@xanots/sdk 0.0.1

package/dist/chunk-7REDODS2.js

@@ -0,0 +1,468 @@
+import {
+  atomicWrite
+} from "./chunk-GNPVYOPB.js";
+
+// src/auth/oauth.ts
+import * as client from "openid-client";
+
+// src/auth/client-store.ts
+import { existsSync, readFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function clientStorePath() {
+  return process.env.XANO_CLIENT_FILE ?? join(homedir(), ".xano", "xanots-clients.json");
+}
+function key(authHost, redirectUri) {
+  return `${authHost}|${redirectUri}`;
+}
+function readAll(path) {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeAll(path, all) {
+  mkdirSync(dirname(path), { recursive: true });
+  atomicWrite(path, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+}
+async function getOrRegisterClient(params) {
+  const path = clientStorePath();
+  const all = readAll(path);
+  const k = key(params.authHost, params.redirectUri);
+  const cached = all[k];
+  if (cached?.client_id) return cached.client_id;
+  const { client_id } = await registerClient({
+    registrationEndpoint: params.registrationEndpoint,
+    redirectUri: params.redirectUri,
+    scope: params.scope
+  });
+  all[k] = { client_id };
+  writeAll(path, all);
+  return client_id;
+}
+function clearClient(params) {
+  const path = clientStorePath();
+  const all = readAll(path);
+  const k = key(params.authHost, params.redirectUri);
+  if (!(k in all)) return;
+  delete all[k];
+  writeAll(path, all);
+}
+
+// src/auth/oauth.ts
+var CALLBACK_PATH = "/oauth/callback";
+var DEFAULT_PORT = 47100;
+var SOFTWARE_ID = "xanots";
+var DEFAULT_AUTH_HOST = "https://app.xano.com";
+var DEFAULT_SCOPE = "offline_access workspace:read workspace:write xano:dev";
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+var NETWORK_TIMEOUT_MS = 3e4;
+async function discover(authHost) {
+  const url = new URL(DISCOVERY_PATH, authHost).href;
+  const res = await fetch(url, { signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS) });
+  if (!res.ok) {
+    throw new Error(
+      `OAuth discovery failed (${res.status} ${res.statusText}) at ${url}. Check --origin (currently ${authHost}).`
+    );
+  }
+  const doc = await res.json();
+  if (!doc.authorization_endpoint || !doc.token_endpoint) {
+    throw new Error(`OAuth discovery doc at ${url} is missing authorization/token endpoints.`);
+  }
+  return {
+    authorization_endpoint: doc.authorization_endpoint,
+    token_endpoint: doc.token_endpoint,
+    registration_endpoint: doc.registration_endpoint
+  };
+}
+async function registerClient(params) {
+  const res = await fetch(params.registrationEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "xanots CLI",
+      software_id: SOFTWARE_ID,
+      redirect_uris: [params.redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scopes: params.scope.split(/\s+/).filter(Boolean)
+    }),
+    signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS)
+  });
+  const text = await res.text();
+  if (res.status !== 200 && res.status !== 201) {
+    throw new Error(`Client registration failed (${res.status} ${res.statusText}):
+${text}`);
+  }
+  const doc = JSON.parse(text);
+  if (!doc.client_id) {
+    throw new Error(`Client registration response had no client_id:
+${text}`);
+  }
+  return { client_id: doc.client_id };
+}
+function decodeAudience(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return Array.isArray(payload.aud) ? payload.aud[0] : payload.aud;
+  } catch {
+    return void 0;
+  }
+}
+function oauthErrorCode(err) {
+  if (err && typeof err === "object" && "error" in err) {
+    const code = err.error;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+var OpenIdProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  configPromise;
+  /** The client_id the resolved config uses — set once `build()` completes. */
+  resolvedClientId;
+  redirectUri() {
+    if (!this.opts.redirectUri) {
+      throw new Error("OpenIdProvider: redirectUri is required for the authorize/exchange flow.");
+    }
+    return this.opts.redirectUri;
+  }
+  /**
+   * The client_id this provider registered or reused. Only valid after the
+   * config has resolved (e.g. after `buildAuthUrl`/`exchange`); throws otherwise
+   * so a caller never records an empty client_id.
+   */
+  clientId() {
+    if (!this.resolvedClientId) {
+      throw new Error("OpenIdProvider.clientId() called before the configuration was resolved.");
+    }
+    return this.resolvedClientId;
+  }
+  async build() {
+    const server = new URL(this.opts.authHost);
+    const options = server.protocol === "http:" ? { execute: [client.allowInsecureRequests] } : void 0;
+    let clientId = this.opts.clientId;
+    if (!clientId) {
+      const { registration_endpoint } = await discover(this.opts.authHost);
+      if (!registration_endpoint) {
+        throw new Error(
+          `The OAuth server at ${this.opts.authHost} does not advertise a registration endpoint, so xanots can't register its loopback client. Check --origin.`
+        );
+      }
+      clientId = await getOrRegisterClient({
+        authHost: this.opts.authHost,
+        redirectUri: this.redirectUri(),
+        registrationEndpoint: registration_endpoint,
+        scope: this.opts.scope
+      });
+    }
+    this.resolvedClientId = clientId;
+    return client.discovery(
+      server,
+      clientId,
+      { token_endpoint_auth_method: "none" },
+      client.None(),
+      options
+    );
+  }
+  config() {
+    return this.configPromise ??= this.build();
+  }
+  async reset() {
+    this.configPromise = void 0;
+    this.resolvedClientId = void 0;
+    if (this.opts.redirectUri) {
+      clearClient({ authHost: this.opts.authHost, redirectUri: this.opts.redirectUri });
+    }
+  }
+  async buildAuthUrl({ verifier, state }) {
+    const config = await this.config();
+    const code_challenge = await client.calculatePKCECodeChallenge(verifier);
+    return client.buildAuthorizationUrl(config, {
+      redirect_uri: this.redirectUri(),
+      scope: this.opts.scope,
+      code_challenge,
+      code_challenge_method: "S256",
+      state
+    }).href;
+  }
+  async exchange(callbackUrl, { verifier, state }) {
+    const config = await this.config();
+    const tokens = await client.authorizationCodeGrant(config, new URL(callbackUrl), {
+      // We don't request `openid`, so no ID Token is expected.
+      pkceCodeVerifier: verifier,
+      expectedState: state,
+      idTokenExpected: false
+    });
+    return pick(tokens);
+  }
+  async refresh(refreshToken, opts) {
+    const config = await this.config();
+    const params = {};
+    if (opts?.scope) params.scope = opts.scope;
+    return pick(await client.refreshTokenGrant(config, refreshToken, params));
+  }
+  async revoke(refreshToken) {
+    const config = await this.config();
+    await client.tokenRevocation(config, refreshToken, { token_type_hint: "refresh_token" });
+  }
+};
+function pick(t) {
+  return {
+    access_token: t.access_token,
+    refresh_token: t.refresh_token,
+    expires_in: t.expires_in,
+    scope: t.scope
+  };
+}
+
+// src/auth/store.ts
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, relative, resolve } from "path";
+var DEFAULT_AUTH_FILE = join2(".xano", "auth.json");
+function globalAuthFilePath() {
+  return process.env.XANO_GLOBAL_CONFIG ?? join2(homedir2(), ".xanots", "auth.json");
+}
+function localAuthFilePath() {
+  return resolve(DEFAULT_AUTH_FILE);
+}
+function resolveAuthFilePath(args, mode = "read") {
+  const explicit = args.authFile ?? process.env.XANO_CONFIG;
+  if (explicit !== void 0) return resolve(explicit);
+  const local = localAuthFilePath();
+  if (args.local) return local;
+  const global = globalAuthFilePath();
+  if (mode === "write") return global;
+  if (existsSync2(local)) return local;
+  return global;
+}
+function readCredential(path) {
+  if (!existsSync2(path)) return null;
+  const text = readFileSync2(path, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `Credential file at ${path} is corrupt (invalid JSON). Delete it and run \`xanots login\` again.`
+    );
+  }
+  return parseCredential(parsed, path);
+}
+function isCredentialRecord(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const record = v;
+  if (record.type === "oauth" || record.type === "token") return true;
+  return typeof record.access_token === "string" && typeof record.instance === "string";
+}
+function parseCredential(v, path) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) {
+    throw new Error(`Credential file at ${path} is not a JSON object. ${REAUTH_HINT}`);
+  }
+  const record = v;
+  const type = record.type;
+  if (type === void 0) {
+    throw new Error(
+      `Credential file at ${path} has no \`type\` field \u2014 it predates the typed credential format. Run \`xanots login\` again to replace it.`
+    );
+  }
+  if (type === "oauth") return parseOAuth(record, path);
+  if (type === "token") return parseToken(record, path);
+  throw new Error(
+    `Credential file at ${path} has an unrecognized \`type\` (${JSON.stringify(type)}). Expected "oauth" or "token".`
+  );
+}
+var REAUTH_HINT = "Delete it and run `xanots login` again.";
+function parseOAuth(record, path) {
+  const at = `in the "oauth" credential at ${path}`;
+  if (typeof record.access_token !== "string" || record.access_token === "") {
+    throw new Error(`Missing \`access_token\` ${at}. ${REAUTH_HINT}`);
+  }
+  if (typeof record.instance !== "string" || record.instance === "") {
+    throw new Error(`Missing \`instance\` ${at}. ${REAUTH_HINT}`);
+  }
+  if (record.workspace_id === void 0) {
+    throw new Error(
+      `Missing \`workspace_id\` ${at} \u2014 it predates workspace pinning at login. ${REAUTH_HINT}`
+    );
+  }
+  if (typeof record.auth_host !== "string" || record.auth_host === "") {
+    throw new Error(`Missing \`auth_host\` ${at}. ${REAUTH_HINT}`);
+  }
+  if (typeof record.client_id !== "string" || record.client_id === "") {
+    throw new Error(`Missing \`client_id\` ${at}. ${REAUTH_HINT}`);
+  }
+  return {
+    type: "oauth",
+    access_token: record.access_token,
+    refresh_token: typeof record.refresh_token === "string" ? record.refresh_token : void 0,
+    // A missing expiry reads as "already expired", which triggers a refresh
+    // rather than handing out a token we cannot vouch for.
+    expires_at: typeof record.expires_at === "number" ? record.expires_at : 0,
+    scope: typeof record.scope === "string" ? record.scope : void 0,
+    instance: record.instance,
+    workspace_id: requireWorkspaceId(record.workspace_id, at),
+    auth_host: record.auth_host,
+    client_id: record.client_id
+  };
+}
+function parseToken(record, path) {
+  return buildTokenCredential(
+    {
+      instance: record.instance_base_url,
+      workspaceId: record.workspace_id,
+      token: record.meta_api_token
+    },
+    {
+      at: `in the "token" credential at ${path}`,
+      labels: {
+        instance: "instance_base_url",
+        workspace: "workspace_id",
+        token: "meta_api_token"
+      }
+    }
+  );
+}
+function buildTokenCredential(values, source) {
+  const { at, labels } = source;
+  const raw = values.instance;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new Error(
+      `Missing \`${labels.instance}\` ${at}. It must be the instance URL, e.g. "https://your-instance.xano.io".`
+    );
+  }
+  let origin;
+  try {
+    origin = new URL(raw.trim()).origin;
+  } catch {
+    throw new Error(
+      `\`${labels.instance}\` ${at} is not a valid URL ("${raw}"), e.g. "https://your-instance.xano.io".`
+    );
+  }
+  const token = values.token;
+  if (typeof token !== "string" || token.trim() === "") {
+    throw new Error(`Missing \`${labels.token}\` ${at}. It must be a meta API bearer token.`);
+  }
+  if (values.workspaceId === void 0) {
+    throw new Error(`Missing \`${labels.workspace}\` ${at}. It must be the numeric workspace id.`);
+  }
+  return {
+    type: "token",
+    instance_base_url: origin,
+    workspace_id: requireWorkspaceId(values.workspaceId, at, labels.workspace),
+    // A pasted token routinely carries stray whitespace or a newline.
+    meta_api_token: token.trim()
+  };
+}
+function requireWorkspaceId(value, at, label = "workspace_id") {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw new Error(`\`${label}\` ${at} must be a positive integer (got ${JSON.stringify(value)}).`);
+  }
+  return value;
+}
+function writeCredential(path, credential) {
+  assertOursIfPresent(path, "overwrite");
+  mkdirSync2(dirname2(path), { recursive: true });
+  atomicWrite(path, JSON.stringify(credential, null, 2) + "\n", { mode: 384 });
+}
+function assertOursIfPresent(path, verb) {
+  if (!existsSync2(path)) return;
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    existing = void 0;
+  }
+  if (!isCredentialRecord(existing)) {
+    throw new Error(
+      `Refusing to ${verb} ${path}: it exists but is not a XanoTS credential file. Choose a different --config/$XANO_CONFIG path.`
+    );
+  }
+}
+function clearCredential(path) {
+  if (!existsSync2(path)) return false;
+  assertOursIfPresent(path, "delete");
+  rmSync(path);
+  return true;
+}
+function findGitRoot(startDir) {
+  let dir = resolve(startDir);
+  for (; ; ) {
+    if (existsSync2(join2(dir, ".git"))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function ensureGitignored(authFilePath) {
+  const abs = resolve(authFilePath);
+  const root = findGitRoot(dirname2(abs)) ?? process.cwd();
+  const rel = relative(root, abs);
+  if (rel.startsWith("..")) return false;
+  const containingDir = dirname2(abs);
+  const entry = containingDir === root ? relForwardSlash(root, abs) : relForwardSlash(root, containingDir) + "/";
+  const gitignorePath = join2(root, ".gitignore");
+  const existing = existsSync2(gitignorePath) ? readFileSync2(gitignorePath, "utf8") : "";
+  if (ignoreCovers(existing, entry)) return false;
+  const prefix = existing.length === 0 || existing.endsWith("\n") ? existing : existing + "\n";
+  writeFileSync(gitignorePath, `${prefix}${entry}
+`, "utf8");
+  return true;
+}
+function relForwardSlash(root, target) {
+  return relative(root, target).split(/[\\/]/).join("/");
+}
+function ignoreCovers(gitignore, entry) {
+  const want = entry.replace(/\/$/, "");
+  return gitignore.split(/\r?\n/).map((line) => line.trim().replace(/\/$/, "")).some((line) => line.length > 0 && !line.startsWith("#") && line === want);
+}
+
+// src/auth/config.ts
+function resolveAuthHost(args, saved) {
+  return args.authHost ?? process.env.XANO_ORIGIN ?? saved ?? DEFAULT_AUTH_HOST;
+}
+function resolveScope(args) {
+  return args.scope ?? DEFAULT_SCOPE;
+}
+function assertHttpsOrigin(origin, label) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    throw new Error(`${label} is not a valid URL: "${origin}" (expected e.g. https://your-instance.xano.io).`);
+  }
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error(`${label} must use https:// (got "${origin}"). Plain http is allowed only for localhost.`);
+  }
+}
+
+export {
+  CALLBACK_PATH,
+  DEFAULT_PORT,
+  decodeAudience,
+  oauthErrorCode,
+  OpenIdProvider,
+  globalAuthFilePath,
+  localAuthFilePath,
+  resolveAuthFilePath,
+  readCredential,
+  buildTokenCredential,
+  writeCredential,
+  clearCredential,
+  ensureGitignored,
+  resolveAuthHost,
+  resolveScope,
+  assertHttpsOrigin
+};
+//# sourceMappingURL=chunk-7REDODS2.js.map