@xano/sdk 1.0.0

package/dist/chunk-LQCMKAJ7.js

@@ -0,0 +1,413 @@
+import {
+  findNonJson,
+  nonJsonMessage
+} from "./chunk-H2V3N23D.js";
+import {
+  resolveDocumentationTokens
+} from "./chunk-3JDU4VRL.js";
+import {
+  appNamesByGuid,
+  displayLockKey,
+  lockNameForObject,
+  sdkKindName
+} from "./chunk-6MR5TI5V.js";
+import {
+  rawDeriveGuid
+} from "./chunk-NZOWWHU5.js";
+import {
+  sha1Bytes
+} from "./chunk-OHX6MIUZ.js";
+
+// src/workspace/export.ts
+var BUNDLE_APP = "xano";
+var BUNDLE_VERSION_JSON = "1.03";
+var PAYLOAD_ARRAY_KEYS = [
+  "dbo",
+  "addon",
+  "function",
+  "middleware",
+  "trigger",
+  "task",
+  "query",
+  "tool",
+  // MCP prompts and resources: after `tool` and before `toolset`, because an MCP
+  // server resolves its `prompts`/`resources` references by guid on import.
+  "prompt",
+  "resource",
+  "toolset",
+  "app",
+  // Prose an agent reads, not an object anything resolves — it references
+  // nothing and nothing references it, so its position is arbitrary.
+  "knowledge",
+  // A knowledge item's reference files. A CHILD section, not a kind of its own:
+  // each row names its parent by guid, so knowledge must precede it.
+  "knowledge_file",
+  // Realtime, in dependency order: a channel resolves its server, and a message
+  // resolves both. They sit after `app` so every object they can reference
+  // (tables for auth, api groups) is already in place.
+  "realtime_server",
+  "channel",
+  "message",
+  // A container workload. Independent of every other object — nothing
+  // references it and it references nothing — so its position is arbitrary.
+  "microservice",
+  "vault",
+  "market_item",
+  "run_install",
+  "action_package_install",
+  "env",
+  "workflow_test",
+  "service",
+  "branch"
+];
+function phpEncodeString(str) {
+  let out = '"';
+  for (const ch of str) {
+    const code = ch.codePointAt(0);
+    switch (ch) {
+      case '"':
+        out += "\\u0022";
+        break;
+      // JSON_HEX_QUOT
+      case "\\":
+        out += "\\\\";
+        break;
+      case "<":
+        out += "\\u003C";
+        break;
+      // JSON_HEX_TAG
+      case ">":
+        out += "\\u003E";
+        break;
+      // JSON_HEX_TAG
+      case "&":
+        out += "\\u0026";
+        break;
+      // JSON_HEX_AMP
+      case "'":
+        out += "\\u0027";
+        break;
+      // JSON_HEX_APOS
+      case "\b":
+        out += "\\b";
+        break;
+      case "\f":
+        out += "\\f";
+        break;
+      case "\n":
+        out += "\\n";
+        break;
+      case "\r":
+        out += "\\r";
+        break;
+      case "	":
+        out += "\\t";
+        break;
+      // PHP escapes the two line terminators even under JSON_UNESCAPED_UNICODE
+      // — that flag is not JSON_UNESCAPED_LINE_TERMINATORS, which the engine
+      // does not pass.
+      case "\u2028":
+        out += "\\u2028";
+        break;
+      case "\u2029":
+        out += "\\u2029";
+        break;
+      default:
+        out += code < 32 ? "\\u" + code.toString(16).padStart(4, "0") : ch;
+    }
+  }
+  return out + '"';
+}
+var PHP_INT_MAX = 9223372036854775807n;
+function phpEncodeNumber(value) {
+  if (!Number.isFinite(value)) return "0";
+  const text = JSON.stringify(value);
+  if (!/[.eE]/.test(text)) {
+    const n = BigInt(text);
+    return n > PHP_INT_MAX || n < -PHP_INT_MAX - 1n ? `"${text}"` : text;
+  }
+  const [mantissaText, exponentText] = Math.abs(value).toExponential().split("e");
+  const exponent = Number(exponentText);
+  if (exponent >= -4 && exponent < 17) return text;
+  const digits = mantissaText.replace(".", "").replace(/0+$/, "") || "0";
+  const mantissa = digits.length > 1 ? `${digits[0]}.${digits.slice(1)}` : `${digits}.0`;
+  const sign = exponent < 0 ? "-" : "+";
+  return `${value < 0 ? "-" : ""}${mantissa}e${sign}${Math.abs(exponent)}`;
+}
+function phpJsonEncode(value) {
+  const out = [];
+  const stack = [{ value }];
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if ("lit" in frame) {
+      out.push(frame.lit);
+      continue;
+    }
+    const current = frame.value;
+    if (current === null || current === void 0) {
+      out.push("null");
+      continue;
+    }
+    switch (typeof current) {
+      case "string":
+        out.push(phpEncodeString(current));
+        continue;
+      case "number":
+        out.push(phpEncodeNumber(current));
+        continue;
+      case "boolean":
+        out.push(current ? "true" : "false");
+        continue;
+      case "object":
+        break;
+      default:
+        out.push("null");
+        continue;
+    }
+    if (Array.isArray(current)) {
+      stack.push({ lit: "]" });
+      for (let i = current.length - 1; i >= 0; i--) {
+        stack.push({ value: current[i] });
+        if (i > 0) stack.push({ lit: "," });
+      }
+      stack.push({ lit: "[" });
+      continue;
+    }
+    const obj = current;
+    const keys = Object.keys(obj).filter((key) => obj[key] !== void 0);
+    if (keys.length > 0 && keys.every((key, i) => key === String(i))) {
+      stack.push({ lit: "]" });
+      for (let i = keys.length - 1; i >= 0; i--) {
+        stack.push({ value: obj[keys[i]] });
+        if (i > 0) stack.push({ lit: "," });
+      }
+      stack.push({ lit: "[" });
+      continue;
+    }
+    stack.push({ lit: "}" });
+    for (let i = keys.length - 1; i >= 0; i--) {
+      const key = keys[i];
+      stack.push({ value: obj[key] });
+      stack.push({ lit: phpEncodeString(key) + ":" });
+      if (i > 0) stack.push({ lit: "," });
+    }
+    stack.push({ lit: "{" });
+  }
+  return out.join("");
+}
+function base64websafe(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, ".");
+}
+function calcSignatureJson(exportObj) {
+  const sorted = {};
+  for (const key of Object.keys(exportObj).sort()) {
+    sorted[key] = exportObj[key];
+  }
+  return base64websafe(sha1Bytes(phpJsonEncode(sorted)));
+}
+function signatureHolds(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return false;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+  const { sig, ...unsigned } = parsed;
+  if (sig === void 0) return void 0;
+  if (sig === calcSignatureJson(unsigned)) return true;
+  const members = topLevelMembers(text);
+  if (members === void 0) return false;
+  const body = members.filter((m) => m.key !== "sig").sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map((m) => `${m.rawKey}:${m.rawValue}`).join(",");
+  return sig === base64websafe(sha1Bytes(`{${body}}`));
+}
+function topLevelMembers(text) {
+  const out = [];
+  let i = text.indexOf("{");
+  if (i === -1 || text.slice(0, i).trim() !== "") return void 0;
+  i++;
+  const skipWs = () => {
+    while (i < text.length && /\s/.test(text[i])) i++;
+  };
+  const endOfString = (from) => {
+    let j = from + 1;
+    while (j < text.length && text[j] !== '"') j += text[j] === "\\" ? 2 : 1;
+    return j;
+  };
+  skipWs();
+  if (text[i] === "}") return out;
+  while (i < text.length) {
+    skipWs();
+    if (text[i] !== '"') return void 0;
+    const keyEnd = endOfString(i);
+    const rawKey = text.slice(i, keyEnd + 1);
+    i = keyEnd + 1;
+    skipWs();
+    if (text[i] !== ":") return void 0;
+    i++;
+    skipWs();
+    const start = i;
+    let depth = 0;
+    while (i < text.length) {
+      const ch = text[i];
+      if (ch === '"') i = endOfString(i);
+      else if (ch === "{" || ch === "[") depth++;
+      else if (ch === "}" || ch === "]") {
+        if (depth === 0) break;
+        depth--;
+      } else if (ch === "," && depth === 0) break;
+      i++;
+    }
+    out.push({ key: JSON.parse(rawKey), rawKey, rawValue: text.slice(start, i).trimEnd() });
+    if (text[i] === "}") return out;
+    i++;
+  }
+  return void 0;
+}
+function assertUniqueGuids(payload, lock) {
+  const seen = /* @__PURE__ */ new Map();
+  const appNames = appNamesByGuid(payload.app);
+  for (const key of PAYLOAD_ARRAY_KEYS) {
+    const arr = payload[key];
+    if (!Array.isArray(arr)) continue;
+    for (const obj of arr) {
+      if (!obj || typeof obj !== "object") continue;
+      const guid = obj.guid;
+      if (typeof guid !== "string") continue;
+      const name = obj.name;
+      const shown = typeof name === "string" ? name : "<unnamed>";
+      const label = `${sdkKindName(key, obj)} "${shown}"`;
+      const held = seen.get(guid);
+      const prev = held?.label;
+      if (held !== void 0) {
+        const pinnedBy = lock ? Object.entries(lock.objects).find(([, e]) => e.guid === guid)?.[0] : void 0;
+        const legacyQueryKey = key === "query" && held.key === key && pinnedBy !== void 0 && pinnedBy.startsWith("query:") && !pinnedBy.includes("|") ? pinnedBy : void 0;
+        const lockNote = legacyQueryKey ? legacyQueryNote(legacyQueryKey, guid, [held.obj, obj], appNames, lock) : held.key !== key ? (
+          // Two kinds never derive one guid: one of them pins it (`guid:`) — a
+          // lock entry holding it too is not a rename re-deriving a name's
+          // guid, which only ever collides within a kind (E2E pass 22).
+          ` Two different kinds cannot share one identity, and no name derives another kind's guid \u2014 an explicit \`guid\` set on one of them is the other's` + (pinnedBy ? ` \u2014 lock entry ${shownEntry(pinnedBy)} pins it` : "") + `. Remove the explicit guid, or set the one the object really has.`
+        ) : pinnedBy ? sameKindPinnedNote(key, guid, pinnedBy, [held, { label, obj }], appNames) : (
+          // No guid-pin advice: a lock entry is keyed by name and holds ONE
+          // guid, so two pinned guids under one name refuse at `export --lock`.
+          key === "toolset" ? ` Agents and MCP servers share ONE name space (identity is derived from the name alone, across both kinds). Rename one.` : ` Object identity is derived from (type, name) \u2014 for a query, (api group, verb, name) \u2014 so two objects of the same kind compose the same identity. Rename one.`
+        );
+        const err = new Error(`Duplicate object guid (${guid}) shared by ${prev} and ${label}.` + lockNote);
+        if (held.key !== key) Object.assign(err, { code: "SDK_KIND_CONFLICT", exitCode: 2 });
+        else if (pinnedBy !== void 0) {
+          Object.assign(err, { code: "SDK_IDENTITY_CONFLICT", exitCode: 2, lockEntry: pinnedBy });
+        }
+        throw err;
+      }
+      seen.set(guid, { label, key, obj });
+    }
+  }
+}
+function sameKindPinnedNote(payloadKey, guid, pinnedBy, pair, appNames) {
+  const keyOf = (obj) => {
+    const name = obj.name;
+    return typeof name === "string" ? `${payloadKey}:${lockNameForObject(payloadKey, obj, appNames)}` : void 0;
+  };
+  const rederives = pair.find(({ obj }) => {
+    const k = keyOf(obj);
+    return k !== void 0 && k !== pinnedBy && rawDeriveGuid(k) === guid;
+  });
+  if (rederives !== void 0) {
+    return ` This guid is pinned by lock entry ${shownEntry(pinnedBy)} \u2014 that entry was moved by \`xanosdk lock rename\`, and ${rederives.label} now re-derives the old name's guid. Pin a distinct explicit \`guid\` on ${rederives.label}, or update the lock entry.`;
+  }
+  const other = pair.find(({ obj }) => keyOf(obj) !== pinnedBy);
+  return ` This guid is pinned by lock entry ${shownEntry(pinnedBy)}, and no name derives it for ${other?.label ?? "the other object"} \u2014 an explicit \`guid\` set on it is that entry's. Remove the explicit guid, or set the one the object really has.`;
+}
+function shownEntry(key) {
+  const shown = displayLockKey(key);
+  return shown === key ? `"${key}"` : `"${shown}" (stored as "${key}" in xano.lock)`;
+}
+function legacyQueryNote(legacyKey, guid, claimants, appNames, lock) {
+  const oldName = legacyKey.slice("query:".length);
+  const names = claimants.map((o) => lockNameForObject("query", o, appNames));
+  const landed = /* @__PURE__ */ new Set();
+  for (const record of Object.values(lock?.landed ?? {})) {
+    for (const [k, e] of Object.entries(record)) if (e.guid === guid) landed.add(k);
+  }
+  const existing = names.filter((n) => landed.has(`query:${n}`));
+  const command = (n) => `\`xanosdk lock rename query ${oldName} "${n}"\``;
+  const which = existing.length === 1 ? `"${existing[0]}", which this guid landed as: ${command(existing[0])}` : `the endpoint deployed before the other was added (no landing record says which): ` + names.map(command).join(" or ");
+  return ` Lock entry "${legacyKey}" pins it by NAME ALONE \u2014 a lock written before a query's identity included its api group and verb. Both of these queries claim it. Move it onto the one that already existed \u2014 ${which} (from the project root or the lock's directory; elsewhere add \`--lock=<path>\`), then re-export: that endpoint keeps its identity and the newcomer derives its own.`;
+}
+function buildContentEnvelope(rows) {
+  const unsigned = {
+    app: BUNDLE_APP,
+    version: BUNDLE_VERSION_JSON,
+    type: "content",
+    payload: rows
+  };
+  return { ...unsigned, sig: calcSignatureJson(unsigned) };
+}
+function mergeEnvOverrides(authored, overrides) {
+  if (!overrides || Object.keys(overrides).length === 0) return authored;
+  const list = Array.isArray(authored) ? authored.map((e) => ({ ...e })) : [];
+  const byName = new Map(list.map((e) => [String(e.name), e]));
+  for (const [name, value] of Object.entries(overrides)) {
+    const prior = byName.get(name);
+    if (prior) prior.value = value;
+    else list.push({ name, value, market_item: [] });
+  }
+  return list;
+}
+function assertNoFunctions(payload) {
+  for (const [key, section] of Object.entries(payload)) {
+    for (const obj of Array.isArray(section) ? section : [section]) {
+      const found = findNonJson(obj);
+      if (found === void 0) continue;
+      const name = obj?.name;
+      const owner = `${key} "${typeof name === "string" ? name : "?"}"`;
+      throw new Error(nonJsonMessage(owner, found.path === "" ? owner : `${owner}, at ${found.path}`, found.value));
+    }
+  }
+}
+function buildBundle(args) {
+  const swept = resolveDocumentationTokens({
+    workspace: args.workspace ?? {},
+    apiGroups: args.sections.app,
+    values: {}
+  });
+  const sections = swept.apiGroups === void 0 ? args.sections : { ...args.sections, app: swept.apiGroups };
+  const workspace = swept.workspace;
+  const wsEnv = mergeEnvOverrides(workspace.env, args.envOverrides);
+  const payload = { partial: false, workspace };
+  for (const key of PAYLOAD_ARRAY_KEYS) {
+    payload[key] = sections[key] ?? [];
+  }
+  if (Array.isArray(wsEnv) && wsEnv.length > 0) {
+    payload.env = wsEnv;
+    workspace.env = [];
+  }
+  assertUniqueGuids(payload, args.lock);
+  assertNoFunctions(payload);
+  const unsigned = {
+    app: BUNDLE_APP,
+    version: BUNDLE_VERSION_JSON,
+    type: args.type ?? "workspace",
+    payload,
+    ...args.knowledgeRead === true && knowledgeBodiesAllEmpty(payload) ? { knowledge_read: true } : {}
+  };
+  return { ...unsigned, sig: calcSignatureJson(unsigned) };
+}
+function knowledgeBodiesAllEmpty(payload) {
+  const knowledge = Array.isArray(payload.knowledge) ? payload.knowledge : [];
+  const files = Array.isArray(payload.knowledge_file) ? payload.knowledge_file.length : 0;
+  return knowledge.length > 0 && files === 0 && knowledge.every((k) => k?.content === "");
+}
+
+export {
+  PAYLOAD_ARRAY_KEYS,
+  phpJsonEncode,
+  calcSignatureJson,
+  signatureHolds,
+  buildContentEnvelope,
+  buildBundle,
+  knowledgeBodiesAllEmpty
+};
+//# sourceMappingURL=chunk-LQCMKAJ7.js.map