@xanots/sdk 0.0.3 → 0.0.5

package/dist/chunk-ERQZFWIW.js

@@ -0,0 +1,22 @@
+// src/emit/project-dir.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+function assertProjectDir(dir, ctx) {
+  const manifest = join(dir, "package.json");
+  if (!existsSync(manifest)) {
+    throw new Error(`No package.json in ${dir} \u2014 ${ctx.what}.
+  ${ctx.remedy}`);
+  }
+  try {
+    JSON.parse(readFileSync(manifest, "utf8"));
+  } catch (err) {
+    throw new Error(
+      `${manifest} is not valid JSON, so npm cannot install into it \u2014 fix it and re-run. (${err instanceof Error ? err.message : String(err)})`
+    );
+  }
+}
+
+export {
+  assertProjectDir
+};
+//# sourceMappingURL=chunk-ERQZFWIW.js.map

package/dist/{chunk-DYCLVQXW.js → chunk-F5T45NAM.js}

@@ -73,7 +73,11 @@ var FLAGS = {
   guest: { spec: "--guest, -g", summary: "Mint a read-only guest session (browse only)" },
   "url-only": { spec: "--url-only, -u", summary: "Print the dashboard URL instead of opening a browser" },
   prompt: { spec: "--prompt", summary: "Print only the add-on wiring prompt, for piping to a coding agent" },
-  port: { spec: "--port <n>", summary: "Fixed loopback callback port (default: ephemeral)" },
+  port: { spec: "--port <n>", summary: "Loopback callback port (default: 47100)" },
+  paste: {
+    spec: "--paste",
+    summary: "Sign in without the loopback callback: open the printed URL in any browser and paste the redirect back. For a host whose 127.0.0.1 the browser cannot reach \u2014 remote shell, container, Codespace. Needs a terminal."
+  },
   scope: { spec: '--scope "<list>"', summary: "OAuth scopes to request (default: the built-in set)" },
   runtime: { spec: "--runtime", summary: "After the round-trip, run each deployed function and report" },
   capture: { spec: "--capture", summary: "Write each round-tripped function's fetched JSON" },
@@ -127,6 +131,10 @@ var FLAGS = {
     spec: "--marketplace <pkgs>",
     summary: "Add-on packages to install and register, comma-separated"
   },
+  check: {
+    spec: "--check",
+    summary: "Report whether an upgrade is available and exit 7, without installing it"
+  },
   force: { spec: "--force", summary: "Scaffold into a non-empty directory (overwriting our own files)" },
   "no-install": { spec: "--no-install", summary: "Skip the post-scaffold npm install" },
   "dry-run": { spec: "--dry-run", summary: "Print what would change and exit without sending it" },
@@ -225,6 +233,19 @@ var COMMANDS = {
     // rather than every flag it accepts.
     example: "xanots init my-app --theme zinc-blue --ai claude --marketplace @xanots/auth"
   },
+  onboard: {
+    group: "Author",
+    display: "onboard [dir]",
+    summary: "Pick a framework, theme and add-ons in a browser, then scaffold",
+    // Variadic, and deliberately flagless. This command does not PARSE its
+    // arguments — it forwards them to a package it launches (see
+    // onboard-command.ts), so the arity check must budget for a tail it cannot
+    // describe. Declaring the configurator's flags here would freeze them: a
+    // flag added there would be rejected here until the SDK released, which is
+    // the coupling launching-instead-of-depending exists to avoid.
+    args: [{ name: "dir", required: false, path: true, variadic: true }],
+    example: "xanots onboard my-app"
+  },
   marketplace: {
     group: "Author",
     display: "marketplace <list|search|details|install>",
@@ -464,6 +485,7 @@ var COMMANDS = {
     summary: "OAuth sign-in \u2014 shared cache, or --local per project",
     flags: [
       "local",
+      "paste",
       "port",
       "scope",
       "origin",
@@ -551,6 +573,13 @@ var COMMANDS = {
     display: "version",
     summary: "Print the CLI version"
   },
+  upgrade: {
+    group: "Maintenance",
+    display: "upgrade",
+    summary: "Install the latest @xanots/sdk, or report an available upgrade with --check",
+    flags: ["check"],
+    example: "xanots upgrade --check"
+  },
   help: {
     group: "Maintenance",
     display: "help",
@@ -646,4 +675,4 @@ export {
   liveSubcommandNames,
   suggest
 };
-//# sourceMappingURL=chunk-DYCLVQXW.js.map
+//# sourceMappingURL=chunk-F5T45NAM.js.map

package/dist/{chunk-TQUO2OXY.js → chunk-FN4OQT2J.js}

@@ -6,7 +6,7 @@ import {
   realtimeChannelGuid,
   realtimeServerRefName,
   resolveRealtimeServerRef
-} from "./chunk-U3G2UW65.js";
+} from "./chunk-CYJ7R3AD.js";
 import {
   assertCanonical,
   assertOneOf,
@@ -25,7 +25,7 @@ import {
   resolveAuthRef,
   resolveMockKeys,
   warnLiveDatasource
-} from "./chunk-5L4X5LS6.js";
+} from "./chunk-YUPQOLFX.js";
 import {
   encodeStatement
 } from "./chunk-5XZ744TS.js";
@@ -35,7 +35,7 @@ import {
   lockKey,
   realtimeMessageSeedName,
   resolveRef
-} from "./chunk-4HT3BNZ7.js";
+} from "./chunk-YUBJLB6G.js";
 
 // src/kinds/canonical.ts
 function resolveCanonicalToken(label, payloadKey, accessor, def, override) {
@@ -667,4 +667,4 @@ export {
   addonKind,
   addon
 };
-//# sourceMappingURL=chunk-TQUO2OXY.js.map
+//# sourceMappingURL=chunk-FN4OQT2J.js.map

package/dist/{chunk-6USV65XA.js → chunk-IVP6TS26.js}

@@ -19,7 +19,7 @@ import {
   liveSubcommandNames,
   renderArgs,
   suggest
-} from "./chunk-DYCLVQXW.js";
+} from "./chunk-F5T45NAM.js";
 
 // src/emit/help.ts
 function table(rows, s, indent = "  ", fixedWidth) {
@@ -245,4 +245,4 @@ export {
   reportFailure,
   exitCodeOf
 };
-//# sourceMappingURL=chunk-6USV65XA.js.map
+//# sourceMappingURL=chunk-IVP6TS26.js.map

package/dist/{chunk-HQ2CBRVI.js → chunk-KXCPZUUM.js}

@@ -2,14 +2,17 @@ import {
   presetFilePath,
   resolveAiPresets,
   scaffoldProject
-} from "./chunk-CMZLPTGW.js";
+} from "./chunk-7SISR3CS.js";
 import {
   runNpmCapturingStderr
-} from "./chunk-WUSKBXXD.js";
+} from "./chunk-ZSYZTGJH.js";
 import {
   DEFAULT_FRAMEWORK,
   allFrontendPresets,
   findFrontendPreset,
+  resolveFrameworkFlag
+} from "./chunk-WGDAOOXG.js";
+import {
   initLanding,
   renderApiTs,
   renderCnUtil,
@@ -23,9 +26,8 @@ import {
   renderTsconfig,
   renderViteConfig,
   renderXanoExampleMd,
-  renderXanoIndex,
-  resolveFrameworkFlag
-} from "./chunk-YZ4GU6F5.js";
+  renderXanoIndex
+} from "./chunk-QUUB7HYK.js";
 import {
   DEFAULT_DARK_MODE,
   curatedThemes,
@@ -42,10 +44,10 @@ import {
 } from "./chunk-6DHJVLYP.js";
 import {
   readVersion
-} from "./chunk-3NFUWXOC.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   UsageError
-} from "./chunk-6USV65XA.js";
+} from "./chunk-IVP6TS26.js";
 import {
   blank,
   detail,
@@ -527,4 +529,4 @@ export {
   projectShellFiles,
   runInitCommand
 };
-//# sourceMappingURL=chunk-HQ2CBRVI.js.map
+//# sourceMappingURL=chunk-KXCPZUUM.js.map

package/dist/{chunk-7REDODS2.js → chunk-LLWK6H77.js}

@@ -130,6 +130,8 @@ var OpenIdProvider = class {
   configPromise;
   /** The client_id the resolved config uses — set once `build()` completes. */
   resolvedClientId;
+  /** The issuer the resolved config discovered — set once `build()` completes. */
+  resolvedIssuer;
   redirectUri() {
     if (!this.opts.redirectUri) {
       throw new Error("OpenIdProvider: redirectUri is required for the authorize/exchange flow.");
@@ -147,6 +149,19 @@ var OpenIdProvider = class {
     }
     return this.resolvedClientId;
   }
+  /**
+   * The authorization server's issuer, as resolved by discovery. Only the paste
+   * login mode needs it: a pasted BARE code carries no `iss`, and the AS
+   * advertises issuer support, so one has to be supplied for the response to
+   * validate at all. Same lifecycle guard as `clientId()` — valid once the
+   * configuration has resolved.
+   */
+  issuer() {
+    if (!this.resolvedIssuer) {
+      throw new Error("OpenIdProvider.issuer() called before the configuration was resolved.");
+    }
+    return this.resolvedIssuer;
+  }
   async build() {
     const server = new URL(this.opts.authHost);
     const options = server.protocol === "http:" ? { execute: [client.allowInsecureRequests] } : void 0;
@@ -166,13 +181,15 @@ var OpenIdProvider = class {
       });
     }
     this.resolvedClientId = clientId;
-    return client.discovery(
+    const config = await client.discovery(
       server,
       clientId,
       { token_endpoint_auth_method: "none" },
       client.None(),
       options
     );
+    this.resolvedIssuer = config.serverMetadata().issuer;
+    return config;
   }
   config() {
     return this.configPromise ??= this.build();
@@ -180,6 +197,7 @@ var OpenIdProvider = class {
   async reset() {
     this.configPromise = void 0;
     this.resolvedClientId = void 0;
+    this.resolvedIssuer = void 0;
     if (this.opts.redirectUri) {
       clearClient({ authHost: this.opts.authHost, redirectUri: this.opts.redirectUri });
     }
@@ -465,4 +483,4 @@ export {
   resolveScope,
   assertHttpsOrigin
 };
-//# sourceMappingURL=chunk-7REDODS2.js.map
+//# sourceMappingURL=chunk-LLWK6H77.js.map

package/dist/{chunk-HJPTWBLH.js → chunk-MFIHIS6B.js}

@@ -4,7 +4,7 @@ import {
 import {
   parseLock,
   serializeLock
-} from "./chunk-4HT3BNZ7.js";
+} from "./chunk-YUBJLB6G.js";
 
 // src/lock/io.ts
 import { readFileSync, existsSync } from "fs";
@@ -35,4 +35,4 @@ export {
   readLockFile,
   writeLockFile
 };
-//# sourceMappingURL=chunk-HJPTWBLH.js.map
+//# sourceMappingURL=chunk-MFIHIS6B.js.map