@xano/sdk 1.0.0

package/dist/chunk-2ZUEE4EK.js

@@ -0,0 +1,408 @@
+import {
+  asTimestamp
+} from "./chunk-2MNLRIOX.js";
+import {
+  explainFetchFailure,
+  fetchOrExplain,
+  fetchReadOrExplain,
+  parseJsonAnswer,
+  retryingFetch,
+  safeHttpFailure,
+  statusLabel,
+  writeStatusAftermath
+} from "./chunk-YLDALTWZ.js";
+
+// src/deploy/release.ts
+var TIMEOUT_MS = 3e4;
+var ReleaseHttpError = class extends Error {
+  constructor(status, action, statusText, body, bind, aftermath) {
+    const head = safeHttpFailure(action, { status, statusText }, body, bind);
+    super(aftermath === void 0 ? head : `${head}
+${aftermath}`);
+    this.status = status;
+    this.name = "ReleaseHttpError";
+  }
+  status;
+};
+var DEPLOY_TIMEOUT_MS = 6e5;
+var ORIGIN_MARKER = "[xanosdk] cut from";
+var COPY_MARKER = "[xanosdk] copied from";
+var RESERVED_DESCRIPTION_PREFIX = "[xanosdk]";
+var ORIGIN_LINE = /(?:^|\n\n)\[xanosdk\] cut from ([a-z]+) "([^"\n]+)"\s*$/;
+var CUT_LINE = /^\[xanosdk\] cut from ([a-z]+) "([^"\n]+)"$/;
+var COPY_LINE = /^\[xanosdk\] copied from release ("(?:[^"\\\n]|\\.)*") of workspace (\d+) on ([^\s"]+)$/;
+function reservedDescriptionLine(description) {
+  return description.split(/\r?\n|\r/).find((l) => l.trimStart().startsWith(RESERVED_DESCRIPTION_PREFIX));
+}
+function describeWithOrigin(description, origin) {
+  const line = `${ORIGIN_MARKER} ${origin.type} ${JSON.stringify(origin.name)}`;
+  return description === void 0 || description === "" ? line : `${description}
+
+${line}`;
+}
+function describeAsCopy(description, copied) {
+  const { host, workspaceId, release } = copied.source;
+  const lines = [
+    ...copied.cut === void 0 ? [] : [`${ORIGIN_MARKER} ${copied.cut.type} ${JSON.stringify(copied.cut.name)}`],
+    `${COPY_MARKER} release ${JSON.stringify(release)} of workspace ${workspaceId} on ${host}`
+  ].join("\n");
+  return description === void 0 || description === "" ? lines : `${description}
+
+${lines}`;
+}
+function splitRecordedOrigin(description) {
+  if (description === void 0) return { description };
+  const m = ORIGIN_LINE.exec(description);
+  if (m === null || m[1] === "branch") return { description };
+  return { description: description.slice(0, m.index), origin: { type: m[1], name: m[2] } };
+}
+function splitCopiedFrom(description) {
+  if (description === void 0) return { description };
+  const lines = description.replace(/\s+$/, "").split("\n");
+  const copy = COPY_LINE.exec(lines[lines.length - 1] ?? "");
+  if (copy === null) return { description };
+  let release;
+  try {
+    release = JSON.parse(copy[1]);
+  } catch {
+    return { description };
+  }
+  if (typeof release !== "string") return { description };
+  let at = lines.length - 1;
+  const cutMatch = at > 0 ? CUT_LINE.exec(lines[at - 1]) : null;
+  if (cutMatch !== null) at--;
+  if (at > 0 && lines[at - 1] !== "") return { description };
+  const source = { host: copy[3], workspaceId: Number(copy[2]), release };
+  return {
+    description: lines.slice(0, Math.max(at - 1, 0)).join("\n"),
+    copiedFrom: { source, ...cutMatch === null ? {} : { cut: { type: cutMatch[1], name: cutMatch[2] } } }
+  };
+}
+function asString(v) {
+  return typeof v === "string" && v !== "" ? v : void 0;
+}
+function asReportedString(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function asNumber(v) {
+  return typeof v === "number" ? v : void 0;
+}
+function positiveSize(v) {
+  const n = asNumber(v);
+  return n !== void 0 && n > 0 ? n : void 0;
+}
+function projectRelease(raw) {
+  const tables = Array.isArray(raw.tables) ? raw.tables : [];
+  const environmentCut = raw.branch === "" || raw.branch === void 0 || raw.branch === null;
+  const copied = splitCopiedFrom(asReportedString(raw.description));
+  const described = copied.copiedFrom !== void 0 ? { description: copied.description } : environmentCut ? splitRecordedOrigin(asReportedString(raw.description)) : { description: asReportedString(raw.description) };
+  return {
+    id: asNumber(raw.id),
+    name: asString(raw.name) ?? "",
+    description: described.description,
+    ...described.origin !== void 0 ? { recordedOrigin: described.origin } : {},
+    ...copied.copiedFrom !== void 0 ? { copiedFrom: copied.copiedFrom } : {},
+    branch: raw.branch === "" ? null : asReportedString(raw.branch),
+    hotfix: raw.hotfix === true,
+    seededTables: tables.flatMap((t) => {
+      if (t === null || typeof t !== "object") return [];
+      const row = t;
+      const name = asString(row.name);
+      return name === void 0 ? [] : [{ name, guid: asString(row.guid), count: asNumber(row.cnt) }];
+    }),
+    createdAt: asTimestamp(raw.created_at),
+    // No `workspaceId`: no release route reports one. The field read
+    // `raw.workspace?.id` against a `workspace` object none of list, get or
+    // create has ever sent, so it was always `undefined` and never appeared in
+    // `--json` at all. A caller already knows the workspace — it is in the URL
+    // it asked on. See `test/fixtures/release/live-records.json`.
+    //
+    // Either signal proves the archive is there. `resource_size` is the one the
+    // routes actually send — as recorded, NO route carries `resource`, and
+    // keying on the path alone reported EVERY release as having lost its
+    // contents, including one cut seconds earlier. The path clause stays
+    // because an engine that does send it must not be read as an empty
+    // archive; it is a fallback, not the primary signal.
+    hasResource: asString(raw.resource) !== void 0 || (asNumber(raw.resource_size) ?? 0) > 0,
+    resourceSize: positiveSize(raw.resource_size)
+  };
+}
+function metaRequest(auth, path, init, timeoutMs, base2) {
+  const url = base2 !== void 0 ? new URL(`${base2.replace(/\/$/, "")}${path}`) : new URL(path, auth.instance);
+  return {
+    url: url.href,
+    init: {
+      ...init,
+      headers: {
+        accept: "application/json",
+        Authorization: `Bearer ${auth.access_token}`,
+        ...init.headers ?? {}
+      },
+      signal: AbortSignal.timeout(timeoutMs)
+    }
+  };
+}
+async function metaWrite(auth, path, action, init, timeoutMs = TIMEOUT_MS, base2) {
+  const req = metaRequest(auth, path, init, timeoutMs, base2);
+  return fetchOrExplain(req.url, req.init, action, timeoutMs);
+}
+async function metaRead(auth, path, action, base2) {
+  const req = metaRequest(auth, path, { method: "GET" }, TIMEOUT_MS, base2);
+  return fetchReadOrExplain(req.url, req.init, action, TIMEOUT_MS);
+}
+function binding(auth, workspaceId, base2) {
+  return {
+    boundWorkspaceId: auth.workspaceId,
+    instance: auth.instance,
+    profile: auth.profile,
+    addressedWorkspaceId: workspaceId,
+    credentialType: auth.credentialType,
+    tenantHost: base2 !== void 0
+  };
+}
+async function readJson(res, action, bind) {
+  const text = await res.text();
+  if (!res.ok) throw new ReleaseHttpError(res.status, action, res.statusText, text, bind);
+  return parseJsonAnswer(text, action, res.url, { safe: true });
+}
+function base(workspaceId) {
+  return `/api:meta/workspace/${workspaceId}/release`;
+}
+var PER_PAGE = 100;
+function pageRows(body) {
+  if (Array.isArray(body)) return body;
+  if (body === null || typeof body !== "object") return [];
+  const items = body.items;
+  return Array.isArray(items) ? items : [];
+}
+function nextPageOf(body) {
+  if (body === null || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const next = body.nextPage;
+  if (next === null) return null;
+  return typeof next === "number" ? next : void 0;
+}
+async function listReleases(auth, opts) {
+  const out = [];
+  let page = 1;
+  for (; ; ) {
+    const path = `${base(opts.workspaceId)}?page=${page}&per_page=${PER_PAGE}`;
+    const res = await metaRead(auth, path, "list releases", opts.base);
+    const body = await readJson(res, "list releases", binding(auth, opts.workspaceId, opts.base));
+    const rows = pageRows(body);
+    for (const r of rows) {
+      if (r !== null && typeof r === "object") out.push(projectRelease(r));
+    }
+    const next = nextPageOf(body);
+    if (next === void 0) {
+      if (rows.length < PER_PAGE) return out;
+      page += 1;
+      continue;
+    }
+    if (next === null) return out;
+    if (next <= page) return out;
+    page = next;
+  }
+}
+async function getRelease(auth, opts) {
+  const path = `${base(opts.workspaceId)}/${opts.id}`;
+  const res = await metaRead(auth, path, "get release", opts.base);
+  if (res.status === 404) return null;
+  const raw = await readJson(res, "get release", binding(auth, opts.workspaceId, opts.base));
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`get release: the instance did not return a release record.`);
+  }
+  return projectRelease(raw);
+}
+async function findRelease(auth, opts) {
+  const all = await listReleases(auth, opts);
+  return all.find((r) => r.name === opts.name) ?? null;
+}
+var MAX_RELEASE_NAME = 100;
+function assertUsableReleaseName(name) {
+  if (name.trim() === "") {
+    throw new Error(
+      `\`release create\` needs a name and was given an empty one.
+The engine does not reject one \u2014 it would store a release that \`release show\`, \`export\` and \`promote\` all address BY NAME and so none of them could reach.`
+    );
+  }
+  if (name.includes("/") || name.includes("\\") || name.includes(":")) {
+    throw new Error(
+      `A release name cannot address a location, and "${name}" does.
+The name is what \`xanosdk release export\` writes the file as, so a name holding \`/\`, \`\\\` or \`:\` would put that file somewhere nobody asked for \u2014 outside the directory the export was invoked from when the name also traverses up, and on another drive when it begins \`C:\` on Windows.
+Name the release, and use \`--path\` on the export to choose where it lands.`
+    );
+  }
+  if (name.startsWith(".")) {
+    throw new Error(
+      `A release name cannot begin with a dot, and "${name}" does.
+\`.\` and \`..\` address a directory rather than name one, and any other leading dot exports to a hidden file in the working directory that a reader will not see.`
+    );
+  }
+  if ([...name].length > MAX_RELEASE_NAME) {
+    throw new Error(
+      `A release name can be at most ${MAX_RELEASE_NAME} characters, and this one is ${[...name].length}.
+The name is what every release command addresses it by and what \`release export\` writes the file as. Pick a shorter one \u2014 put the detail in \`--description\`.`
+    );
+  }
+  const unpromotable = unpromotableReleasePart(name);
+  if (unpromotable !== void 0) {
+    throw new Error(
+      `A release name cannot hold \`${unpromotable}\`, and "${name}" does.
+It would be cut, but \`xanosdk promote\` could never land it: the route a promote lands a release by cannot address a name holding ${UNPROMOTABLE_RELEASE_PARTS}. Name it "${promotableReleaseName(name)}" instead.`
+    );
+  }
+  if ([...name].some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127)) {
+    throw new Error(
+      `A release name cannot carry a control character (a tab, a newline, \u2026), and ${JSON.stringify(name)} does.
+The engine stores it as typed, so every command that addresses the release \u2014 and the file \`release export\` writes \u2014 would need the same invisible character typed back.`
+    );
+  }
+}
+function unpromotableReleasePart(name) {
+  if (name.includes("..")) return "..";
+  return ["+", "=", "|"].find((ch) => name.includes(ch));
+}
+function untenantDeployableReleasePart(name) {
+  return ["=", "|"].find((ch) => name.includes(ch));
+}
+var UNPROMOTABLE_RELEASE_PARTS = "`+`, `=`, `|` or `..`";
+function promotableReleaseName(name) {
+  return name.replace(/\.{2,}/g, ".").replace(/[+=|]/g, "-");
+}
+async function createRelease(auth, opts) {
+  const body = { name: opts.name, branch: opts.branch };
+  if (opts.description !== void 0) body.description = opts.description;
+  if (opts.hotfix !== void 0) body.hotfix = opts.hotfix;
+  if (opts.tableIds !== void 0) body.table_ids = opts.tableIds;
+  if (opts.sourceTenant !== void 0) body.source_tenant = opts.sourceTenant;
+  const res = await metaWrite(
+    auth,
+    base(opts.workspaceId),
+    "create release",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    },
+    DEPLOY_TIMEOUT_MS,
+    opts.base
+  );
+  return projectRelease(await readJson(res, "create release", binding(auth, opts.workspaceId, opts.base)));
+}
+async function deployRelease(auth, opts) {
+  const body = { set_live: opts.setLive === true };
+  if (opts.branch !== void 0) body.branch = opts.branch;
+  const path = `${base(opts.workspaceId)}/${encodeURIComponent(opts.name)}/deploy`;
+  const res = await metaWrite(
+    auth,
+    path,
+    "deploy release",
+    { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) },
+    DEPLOY_TIMEOUT_MS
+  );
+  return projectRelease(await readJson(res, "deploy release", binding(auth, opts.workspaceId)));
+}
+async function downloadRelease(auth, opts) {
+  const path = `${base(opts.workspaceId)}/${opts.id}/export`;
+  const res = await metaRead(auth, path, "export release", opts.base);
+  const link = await readJson(res, "export release", binding(auth, opts.workspaceId, opts.base));
+  const src = typeof link.src === "string" && link.src !== "" ? link.src : void 0;
+  if (src === void 0) {
+    throw new Error(`export release: the instance returned no download link.`);
+  }
+  let file;
+  try {
+    file = await retryingFetch(src, { method: "GET", signal: AbortSignal.timeout(DEPLOY_TIMEOUT_MS) });
+  } catch (err) {
+    throw explainFetchFailure(err, {
+      url: src,
+      what: "download release archive",
+      timeoutMs: DEPLOY_TIMEOUT_MS,
+      display: "the release download link"
+    });
+  }
+  if (!file.ok) {
+    throw Object.assign(
+      new Error(`download release archive failed (${statusLabel(file)}). The link may have expired \u2014 retry.`),
+      { status: file.status }
+    );
+  }
+  return new Uint8Array(await file.arrayBuffer());
+}
+async function importRelease(auth, opts) {
+  const form = new FormData();
+  form.append("file", new Blob([opts.archive], { type: "application/gzip" }), "release.tar.gz");
+  const res = await metaWrite(
+    auth,
+    `${base(opts.workspaceId)}/import`,
+    "import release",
+    { method: "POST", body: form },
+    DEPLOY_TIMEOUT_MS
+  );
+  const body = await readJson(res, "import release", binding(auth, opts.workspaceId));
+  const id = body !== null && typeof body === "object" ? body.id : void 0;
+  if (typeof id !== "number") {
+    throw new Error(`import release: the instance returned no release id.`);
+  }
+  return { id };
+}
+async function updateReleaseDescription(auth, opts) {
+  const res = await metaWrite(auth, `${base(opts.workspaceId)}/${opts.id}`, "update release", {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name: opts.name, description: opts.description })
+  });
+  const body = await readJson(res, "update release", binding(auth, opts.workspaceId));
+  if (body === null || typeof body !== "object" || Array.isArray(body)) {
+    throw new Error(`update release: the instance answered with no release record.`);
+  }
+  return projectRelease(body);
+}
+var SCRATCH_WORKSPACE_NAME = /"workspace-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"/gi;
+async function exportRelease(auth, opts) {
+  const path = `${base(opts.workspaceId)}/${opts.id}/multidoc${opts.records === true ? "?records=true" : ""}`;
+  const res = await metaRead(auth, path, "export release");
+  const text = await res.text();
+  if (!res.ok) throw new ReleaseHttpError(res.status, "export release", res.statusText, text, binding(auth, opts.workspaceId));
+  return opts.name === void 0 ? text : text.replace(SCRATCH_WORKSPACE_NAME, JSON.stringify(opts.name));
+}
+async function deleteRelease(auth, opts) {
+  const path = `${base(opts.workspaceId)}/${opts.id}`;
+  const res = await metaWrite(auth, path, "delete release", { method: "DELETE" }, TIMEOUT_MS, opts.base);
+  if (res.status === 404) return { alreadyGone: true };
+  if (!res.ok) {
+    throw new ReleaseHttpError(
+      res.status,
+      "delete release",
+      res.statusText,
+      await res.text(),
+      binding(auth, opts.workspaceId, opts.base),
+      writeStatusAftermath(res.status)
+    );
+  }
+  return { alreadyGone: false };
+}
+
+export {
+  ReleaseHttpError,
+  RESERVED_DESCRIPTION_PREFIX,
+  reservedDescriptionLine,
+  describeWithOrigin,
+  describeAsCopy,
+  listReleases,
+  getRelease,
+  findRelease,
+  assertUsableReleaseName,
+  unpromotableReleasePart,
+  untenantDeployableReleasePart,
+  UNPROMOTABLE_RELEASE_PARTS,
+  promotableReleaseName,
+  createRelease,
+  deployRelease,
+  downloadRelease,
+  importRelease,
+  updateReleaseDescription,
+  exportRelease,
+  deleteRelease
+};
+//# sourceMappingURL=chunk-2ZUEE4EK.js.map

package/dist/chunk-36JUQZVQ.js

@@ -0,0 +1,22 @@
+// src/util/article.ts
+function article(word) {
+  const w = word.trim().toLowerCase();
+  const digits = /^\d+/.exec(w)?.[0];
+  if (digits !== void 0) {
+    if (digits.startsWith("8")) return "an";
+    const lead = digits.length % 3 === 2 ? digits.slice(0, 2) : "";
+    return lead === "11" || lead === "18" ? "an" : "a";
+  }
+  if (/^(uu|uni|uint|use|usu|uti|ur[il]|eu|one\b|once)/.test(w)) return "a";
+  if (/^(mcp|llm|mfa|sql|sms|smtp|ssl|ssh|xml|html|http|rpc)/.test(w)) return "an";
+  return /^[aeiou]/.test(w) ? "an" : "a";
+}
+function withArticle(word) {
+  return `${article(word)} ${word}`;
+}
+
+export {
+  article,
+  withArticle
+};
+//# sourceMappingURL=chunk-36JUQZVQ.js.map

package/dist/chunk-3DRXWLJ5.js

@@ -0,0 +1,83 @@
+import {
+  tarGz
+} from "./chunk-X4DVXBFY.js";
+
+// src/validate/archive.ts
+import { gunzipSync } from "zlib";
+function encodeWorkspaceArchive(workspaceJson, extra = []) {
+  return tarGz([
+    { name: "workspace.json", data: Buffer.from(workspaceJson, "utf8") },
+    ...extra.map((e) => ({
+      name: e.name,
+      data: typeof e.content === "string" ? Buffer.from(e.content, "utf8") : Buffer.from(e.content)
+    }))
+  ]);
+}
+function archiveHostedFiles(archive) {
+  return Object.entries(readArchiveEntries(archive)).filter(([name]) => name.startsWith("vault/")).map(([name, data]) => ({ name, content: data }));
+}
+var MAX_UNWRAPPED_BYTES = 1024 * 1024 * 1024;
+var ArchiveTooLargeError = class extends Error {
+  constructor(maxBytes) {
+    super(`The archive decompresses to more than ${maxBytes} bytes, so it was not read.`);
+    this.maxBytes = maxBytes;
+  }
+  maxBytes;
+  name = "ArchiveTooLargeError";
+};
+function unwrapGzip(data, opts = {}) {
+  const maxBytes = opts.maxBytes ?? MAX_UNWRAPPED_BYTES;
+  let buf = Buffer.from(data);
+  let guard = 0;
+  while (buf.length > 2 && buf[0] === 31 && buf[1] === 139 && guard++ < 8) {
+    try {
+      buf = gunzipSync(buf, { maxOutputLength: maxBytes });
+    } catch (err) {
+      if (err.code === "ERR_BUFFER_TOO_LARGE") {
+        throw new ArchiveTooLargeError(maxBytes);
+      }
+      throw err;
+    }
+  }
+  return buf;
+}
+function readArchiveEntries(data) {
+  const out = {};
+  for (const [name, bytes] of Object.entries(readTar(unwrapGzip(data)))) {
+    out[name.replace(/^\.\//, "")] = bytes;
+  }
+  return out;
+}
+function decodeWorkspaceArchive(data) {
+  const files = readTar(unwrapGzip(data));
+  const key = Object.keys(files).find((k) => k.endsWith("workspace.json"));
+  if (key === void 0) {
+    const seen = Object.keys(files).join(", ") || "none";
+    throw new Error(`Workspace export archive has no workspace.json (entries: ${seen}).`);
+  }
+  return JSON.parse(files[key].toString("utf8"));
+}
+function readTar(buf) {
+  const files = {};
+  let off = 0;
+  while (off + 512 <= buf.length) {
+    const name = buf.toString("utf8", off, off + 100).replace(/\0.*$/, "");
+    if (name === "") break;
+    const sizeField = buf.toString("utf8", off + 124, off + 136).replace(/\0.*$/, "").trim();
+    const size = parseInt(sizeField || "0", 8);
+    const start = off + 512;
+    if (Number.isFinite(size) && size > 0) files[name] = buf.subarray(start, start + size);
+    off = start + Math.ceil(size / 512) * 512;
+  }
+  return files;
+}
+
+export {
+  encodeWorkspaceArchive,
+  archiveHostedFiles,
+  ArchiveTooLargeError,
+  unwrapGzip,
+  readArchiveEntries,
+  decodeWorkspaceArchive
+};
+//# sourceMappingURL=chunk-3DRXWLJ5.js.map

package/dist/chunk-3JDU4VRL.js

@@ -0,0 +1,137 @@
+// src/workspace/documentation-token.ts
+var WORKSPACE_SECRETS_BASENAME = ".secrets.json";
+var WORKSPACE_SECRETS_FILE = `xano/${WORKSPACE_SECRETS_BASENAME}`;
+function supplyTokenRemedy(remedy, scope) {
+  return remedy.supply?.(scope) ?? `--doc-token "${scope}=<value>"`;
+}
+function allowEmptyTokenRemedy(remedy, scope) {
+  return remedy.allowEmpty?.(scope) ?? `--allow-empty-doc-token="${scope}"`;
+}
+var SCAFFOLD_SECRETS_REMEDY = { file: WORKSPACE_SECRETS_FILE, fill: "xanosdk secrets fill" };
+function documentationScopeLabel(scope) {
+  return scope.kind === "workspace" ? "the workspace" : `API group "${scope.name}"`;
+}
+function documentationScopeFlagLabel(scope) {
+  return scope.kind === "workspace" ? "workspace" : scope.name;
+}
+function documentationScopeKey(scope) {
+  return scope.kind === "workspace" ? "workspace" : `${API_GROUP_SCOPE_PREFIX}${scope.guid ?? scope.name}`;
+}
+var API_GROUP_SCOPE_PREFIX = "apiGroup:";
+function normalizeDocumentationScopeKey(key) {
+  return key.startsWith("app:") ? `${API_GROUP_SCOPE_PREFIX}${key.slice("app:".length)}` : key;
+}
+function apiGroupScope(record) {
+  const guid = typeof record.guid === "string" && record.guid !== "" ? record.guid : void 0;
+  return {
+    kind: "api_group",
+    name: typeof record.name === "string" ? record.name : "(unnamed)",
+    ...guid !== void 0 ? { guid } : {}
+  };
+}
+function documentationTokenLiteral(block) {
+  if (block === null || typeof block !== "object" || Array.isArray(block)) return void 0;
+  const token = block.token;
+  return typeof token === "string" && token !== "" ? token : void 0;
+}
+function awaitsDocumentationToken(block) {
+  if (block === null || typeof block !== "object" || Array.isArray(block)) return false;
+  return !Object.hasOwn(block, "token");
+}
+function declaresDocumentationGate(block) {
+  if (!awaitsDocumentationToken(block)) return false;
+  return block.require_token === true;
+}
+function documentationTokenDeclarations(args) {
+  const out = [];
+  const ws = args.workspace;
+  if (ws !== null && typeof ws === "object" && !Array.isArray(ws)) {
+    const block = ws.documentation;
+    if (awaitsDocumentationToken(block)) {
+      const scope = { kind: "workspace" };
+      out.push({
+        scope,
+        key: documentationScopeKey(scope),
+        gated: declaresDocumentationGate(block),
+        published: false
+      });
+    }
+  }
+  for (const group of args.apiGroups ?? []) {
+    if (group === null || typeof group !== "object" || Array.isArray(group)) continue;
+    const record = group;
+    if (!awaitsDocumentationToken(record.documentation)) continue;
+    const scope = apiGroupScope(record);
+    out.push({
+      scope,
+      key: documentationScopeKey(scope),
+      gated: declaresDocumentationGate(record.documentation),
+      published: record.swagger === true
+    });
+  }
+  return out;
+}
+function resolveDocumentationBlock(block, key, values, allowEmpty) {
+  if (block === null || typeof block !== "object" || Array.isArray(block)) return void 0;
+  const record = { ...block };
+  if (!awaitsDocumentationToken(record)) return record;
+  if (Object.hasOwn(values, key)) return { ...record, token: values[key] };
+  if (allowEmpty.has(key)) return { ...record, token: "" };
+  return declaresDocumentationGate(record) ? void 0 : record;
+}
+function resolveDocumentationTokens(args) {
+  const allowEmpty = new Set([...args.allowEmpty ?? []].map(normalizeDocumentationScopeKey));
+  const values = Object.fromEntries(
+    Object.entries(args.values).map(([key, value]) => [normalizeDocumentationScopeKey(key), value])
+  );
+  args = { ...args, values, allowEmpty };
+  const workspace = { ...args.workspace };
+  if (Object.hasOwn(workspace, "documentation")) {
+    const resolved = resolveDocumentationBlock(
+      workspace.documentation,
+      documentationScopeKey({ kind: "workspace" }),
+      args.values,
+      allowEmpty
+    );
+    if (resolved === void 0) delete workspace.documentation;
+    else workspace.documentation = resolved;
+  }
+  const unresolvedGroups = [];
+  const apiGroups = args.apiGroups?.map((group) => {
+    if (group === null || typeof group !== "object" || Array.isArray(group)) return group;
+    const record = group;
+    if (!Object.hasOwn(record, "documentation")) return group;
+    const scope = apiGroupScope(record);
+    const declared = declaresDocumentationGate(record.documentation);
+    const resolved = resolveDocumentationBlock(
+      record.documentation,
+      documentationScopeKey(scope),
+      args.values,
+      allowEmpty
+    );
+    const copy = { ...record };
+    if (resolved === void 0) {
+      delete copy.documentation;
+      if (declared) unresolvedGroups.push(scope.name);
+    } else copy.documentation = resolved;
+    return copy;
+  });
+  return { workspace, apiGroups, unresolvedGroups };
+}
+
+export {
+  WORKSPACE_SECRETS_BASENAME,
+  WORKSPACE_SECRETS_FILE,
+  supplyTokenRemedy,
+  allowEmptyTokenRemedy,
+  SCAFFOLD_SECRETS_REMEDY,
+  documentationScopeLabel,
+  documentationScopeFlagLabel,
+  documentationScopeKey,
+  normalizeDocumentationScopeKey,
+  apiGroupScope,
+  documentationTokenLiteral,
+  documentationTokenDeclarations,
+  resolveDocumentationTokens
+};
+//# sourceMappingURL=chunk-3JDU4VRL.js.map