@xanots/sdk 0.0.1

package/dist/io-AMIKRLPC.js

@@ -0,0 +1,11 @@
+import {
+  readLockFile,
+  writeLockFile
+} from "./chunk-HJPTWBLH.js";
+import "./chunk-GNPVYOPB.js";
+import "./chunk-4HT3BNZ7.js";
+export {
+  readLockFile,
+  writeLockFile
+};
+//# sourceMappingURL=io-AMIKRLPC.js.map

package/dist/live-diff-Y3AKETHE.js

@@ -0,0 +1,196 @@
+import {
+  deepEqual,
+  normalize
+} from "./chunk-26CNBZE2.js";
+
+// src/deploy/live-diff.ts
+function rows(bundle, key) {
+  const payload = bundle?.payload;
+  if (payload === null || typeof payload !== "object") return [];
+  const value = payload[key];
+  return Array.isArray(value) ? value.filter((r) => r !== null && typeof r === "object") : [];
+}
+function columnsOf(table) {
+  const schema = table.schema;
+  if (!Array.isArray(schema)) return /* @__PURE__ */ new Set();
+  const names = schema.map((c) => c !== null && typeof c === "object" ? c.name : void 0).filter((n) => typeof n === "string" && n !== "");
+  return new Set(names);
+}
+function identify(table) {
+  const guid = table.guid;
+  if (typeof guid === "string" && guid !== "") return `guid:${guid}`;
+  const name = table.name;
+  return typeof name === "string" ? `name:${name}` : "";
+}
+function envOf(bundle) {
+  const payload = bundle?.payload;
+  const out = /* @__PURE__ */ new Map();
+  if (payload === null || typeof payload !== "object") return out;
+  const workspace = payload.workspace;
+  const candidates = [
+    payload.env,
+    workspace !== null && typeof workspace === "object" && !Array.isArray(workspace) ? workspace.env : void 0,
+    Array.isArray(workspace) && workspace[0] !== null && typeof workspace[0] === "object" ? workspace[0].env : void 0
+  ];
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) continue;
+    for (const entry of candidate) {
+      if (typeof entry === "string") {
+        const at = entry.indexOf("=");
+        if (at > 0) out.set(entry.slice(0, at), entry.slice(at + 1));
+        continue;
+      }
+      if (entry === null || typeof entry !== "object") continue;
+      const { name, value } = entry;
+      if (typeof name === "string" && name !== "") out.set(name, typeof value === "string" ? value : "");
+    }
+  }
+  return out;
+}
+function diffAgainstLive(outgoing, live, opts) {
+  const outgoingTables = new Map(rows(outgoing, "dbo").map((t) => [identify(t), t]));
+  const droppedColumns = [];
+  for (const liveTable of rows(live, "dbo")) {
+    const outgoingTable = outgoingTables.get(identify(liveTable));
+    if (outgoingTable === void 0) continue;
+    const kept = columnsOf(outgoingTable);
+    const name = typeof liveTable.name === "string" ? liveTable.name : "(unnamed)";
+    for (const column of columnsOf(liveTable)) {
+      if (!kept.has(column)) droppedColumns.push({ table: name, column });
+    }
+  }
+  const unchangedEnv = [];
+  if (opts.mode === "merge") {
+    const liveEnv = envOf(live);
+    for (const [name, value] of envOf(outgoing)) {
+      const current = liveEnv.get(name);
+      if (current !== void 0 && current !== value) unchangedEnv.push({ name });
+    }
+  }
+  return { droppedColumns, unchangedEnv };
+}
+var WORKSPACE_KEY = "workspace";
+var ENV_KEY = "env";
+var SETTINGS_KEYS_COMPARED_ELSEWHERE = /* @__PURE__ */ new Set([WORKSPACE_KEY, ENV_KEY, "canonical"]);
+function isDeepSubset(ours, theirs) {
+  if (ours === null || typeof ours !== "object") return deepEqual(ours, theirs);
+  if (Array.isArray(ours) || Array.isArray(theirs)) return deepEqual(ours, theirs);
+  if (theirs === null || typeof theirs !== "object") return false;
+  const live = theirs;
+  return Object.entries(ours).every(
+    ([key, value]) => isDeepSubset(value, live[key])
+  );
+}
+function workspaceSettingsMatch(ours, theirs, outgoing, live) {
+  if (ours === null || typeof ours !== "object" || Array.isArray(ours)) {
+    return deepEqual(normalize(ours), normalize(theirs));
+  }
+  const authored = Object.fromEntries(
+    Object.entries(normalize(ours)).filter(
+      ([key]) => !SETTINGS_KEYS_COMPARED_ELSEWHERE.has(key)
+    )
+  );
+  if (!isDeepSubset(authored, normalize(theirs))) return false;
+  const liveEnv = envOf(live);
+  for (const name of envOf(outgoing).keys()) {
+    if (!liveEnv.has(name)) return false;
+  }
+  return true;
+}
+var SAMPLE = 5;
+function payloadOf(bundle) {
+  const payload = bundle?.payload;
+  return payload !== null && typeof payload === "object" ? payload : {};
+}
+function guidOf(row) {
+  const guid = row.guid;
+  return typeof guid === "string" && guid !== "" ? guid : void 0;
+}
+function indexSection(rows2) {
+  const byGuid = /* @__PURE__ */ new Map();
+  const byName = /* @__PURE__ */ new Map();
+  const repeated = /* @__PURE__ */ new Set();
+  const all = [];
+  for (const row of rows2) {
+    if (row === null || typeof row !== "object") continue;
+    const record = row;
+    all.push(record);
+    const guid = guidOf(record);
+    if (guid !== void 0) byGuid.set(guid, record);
+    const name = record.name;
+    if (typeof name !== "string" || name === "") continue;
+    if (byName.has(name) || repeated.has(name)) {
+      byName.delete(name);
+      repeated.add(name);
+      continue;
+    }
+    byName.set(name, record);
+  }
+  return { byGuid, byName, all };
+}
+function byNameWithoutGuid(index, name, ourGuid) {
+  const candidate = index.byName.get(name);
+  if (candidate === void 0) return void 0;
+  return guidOf(candidate) === void 0 || ourGuid === void 0 ? candidate : void 0;
+}
+function nameOf(row) {
+  return typeof row.name === "string" && row.name !== "" ? row.name : "(unnamed)";
+}
+function compareToLive(outgoing, live) {
+  const ours = payloadOf(outgoing);
+  const theirs = payloadOf(live);
+  const differing = [];
+  const liveOnly = [];
+  let differingCount = 0;
+  let compared = 0;
+  const note = (key, name) => {
+    differingCount++;
+    if (differing.length < SAMPLE) differing.push(`${key}:${name}`);
+  };
+  for (const [key, value] of Object.entries(ours)) {
+    if (key === ENV_KEY) continue;
+    if (key === WORKSPACE_KEY) {
+      compared++;
+      if (!workspaceSettingsMatch(value, theirs[key], outgoing, live)) note(key, "(settings)");
+      continue;
+    }
+    if (!Array.isArray(value)) {
+      compared++;
+      if (!deepEqual(normalize(value), normalize(theirs[key]))) note(key, "(settings)");
+      continue;
+    }
+    const liveSection = theirs[key];
+    const index = indexSection(Array.isArray(liveSection) ? liveSection : []);
+    const matched = /* @__PURE__ */ new Set();
+    for (const row of value) {
+      compared++;
+      if (row === null || typeof row !== "object") {
+        note(key, "(unreadable)");
+        continue;
+      }
+      const record = row;
+      const guid = guidOf(record);
+      const name = typeof record.name === "string" ? record.name : void 0;
+      const counterpart = (guid !== void 0 ? index.byGuid.get(guid) : void 0) ?? // Name only answers what guid cannot. A live row that HAS a guid and
+      // does not have ours is a different object — the import would create
+      // ours alongside it — so the fallback is refused there and taken only
+      // when one side carries no guid at all.
+      (name !== void 0 ? byNameWithoutGuid(index, name, guid) : void 0);
+      if (counterpart === void 0) {
+        note(key, nameOf(record));
+        continue;
+      }
+      matched.add(counterpart);
+      if (!deepEqual(normalize(record), normalize(counterpart))) note(key, nameOf(record));
+    }
+    for (const row of index.all) {
+      if (!matched.has(row)) liveOnly.push(`${key}:${nameOf(row)}`);
+    }
+  }
+  return { converged: compared > 0 && differingCount === 0, compared, differing, differingCount, liveOnly };
+}
+export {
+  compareToLive,
+  diffAgainstLive
+};
+//# sourceMappingURL=live-diff-Y3AKETHE.js.map

package/dist/lock-3CVKALKT.js

@@ -0,0 +1,37 @@
+import {
+  CANONICAL_PAYLOAD_KEYS,
+  LOCK_PAYLOAD_KEYS,
+  LOCK_VERSION,
+  WORKSPACE_KEY,
+  adoptFromBundle,
+  createLockContext,
+  emptyLock,
+  lockKey,
+  mergeObserved,
+  mintCanonical,
+  parseLock,
+  recordObserved,
+  renameLockEntry,
+  resolvePayloadKey,
+  serializeLock,
+  validateLockModel
+} from "./chunk-4HT3BNZ7.js";
+export {
+  CANONICAL_PAYLOAD_KEYS,
+  LOCK_PAYLOAD_KEYS,
+  LOCK_VERSION,
+  WORKSPACE_KEY,
+  adoptFromBundle,
+  createLockContext,
+  emptyLock,
+  lockKey,
+  mergeObserved,
+  mintCanonical,
+  parseLock,
+  recordObserved,
+  renameLockEntry,
+  resolvePayloadKey,
+  serializeLock,
+  validateLockModel
+};
+//# sourceMappingURL=lock-3CVKALKT.js.map

package/dist/lock-commands-XTR2YKLY.js

@@ -0,0 +1,232 @@
+import {
+  loadDefault
+} from "./chunk-YGPIY3WT.js";
+import {
+  UsageError,
+  missingArgument,
+  unknownSubcommand
+} from "./chunk-IZW6MK3U.js";
+import "./chunk-EZG76F7R.js";
+import {
+  Xano
+} from "./chunk-3DUAGYGP.js";
+import "./chunk-YYRDLFSJ.js";
+import "./chunk-EMCAWMHC.js";
+import "./chunk-WHOJWOSV.js";
+import "./chunk-LH6Z6KFV.js";
+import {
+  readLockFile,
+  writeLockFile
+} from "./chunk-HJPTWBLH.js";
+import "./chunk-GNPVYOPB.js";
+import {
+  adoptFromBundle,
+  createLockContext,
+  emptyLock,
+  renameLockEntry,
+  resetLockOverrides,
+  resolvePayloadKey,
+  seedLockOverrides
+} from "./chunk-4HT3BNZ7.js";
+
+// src/emit/lock-commands.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+async function runLockCommand(args) {
+  const [sub] = args.positionals;
+  switch (sub) {
+    case "rename":
+      return lockRename(args);
+    case "prune":
+      return lockPrune(args);
+    case "adopt":
+      return lockAdopt(args);
+    default:
+      throw unknownSubcommand("lock", sub);
+  }
+}
+function describeEntry(entry) {
+  const parts = [];
+  if (entry.guid !== void 0) parts.push(`guid ${entry.guid}`);
+  if (entry.canonical !== void 0) parts.push(`canonical ${entry.canonical}`);
+  return parts.join(", ");
+}
+function lockBesideEntry(entryFile) {
+  return join(dirname(resolve(entryFile)), "xano.lock");
+}
+function commandLockPath(args, subcommand) {
+  if (args.lockPath !== void 0) return resolve(args.lockPath);
+  if (args.entryPath !== void 0) return lockBesideEntry(args.entryPath);
+  const cwdLock = resolve("xano.lock");
+  if (existsSync(cwdLock)) return cwdLock;
+  const nested = resolve("xano", "xano.lock");
+  if (existsSync(nested)) {
+    throw new Error(
+      `lock ${subcommand}: no xano.lock in this directory, but one exists at xano/xano.lock \u2014 the layout \`xanots init\` scaffolds (the lock sits beside the entry file). Re-run with \`--entry=xano/index.ts\` (or \`--lock=xano/xano.lock\`).`
+    );
+  }
+  return cwdLock;
+}
+function lockRename(args) {
+  const [, kind, oldName, newName] = args.positionals;
+  if (!kind || !oldName || !newName) {
+    throw missingArgument(!kind ? "kind" : !oldName ? "old" : "new", { command: "lock", subcommand: "rename" });
+  }
+  const lockPath = commandLockPath(args, "rename");
+  const lock = readLockFile(lockPath);
+  const payloadKey = resolvePayloadKey(kind);
+  const { lock: renamed, discardedNewcomer } = renameLockEntry(lock, payloadKey, oldName, newName);
+  writeLockFile(lockPath, renamed);
+  process.stdout.write(
+    `Renamed lock entry "${payloadKey}:${oldName}" \u2192 "${payloadKey}:${newName}" (${describeEntry(renamed.objects[`${payloadKey}:${newName}`])}).
+`
+  );
+  if (discardedNewcomer) {
+    process.stdout.write(
+      `Replaced the fresh entry the last export appended for "${payloadKey}:${newName}"` + (discardedNewcomer.canonical !== void 0 ? ` \u2014 its minted canonical ${discardedNewcomer.canonical} is discarded (that URL was never the object's real identity)` : "") + `.
+`
+    );
+  }
+  process.stdout.write(`Re-run \`xanots export\` to emit the original guid under the new name.
+`);
+}
+async function observedLockKeys(entryFile, lock) {
+  resetLockOverrides();
+  seedLockOverrides(lock);
+  let def;
+  try {
+    def = await loadDefault(entryFile);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `lock prune evaluated "${entryFile}" to find out which lock entries are still live, and loading it failed:
+  ${reason}
+Finding orphans requires running your workspace source \u2014 anything the entry file does at module scope (asserting env vars, reading config) runs too. To drop entries you can name yourself, no evaluation is needed: \`xanots lock prune --no-verify --yes <kind:name>\u2026\` with \`--lock=<path>\` or \`--entry=<path>\` to locate the lock.`,
+      { cause: err }
+    );
+  }
+  if (!Xano.isXano(def)) {
+    throw new Error(`Module "${entryFile}" must default-export a Xano registry for \`lock prune\`.`);
+  }
+  const ctx = createLockContext(lock);
+  def.export({ lock: ctx });
+  return new Set(Object.keys(ctx.observed));
+}
+async function lockPrune(args) {
+  const [, ...rest] = args.positionals;
+  if (args.noVerify) return lockPruneNamed(args, rest);
+  const [entryFile, ...keys] = rest;
+  if (!entryFile) {
+    throw missingArgument("entry-file", { command: "lock", subcommand: "prune" });
+  }
+  const lockPath = args.lockPath !== void 0 ? resolve(args.lockPath) : lockBesideEntry(entryFile);
+  const lock = readLockFile(lockPath);
+  const observed = await observedLockKeys(entryFile, lock);
+  const orphans = Object.keys(lock.objects).filter((key) => !observed.has(key));
+  let targets;
+  if (keys.length > 0) {
+    for (const key of keys) {
+      if (!(key in lock.objects)) {
+        throw new Error(`No lock entry "${key}" to prune.`);
+      }
+      if (!orphans.includes(key)) {
+        throw new Error(`Lock entry "${key}" still matches an exported object \u2014 not pruning it.`);
+      }
+    }
+    targets = keys;
+  } else {
+    targets = orphans;
+  }
+  if (targets.length === 0) {
+    process.stdout.write("Nothing to prune \u2014 every lock entry matches an exported object.\n");
+    return;
+  }
+  applyPrune(args, lockPath, lock, targets);
+}
+function lockPruneNamed(args, keys) {
+  if (keys.length === 0) {
+    throw new UsageError(
+      "`lock prune --no-verify` prunes the entries you name, so it needs at least one key (`table:users`). Without keys there is nothing to prune, because finding orphans is exactly the step --no-verify skips \u2014 drop the flag and pass the entry file to do that.",
+      { helpFor: { command: "lock", subcommand: "prune" } }
+    );
+  }
+  const lockPath = commandLockPath(args, "prune");
+  const lock = readLockFile(lockPath);
+  for (const key of keys) {
+    if (!(key in lock.objects)) {
+      throw new Error(`No lock entry "${key}" to prune.`);
+    }
+  }
+  process.stderr.write(
+    `xanots: --no-verify \u2014 nothing was evaluated, so nothing confirms ${keys.length === 1 ? "this key is" : "these keys are"} orphaned. A key the workspace still exports gets a NEW identity at the next export.
+`
+  );
+  applyPrune(args, lockPath, lock, keys);
+}
+function applyPrune(args, lockPath, lock, targets) {
+  const lines = targets.sort().map((key) => `  ${key} (${describeEntry(lock.objects[key])})`).join("\n");
+  const discarded = targets.filter((key) => lock.objects[key].canonical !== void 0);
+  const canonicalNote = discarded.length > 0 ? `Discards ${discarded.length} canonical(s) \u2014 a pruned canonical's public URL is unrecoverable.
+` : "";
+  if (!args.yes) {
+    process.stdout.write(`Would prune ${targets.length} lock entr(y/ies):
+${lines}
+${canonicalNote}`);
+    throw new Error("lock prune is destructive \u2014 re-run with --yes to apply.");
+  }
+  const objects = { ...lock.objects };
+  for (const key of targets) delete objects[key];
+  writeLockFile(lockPath, { version: lock.version, objects });
+  process.stdout.write(`Pruned ${targets.length} lock entr(y/ies):
+${lines}
+${canonicalNote}`);
+}
+function lockAdopt(args) {
+  const [, bundlePath] = args.positionals;
+  if (!bundlePath) {
+    throw missingArgument("bundle.json", { command: "lock", subcommand: "adopt" });
+  }
+  const lockPath = commandLockPath(args, "adopt");
+  const lock = existsSync(lockPath) ? readLockFile(lockPath) : emptyLock();
+  let bundle;
+  try {
+    bundle = JSON.parse(readFileSync(bundlePath, "utf8"));
+  } catch (err) {
+    throw new Error(
+      `Cannot read ${bundlePath} as JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const { lock: adopted, added, changed, canonicalsSeen, vaultCount } = adoptFromBundle(
+    lock,
+    bundle,
+    bundlePath
+  );
+  if (changed.length > 0 && !args.yes) {
+    const lines = changed.map((c) => `  ${c.key}: ${describeEntry(c.before)} \u2192 ${describeEntry(c.after)}`).join("\n");
+    process.stdout.write(`Adoption would overwrite ${changed.length} existing lock entr(y/ies):
+${lines}
+`);
+    throw new Error("lock adopt overwrites pinned identities \u2014 re-run with --yes to apply.");
+  }
+  if (vaultCount > 0) {
+    process.stderr.write(
+      `xanots: WARNING \u2014 ${bundlePath} contains ${vaultCount} vault entr(y/ies) (secrets). Do NOT commit the bundle file; delete it once adoption is done.
+`
+    );
+  }
+  if (!canonicalsSeen) {
+    process.stderr.write(
+      `xanots: no canonicals found in ${bundlePath} \u2014 the engine's standard partial export strips them, so only guids were adopted. Existing public URLs are safe (the engine keeps the server-side canonical on guid-matched updates), but fresh imports elsewhere will mint new ones at the next locked export.
+`
+    );
+  }
+  writeLockFile(lockPath, adopted);
+  process.stdout.write(
+    `Adopted ${bundlePath} into ${lockPath}: ${added.length} added, ${changed.length} updated.
+`
+  );
+}
+export {
+  runLockCommand
+};
+//# sourceMappingURL=lock-commands-XTR2YKLY.js.map

package/dist/login-command-ACJF6KWQ.js

@@ -0,0 +1,167 @@
+import {
+  openBrowser,
+  startCallbackServer
+} from "./chunk-VTIL47DT.js";
+import {
+  envMetaCredentialVarsSet
+} from "./chunk-C56BC2FY.js";
+import {
+  CALLBACK_PATH,
+  DEFAULT_PORT,
+  OpenIdProvider,
+  assertHttpsOrigin,
+  decodeAudience,
+  ensureGitignored,
+  globalAuthFilePath,
+  oauthErrorCode,
+  readCredential,
+  resolveAuthFilePath,
+  resolveAuthHost,
+  resolveScope,
+  writeCredential
+} from "./chunk-7REDODS2.js";
+import {
+  blank,
+  detail,
+  hostLabel,
+  info,
+  step,
+  success,
+  warn
+} from "./chunk-EZG76F7R.js";
+import "./chunk-GNPVYOPB.js";
+
+// src/emit/login-command.ts
+import * as client from "openid-client";
+async function runLoginCommand(args) {
+  const authHost = resolveAuthHost(args);
+  const scope = resolveScope(args);
+  const port = args.port ?? DEFAULT_PORT;
+  assertHttpsOrigin(authHost, "--origin");
+  if (!args.force && reportAlreadySignedIn(resolveAuthFilePath(args, "write"))) return;
+  step(`Signing in to ${hostLabel(authHost)}`);
+  let record;
+  try {
+    record = await attemptLogin({ authHost, scope, port });
+  } catch (err) {
+    if (oauthErrorCode(err) !== "invalid_client") throw err;
+    warn("The registered client was rejected \u2014 re-registering and retrying once.");
+    record = await attemptLogin({ authHost, scope, port });
+  }
+  const authFilePath = resolveAuthFilePath(args, "write");
+  writeCredential(authFilePath, record);
+  blank();
+  success(`Signed in to ${hostLabel(record.instance)}`);
+  detail(`Workspace ${record.workspace_id} (pinned \u2014 every command acts on this one)`);
+  detail(`Credentials saved to ${authFilePath}`);
+  const envVars = envMetaCredentialVarsSet();
+  if (envVars.length > 0) {
+    warn(
+      `${envVars.join(", ")} ${envVars.length === 1 ? "is" : "are"} set in this environment, outranking this credential \u2014 commands will keep using ${envVars.length === 3 ? "it" : "that environment credential, or fail because the set is incomplete"}. Unset ${envVars.length === 1 ? "it" : "them"} to act as the account you just signed in as.`
+    );
+  }
+  if (authFilePath === globalAuthFilePath()) {
+    detail("Using the shared ~/.xanots cache \u2014 available from any project directory.");
+  } else if (args.local) {
+    detail("Using the project-local .xano cache \u2014 scoped to this directory.");
+  }
+  try {
+    if (ensureGitignored(authFilePath)) {
+      detail("Added the credential file to .gitignore");
+    }
+  } catch (err) {
+    warn(
+      `Could not update .gitignore (${err instanceof Error ? err.message : String(err)}). Add ${authFilePath} to your ignore rules manually.`
+    );
+  }
+  if (!record.refresh_token) {
+    warn(
+      "No refresh token was issued (offline_access not granted); push will require re-login once the access token expires."
+    );
+  }
+}
+function reportAlreadySignedIn(authFilePath) {
+  let existing;
+  try {
+    existing = readCredential(authFilePath);
+  } catch {
+    return false;
+  }
+  if (!existing) return false;
+  if (existing.type === "oauth" && !existing.refresh_token && Date.now() >= existing.expires_at) return false;
+  const target = existing.type === "token" ? `${hostLabel(existing.instance_base_url)} with a hand-authored token` : hostLabel(existing.instance);
+  info(`Already signed in to ${target}, workspace ${existing.workspace_id}.`);
+  detail(`Credential: ${authFilePath}`);
+  detail("Re-run with --force to sign in again.");
+  return true;
+}
+async function attemptLogin(p) {
+  const verifier = client.randomPKCECodeVerifier();
+  const state = client.randomState();
+  let listener;
+  try {
+    listener = await startCallbackServer({ callbackPath: CALLBACK_PATH, expectedState: state, port: p.port });
+  } catch (err) {
+    const code = err.code;
+    if (code === "EADDRINUSE") {
+      throw new Error(`Loopback port ${p.port} is in use. Pass a free one with --port <n> and retry.`);
+    }
+    throw err;
+  }
+  const provider = new OpenIdProvider({ authHost: p.authHost, redirectUri: listener.redirectUri, scope: p.scope });
+  let authorizeUrl;
+  try {
+    authorizeUrl = await provider.buildAuthUrl({ verifier, state });
+  } catch (err) {
+    listener.close();
+    throw err;
+  }
+  detail("Opening your browser to authorize \u2014 waiting for you to finish\u2026");
+  detail("If it doesn't open, paste this URL into your browser:");
+  detail(authorizeUrl);
+  openBrowser(authorizeUrl);
+  let callbackUrl;
+  try {
+    ({ callbackUrl } = await listener.waitForCallback);
+  } catch (err) {
+    listener.close();
+    if (oauthErrorCode(err) === "invalid_client") await provider.reset();
+    throw err;
+  }
+  let tokens;
+  try {
+    tokens = await provider.exchange(callbackUrl, { verifier, state });
+  } catch (err) {
+    if (oauthErrorCode(err) === "invalid_client") await provider.reset();
+    throw err;
+  }
+  const boundInstance = decodeAudience(tokens.access_token);
+  if (!boundInstance) {
+    throw new Error(
+      `Could not determine the instance from the issued token (no readable \`aud\` claim). This is unexpected \u2014 please report it.`
+    );
+  }
+  const { resolveScopedWorkspaceId } = await import("./workspace-K72NP7SX.js");
+  detail("Resolving the workspace this token is scoped to\u2026");
+  const workspaceId = await resolveScopedWorkspaceId({
+    access_token: tokens.access_token,
+    instance: boundInstance
+  });
+  return {
+    type: "oauth",
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+    expires_at: Date.now() + (tokens.expires_in ?? 0) * 1e3,
+    scope: tokens.scope ?? p.scope,
+    instance: boundInstance,
+    workspace_id: workspaceId,
+    auth_host: p.authHost,
+    // Record exactly which client minted the token — required to refresh/revoke
+    // it later. Resolved already (buildAuthUrl awaited the config).
+    client_id: provider.clientId()
+  };
+}
+export {
+  runLoginCommand
+};
+//# sourceMappingURL=login-command-ACJF6KWQ.js.map