oauth") found.push(`profile "${name}" in ${path}`);
+      }
+    } catch {
+    }
+  }
+  return found;
+}
+function oauthSearchPaths(args) {
+  let resolved;
+  try {
+    resolved = resolveAuthFilePath(args);
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([...resolved !== void 0 ? [resolved] : [], globalAuthFilePath(), localAuthFilePath()])];
+}
+var NotSignedInError = class extends Error {
+  name = "NotSignedInError";
+  /**
+   * The profile that was asked for by NAME and is not stored — set when other
+   * profiles are, or when a flag, `$XANO_PROFILE` or a pin named it, so the
+   * absence is a wrong name rather than a machine nobody has signed in on
+   * without choosing anything. `status` reads it to refuse rather than answer
+   * "not signed in" about a profile someone (or a pointer) chose.
+   */
+  missingProfile;
+  /**
+   * The profiles the file DOES hold — empty on a machine nobody signed in on.
+   * `status` reads it to name `profile set-default` rather than `login` when
+   * only the default is missing.
+   */
+  storedProfiles;
+  constructor(message, missingProfile, storedProfiles = []) {
+    super(message);
+    if (missingProfile !== void 0) this.missingProfile = missingProfile;
+    this.storedProfiles = storedProfiles;
+  }
+};
+var ProfileNotFoundError = class extends NotSignedInError {
+  name = "ProfileNotFoundError";
+  exitCode = EXIT_SOURCE_UNRESOLVABLE;
+};
+var StoredCredentialError = class extends Error {
+  constructor(message, profile, instance, fix, options) {
+    super(message, options);
+    this.profile = profile;
+    this.instance = instance;
+    this.fix = fix;
+  }
+  profile;
+  instance;
+  fix;
+  name = "StoredCredentialError";
+};
+function credentialRejected(err, details) {
+  return Object.assign(err, { code: "SDK_CREDENTIAL_REJECTED", details });
+}
+function recordedTargetFor(pin, name) {
+  if (pin === void 0) return {};
+  const keyed = Object.entries(readEphemeralState(dirname(pin.path)).environments).filter(
+    ([key]) => key.startsWith(`${name}/`) && key.split("/").length >= 3
+  );
+  const targets = new Map(
+    keyed.map(([key, record]) => {
+      const instance = record.instance ?? `https://${key.split("/").slice(1, -1).join("/")}`;
+      const workspaceId = key.slice(key.lastIndexOf("/") + 1);
+      return [`${instance} ${workspaceId}`, { instance, workspaceId }];
+    })
+  );
+  return targets.size === 1 ? [...targets.values()][0] : {};
+}
+function notSignedIn(path, file, selection, origin, pin) {
+  const available = file === null ? [] : profileNames(file);
+  const target = {
+    path,
+    ...origin !== void 0 ? { origin } : {},
+    ...selection.source === "pointer" ? recordedTargetFor(pin, selection.name) : {}
+  };
+  const named = selection.source === "flag" || selection.source === "env" || selection.source === "pointer";
+  if (available.length === 0 && named) {
+    return new ProfileNotFoundError(
+      `No credential profile "${selection.name}" (${profileSourceLabel(selection.source)}) \u2014 no profile is stored at ${path}.
+Run ${addProfileHint(selection.name, target)} to add it.`,
+      selection,
+      available
+    );
+  }
+  if (available.length === 0) {
+    return new NotSignedInError(
+      `Not signed in (no credential at ${path}). Run \`${loginCommand(DEFAULT_PROFILE, target)}\` to sign in, or store a meta API token with \`xanosdk profile add <name>${credentialFileFlag(path)} --instance <url> --workspace-id <id>\`. For CI, set XANO_INSTANCE_URL, XANO_WORKSPACE_ID and XANO_META_TOKEN together.`
+    );
+  }
+  const have = `Stored profiles: ${quotedNames(available)}.`;
+  const shared = shadowedInShared(path, selection.name);
+  if (shared !== void 0) {
+    return new ProfileNotFoundError(
+      `Profile "${selection.name}" (${profileSourceLabel(selection.source)}) is stored in this machine's shared credential file (${shared}), but this project's ${path} is read instead and does not hold it. ${have}
+Use the shared one with \`--config ${shellQuote(shared)}\`, remove ${path} so commands here fall back to it, or add the profile here: ${addProfileHint(selection.name, target)}.`,
+      selection,
+      available
+    );
+  }
+  if (selection.source === "pointer") {
+    const near2 = suggest(selection.name, available);
+    const err2 = new ProfileNotFoundError(
+      `This project's xano.profile.json names profile "${selection.name}", which is not signed in on this machine (${path}). ${have}` + (near2 === void 0 ? "" : ` Did you mean "${safeText(near2)}"? Run \`xanosdk profile use ${shellQuote(near2)}${credentialFileFlag(path)}\` to pin it.`) + `
+Run ${addProfileHint(selection.name, target)} to sign in as it, or \`xanosdk profile use <name>${credentialFileFlag(path)}\` to point this project at one you have.`,
+      selection,
+      available
+    );
+    if (near2 !== void 0) Object.defineProperty(err2, "suggestion", { value: near2, enumerable: true });
+    return err2;
+  }
+  const unchosen = selection.source === "file-default" || selection.source === "implicit";
+  if (unchosen) {
+    const one = available.length === 1;
+    return new ProfileNotFoundError(
+      `No default profile to use: ${path} holds no profile "${selection.name}". ${have} Run \`xanosdk profile set-default ${one ? shellQuote(available[0]) : "<name>"}${credentialFileFlag(path)}\` to make ${one ? "it" : "one of them"} the default, or ${addProfileHint(selection.name, target)} to add "${selection.name}".`,
+      selection,
+      available
+    );
+  }
+  const near = suggest(selection.name, available);
+  const retype = near === void 0 ? "" : ` Did you mean "${safeText(near)}"? ${selection.source === "env" ? `Set XANO_PROFILE=${shellQuote(near)}` : `Pass \`--profile ${shellQuote(near)}\``} instead.`;
+  const err = new ProfileNotFoundError(
+    `No credential profile "${selection.name}" in ${path} (${profileSourceLabel(selection.source)}). ${have}${retype} Run ${addProfileHint(selection.name, target)} to add it.`,
+    selection,
+    available
+  );
+  if (near !== void 0) Object.defineProperty(err, "suggestion", { value: near, enumerable: true });
+  return err;
+}
+function shadowedInShared(path, name) {
+  if (resolvePath(path) !== localAuthFilePath()) return void 0;
+  const shared = globalAuthFilePath();
+  try {
+    const file = readCredentialFile(shared);
+    return file !== null && Object.prototype.hasOwnProperty.call(file.profiles, name) ? shared : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function targetOf(credential) {
+  return credential.type === "token" ? { instance: credential.instance_base_url, workspaceId: credential.workspace_id } : { instance: credential.instance, workspaceId: credential.workspace_id };
+}
+function warnIfLocalShadowsGlobal(args, resolved, saved, selection) {
+  const isDefaultResolution = args.authFile === void 0 && readPathEnvVar("XANO_CONFIG") === void 0 && !args.local;
+  if (!isDefaultResolution || resolved !== localAuthFilePath()) return;
+  const globalPath = globalAuthFilePath();
+  if (globalPath === resolved) return;
+  let globalSaved = null;
+  try {
+    globalSaved = readCredential(globalPath, selection.name);
+  } catch {
+    return;
+  }
+  if (!globalSaved) return;
+  const here = targetOf(saved);
+  const there = targetOf(globalSaved);
+  if (here.instance === there.instance && here.workspaceId === there.workspaceId) return;
+  credentialWarning(
+    "credential.shadowed-global",
+    `Using project-local ${resolved}, ${describeProfileSelection(selection)} (${hostLabel(here.instance)}, workspace ${here.workspaceId}), but a global credential for ${hostLabel(there.instance)}, workspace ${there.workspaceId} also exists under the same profile name \u2014 the local one wins. Remove ./.xano/auth.json (or pass --config) to use the global credential instead.`
+  );
+}
+async function refreshUnderLock(authFilePath, selection, saved) {
+  const profile = selection.name;
+  return withCredentialLock(authFilePath, async (file) => {
+    const current = rereadOAuthProfile(file, profile, authFilePath, saved);
+    const instance = current.instance;
+    const workspaceId = current.workspace_id;
+    if (Date.now() < current.expires_at - EXPIRY_SKEW_MS) {
+      return {
+        access_token: current.access_token,
+        instance,
+        workspaceId,
+        credentialType: "oauth",
+        profile: selection
+      };
+    }
+    const target = { path: authFilePath, origin: current.auth_host };
+    const login = (force = false) => loginCommand(profile, target, force ? ["--force"] : []);
+    const unusable = (message, fix, cause) => new StoredCredentialError(message, selection, instance, fix, { cause });
+    if (!current.refresh_token) {
+      throw unusable(
+        `No usable access token for ${instance} and no refresh token is cached. Run \`${login()}\` again.`,
+        login()
+      );
+    }
+    try {
+      assertStoredAuthHost(current.auth_host, profile, authFilePath);
+    } catch (err) {
+      const fix = loginCommand(profile, { path: authFilePath }, ["--force"]);
+      throw unusable(err instanceof Error ? err.message : String(err), fix, err);
+    }
+    detail(`Refreshing access token for ${hostLabel(instance)}\u2026`);
+    let set;
+    try {
+      set = await refreshWithRetry(current.auth_host, current.client_id, current.refresh_token, current.scope);
+    } catch (err) {
+      const message = await describeRefreshFailure(err);
+      const refused = await refusedRefreshCredential(err);
+      if (refused === "token") {
+        const removedFile = writeOrRemoveCredentialFile(authFilePath, dropProfile(file, profile));
+        const relogin = login();
+        throw credentialRejected(
+          unusable(
+            `Session for profile "${profile}" (${instance}) has expired or was revoked (the refresh token was rejected), so the profile was removed from ${authFilePath}${removedFile ? " \u2014 it was the last one, so the file went with it" : ""}. Run \`${relogin}\` to sign in again.`,
+            relogin
+          ),
+          { profile, credentialType: "oauth", instance, workspaceId, signIn: relogin }
+        );
+      }
+      if (isTransientRefreshError(err)) {
+        const answer = await describeRefreshAnswer(err);
+        throw unansweredRefresh(unusable(
+          answer === void 0 ? `Token refresh for ${instance} could not reach the authorization server (${message}), even after one retry. This is a transient network error, not an auth problem \u2014 re-run the command. If it persists, check connectivity to ${current.auth_host}.` : `Token refresh for ${instance} failed: the authorization server answered ${answer}${retriedNote(err)}. ` + unansweredRefreshCause(err, current.auth_host, "Signing in again"),
+          null,
+          err
+        ), err);
+      }
+      const failed = unusable(
+        `Token refresh failed for ${instance}: ${message}
+Run \`${login()}\` to sign in again.`,
+        login(),
+        err
+      );
+      throw refused === "client" ? credentialRejected(failed, { profile, credentialType: "oauth", instance, workspaceId, signIn: login() }) : failed;
+    }
+    const stamped = stampExpiry(set);
+    file.profiles[profile] = {
+      ...current,
+      access_token: stamped.access_token,
+      refresh_token: stamped.refresh_token ?? current.refresh_token,
+      expires_at: stamped.expires_at,
+      scope: stamped.scope ?? current.scope
+    };
+    writeCredentialFile(authFilePath, file);
+    return {
+      access_token: stamped.access_token,
+      instance,
+      workspaceId,
+      credentialType: "oauth",
+      profile: selection
+    };
+  });
+}
+function assertStoredAuthHost(authHost, profile, authFilePath) {
+  try {
+    assertHttpsOrigin(
+      authHost,
+      `The sign-in server (\`auth_host\`) stored for profile "${profile}"${authFilePath === void 0 ? "" : ` in ${authFilePath}`}`
+    );
+  } catch (err) {
+    throw new Error(
+      `${err instanceof Error ? err.message : String(err)} The refresh token was not sent. Run \`${loginCommand(profile, { path: authFilePath }, ["--force"])}\` to sign in again and replace the record.`,
+      { cause: err }
+    );
+  }
+}
+function rereadOAuthProfile(file, profile, path, saved) {
+  let current;
+  try {
+    current = readProfile(file, profile, path);
+  } catch {
+    current = null;
+  }
+  if (current === null) {
+    throw new Error(
+      `Profile "${profile}" was removed from ${path} while its token was being refreshed. Nothing was written. Run ${loginHint(profile, { path, origin: saved.auth_host })} to sign in again.`
+    );
+  }
+  if (current.type !== "oauth") {
+    throw new Error(
+      `Profile "${profile}" in ${path} was replaced with a hand-authored meta API token while its OAuth token was being refreshed. Nothing was written \u2014 re-run the command to use it.`
+    );
+  }
+  if (current.instance !== saved.instance || current.workspace_id !== saved.workspace_id) {
+    throw new Error(
+      `Profile "${profile}" in ${path} was repointed from ${hostLabel(saved.instance)} workspace ${saved.workspace_id} to ${hostLabel(current.instance)} workspace ${current.workspace_id} while its token was being refreshed. Nothing was written \u2014 re-run the command.`
+    );
+  }
+  return current;
+}
+
+export {
+  isTransientRefreshError,
+  refusedRefreshCredential,
+  describeRefreshFailure,
+  describeRefreshAnswer,
+  ENV_INSTANCE,
+  ENV_WORKSPACE,
+  ENV_META_TOKEN,
+  readEnvMetaCredential,
+  envMetaCredentialVarsSet,
+  environmentCredentialVars,
+  getAccessToken,
+  resolveNamedProfile,
+  warnIfReadableByOthers,
+  credentialWarning,
+  NotSignedInError,
+  ProfileNotFoundError,
+  StoredCredentialError,
+  credentialRejected,
+  notSignedIn,
+  assertStoredAuthHost
+};
+//# sourceMappingURL=chunk-ET4Y4XCB.js.map