@xano/sdk 1.0.0

package/dist/chunk-XW6KISBB.js

@@ -0,0 +1,1192 @@
+import {
+  registerSecret,
+  tokenTextProblem
+} from "./chunk-AWQ7BQTQ.js";
+import {
+  expandHome,
+  readPathEnvVar
+} from "./chunk-EUUUMY7J.js";
+import {
+  debugEnabled,
+  describeTransportFailure,
+  httpFailure,
+  isTimeoutError,
+  statusLabel
+} from "./chunk-YLDALTWZ.js";
+import {
+  pointerRootFor,
+  resolveProjectProfile
+} from "./chunk-5FBYXK5P.js";
+import {
+  atomicWrite,
+  linkTarget
+} from "./chunk-LLNZGEFK.js";
+import {
+  DEFAULT_PROFILE,
+  resolveActiveProfile
+} from "./chunk-QXTKSOFI.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import {
+  UsageError
+} from "./chunk-PTHVMXZI.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+
+// src/auth/store.ts
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync, rmdirSync, statSync, lstatSync, realpathSync, accessSync, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { execFileSync } from "child_process";
+import { basename, dirname as dirname2, join as join2, relative, resolve } from "path";
+import lockfile from "proper-lockfile";
+
+// src/auth/oauth.ts
+import * as client from "openid-client";
+
+// src/auth/client-store.ts
+import { existsSync, readFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function clientStorePath() {
+  return readPathEnvVar("XANO_CLIENT_FILE") ?? join(homedir(), ".xano", "xanosdk-clients.json");
+}
+function key(authHost, redirectUri) {
+  return `${authHost}|${redirectUri}`;
+}
+function readAll(path) {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8").replace(/^\uFEFF/, ""));
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeAll(path, all) {
+  mkdirSync(dirname(path), { recursive: true });
+  atomicWrite(path, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+}
+async function getOrRegisterClient(params) {
+  const path = clientStorePath();
+  const all = readAll(path);
+  const k = key(params.authHost, params.redirectUri);
+  const cached = all[k];
+  if (cached?.client_id) return cached.client_id;
+  const { client_id } = await registerClient({
+    registrationEndpoint: params.registrationEndpoint,
+    redirectUri: params.redirectUri,
+    scope: params.scope
+  });
+  all[k] = { client_id };
+  writeAll(path, all);
+  return client_id;
+}
+function clearClient(params) {
+  const path = clientStorePath();
+  const all = readAll(path);
+  const k = key(params.authHost, params.redirectUri);
+  if (!(k in all)) return;
+  delete all[k];
+  writeAll(path, all);
+}
+
+// src/auth/oauth.ts
+var CALLBACK_PATH = "/oauth/callback";
+var DEFAULT_PORT = 47100;
+var SOFTWARE_ID = "xanosdk";
+var DEFAULT_AUTH_HOST = "https://app.xano.com";
+var DEFAULT_SCOPE = "offline_access workspace:read workspace:write xano:dev";
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+var NETWORK_TIMEOUT_MS = 3e4;
+function unreachableAuthHost(authHost, err) {
+  const why = isTimeoutError(err) ? `no answer within ${NETWORK_TIMEOUT_MS / 1e3}s` : describeTransportFailure(err);
+  return new Error(
+    `Could not reach the sign-in server at ${authHost}: ${why}. Check the network, and --origin or XANO_ORIGIN if either is set.`,
+    { cause: err }
+  );
+}
+async function discover(authHost) {
+  const url = new URL(DISCOVERY_PATH, authHost).href;
+  let res;
+  try {
+    res = await fetch(url, { signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS) });
+  } catch (err) {
+    throw unreachableAuthHost(authHost, err);
+  }
+  if (!res.ok) {
+    throw new Error(
+      `OAuth discovery failed (${statusLabel(res)}) at ${url}. Check --origin (currently ${authHost}).`
+    );
+  }
+  const doc = await res.json();
+  if (!doc.authorization_endpoint || !doc.token_endpoint) {
+    throw new Error(`OAuth discovery doc at ${url} is missing authorization/token endpoints.`);
+  }
+  return {
+    authorization_endpoint: doc.authorization_endpoint,
+    token_endpoint: doc.token_endpoint,
+    registration_endpoint: doc.registration_endpoint
+  };
+}
+async function registerClient(params) {
+  const res = await fetch(params.registrationEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "xanosdk CLI",
+      software_id: SOFTWARE_ID,
+      redirect_uris: [params.redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scopes: params.scope.split(/\s+/).filter(Boolean)
+    }),
+    signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS)
+  });
+  const text = await res.text();
+  if (res.status !== 200 && res.status !== 201) {
+    throw new Error(httpFailure("Client registration", res, text));
+  }
+  const doc = JSON.parse(text);
+  if (!doc.client_id) {
+    throw new Error(`Client registration response had no client_id.${debugEnabled() ? `
+${text}` : ""}`);
+  }
+  return { client_id: doc.client_id };
+}
+function decodeAudience(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return Array.isArray(payload.aud) ? payload.aud[0] : payload.aud;
+  } catch {
+    return void 0;
+  }
+}
+function oauthErrorCode(err) {
+  if (err && typeof err === "object" && "error" in err) {
+    const code = err.error;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function oauthErrorResponse(err) {
+  const cause = err?.cause;
+  return typeof Response !== "undefined" && cause instanceof Response ? cause : void 0;
+}
+var OAUTH_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_request",
+  "invalid_client",
+  "invalid_grant",
+  "unauthorized_client",
+  "unsupported_grant_type",
+  "invalid_scope"
+]);
+async function resolveOAuthErrorCode(err) {
+  const rfc = oauthErrorCode(err);
+  if (rfc !== void 0) return rfc;
+  const res = oauthErrorResponse(err);
+  if (res === void 0 || res.bodyUsed) return void 0;
+  try {
+    const body = await res.clone().json();
+    if (!body || typeof body !== "object") return void 0;
+    const fields = body;
+    for (const candidate of [fields.error, fields.message, fields.code]) {
+      const code = typeof candidate === "string" ? leadingOAuthCode(candidate) : void 0;
+      if (code !== void 0) return code;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function leadingOAuthCode(value) {
+  const colon = value.indexOf(":");
+  const head = (colon === -1 ? value : value.slice(0, colon)).trim();
+  if (colon === -1 && head !== value) return void 0;
+  return OAUTH_ERROR_CODES.has(head) ? head : void 0;
+}
+var OpenIdProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  configPromise;
+  /** The client_id the resolved config uses — set once `build()` completes. */
+  resolvedClientId;
+  /** The issuer the resolved config discovered — set once `build()` completes. */
+  resolvedIssuer;
+  redirectUri() {
+    if (!this.opts.redirectUri) {
+      throw new Error("OpenIdProvider: redirectUri is required for the authorize/exchange flow.");
+    }
+    return this.opts.redirectUri;
+  }
+  /**
+   * The client_id this provider registered or reused. Only valid after the
+   * config has resolved (e.g. after `buildAuthUrl`/`exchange`); throws otherwise
+   * so a caller never records an empty client_id.
+   */
+  clientId() {
+    if (!this.resolvedClientId) {
+      throw new Error("OpenIdProvider.clientId() called before the configuration was resolved.");
+    }
+    return this.resolvedClientId;
+  }
+  /**
+   * The authorization server's issuer, as resolved by discovery. Only the paste
+   * login mode needs it: a pasted BARE code carries no `iss`, and the AS
+   * advertises issuer support, so one has to be supplied for the response to
+   * validate at all. Same lifecycle guard as `clientId()` — valid once the
+   * configuration has resolved.
+   */
+  issuer() {
+    if (!this.resolvedIssuer) {
+      throw new Error("OpenIdProvider.issuer() called before the configuration was resolved.");
+    }
+    return this.resolvedIssuer;
+  }
+  async build() {
+    const server = new URL(this.opts.authHost);
+    const options = server.protocol === "http:" ? { execute: [client.allowInsecureRequests] } : void 0;
+    let clientId = this.opts.clientId;
+    if (!clientId) {
+      const { registration_endpoint } = await discover(this.opts.authHost);
+      if (!registration_endpoint) {
+        throw new Error(
+          `The OAuth server at ${this.opts.authHost} does not advertise a registration endpoint, so xanosdk can't register its loopback client. Check --origin.`
+        );
+      }
+      clientId = await getOrRegisterClient({
+        authHost: this.opts.authHost,
+        redirectUri: this.redirectUri(),
+        registrationEndpoint: registration_endpoint,
+        scope: this.opts.scope
+      });
+    }
+    this.resolvedClientId = clientId;
+    const config = await client.discovery(
+      server,
+      clientId,
+      { token_endpoint_auth_method: "none" },
+      client.None(),
+      options
+    );
+    this.resolvedIssuer = config.serverMetadata().issuer;
+    return config;
+  }
+  config() {
+    return this.configPromise ??= this.build();
+  }
+  async reset() {
+    this.configPromise = void 0;
+    this.resolvedClientId = void 0;
+    this.resolvedIssuer = void 0;
+    if (this.opts.redirectUri) {
+      clearClient({ authHost: this.opts.authHost, redirectUri: this.opts.redirectUri });
+    }
+  }
+  async buildAuthUrl({ verifier, state }) {
+    const config = await this.config();
+    const code_challenge = await client.calculatePKCECodeChallenge(verifier);
+    return client.buildAuthorizationUrl(config, {
+      redirect_uri: this.redirectUri(),
+      scope: this.opts.scope,
+      code_challenge,
+      code_challenge_method: "S256",
+      state
+    }).href;
+  }
+  async exchange(callbackUrl, { verifier, state }) {
+    const config = await this.config();
+    const tokens = await client.authorizationCodeGrant(config, new URL(callbackUrl), {
+      // We don't request `openid`, so no ID Token is expected.
+      pkceCodeVerifier: verifier,
+      expectedState: state,
+      idTokenExpected: false
+    });
+    return pick(tokens);
+  }
+  async refresh(refreshToken, opts) {
+    const config = await this.config();
+    const params = {};
+    if (opts?.scope) params.scope = opts.scope;
+    return pick(await client.refreshTokenGrant(config, refreshToken, params));
+  }
+  async revoke(refreshToken) {
+    const config = await this.config();
+    await client.tokenRevocation(config, refreshToken, { token_type_hint: "refresh_token" });
+  }
+};
+function pick(t) {
+  registerSecret(t.access_token);
+  registerSecret(t.refresh_token);
+  return {
+    access_token: t.access_token,
+    refresh_token: t.refresh_token,
+    expires_in: t.expires_in,
+    scope: t.scope
+  };
+}
+
+// src/auth/config.ts
+function resolveAuthHost(args, saved) {
+  return args.authHost ?? envOrigin() ?? saved ?? DEFAULT_AUTH_HOST;
+}
+function envOrigin() {
+  return readEnvVar("XANO_ORIGIN");
+}
+function resolveScope(args) {
+  if (args.scope !== void 0 && args.scope.trim() === "") {
+    throw new UsageError(
+      '--scope is empty \u2014 usually an unset shell variable. Pass the space-separated OAuth scopes to request (e.g. --scope "offline_access workspace:read"). Drop --scope to request the default set.',
+      { hintFor: { command: "login" } }
+    );
+  }
+  return args.scope ?? DEFAULT_SCOPE;
+}
+function assertHttpsOrigin(origin, label) {
+  refuseMistypedScheme(origin, label);
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    throw new Error(`${label} is not a valid URL: "${origin}" (expected e.g. https://your-instance.xano.io).`);
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "::1";
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error(
+      `${label} must use https://, or http:// for localhost (got "${origin}", whose scheme is ${url.protocol}).`
+    );
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error(`${label} must use https:// (got "${origin}"). Plain http is allowed only for localhost.`);
+  }
+}
+function assertSignInOrigin(origin, label) {
+  assertNoUserinfo(origin, label);
+  assertHttpsOrigin(origin, label);
+  const url = new URL(origin);
+  if ((url.pathname === "" || url.pathname === "/") && url.search === "" && url.hash === "") return;
+  throw new Error(
+    `${label} must be an origin \u2014 a scheme and host, with no path, query or fragment (got "${origin}"). Use ${url.origin}.`
+  );
+}
+function assertInstanceOrigin(value, label) {
+  refuseMistypedScheme(value, label);
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new Error(
+      `${label} must not carry a user name or password (the \`user:password@\` part) \u2014 an instance is addressed by its origin, and the meta API token is what authenticates. Use ${url.origin}${url.password === "" ? "" : ", and treat that password as exposed"}.`
+    );
+  }
+  if ((url.pathname === "" || url.pathname === "/") && url.search === "" && url.hash === "") return;
+  throw new Error(
+    `${label} must be the instance's origin \u2014 a scheme and host, with no path, query or fragment (got "${value}"). Use ${url.origin}.`
+  );
+}
+function refuseMistypedScheme(value, label) {
+  const doubled = /^([a-z][a-z0-9+.-]*):\/\/+([a-z][a-z0-9+.-]*):\/\/(.*)$/i.exec(value.trim());
+  const bare = value.trim();
+  const hostLike = !bare.includes("://") && /^(?:[^\s/:@]+@)?(?:localhost|[a-z0-9-]+(?:\.[a-z0-9-]+)+)(?::\d+)?\/?$/i.test(bare);
+  const loopback = doubled !== null && /^(?:[^/@]*@)?(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:[/?#]|$)/i.test(doubled[3]);
+  const scheme = loopback && [doubled[1], doubled[2]].every((x) => x.toLowerCase() === "http") ? "http" : "https";
+  const meant = doubled !== null ? `${scheme}://${doubled[3]}` : hostLike ? `https://${bare}` : void 0;
+  if (meant === void 0) return;
+  let origin;
+  try {
+    origin = new URL(meant).origin;
+  } catch {
+    return;
+  }
+  if (origin === "null") return;
+  throw new Error(
+    doubled !== null ? `${label} has its scheme twice. Use ${origin}.` : `${label} needs a scheme (https://). Use ${origin}.`
+  );
+}
+function assertNoUserinfo(origin, label) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return;
+  }
+  if (url.username === "" && url.password === "") return;
+  throw new Error(
+    `${label} must not carry a user name or password (the \`user:password@\` part). A sign-in server is an origin, and the sign-in itself happens in the browser. Use ${url.origin}${url.password === "" ? "" : ", and treat that password as exposed"}.`
+  );
+}
+
+// src/auth/store.ts
+var XANO_DIR = "xano";
+var DEDICATED_DIR = ".xano";
+var CREDENTIAL_FILE_VERSION = 2;
+function emptyCredentialFile() {
+  return { version: CREDENTIAL_FILE_VERSION, profiles: {} };
+}
+var DEFAULT_AUTH_FILE = join2(".xano", "auth.json");
+function globalAuthFilePath() {
+  return readPathEnvVar("XANO_GLOBAL_CONFIG") ?? join2(homedir2(), ".xanosdk", "auth.json");
+}
+function localAuthFilePath() {
+  return join2(pointerRootFor(process.cwd()), DEFAULT_AUTH_FILE);
+}
+function resolveAuthFilePath(args, mode = "read") {
+  const explicit = expandHome(args.authFile) ?? readPathEnvVar("XANO_CONFIG");
+  if (explicit !== void 0 && explicit.trim() === "") {
+    const named = args.authFile !== void 0 ? "`--config`" : "XANO_CONFIG";
+    throw new UsageError(
+      `${named} is empty. It takes the path of a credential file \u2014 the JSON file \`xanosdk login\` or \`xanosdk profile add\` writes, e.g. \`.xano/auth.json\`` + (args.authFile !== void 0 ? ` \u2014 or drop it to use the default one.` : ` \u2014 or unset XANO_CONFIG.`)
+    );
+  }
+  if (explicit !== void 0 && args.local && resolve(explicit) !== localAuthFilePath()) {
+    const named = args.authFile !== void 0 ? `\`--config ${explicit}\`` : `XANO_CONFIG=${explicit}`;
+    throw new UsageError(
+      `\`--local\` selects the project-local .xano/auth.json and ${named} names another credential file \u2014 they cannot both be the one this command uses. Drop \`--local\`` + (args.authFile !== void 0 ? `, or drop \`--config\`.` : `, or unset XANO_CONFIG.`)
+    );
+  }
+  if (explicit !== void 0) {
+    const path = resolve(explicit);
+    assertCredentialPathUsable(path, args.authFile !== void 0 ? `--config ${explicit}` : `XANO_CONFIG=${explicit}`);
+    return path;
+  }
+  const local = localAuthFilePath();
+  if (args.local) return local;
+  const global = globalAuthFilePath();
+  if (mode === "write") return global;
+  if (existsSync2(local) && !holdsNoProfiles(local)) return local;
+  return global;
+}
+function loopError(path) {
+  return new UsageError(
+    `The credential file ${path} is a symbolic link that loops back on itself (ELOOP). Point it at a real file, or pass \`--config <file>\`.`
+  );
+}
+function credentialWriteFailure(err, path) {
+  const code = err?.code;
+  const head = `No credential can be written to ${path}:`;
+  const elsewhere = "or pass `--config <file>` somewhere you can write.";
+  switch (code) {
+    case "EACCES":
+    case "EPERM":
+      return new UsageError(`${head} ${dirname2(path)} is not writable by this user (${code}). Make it writable, ${elsewhere}`);
+    case "EROFS":
+      return new UsageError(`${head} ${dirname2(path)} is on a read-only file system (EROFS). Pass \`--config <file>\` somewhere you can write.`);
+    case "ELOOP":
+      return loopError(path);
+    case "EISDIR":
+      return new UsageError(`${head} it is a directory. Remove or rename it, ${elsewhere}`);
+    default:
+      return err;
+  }
+}
+function credentialFileExists(path) {
+  try {
+    statSync(path);
+    return true;
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ELOOP") throw loopError(path);
+    if (code !== "EACCES" && code !== "EPERM") return false;
+    const dir = dirname2(path);
+    const quoted = shellQuote(dir);
+    throw new Error(
+      `Cannot read the credential directory ${dir}: permission denied (${code}). Nothing is lost \u2014 this user cannot open it, usually because a command run with sudo created it as root. Restore access with \`sudo chown -R "$(whoami)" ${quoted}\` and \`chmod 700 ${quoted}\`, then retry.`,
+      { cause: err }
+    );
+  }
+}
+function readCredentialText(path) {
+  try {
+    return readFileSync2(path, "utf8").replace(/^\uFEFF/, "");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ELOOP") throw loopError(path);
+    if (code === "EISDIR") throw new UsageError(`The credential file ${path} is a directory. Remove or rename it, or pass \`--config <file>\`.`);
+    if (code !== "EACCES" && code !== "EPERM") throw err;
+    const quoted = shellQuote(path);
+    throw new Error(
+      `Cannot read the credential file ${path}: permission denied (${code}). The file is not corrupt \u2014 this user cannot open it. Restore access with \`chmod u+rw ${quoted}\` (if another user owns it: \`sudo chown "$(whoami)" ${quoted}\`), then retry.`,
+      { cause: err }
+    );
+  }
+}
+function assertCredentialPathUsable(path, named) {
+  const blocker = fileInTheWay(path);
+  if (blocker !== void 0) {
+    throw new UsageError(
+      `\`${named}\` names ${path}, but ${blocker} is a file, not a directory \u2014 no credential file can exist below it. Choose a path whose directories are directories, e.g. \`.xano/auth.json\`.`
+    );
+  }
+  if (isDirectory(path)) {
+    throw new UsageError(
+      `\`${named}\` names a directory (${path}). It must name a credential file \u2014 the JSON file \`xanosdk login\` or \`xanosdk profile add\` writes, e.g. \`.xano/auth.json\`.`
+    );
+  }
+  const existing = readExistingRaw(path);
+  if (existing.absent) return;
+  if (!existing.unparseable && isCredentialRecord(existing.value)) return;
+  throw new UsageError(
+    `\`${named}\` names ${path}, which exists but is not a Xano SDK credential file. Choose a different path \u2014 a new one is created on the first \`xanosdk login\` or \`xanosdk profile add\`. If it really is a credential file that has been corrupted beyond recognition, delete it yourself and sign in again.`
+  );
+}
+function fileInTheWay(path) {
+  let dir = dirname2(resolve(path));
+  for (; ; ) {
+    if (existsSync2(dir)) return isDirectory(dir) ? void 0 : dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function isDirectory(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function holdsNoProfiles(path) {
+  try {
+    const file = readCredentialFile(path);
+    return file !== null && profileNames(file).length === 0;
+  } catch {
+    return false;
+  }
+}
+function projectAuthFilePath() {
+  return resolveAuthFilePath({ authFile: void 0, local: false }, "read");
+}
+function readCredentialFile(path) {
+  if (!credentialFileExists(path)) return null;
+  if (isDirectory(path)) {
+    throw new UsageError(`Credential file at ${path} is a directory, not a file. Remove or rename it, then sign in again.`);
+  }
+  const text = readCredentialText(path);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `Credential file at ${path} is corrupt (invalid JSON). ${reauthHint(path)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Credential file at ${path} is not a JSON object. ${reauthHint(path)}`);
+  }
+  const record = parsed;
+  if (isEnvelope(record)) {
+    return {
+      version: record.version,
+      default: typeof record.default === "string" ? record.default : void 0,
+      profiles: { ...record.profiles }
+    };
+  }
+  if (!isCredentialRecord(record) && typeof record.type !== "string") {
+    throw new Error(
+      `${path} is not a Xano SDK credential file. If it should be one, delete it and run \`${loginCommand(DEFAULT_PROFILE, { path })}\` again.`
+    );
+  }
+  return { version: CREDENTIAL_FILE_VERSION, profiles: { [DEFAULT_PROFILE]: record } };
+}
+function isEnvelope(record) {
+  return typeof record.version === "number" && typeof record.profiles === "object" && record.profiles !== null && !Array.isArray(record.profiles);
+}
+function readProfile(file, name, path) {
+  if (!Object.prototype.hasOwnProperty.call(file.profiles, name)) return null;
+  try {
+    return parseCredential(file.profiles[name], path, name);
+  } catch (err) {
+    if (file.version > CREDENTIAL_FILE_VERSION) {
+      throw new Error(
+        `${name === DEFAULT_PROFILE ? "The default profile" : `Profile "${name}"`} in the credential file at ${path} was written by a newer xanosdk (file version ${file.version}; this CLI understands ${CREDENTIAL_FILE_VERSION}) \u2014 ${UPGRADE_REMEDY}`
+      );
+    }
+    throw err;
+  }
+}
+var UPGRADE_REMEDY = "upgrade with `npm install -g @xano/sdk@latest` (or `xanosdk upgrade`) and try again.";
+function readCredential(path, profile = DEFAULT_PROFILE) {
+  const file = readCredentialFile(path);
+  return file === null ? null : readProfile(file, profile, path);
+}
+function profileNames(file) {
+  return Object.keys(file.profiles);
+}
+function recordedCredentialPath(recorded) {
+  if (recorded === void 0) return null;
+  if (recorded === "shared") return globalAuthFilePath();
+  if (recorded === "local") return localAuthFilePath();
+  return recorded;
+}
+function recordedCredentialFile(path) {
+  const abs = resolve(path);
+  if (abs === resolve(globalAuthFilePath())) return "shared";
+  if (abs === localAuthFilePath()) return "local";
+  return abs;
+}
+function recordedProfileStored(profile, recorded) {
+  const file = recordedCredentialPath(recorded);
+  for (const path of file === null ? [globalAuthFilePath(), localAuthFilePath()] : [file]) {
+    try {
+      const read = readCredentialFile(path);
+      if (read !== null && profileNames(read).includes(profile)) return true;
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+function describeProfile(file, name, path) {
+  try {
+    return { name, record: readProfile(file, name, path) };
+  } catch (err) {
+    return { name, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function isCredentialRecord(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return false;
+  const record = v;
+  if (isEnvelope(record)) return true;
+  if (record.type === "oauth" || record.type === "token") return true;
+  return typeof record.access_token === "string" && typeof record.instance === "string";
+}
+function parseCredential(v, path, profile = DEFAULT_PROFILE) {
+  const where = `${profile === DEFAULT_PROFILE ? "" : `Profile "${profile}" in the `}credential file at ${path}`;
+  if (typeof v !== "object" || v === null || Array.isArray(v)) {
+    throw new Error(`${where} is not a JSON object. ${replaceHint(path, profile)}`);
+  }
+  const record = v;
+  const type = record.type;
+  if (type === void 0) {
+    throw new Error(
+      `${where} has no \`type\` field \u2014 it predates the typed credential format. Run ${loginHint(profile, { path })} again to replace it.`
+    );
+  }
+  if (type === "oauth") return parseOAuth(record, path, profile);
+  if (type === "token") return parseToken(record, path, profile);
+  throw new Error(
+    `${where} has an unrecognized \`type\` (${JSON.stringify(type)}). Expected "oauth" or "token".`
+  );
+}
+function whereIn(kind, path, profile) {
+  const suffix = profile === DEFAULT_PROFILE ? "" : ` (profile "${profile}")`;
+  return `in the "${kind}" credential at ${path}${suffix}`;
+}
+function reauthHint(path, profile = DEFAULT_PROFILE) {
+  return `Delete it and run \`${loginCommand(profile, { path })}\` again.`;
+}
+function replaceHint(path, profile) {
+  return `Run \`${loginCommand(profile, { path })}\` to replace it.`;
+}
+function loginHint(profile, target = {}) {
+  return `\`${loginCommand(profile, target)}\``;
+}
+function credentialFileFlag(path) {
+  if (path === void 0) return "";
+  const abs = resolve(path);
+  const byEnv = readPathEnvVar("XANO_CONFIG");
+  if (byEnv !== void 0 && byEnv.trim() !== "") {
+    return abs === resolve(byEnv) ? "" : ` --config ${shellQuote(abs)}`;
+  }
+  if (abs === resolve(globalAuthFilePath())) return "";
+  if (abs === localAuthFilePath()) return " --local";
+  return ` --config ${shellQuote(abs)}`;
+}
+function loginCommand(profile, target = {}, extra = []) {
+  const name = profile === DEFAULT_PROFILE && bareLoginReaches(target.path) === DEFAULT_PROFILE ? "" : ` --profile ${shellQuote(profile)}`;
+  const origin = target.origin === void 0 || sameOriginAs(target.origin, DEFAULT_AUTH_HOST) ? "" : ` --origin ${shellQuote(originOnly(target.origin))}`;
+  return `xanosdk login${name}${credentialFileFlag(target.path)}${origin}${extra.map((f) => ` ${f}`).join("")}`;
+}
+function bareLoginReaches(path) {
+  let fileDefault;
+  try {
+    fileDefault = readCredentialFile(path ?? globalAuthFilePath())?.default;
+  } catch {
+  }
+  try {
+    return resolveActiveProfile({ fileDefault, readPointer: () => resolveProjectProfile(process.cwd()) }).name;
+  } catch {
+    return void 0;
+  }
+}
+function originOnly(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return url;
+  }
+}
+function sameOriginAs(a, b) {
+  return originOnly(a) === originOnly(b);
+}
+function addProfileHint(profile, target = {}) {
+  return `${loginHint(profile, target)} (OAuth), or \`${profileAddCommand(profile, target)}\` (meta API token)`;
+}
+function profileAddCommand(profile, target = {}) {
+  const instance = target.instance !== void 0 ? shellQuote(originOnly(target.instance)) : "<url>";
+  const workspace = target.workspaceId !== void 0 ? String(target.workspaceId) : "<id>";
+  return `xanosdk profile add ${shellQuote(profile)}${credentialFileFlag(target.path)} --instance ${instance} --workspace-id ${workspace}`;
+}
+function parseOAuth(record, path, profile) {
+  const at = whereIn("oauth", path, profile);
+  if (typeof record.access_token !== "string" || record.access_token === "") {
+    throw new Error(`Missing \`access_token\` ${at}. ${replaceHint(path, profile)}`);
+  }
+  if (typeof record.instance !== "string" || record.instance === "") {
+    throw new Error(`Missing \`instance\` ${at}. ${replaceHint(path, profile)}`);
+  }
+  if (record.workspace_id === void 0) {
+    throw new Error(
+      `Missing \`workspace_id\` ${at} \u2014 it predates workspace pinning at login. ${replaceHint(path, profile)}`
+    );
+  }
+  if (typeof record.auth_host !== "string" || record.auth_host === "") {
+    throw new Error(`Missing \`auth_host\` ${at}. ${replaceHint(path, profile)}`);
+  }
+  if (typeof record.client_id !== "string" || record.client_id === "") {
+    throw new Error(`Missing \`client_id\` ${at}. ${replaceHint(path, profile)}`);
+  }
+  registerSecret(record.access_token);
+  registerSecret(record.refresh_token);
+  for (const field of ["access_token", "refresh_token"]) {
+    const value = record[field];
+    const problem = typeof value === "string" ? tokenTextProblem(value) : void 0;
+    if (problem !== void 0) {
+      throw new UsageError(`\`${field}\` ${at} ${problem}, which no request can carry. ${replaceHint(path, profile)}`);
+    }
+  }
+  return {
+    type: "oauth",
+    access_token: record.access_token,
+    refresh_token: typeof record.refresh_token === "string" ? record.refresh_token : void 0,
+    // A missing expiry reads as "already expired", which triggers a refresh
+    // rather than handing out a token we cannot vouch for.
+    expires_at: typeof record.expires_at === "number" ? record.expires_at : 0,
+    scope: typeof record.scope === "string" ? record.scope : void 0,
+    instance: record.instance,
+    workspace_id: requireWorkspaceId(record.workspace_id, at),
+    auth_host: record.auth_host,
+    client_id: record.client_id
+  };
+}
+function parseToken(record, path, profile) {
+  return buildTokenCredential(
+    {
+      instance: record.instance_base_url,
+      workspaceId: record.workspace_id,
+      token: record.meta_api_token
+    },
+    {
+      at: whereIn("token", path, profile),
+      labels: {
+        instance: "instance_base_url",
+        workspace: "workspace_id",
+        token: "meta_api_token"
+      },
+      fix: `Edit \`meta_api_token\` in ${path} to hold the token alone, on one line.`
+    }
+  );
+}
+function buildTokenCredential(values, source) {
+  const { at, labels } = source;
+  const raw = values.instance;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new Error(
+      `Missing \`${labels.instance}\` ${at}. It must be the instance URL, e.g. "https://your-instance.xano.io".`
+    );
+  }
+  let origin;
+  try {
+    origin = new URL(raw.trim()).origin;
+  } catch {
+    throw new Error(
+      `\`${labels.instance}\` ${at} is not a valid URL ("${raw}"), e.g. "https://your-instance.xano.io".`
+    );
+  }
+  assertHttpsOrigin(raw.trim(), `\`${labels.instance}\` ${at}`);
+  const token = values.token;
+  if (typeof token !== "string" || token.trim() === "") {
+    throw new Error(`Missing \`${labels.token}\` ${at}. It must be a meta API bearer token.`);
+  }
+  registerSecret(token);
+  const problem = tokenTextProblem(token.trim());
+  if (problem !== void 0) {
+    throw new UsageError(
+      `${labels.token.includes(" ") ? labels.token[0].toUpperCase() + labels.token.slice(1) : `\`${labels.token}\``} ${at} ${problem}, which no request can carry. ` + (source.fix ?? `Set it to the meta API token alone \u2014 one line, nothing else.`)
+    );
+  }
+  if (values.workspaceId === void 0) {
+    throw new Error(`Missing \`${labels.workspace}\` ${at}. It must be the numeric workspace id.`);
+  }
+  return {
+    type: "token",
+    instance_base_url: origin,
+    workspace_id: requireWorkspaceId(values.workspaceId, at, labels.workspace),
+    // A pasted token routinely carries stray whitespace or a newline.
+    meta_api_token: token.trim()
+  };
+}
+function isSafeIdText(text) {
+  return /^\d+$/.test(text.trim()) && Number.isSafeInteger(Number(text.trim()));
+}
+function requireWorkspaceId(value, at, label = "workspace_id") {
+  if (typeof value === "string" && /^\d+$/.test(value.trim()) || typeof value === "number" && Number.isInteger(value) && !Number.isSafeInteger(value)) {
+    throw new UsageError(
+      `\`${label}\` ${at} is out of range (got ${typeof value === "string" ? value.trim() : JSON.stringify(value)}) \u2014 a workspace id is a positive integer no larger than ${Number.MAX_SAFE_INTEGER}.`
+    );
+  }
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw new UsageError(`\`${label}\` ${at} must be a positive integer (got ${JSON.stringify(value)}).`);
+  }
+  return value;
+}
+function writeCredentialFile(path, file) {
+  const existing = readExistingRaw(path);
+  assertOursIfPresent(existing, path, "overwrite");
+  assertWritableVersion(existing, path);
+  const body = {
+    version: CREDENTIAL_FILE_VERSION,
+    ...file.default === void 0 ? {} : { default: file.default },
+    profiles: file.profiles,
+    ...unknownTopLevelKeys(existing)
+  };
+  try {
+    mkdirSync2(dirname2(path), { recursive: true });
+    atomicWrite(path, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
+  } catch (err) {
+    throw credentialWriteFailure(err, path);
+  }
+}
+function assertCredentialFileWritable(path) {
+  if (isDirectory(path)) {
+    throw new UsageError(`${path} is a directory, so no credential can be written there. Remove or rename it, or pass \`--config <file>\`.`);
+  }
+  const existing = readExistingRaw(path);
+  assertOursIfPresent(existing, path, "overwrite");
+  assertWritableVersion(existing, path);
+  const target = linkTarget(path);
+  assertDirectoryWritable(target);
+  assertLockPathUsable(target);
+}
+function assertDirectoryWritable(path) {
+  const blocker = fileInTheWay(path);
+  if (blocker !== void 0) {
+    throw new UsageError(
+      `No credential can be written to ${path}: ${blocker} is a file, not a directory. Pass \`--config <file>\` with a path whose directories are directories.`
+    );
+  }
+  let dir = dirname2(path);
+  while (!existsSync2(dir)) {
+    const parent = dirname2(dir);
+    if (parent === dir) return;
+    dir = parent;
+  }
+  try {
+    accessSync(dir, fsConstants.W_OK | fsConstants.X_OK);
+  } catch (err) {
+    if (err?.code === "EROFS") {
+      throw new UsageError(`No credential can be written to ${path}: ${dir} is on a read-only file system (EROFS). Pass \`--config <file>\` somewhere you can write.`);
+    }
+    throw new UsageError(
+      `No credential can be written to ${path}: ${dir} is not writable by this user. Make it writable, or pass \`--config <file>\` somewhere you can write.`
+    );
+  }
+}
+function assertWritableVersion(existing, path, verb = "overwrite") {
+  if (existing.absent || existing.unparseable) return;
+  const version = existing.value?.version;
+  if (typeof version === "number" && version > CREDENTIAL_FILE_VERSION) {
+    throw new Error(
+      `Credential file at ${path} is version ${version}, newer than this CLI understands (${CREDENTIAL_FILE_VERSION}). Refusing to ${verb} it \u2014 ${UPGRADE_REMEDY}`
+    );
+  }
+}
+function assertCredentialFileRemovable(path) {
+  const existing = readExistingRaw(path);
+  assertOursIfPresent(existing, path, "delete");
+  assertWritableVersion(existing, path, "delete");
+}
+function unknownTopLevelKeys(existing) {
+  const value = existing.value;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+  const record = value;
+  if (!isEnvelope(record)) return {};
+  return Object.fromEntries(Object.entries(record).filter(([key2]) => key2 !== "version" && key2 !== "default" && key2 !== "profiles"));
+}
+function readExistingRaw(path) {
+  if (!credentialFileExists(path)) return { absent: true, unparseable: false, value: void 0 };
+  const text = readCredentialText(path);
+  try {
+    return { absent: false, unparseable: false, value: JSON.parse(text) };
+  } catch {
+    return { absent: false, unparseable: true, value: void 0 };
+  }
+}
+function assertOursIfPresent(existing, path, verb) {
+  if (existing.absent) return;
+  if (!existing.unparseable && isCredentialRecord(existing.value)) return;
+  {
+    throw new Error(
+      `Refusing to ${verb} ${path}: it exists but is not a Xano SDK credential file. Choose a different --config/$XANO_CONFIG path \u2014 or, if this really is a credential file that has been corrupted beyond recognition, delete it yourself and run \`${loginCommand(DEFAULT_PROFILE, { path })}\` again.`
+    );
+  }
+}
+var CREDENTIAL_LOCK_OPTS = {
+  // The retry budget deliberately EXCEEDS `stale`: a writer killed mid-write
+  // leaves a lock that only goes stale at 20s, and a budget shorter than that
+  // would fail the next command with a raw ELOCKED for a process that no longer
+  // exists. ~60s of retries against a 20s stale window means the common crash
+  // recovers by waiting rather than by the user deleting a lock directory.
+  retries: { retries: 60, factor: 1.3, minTimeout: 50, maxTimeout: 1e3 },
+  stale: 2e4
+};
+async function withCredentialLock(path, fn) {
+  const target = linkTarget(path);
+  assertDirectoryWritable(target);
+  let created;
+  let release;
+  try {
+    mkdirSync2(dirname2(target), { recursive: true });
+    created = bootstrapEnvelope(target);
+  } catch (err) {
+    throw credentialWriteFailure(err, path);
+  }
+  try {
+    release = await acquireCredentialLock(target);
+  } catch (err) {
+    if (created && holdsNoProfiles(target)) rmSync(target, { force: true });
+    throw credentialWriteFailure(err, path);
+  }
+  try {
+    assertWritableVersion(readExistingRaw(path), path, "change");
+    return await fn(readCredentialFile(path) ?? emptyCredentialFile());
+  } catch (err) {
+    if (created && holdsNoProfiles(target)) rmSync(target, { force: true });
+    throw err;
+  } finally {
+    await release();
+  }
+}
+function bootstrapEnvelope(path) {
+  try {
+    writeFileSync(path, JSON.stringify(emptyCredentialFile(), null, 2) + "\n", {
+      encoding: "utf8",
+      mode: 384,
+      flag: "wx"
+    });
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+async function acquireCredentialLock(path) {
+  assertLockPathUsable(path);
+  try {
+    return await lockfile.lock(path, CREDENTIAL_LOCK_OPTS);
+  } catch (err) {
+    if (err.code !== "ELOCKED") throw err;
+    throw new Error(
+      `Timed out waiting for the credential file lock on ${path}. Another \`xanosdk\` command is writing it \u2014 wait for that one to finish and re-run. If no other run is in progress, a previous one was killed mid-write: remove ${path}.lock and try again.`
+    );
+  }
+}
+function assertLockPathUsable(path) {
+  let real = path;
+  try {
+    real = realpathSync(path);
+  } catch {
+  }
+  const lock = `${real}.lock`;
+  let isDir;
+  try {
+    isDir = lstatSync(lock).isDirectory();
+  } catch {
+    return;
+  }
+  if (!isDir) {
+    throw new UsageError(
+      `The credential file lock ${lock} is not a directory, so no \`xanosdk\` run can take it. If no other \`xanosdk\` command is running, remove it (\`rm ${shellQuote(lock)}\`) and try again.`
+    );
+  }
+}
+function clearCredential(path) {
+  if (!credentialFileExists(path)) return false;
+  assertCredentialFileRemovable(path);
+  removeCredentialFile(path);
+  return true;
+}
+function removeCredentialFile(path) {
+  try {
+    rmSync(path, { force: true });
+  } catch (err) {
+    throw credentialWriteFailure(err, path);
+  }
+}
+async function clearCredentialUnderLock(path, fn) {
+  if (!credentialFileExists(path)) return false;
+  return withCredentialLock(path, async (file) => {
+    assertCredentialFileRemovable(path);
+    await fn?.(file);
+    removeCredentialFile(path);
+    return true;
+  });
+}
+function writeOrRemoveCredentialFile(path, file) {
+  if (profileNames(file).length > 0) {
+    writeCredentialFile(path, file);
+    return false;
+  }
+  assertCredentialFileRemovable(path);
+  removeCredentialFile(path);
+  return true;
+}
+function removeEmptyProjectCacheDir(path) {
+  if (resolve(path) !== localAuthFilePath() || existsSync2(path)) return false;
+  try {
+    rmdirSync(dirname2(localAuthFilePath()));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function dropProfile(file, name) {
+  delete file.profiles[name];
+  if (file.default === name) delete file.default;
+  return file;
+}
+function insideGitRepo(path) {
+  return findGitRoot(dirname2(resolve(path))) !== void 0;
+}
+function findGitRoot(startDir) {
+  let dir = resolve(startDir);
+  for (; ; ) {
+    if (existsSync2(join2(dir, ".git"))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function ensureGitignored(authFilePath, opts = {}) {
+  return addGitignoreRule(authFilePath, opts) !== void 0;
+}
+function gitignoreRootFor(path, opts = {}) {
+  return findGitRoot(dirname2(resolve(path))) ?? opts.root ?? process.cwd();
+}
+function addGitignoreRule(authFilePath, opts = {}) {
+  const abs = resolve(authFilePath);
+  const root = gitignoreRootFor(abs, opts);
+  const rel = relative(root, abs);
+  if (rel.startsWith("..")) return void 0;
+  const containingDir = dirname2(abs);
+  const insideBackend = relForwardSlash(root, containingDir).split("/").includes(XANO_DIR);
+  const dedicatedDir = basename(containingDir) === DEDICATED_DIR;
+  const fileEntry = relForwardSlash(root, abs);
+  const entry = opts.fileOnly === true || insideBackend || containingDir === root || !dedicatedDir ? (
+    // This file, and nothing around it. A root-level name is anchored with a
+    // leading slash: a pattern with no slash in it matches at ANY depth, so
+    // `out.json` also ignored every `out.json` in every subdirectory (E2E
+    // pass 26). One with a slash inside is anchored already.
+    fileEntry.includes("/") ? fileEntry : `/${fileEntry}`
+  ) : relForwardSlash(root, containingDir) + "/";
+  const gitignorePath = join2(root, ".gitignore");
+  const existing = existsSync2(gitignorePath) ? readFileSync2(gitignorePath, "utf8") : "";
+  if (ignoreCovers(existing, entry) || ignoreCovers(existing, fileEntry) || gitIgnores(abs)) return void 0;
+  const prefix = existing.length === 0 || existing.endsWith("\n") ? existing : existing + "\n";
+  writeFileSync(gitignorePath, `${prefix}${entry}
+`, "utf8");
+  return entry;
+}
+function gitIgnores(abs) {
+  return gitSaysIgnored(abs) === true;
+}
+function gitSaysIgnored(abs) {
+  const root = findGitRoot(dirname2(resolve(abs)));
+  if (root === void 0) return void 0;
+  try {
+    execFileSync("git", ["check-ignore", "-q", "--", abs], {
+      cwd: root,
+      stdio: ["ignore", "ignore", "ignore"],
+      // Bounded: `execFileSync` with no timeout blocks forever on a git that
+      // hangs or stops to prompt. A timeout reads as "cannot tell", which falls
+      // through to the line comparison — the conservative direction.
+      timeout: 5e3
+    });
+    return true;
+  } catch (err) {
+    const status = err.status;
+    return status === 1 ? false : void 0;
+  }
+}
+function relForwardSlash(root, target) {
+  return relative(root, target).split(/[\\/]/).join("/");
+}
+function ignoreCovers(gitignore, entry) {
+  const want = entry.replace(/\/$/, "");
+  return gitignore.split(/\r?\n/).map((line) => line.trim().replace(/\/$/, "")).some((line) => line.length > 0 && !line.startsWith("#") && line === want);
+}
+
+export {
+  CALLBACK_PATH,
+  DEFAULT_PORT,
+  decodeAudience,
+  oauthErrorCode,
+  oauthErrorResponse,
+  resolveOAuthErrorCode,
+  OpenIdProvider,
+  resolveAuthHost,
+  envOrigin,
+  resolveScope,
+  assertHttpsOrigin,
+  assertSignInOrigin,
+  assertInstanceOrigin,
+  assertNoUserinfo,
+  CREDENTIAL_FILE_VERSION,
+  emptyCredentialFile,
+  globalAuthFilePath,
+  localAuthFilePath,
+  resolveAuthFilePath,
+  assertCredentialPathUsable,
+  projectAuthFilePath,
+  readCredentialFile,
+  readProfile,
+  UPGRADE_REMEDY,
+  readCredential,
+  profileNames,
+  recordedCredentialPath,
+  recordedCredentialFile,
+  recordedProfileStored,
+  describeProfile,
+  loginHint,
+  credentialFileFlag,
+  loginCommand,
+  sameOriginAs,
+  addProfileHint,
+  profileAddCommand,
+  buildTokenCredential,
+  isSafeIdText,
+  writeCredentialFile,
+  assertCredentialFileWritable,
+  assertCredentialFileRemovable,
+  withCredentialLock,
+  clearCredential,
+  clearCredentialUnderLock,
+  writeOrRemoveCredentialFile,
+  removeEmptyProjectCacheDir,
+  dropProfile,
+  insideGitRepo,
+  ensureGitignored,
+  gitignoreRootFor,
+  addGitignoreRule,
+  gitSaysIgnored
+};
+//# sourceMappingURL=chunk-XW6KISBB.js.map