@xanots/sdk 0.0.1

package/dist/chunk-C56BC2FY.js

@@ -0,0 +1,254 @@
+import {
+  OpenIdProvider,
+  assertHttpsOrigin,
+  buildTokenCredential,
+  clearCredential,
+  decodeAudience,
+  globalAuthFilePath,
+  localAuthFilePath,
+  oauthErrorCode,
+  readCredential,
+  resolveAuthFilePath,
+  resolveAuthHost,
+  resolveScope,
+  writeCredential
+} from "./chunk-7REDODS2.js";
+import {
+  detail,
+  hostLabel,
+  info,
+  warn
+} from "./chunk-EZG76F7R.js";
+
+// src/auth/token.ts
+import lockfile from "proper-lockfile";
+var EXPIRY_SKEW_MS = 3e4;
+var REFRESH_LOCK_OPTS = {
+  retries: { retries: 30, factor: 1.3, minTimeout: 50, maxTimeout: 500 },
+  stale: 2e4
+};
+function stampExpiry(raw) {
+  return {
+    access_token: raw.access_token,
+    refresh_token: raw.refresh_token,
+    scope: raw.scope,
+    expires_at: Date.now() + (raw.expires_in ?? 0) * 1e3
+  };
+}
+function refreshAccessToken(authHost, clientId, refreshToken, scope) {
+  const provider = new OpenIdProvider({ authHost, scope: scope ?? "", clientId });
+  return provider.refresh(refreshToken, { scope });
+}
+function isTransientRefreshError(err) {
+  return oauthErrorCode(err) === void 0;
+}
+async function refreshWithRetry(authHost, clientId, refreshToken, scope) {
+  try {
+    return await refreshAccessToken(authHost, clientId, refreshToken, scope);
+  } catch (err) {
+    if (!isTransientRefreshError(err)) throw err;
+    detail(`Token refresh hit a network error; retrying once\u2026`);
+    return await refreshAccessToken(authHost, clientId, refreshToken, scope);
+  }
+}
+var ENV_INSTANCE = "XANO_INSTANCE_URL";
+var ENV_WORKSPACE = "XANO_WORKSPACE_ID";
+var ENV_META_TOKEN = "XANO_META_TOKEN";
+function readEnvVar(name) {
+  const raw = process.env[name];
+  return raw === void 0 || raw.trim() === "" ? void 0 : raw;
+}
+function readEnvMetaCredential() {
+  const instance = readEnvVar(ENV_INSTANCE);
+  const workspace = readEnvVar(ENV_WORKSPACE);
+  const token = readEnvVar(ENV_META_TOKEN);
+  if (instance === void 0 && workspace === void 0 && token === void 0) return void 0;
+  const missing = [
+    instance === void 0 ? ENV_INSTANCE : void 0,
+    workspace === void 0 ? ENV_WORKSPACE : void 0,
+    token === void 0 ? ENV_META_TOKEN : void 0
+  ].filter((n) => n !== void 0);
+  if (missing.length > 0) {
+    const set = [ENV_INSTANCE, ENV_WORKSPACE, ENV_META_TOKEN].filter((n) => !missing.includes(n));
+    throw new Error(
+      `Incomplete meta credential in the environment: ${set.join(", ")} ${set.length === 1 ? "is" : "are"} set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not. All three are required \u2014 check for a misspelled secret name, or unset the rest to use a different credential.`
+    );
+  }
+  return buildTokenCredential(
+    {
+      instance,
+      // Parsed here, not in the validator: pass the ORIGINAL string through on a
+      // bad parse so the rejection quotes what was actually set, not `NaN`.
+      workspaceId: /^\d+$/.test(workspace.trim()) ? Number(workspace.trim()) : workspace,
+      token
+    },
+    {
+      at: "in the environment",
+      labels: { instance: ENV_INSTANCE, workspace: ENV_WORKSPACE, token: ENV_META_TOKEN }
+    }
+  );
+}
+function envMetaCredentialVarsSet() {
+  return [ENV_INSTANCE, ENV_WORKSPACE, ENV_META_TOKEN].filter(
+    (name) => readEnvVar(name) !== void 0
+  );
+}
+function noteDisplacedCredentials(args) {
+  const configPath = args.authFile ?? process.env.XANO_CONFIG;
+  if (configPath !== void 0) {
+    info(`Using the ${ENV_META_TOKEN} credential from the environment \u2014 ignoring ${configPath}.`);
+  }
+  if (process.env.XANO_REFRESH_TOKEN !== void 0) {
+    info(`Using the ${ENV_META_TOKEN} credential from the environment \u2014 ignoring XANO_REFRESH_TOKEN.`);
+  }
+}
+async function getAccessToken(args) {
+  const envMeta = readEnvMetaCredential();
+  if (envMeta) {
+    assertHttpsOrigin(envMeta.instance_base_url, ENV_INSTANCE);
+    noteDisplacedCredentials(args);
+    return {
+      access_token: envMeta.meta_api_token,
+      instance: envMeta.instance_base_url,
+      workspaceId: envMeta.workspace_id,
+      credentialType: "token"
+    };
+  }
+  const envRefresh = process.env.XANO_REFRESH_TOKEN;
+  if (envRefresh) {
+    const authHost = resolveAuthHost(args);
+    assertHttpsOrigin(authHost, "--origin");
+    const clientId = process.env.XANO_CLIENT_ID;
+    if (!clientId) {
+      throw new Error(
+        `XANO_REFRESH_TOKEN is set but XANO_CLIENT_ID is not. A refresh token can only be exchanged by the client that minted it \u2014 copy both values from \`.xano/auth.json\` (fields "refresh_token" and "client_id") after \`xanots login\`.`
+      );
+    }
+    let set;
+    try {
+      set = await refreshAccessToken(authHost, clientId, envRefresh, resolveScope(args));
+    } catch (err) {
+      throw new Error(
+        `XANO_REFRESH_TOKEN exchange failed: ${err instanceof Error ? err.message : String(err)}
+The refresh token may be expired or already spent \u2014 refresh tokens rotate on use, so a single stored value is consumed on first exchange. Mint a fresh one via \`xanots login\`.`
+      );
+    }
+    const instance2 = decodeAudience(set.access_token);
+    if (!instance2) {
+      throw new Error(
+        `Could not determine the target instance from the token minted by XANO_REFRESH_TOKEN (no readable \`aud\` claim). Mint a fresh refresh token via \`xanots login\`.`
+      );
+    }
+    assertHttpsOrigin(instance2, "instance");
+    const { resolveScopedWorkspaceId } = await import("./workspace-K72NP7SX.js");
+    const workspaceId = await resolveScopedWorkspaceId({ access_token: set.access_token, instance: instance2 });
+    return { access_token: set.access_token, instance: instance2, workspaceId, credentialType: "oauth" };
+  }
+  const authFilePath = resolveAuthFilePath(args);
+  const saved = readCredential(authFilePath);
+  if (!saved) {
+    throw new Error(
+      `Not signed in (no credential at ${authFilePath}). Run \`xanots login\` first, or set XANO_REFRESH_TOKEN for CI.`
+    );
+  }
+  warnIfLocalShadowsGlobal(args, authFilePath, saved);
+  if (saved.type === "token") {
+    assertHttpsOrigin(saved.instance_base_url, "instance_base_url");
+    return {
+      access_token: saved.meta_api_token,
+      instance: saved.instance_base_url,
+      workspaceId: saved.workspace_id,
+      credentialType: "token"
+    };
+  }
+  const instance = saved.instance;
+  assertHttpsOrigin(instance, "instance");
+  if (Date.now() < saved.expires_at - EXPIRY_SKEW_MS) {
+    return {
+      access_token: saved.access_token,
+      instance,
+      workspaceId: saved.workspace_id,
+      credentialType: "oauth"
+    };
+  }
+  return refreshUnderLock(authFilePath, saved);
+}
+function targetOf(credential) {
+  return credential.type === "token" ? { instance: credential.instance_base_url, workspaceId: credential.workspace_id } : { instance: credential.instance, workspaceId: credential.workspace_id };
+}
+function warnIfLocalShadowsGlobal(args, resolved, saved) {
+  const isDefaultResolution = args.authFile === void 0 && process.env.XANO_CONFIG === void 0 && !args.local;
+  if (!isDefaultResolution || resolved !== localAuthFilePath()) return;
+  const globalPath = globalAuthFilePath();
+  if (globalPath === resolved) return;
+  let globalSaved = null;
+  try {
+    globalSaved = readCredential(globalPath);
+  } catch {
+    return;
+  }
+  if (!globalSaved) return;
+  const here = targetOf(saved);
+  const there = targetOf(globalSaved);
+  if (here.instance === there.instance && here.workspaceId === there.workspaceId) return;
+  warn(
+    `Using project-local ${resolved} (${hostLabel(here.instance)}, workspace ${here.workspaceId}), but a global credential for ${hostLabel(there.instance)}, workspace ${there.workspaceId} also exists \u2014 the local one wins. Remove ./.xano/auth.json (or pass --config) to use the global credential instead.`
+  );
+}
+async function refreshUnderLock(authFilePath, saved) {
+  const release = await lockfile.lock(authFilePath, REFRESH_LOCK_OPTS);
+  try {
+    const reread = readCredential(authFilePath);
+    const current = reread?.type === "oauth" ? reread : saved;
+    const instance = current.instance;
+    const workspaceId = current.workspace_id;
+    if (Date.now() < current.expires_at - EXPIRY_SKEW_MS) {
+      return { access_token: current.access_token, instance, workspaceId, credentialType: "oauth" };
+    }
+    if (!current.refresh_token) {
+      throw new Error(
+        `No usable access token for ${instance} and no refresh token is cached. Run \`xanots login\` again.`
+      );
+    }
+    detail(`Refreshing access token for ${hostLabel(instance)}\u2026`);
+    let set;
+    try {
+      set = await refreshWithRetry(current.auth_host, current.client_id, current.refresh_token, current.scope);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (oauthErrorCode(err) === "invalid_grant") {
+        clearCredential(authFilePath);
+        throw new Error(
+          `Session for ${instance} has expired or was revoked (the refresh token was rejected). Run \`xanots login\` to sign in again.`
+        );
+      }
+      if (isTransientRefreshError(err)) {
+        throw new Error(
+          `Token refresh for ${instance} could not reach the authorization server (${message}), even after one retry. This is a transient network error, not an auth problem \u2014 re-run the deploy. If it persists, check connectivity to ${current.auth_host}.`
+        );
+      }
+      throw new Error(
+        `Token refresh failed for ${instance}: ${message}
+Run \`xanots login\` to sign in again.`
+      );
+    }
+    const stamped = stampExpiry(set);
+    writeCredential(authFilePath, {
+      ...current,
+      access_token: stamped.access_token,
+      refresh_token: stamped.refresh_token ?? current.refresh_token,
+      expires_at: stamped.expires_at,
+      scope: stamped.scope ?? current.scope
+    });
+    return { access_token: stamped.access_token, instance, workspaceId, credentialType: "oauth" };
+  } finally {
+    await release();
+  }
+}
+
+export {
+  ENV_WORKSPACE,
+  envMetaCredentialVarsSet,
+  getAccessToken
+};
+//# sourceMappingURL=chunk-C56BC2FY.js.map

package/dist/chunk-DGSF2Q5H.js

@@ -0,0 +1,60 @@
+import {
+  ensureGitignored
+} from "./chunk-7REDODS2.js";
+import {
+  atomicWrite
+} from "./chunk-GNPVYOPB.js";
+
+// src/deploy/ephemeral-state.ts
+import { readFileSync, mkdirSync } from "fs";
+import { dirname, join, resolve } from "path";
+function ephemeralStatePath(dir) {
+  return join(resolve(dir), ".xano", "ephemeral.json");
+}
+function readEphemeralState(dir) {
+  const path = ephemeralStatePath(dir);
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { version: 1, environments: {} };
+  }
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object" && typeof parsed.environments === "object") {
+      const envs = parsed.environments ?? {};
+      return { version: 1, environments: { ...envs } };
+    }
+  } catch {
+  }
+  return { version: 1, environments: {} };
+}
+function getEnvironment(state, workspaceId) {
+  return state.environments[String(workspaceId)];
+}
+function setEnvironment(dir, workspaceId, record) {
+  const state = readEphemeralState(dir);
+  state.environments[String(workspaceId)] = record;
+  writeState(dir, state);
+}
+function clearEnvironment(dir, workspaceId) {
+  const state = readEphemeralState(dir);
+  if (!(String(workspaceId) in state.environments)) return false;
+  delete state.environments[String(workspaceId)];
+  writeState(dir, state);
+  return true;
+}
+function writeState(dir, state) {
+  const path = ephemeralStatePath(dir);
+  mkdirSync(dirname(path), { recursive: true });
+  atomicWrite(path, JSON.stringify({ version: 1, environments: state.environments }, null, 2) + "\n");
+  ensureGitignored(path);
+}
+
+export {
+  readEphemeralState,
+  getEnvironment,
+  setEnvironment,
+  clearEnvironment
+};
+//# sourceMappingURL=chunk-DGSF2Q5H.js.map