xapi-to 0.1.19 → 0.1.20

package/dist/chunk-TYY6JR6O.js

@@ -0,0 +1,870 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/config.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "fs";
+
+// src/format.ts
+function getFormat() {
+  const f = process.env.XAPI_OUTPUT || "json";
+  if (f === "pretty" || f === "table") return f;
+  return "json";
+}
+function output(data, format) {
+  const fmt = format || getFormat();
+  if (fmt === "json") {
+    console.log(JSON.stringify(data));
+    return;
+  }
+  if (fmt === "pretty") {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (fmt === "table") {
+    const rows = tableRows(data);
+    if (rows) {
+      printTable(rows);
+      return;
+    }
+  }
+  console.log(JSON.stringify(data, null, 2));
+}
+function tableRows(data) {
+  if (Array.isArray(data)) return normalizeRows(data, "value");
+  if (!data || typeof data !== "object") return null;
+  const obj = data;
+  const preferredKeys = ["items", "actions", "results", "services", "categories", "bindings", "providers"];
+  for (const key of preferredKeys) {
+    const value = obj[key];
+    if (Array.isArray(value)) return normalizeRows(value, singularKey(key));
+  }
+  const firstArray = Object.entries(obj).find(([, value]) => Array.isArray(value));
+  return firstArray ? normalizeRows(firstArray[1], singularKey(firstArray[0])) : null;
+}
+function normalizeRows(rows, primitiveKey) {
+  return rows.map((row) => {
+    if (row && typeof row === "object" && !Array.isArray(row)) {
+      return row;
+    }
+    return { [primitiveKey]: row };
+  });
+}
+function singularKey(key) {
+  if (key === "categories") return "category";
+  if (key.endsWith("ies")) return `${key.slice(0, -3)}y`;
+  if (key.endsWith("s")) return key.slice(0, -1);
+  return "value";
+}
+function formatCell(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+function fitCell(value, width) {
+  const rendered = formatCell(value);
+  if (rendered.length <= width) return rendered.padEnd(width);
+  if (width <= 1) return "\u2026".slice(0, width);
+  return `${rendered.slice(0, width - 1)}\u2026`;
+}
+function printTable(rows) {
+  if (rows.length === 0) {
+    console.log("(empty)");
+    return;
+  }
+  const keys = Object.keys(rows[0]);
+  const widths = keys.map(
+    (k) => Math.min(40, Math.max(k.length, ...rows.map((r) => formatCell(r[k]).length)))
+  );
+  const sep = widths.map((w) => "-".repeat(w)).join("  ");
+  const header = keys.map((k, i) => k.padEnd(widths[i])).join("  ");
+  console.log(header);
+  console.log(sep);
+  for (const row of rows) {
+    const line = keys.map((k, i) => fitCell(row[k], widths[i])).join("  ");
+    console.log(line);
+  }
+}
+function err(msg, detail) {
+  if (process.stderr.isTTY) {
+    console.error(`Error: ${msg}`);
+    if (detail !== void 0) {
+      const rendered = detail && typeof detail === "object" ? JSON.stringify(detail, null, 2) : String(detail);
+      console.error(rendered.split("\n").map((line) => `  ${line}`).join("\n"));
+    }
+  } else {
+    const out = { error: msg };
+    if (detail !== void 0) out.detail = detail;
+    console.error(JSON.stringify(out));
+  }
+  process.exit(1);
+}
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+var XAPI_ACTION_HOST = process.env.XAPI_ACTION_HOST || "action.xapi.to";
+var XAPI_API_HOST = process.env.XAPI_API_HOST || "api.xapi.to";
+var XAPI_SANDBOX_HOST = process.env.XAPI_SANDBOX_HOST || "sandbox.xapi.to";
+function scheme(host) {
+  return isLoopbackHost(host) ? "http" : "https";
+}
+var ALLOWED_HOST_EXACT = ["xapi.to", "xapi.xyz"];
+var ALLOWED_HOST_SUFFIXES = [".xapi.to", ".xapi.xyz"];
+function hostnameOf(hostOrUrl) {
+  const raw = hostOrUrl.includes("://") ? hostOrUrl : `http://${hostOrUrl}`;
+  try {
+    return new URL(raw).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function isLoopbackIPv4(h) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+  if (!m) return false;
+  const octets = m.slice(1).map(Number);
+  return octets.every((o) => o <= 255) && octets[0] === 127;
+}
+function isLoopbackHostname(h) {
+  return h === "localhost" || h.endsWith(".localhost") || h === "::1" || h === "[::1]" || isLoopbackIPv4(h);
+}
+function isLoopbackHost(hostOrUrl) {
+  return isLoopbackHostname(hostnameOf(hostOrUrl));
+}
+function isAllowedHost(hostOrUrl) {
+  const h = hostnameOf(hostOrUrl);
+  if (!h) return false;
+  if (isLoopbackHostname(h)) return true;
+  if (ALLOWED_HOST_EXACT.includes(h)) return true;
+  return ALLOWED_HOST_SUFFIXES.some((suffix) => h.endsWith(suffix));
+}
+function assertAllowedHost(hostOrUrl) {
+  if (!isAllowedHost(hostOrUrl)) {
+    throw new Error(
+      `refusing to contact untrusted host "${hostnameOf(hostOrUrl) || hostOrUrl}": the xapi API key may only be sent to *.xapi.to, *.xapi.xyz, or localhost`
+    );
+  }
+}
+var CONFIG_DIR = join(homedir(), ".xapi");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+function loadFileConfig() {
+  if (!existsSync(CONFIG_FILE)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+    if (!parsed || typeof parsed !== "object") return {};
+    return typeof parsed.apiKey === "string" && parsed.apiKey.trim() ? { apiKey: parsed.apiKey } : {};
+  } catch {
+    return {};
+  }
+}
+function getApiKeySource() {
+  if (process.env.XAPI_KEY) return "XAPI_KEY";
+  if (process.env.XAPI_API_KEY) return "XAPI_API_KEY";
+  return loadFileConfig().apiKey ? "file" : "none";
+}
+function getConfig() {
+  const file = loadFileConfig();
+  return {
+    actionHost: XAPI_ACTION_HOST,
+    sandboxHost: XAPI_SANDBOX_HOST,
+    apiKey: process.env.XAPI_KEY || process.env.XAPI_API_KEY || file.apiKey
+  };
+}
+function requireApiKey(cfg) {
+  if (!cfg.apiKey) {
+    err("API key not configured", 'Run "npx xapi-to register" to create an account, or "npx xapi-to config set apiKey=<key>" to set an existing key.');
+  }
+}
+function saveConfig(updates) {
+  const current = loadFileConfig();
+  const merged = { ...current, ...updates };
+  if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") chmodSync(CONFIG_DIR, 448);
+  writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), { mode: 384 });
+  if (process.platform !== "win32") chmodSync(CONFIG_FILE, 384);
+}
+function showConfig() {
+  const cfg = getConfig();
+  return {
+    actionHost: cfg.actionHost,
+    sandboxHost: cfg.sandboxHost,
+    apiKey: cfg.apiKey ? `${cfg.apiKey.slice(0, 8)}...` : void 0,
+    source: {
+      apiKey: getApiKeySource()
+    },
+    configFile: CONFIG_FILE
+  };
+}
+
+// src/client.ts
+import { open, rm } from "fs/promises";
+import { once } from "events";
+import { resolve } from "path";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var EXECUTE_TIMEOUT_MS = 6e4;
+var TRANSFER_IDLE_TIMEOUT_MS = 6e4;
+var IDEMPOTENT_RETRIES = 2;
+var RETRY_BASE_DELAY_MS = 500;
+var RETRY_MAX_DELAY_MS = 8e3;
+var HttpError = class extends Error {
+  constructor(status, detail, retryAfterMs) {
+    super(`HTTP ${status}: ${detail}`);
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "HttpError";
+  }
+  status;
+  retryAfterMs;
+};
+var RequestTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`request timed out after ${timeoutMs}ms`);
+    this.timeoutMs = timeoutMs;
+    this.name = "RequestTimeoutError";
+  }
+  timeoutMs;
+};
+function isRetryableStatus(status) {
+  return status === 408 || status === 429 || status === 502 || status === 503 || status === 504;
+}
+function isRetryableNetworkError(e) {
+  if (!(e instanceof Error)) return false;
+  if (e instanceof HttpError || e instanceof RequestTimeoutError) return false;
+  if (e.name === "AbortError") return false;
+  return e instanceof TypeError || /network|fetch failed|econn|etimedout|eai_again|socket|dns/i.test(e.message);
+}
+function isRetryableRequestError(e) {
+  if (e instanceof HttpError) return isRetryableStatus(e.status);
+  if (e instanceof RequestTimeoutError) return true;
+  return isRetryableNetworkError(e);
+}
+function retryBaseDelayMs() {
+  const override = Number(process.env.XAPI_RETRY_BASE_MS);
+  return Number.isFinite(override) && override > 0 ? override : RETRY_BASE_DELAY_MS;
+}
+function transferIdleTimeoutMs() {
+  const override = Number(process.env.XAPI_TRANSFER_IDLE_TIMEOUT_MS);
+  return Number.isFinite(override) && override > 0 ? override : TRANSFER_IDLE_TIMEOUT_MS;
+}
+function backoffDelayMs(attempt, retryAfterMs) {
+  if (retryAfterMs !== void 0 && Number.isFinite(retryAfterMs) && retryAfterMs >= 0) {
+    return Math.min(retryAfterMs, RETRY_MAX_DELAY_MS);
+  }
+  const capped = Math.min(retryBaseDelayMs() * 2 ** attempt, RETRY_MAX_DELAY_MS);
+  return capped / 2 + Math.random() * (capped / 2);
+}
+function parseRetryAfterMs(res) {
+  const header = res.headers.get("retry-after");
+  if (!header) return void 0;
+  const seconds = Number(header);
+  if (Number.isFinite(seconds)) return seconds * 1e3;
+  const at = Date.parse(header);
+  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : void 0;
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function request(url, options, timeoutMs = DEFAULT_TIMEOUT_MS, retries = 0) {
+  assertAllowedHost(url);
+  let attempt = 0;
+  while (true) {
+    const controller = new AbortController();
+    const callerSignal = options.signal;
+    const abortFromCaller = () => controller.abort();
+    if (callerSignal?.aborted) controller.abort();
+    else callerSignal?.addEventListener("abort", abortFromCaller, { once: true });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    try {
+      const res = await fetch(url, { ...options, redirect: "manual", signal: controller.signal });
+      if (res.status >= 300 && res.status < 400) {
+        throw new Error(
+          `refusing to follow redirect to "${res.headers.get("location") ?? "?"}" (would forward the API key past the host allowlist)`
+        );
+      }
+      if (!res.ok) {
+        const retryAfterMs = isRetryableStatus(res.status) ? parseRetryAfterMs(res) : void 0;
+        if (isRetryableStatus(res.status) && attempt < retries) {
+          await res.text().catch(() => "");
+          clearTimeout(timer);
+          await sleep(backoffDelayMs(attempt, retryAfterMs));
+          attempt++;
+          continue;
+        }
+        const text2 = await res.text();
+        throw new HttpError(res.status, text2.slice(0, 300), retryAfterMs);
+      }
+      if (res.status === 204) {
+        return void 0;
+      }
+      const text = await res.text();
+      if (!text.trim()) {
+        return void 0;
+      }
+      const body = JSON.parse(text);
+      if (body && typeof body === "object" && "success" in body && body.success === false) {
+        const data = body.data;
+        if (data?.statusCode === 401 || data?.error === "Unauthorized") {
+          throw new Error(
+            "Authentication failed: " + (data.message || "Invalid or missing API key") + '. Run "npx xapi-to config set apiKey=<key>" to update your key.'
+          );
+        }
+        if (data?.error === "OAuth Required" || data?.statusCode === 403 && data?.message?.includes("OAuth")) {
+          throw new Error(
+            (data.message || "OAuth authorization required") + '. Run "xapi-to oauth bind" to connect your account.'
+          );
+        }
+      }
+      return body;
+    } catch (e) {
+      if (timedOut) {
+        const timeoutError = new RequestTimeoutError(timeoutMs);
+        if (attempt < retries) {
+          await sleep(backoffDelayMs(attempt));
+          attempt++;
+          continue;
+        }
+        throw timeoutError;
+      }
+      if (isRetryableNetworkError(e) && attempt < retries) {
+        clearTimeout(timer);
+        await sleep(backoffDelayMs(attempt));
+        attempt++;
+        continue;
+      }
+      throw e;
+    } finally {
+      clearTimeout(timer);
+      callerSignal?.removeEventListener("abort", abortFromCaller);
+    }
+  }
+}
+function headers(apiKey) {
+  const h = { "Content-Type": "application/json" };
+  if (apiKey) h["XAPI-Key"] = apiKey;
+  return h;
+}
+function baseUrl(opts) {
+  return `${scheme(opts.actionHost)}://${opts.actionHost}`;
+}
+async function actionList(opts, params = {}) {
+  const url = new URL(`${baseUrl(opts)}/v1/actions`);
+  if (params.page) url.searchParams.set("page", String(params.page));
+  if (params.page_size) url.searchParams.set("page_size", String(params.page_size));
+  if (params.category) url.searchParams.set("category", params.category);
+  if (params.source) url.searchParams.set("source", params.source);
+  if (params.service_id) url.searchParams.set("service_id", params.service_id);
+  return request(
+    url.toString(),
+    { method: "GET", headers: headers(opts.apiKey) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function actionSearch(query, opts, params = {}) {
+  const url = new URL(`${baseUrl(opts)}/v1/actions/search`);
+  url.searchParams.set("q", query);
+  if (params.category) url.searchParams.set("category", params.category);
+  if (params.source) url.searchParams.set("source", params.source);
+  if (params.page) url.searchParams.set("page", String(params.page));
+  if (params.page_size) url.searchParams.set("page_size", String(params.page_size));
+  if (params.include_all_versions) url.searchParams.set("include_all_versions", "true");
+  if (params.sort) url.searchParams.set("sort", params.sort);
+  return request(
+    url.toString(),
+    { method: "GET", headers: headers(opts.apiKey) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function actionCategories(opts, params = {}) {
+  const url = new URL(`${baseUrl(opts)}/v1/actions/categories`);
+  if (params.source) url.searchParams.set("source", params.source);
+  return request(
+    url.toString(),
+    { method: "GET", headers: headers(opts.apiKey) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function actionGet(id, opts) {
+  return request(
+    `${baseUrl(opts)}/v1/actions/${encodeURIComponent(id)}`,
+    { method: "GET", headers: headers(opts.apiKey) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function actionBatch(ids, opts) {
+  return request(
+    `${baseUrl(opts)}/v1/actions/batch`,
+    {
+      method: "POST",
+      headers: headers(opts.apiKey),
+      body: JSON.stringify({ ids })
+    },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+    // read-only metadata fetch — safe to retry
+  );
+}
+async function actionCall(actionId, input, opts, httpMethod, retries = 0, timeoutMs = EXECUTE_TIMEOUT_MS) {
+  return request(
+    `${baseUrl(opts)}/v1/actions/execute`,
+    {
+      method: "POST",
+      headers: headers(opts.apiKey),
+      body: JSON.stringify({ action_id: actionId, ...httpMethod ? { method: httpMethod } : {}, input })
+    },
+    Math.min(timeoutMs, EXECUTE_TIMEOUT_MS),
+    retries
+  );
+}
+async function actionStream(actionId, input, opts, httpMethod) {
+  const controller = new AbortController();
+  let timedOut = false;
+  let activeTimeoutMs = EXECUTE_TIMEOUT_MS;
+  let timer;
+  const resetTimeout = (timeoutMs) => {
+    if (timer) clearTimeout(timer);
+    activeTimeoutMs = timeoutMs;
+    timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+  };
+  resetTimeout(EXECUTE_TIMEOUT_MS);
+  const url = `${baseUrl(opts)}/v1/actions/execute`;
+  assertAllowedHost(url);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        ...headers(opts.apiKey),
+        Accept: "text/event-stream"
+      },
+      body: JSON.stringify({
+        action_id: actionId,
+        ...httpMethod ? { method: httpMethod } : {},
+        input,
+        stream: true
+      }),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (res.status >= 300 && res.status < 400) {
+      throw new Error(
+        `refusing to follow redirect to "${res.headers.get("location") ?? "?"}" (would forward the API key past the host allowlist)`
+      );
+    }
+    if (!res.ok) {
+      const text = await res.text();
+      throw new HttpError(
+        res.status,
+        text.slice(0, 300),
+        isRetryableStatus(res.status) ? parseRetryAfterMs(res) : void 0
+      );
+    }
+    const contentType = res.headers.get("content-type") || "";
+    if (!contentType.toLowerCase().includes("text/event-stream")) {
+      const text = await res.text();
+      throw new Error(
+        `expected an SSE response but received "${contentType || "unknown"}": ${text.slice(0, 300)}`
+      );
+    }
+    if (!res.body) return;
+    const idleTimeoutMs = transferIdleTimeoutMs();
+    resetTimeout(idleTimeoutMs);
+    const source = Readable.fromWeb(res.body);
+    for await (const chunk of source) {
+      resetTimeout(idleTimeoutMs);
+      if (!process.stdout.write(chunk)) await once(process.stdout, "drain");
+    }
+  } catch (error) {
+    if (timedOut) throw new RequestTimeoutError(activeTimeoutMs);
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function actionDownload(actionId, input, opts, outputPath, httpMethod) {
+  const controller = new AbortController();
+  let timedOut = false;
+  let activeTimeoutMs = EXECUTE_TIMEOUT_MS;
+  let timer;
+  const resetTimeout = (timeoutMs) => {
+    if (timer) clearTimeout(timer);
+    activeTimeoutMs = timeoutMs;
+    timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+  };
+  resetTimeout(EXECUTE_TIMEOUT_MS);
+  const target = resolve(outputPath);
+  let file;
+  let complete = false;
+  try {
+    try {
+      file = await open(target, "wx");
+    } catch (error) {
+      if (error?.code === "EEXIST") {
+        throw new Error(`Output file already exists: ${target}`);
+      }
+      throw error;
+    }
+    const url = `${baseUrl(opts)}/v1/actions/execute`;
+    assertAllowedHost(url);
+    const res = await fetch(url, {
+      method: "POST",
+      headers: headers(opts.apiKey),
+      body: JSON.stringify({
+        action_id: actionId,
+        ...httpMethod ? { method: httpMethod } : {},
+        input,
+        response_mode: "raw"
+      }),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (res.status >= 300 && res.status < 400) {
+      throw new Error(
+        `refusing to follow redirect to "${res.headers.get("location") ?? "?"}" (would forward the API key past the host allowlist)`
+      );
+    }
+    if (!res.ok) {
+      const text = await res.text();
+      throw new HttpError(
+        res.status,
+        text.slice(0, 300),
+        isRetryableStatus(res.status) ? parseRetryAfterMs(res) : void 0
+      );
+    }
+    let bytes = 0;
+    if (res.body) {
+      const idleTimeoutMs = transferIdleTimeoutMs();
+      resetTimeout(idleTimeoutMs);
+      const source = Readable.fromWeb(res.body);
+      const counter = new Transform({
+        transform(chunk, _encoding, callback) {
+          resetTimeout(idleTimeoutMs);
+          bytes += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(chunk);
+          callback(null, chunk);
+        }
+      });
+      await pipeline(source, counter, file.createWriteStream());
+    } else {
+      await file.close();
+    }
+    complete = true;
+    return {
+      output: target,
+      bytes,
+      contentType: res.headers.get("content-type") || void 0,
+      contentDisposition: res.headers.get("content-disposition") || void 0,
+      status: res.status
+    };
+  } catch (error) {
+    if (timedOut) throw new RequestTimeoutError(activeTimeoutMs);
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (!complete && file) {
+      await file.close().catch(() => void 0);
+      await rm(target, { force: true }).catch(() => void 0);
+    }
+  }
+}
+async function actionServices(opts, params = {}) {
+  const url = new URL(`${baseUrl(opts)}/v1/actions/services`);
+  if (params.page) url.searchParams.set("page", String(params.page));
+  if (params.page_size) url.searchParams.set("page_size", String(params.page_size));
+  if (params.category) url.searchParams.set("category", params.category);
+  return request(
+    url.toString(),
+    { method: "GET", headers: headers(opts.apiKey) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function healthCheck(opts) {
+  return request(
+    `${baseUrl(opts)}/health`,
+    { method: "GET", headers: headers(opts.apiKey) },
+    5e3,
+    0
+    // health is a quick connectivity probe — fail fast, don't retry
+  );
+}
+async function loginWithApiKey(apiKey, apiHost) {
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/auth/login/apikey`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiKey })
+    },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+    // auth exchange has no side effect — safe to retry
+  );
+}
+function jwtHeaders(jwtToken) {
+  return { "Content-Type": "application/json", Authorization: `Bearer ${jwtToken}` };
+}
+async function listKeys(jwtToken, apiHost) {
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/keys`,
+    { method: "GET", headers: jwtHeaders(jwtToken) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function enableOAuthForKey(keyId, plaintextKey, jwtToken, apiHost) {
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/keys/${keyId}/enable-oauth`,
+    {
+      method: "POST",
+      headers: jwtHeaders(jwtToken),
+      body: JSON.stringify({ plaintextKey })
+    }
+  );
+}
+async function listOAuthProviders(apiHost) {
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/oauth/providers`,
+    { method: "GET", headers: { "Content-Type": "application/json" } },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function initiateOAuth(apiKeyId, providerId, jwtToken, apiHost, scopes) {
+  const body = { apiKeyId, providerId };
+  if (scopes) body.scopes = scopes;
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/oauth/authorize`,
+    {
+      method: "POST",
+      headers: jwtHeaders(jwtToken),
+      body: JSON.stringify(body)
+    }
+  );
+}
+async function listOAuthBindings(jwtToken, apiHost) {
+  return request(
+    `${scheme(apiHost)}://${apiHost}/api/oauth/bindings`,
+    { method: "GET", headers: jwtHeaders(jwtToken) },
+    DEFAULT_TIMEOUT_MS,
+    IDEMPOTENT_RETRIES
+  );
+}
+async function deleteOAuthBinding(bindingId, jwtToken, apiHost) {
+  const result = await request(
+    `${scheme(apiHost)}://${apiHost}/api/oauth/bindings/${bindingId}`,
+    { method: "DELETE", headers: jwtHeaders(jwtToken) }
+  );
+  return result ?? { success: true };
+}
+
+// src/sandbox-client.ts
+var READ_RETRIES = 2;
+var READ_TIMEOUT_MS = 3e4;
+var MUTATION_TIMEOUT_MS = 18e4;
+var PRODUCTION_PROVIDER_HOSTS = {
+  daytona: "daytona-sandbox",
+  e2b: "e2b-sandbox"
+};
+function parsedHost(raw) {
+  const value = raw.trim();
+  if (!value) throw new Error("sandbox host is empty");
+  const url = new URL(value.includes("://") ? value : `${scheme(value)}://${value}`);
+  if (url.username || url.password) throw new Error("sandbox host must not contain credentials");
+  if (url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("sandbox host must not contain a path, query, or fragment");
+  }
+  const loopback = isLoopbackHost(url.toString());
+  if (loopback && url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("localhost sandbox hosts must use HTTP or HTTPS");
+  }
+  if (!loopback && url.protocol !== "https:") {
+    throw new Error("public sandbox hosts must use HTTPS");
+  }
+  return url;
+}
+function sandboxBaseUrl(host, provider) {
+  const url = parsedHost(host);
+  const pin = provider && provider !== "auto" ? provider : void 0;
+  if (pin) {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(pin)) {
+      throw new Error(`invalid sandbox provider: ${pin}`);
+    }
+    if (isLoopbackHost(url.toString())) {
+      throw new Error("provider pinning is unavailable for a localhost sandbox gateway");
+    }
+    const labels = url.hostname.split(".");
+    const sandboxIndex = labels.indexOf("sandbox");
+    const isProduction = sandboxIndex >= 0 && labels.slice(sandboxIndex).join(".") === "sandbox.xapi.to";
+    const gatewayLabel = isProduction ? PRODUCTION_PROVIDER_HOSTS[pin] || pin : pin;
+    if (sandboxIndex === 0) labels.unshift(gatewayLabel);
+    else if (sandboxIndex === 1) labels[0] = gatewayLabel;
+    else throw new Error("provider pinning requires a sandbox.<xapi-domain> host");
+    url.hostname = labels.join(".");
+  }
+  assertAllowedHost(url.toString());
+  const hostname = url.hostname.toLowerCase();
+  if (!isLoopbackHost(url.toString()) && hostname !== "xapi.to" && !hostname.endsWith(".xapi.to")) {
+    throw new Error("sandbox API keys may only be sent to *.xapi.to or localhost");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function headers2(apiKey, body) {
+  return {
+    Accept: "application/json",
+    "XAPI-Key": apiKey,
+    ...body ? { "Content-Type": "application/json" } : {}
+  };
+}
+async function sandboxRequest(opts, path, init = {}) {
+  const method = init.method || "GET";
+  const hasBody = init.body !== void 0;
+  return request(
+    `${sandboxBaseUrl(opts.sandboxHost, opts.provider)}${path}`,
+    {
+      method,
+      headers: headers2(opts.apiKey, hasBody),
+      ...hasBody ? { body: JSON.stringify(init.body) } : {},
+      ...init.signal ? { signal: init.signal } : {}
+    },
+    init.timeoutMs || (init.readOnly || method === "GET" ? READ_TIMEOUT_MS : MUTATION_TIMEOUT_MS),
+    init.readOnly || method === "GET" ? READ_RETRIES : 0
+  );
+}
+var sandboxOfferings = (opts) => sandboxRequest(opts, "/v1/offerings");
+var sandboxQuote = (opts, body, signal) => sandboxRequest(opts, "/v1/quotes", { method: "POST", body, readOnly: true, signal });
+var sandboxList = (opts) => sandboxRequest(opts, "/v1/sandboxes");
+var sandboxHistory = (opts, filters = {}) => {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(filters)) {
+    if (value !== void 0 && value !== "") query.set(key, String(value));
+  }
+  return sandboxRequest(opts, `/v1/sandbox-history${query.size ? `?${query}` : ""}`);
+};
+var sandboxGet = (opts, id, signal) => sandboxRequest(opts, `/v1/sandboxes/${encodeURIComponent(id)}`, { signal });
+var sandboxCreate = (opts, body) => sandboxRequest(opts, "/v1/sandboxes", { method: "POST", body });
+var sandboxExec = (opts, id, body, signal) => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/commands`,
+  {
+    method: "POST",
+    body,
+    signal,
+    timeoutMs: Math.max(MUTATION_TIMEOUT_MS, (body.timeoutSeconds || 60) * 1e3 + 3e4)
+  }
+);
+var sandboxFileWrite = (opts, id, body) => sandboxRequest(opts, `/v1/sandboxes/${encodeURIComponent(id)}/files`, { method: "POST", body });
+var sandboxFileRead = (opts, id, path, encoding = "utf8") => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/files?path=${encodeURIComponent(path)}&encoding=${encoding}`
+);
+var sandboxFileList = (opts, id, path = ".", depth = 2) => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/files/list?path=${encodeURIComponent(path)}&depth=${depth}`
+);
+var sandboxPort = (opts, id, port) => sandboxRequest(opts, `/v1/sandboxes/${encodeURIComponent(id)}/ports/${port}`);
+var sandboxExtension = (opts, id, extensionId, body) => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/extensions/${encodeURIComponent(extensionId)}`,
+  { method: "POST", body }
+);
+var sandboxStateAction = (opts, id, action, body = {}) => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/${action}`,
+  { method: "POST", body }
+);
+var sandboxAudit = (opts, id, kind, page = 1, pageSize = 100) => sandboxRequest(
+  opts,
+  `/v1/sandboxes/${encodeURIComponent(id)}/audit?kind=${encodeURIComponent(kind)}&page=${page}&pageSize=${pageSize}`
+);
+async function sandboxWait(opts, id, wanted, timeoutMs = 3e5, intervalMs = 2e3, signal) {
+  const deadline = Date.now() + timeoutMs;
+  let last;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error(`sandbox wait interrupted while waiting for ${wanted.join(" or ")}`);
+    last = await sandboxGet(opts, id, signal);
+    const state = String(last.observedState || "");
+    if (wanted.includes(state)) return last;
+    if (["FAILED", "TERMINATED"].includes(state) && !wanted.includes(state)) {
+      throw new Error(`sandbox ${id} entered ${state} while waiting for ${wanted.join(" or ")}`);
+    }
+    await new Promise((resolve2) => {
+      const done = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", done);
+        resolve2();
+      };
+      const timer = setTimeout(done, Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+      signal?.addEventListener("abort", done, { once: true });
+    });
+  }
+  throw new Error(
+    `sandbox ${id} did not enter ${wanted.join(" or ")} within ${timeoutMs}ms (last state: ${last?.observedState || "unknown"})`
+  );
+}
+
+export {
+  __export,
+  getFormat,
+  output,
+  err,
+  XAPI_API_HOST,
+  XAPI_SANDBOX_HOST,
+  scheme,
+  assertAllowedHost,
+  getApiKeySource,
+  getConfig,
+  requireApiKey,
+  saveConfig,
+  showConfig,
+  HttpError,
+  isRetryableRequestError,
+  request,
+  actionList,
+  actionSearch,
+  actionCategories,
+  actionGet,
+  actionBatch,
+  actionCall,
+  actionStream,
+  actionDownload,
+  actionServices,
+  healthCheck,
+  loginWithApiKey,
+  listKeys,
+  enableOAuthForKey,
+  listOAuthProviders,
+  initiateOAuth,
+  listOAuthBindings,
+  deleteOAuthBinding,
+  sandboxOfferings,
+  sandboxQuote,
+  sandboxList,
+  sandboxHistory,
+  sandboxGet,
+  sandboxCreate,
+  sandboxExec,
+  sandboxFileWrite,
+  sandboxFileRead,
+  sandboxFileList,
+  sandboxPort,
+  sandboxExtension,
+  sandboxStateAction,
+  sandboxAudit,
+  sandboxWait
+};