@xanots/sdk 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -11,19 +11,18 @@ listed here.
 
 ---
 
-## 0.0.4 — Agents get their instructions
+## 0.0.4 — The markdown your agents read
 
-_2026-08-25_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.4)
+_2026-08-26_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.4)
 
-`knowledge()` lands: the markdown a Xano workspace's AI agents read before they act, authored as real `.md` files in your repo instead of typed into a console. Standing instructions, skills, and reference docs are now workspace source — reviewed in a diff, versioned with the code they describe, and redeployed with it. Nothing changes for a workspace that declares none.
+Knowledge is now workspace source: the markdown your Xano agents read before they act is authored as real `.md` files, reviewed in a diff, and deployed with the code it describes. Two commands join the CLI — `xanots onboard` puts the scaffold's choices in a browser, and `xanots upgrade` answers the version question on purpose rather than nudging. Windows users should take this one regardless: every npm call in the package was failing before it reached npm.
 
-- `knowledge()` authors the instructions your agents follow
-- The body is a real markdown file, never a string in a def
-- `refs` ships a whole folder the agent searches on demand
-- `type` and `mode` decide what the agent actually receives
-- Authoring mistakes that used to deploy silently are now build errors
-- `xanots codegen` writes the markdown back out as files
-- Repeated releases update knowledge instead of duplicating it
+- `knowledge()` — author the markdown your Xano agents read
+- `xanots onboard` — pick the scaffold's look in a browser
+- `xanots upgrade` — the version question asked on purpose
+- Every npm call failed on a current Node for Windows
+- The guides ship in the tarball
+- `CHANGELOG.md` ships, generated from the releases
 
 ---
 

package/README.md

@@ -93,6 +93,10 @@ for you, and the target instance comes from your token rather than a flag.
 npx @xanots/sdk login
 ```
 
+> On a remote shell, container, or Codespace — anywhere your browser can't reach this
+> machine's `127.0.0.1` — add `--paste`. It prints the URL for you to open anywhere, and you
+> paste the redirect back. See [Signing in & deploying](https://github.com/xanots/sdk/blob/main/guides/deploying.md).
+
 **2. Scaffold.** `init` writes a complete project: a Vite frontend under `frontend/` (React
 19 + shadcn/ui by default, or SvelteKit with `--framework svelte`), a XanoTS backend under
 `xano/`, and the `xano:export` / `xano:deploy` scripts already wired.

package/dist/.build-fingerprint

@@ -0,0 +1 @@
+c0021219c47ba8aba005451538637f3d324faefad89c71468080cbe5bd443fa1

package/dist/bin.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   maybeNotifyUpdate
-} from "./chunk-T6N3VMMO.js";
+} from "./chunk-ZGA5MUNC.js";
 import {
   readVersion,
   run
-} from "./chunk-DUC3PXDG.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   exitCodeOf,
   reportFailure
-} from "./chunk-KGNJM4LN.js";
+} from "./chunk-IVP6TS26.js";
 import "./chunk-MFIHIS6B.js";
 import "./chunk-GNPVYOPB.js";
 import {
@@ -17,7 +17,7 @@ import {
   error
 } from "./chunk-EZG76F7R.js";
 import "./chunk-BPEEGJJA.js";
-import "./chunk-YYSJAAJM.js";
+import "./chunk-F5T45NAM.js";
 import "./chunk-YUPQOLFX.js";
 import "./chunk-WHOJWOSV.js";
 import "./chunk-5XZ744TS.js";

package/dist/{chunk-AJ7JQ4OU.js → chunk-AAFBSOSD.js}

@@ -1,9 +1,9 @@
 import {
   sandboxBaseUrl
-} from "./chunk-ACQCK4DT.js";
+} from "./chunk-OR43PDCW.js";
 import {
   getAccessToken
-} from "./chunk-C56BC2FY.js";
+} from "./chunk-SG4UBJ47.js";
 import {
   exportWorkspaceBundle
 } from "./chunk-QTNO2WD6.js";
@@ -115,4 +115,4 @@ export {
   fetchSandboxBundle,
   runSandboxExportCommand
 };
-//# sourceMappingURL=chunk-AJ7JQ4OU.js.map
+//# sourceMappingURL=chunk-AAFBSOSD.js.map

package/dist/{chunk-VWGJQTNA.js → chunk-APOR6TCV.js}

@@ -1,10 +1,10 @@
 import {
   getEnvironment,
   readEphemeralState
-} from "./chunk-DGSF2Q5H.js";
+} from "./chunk-WJYB7DSI.js";
 import {
   sandboxBaseUrl
-} from "./chunk-ACQCK4DT.js";
+} from "./chunk-OR43PDCW.js";
 import {
   fetchReadOrExplain,
   httpFailure
@@ -66,7 +66,7 @@ async function resolveMetaTarget(auth, opts, deps = {}) {
     case "sandbox":
       return resolveSandbox(auth);
     case "ephemeral": {
-      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-6WJW7LP6.js")).resolveLive;
+      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-46SL27GJ.js")).resolveLive;
       return resolveEphemeral(auth, opts.name, { ...deps, resolveLive });
     }
   }
@@ -75,4 +75,4 @@ async function resolveMetaTarget(auth, opts, deps = {}) {
 export {
   resolveMetaTarget
 };
-//# sourceMappingURL=chunk-VWGJQTNA.js.map
+//# sourceMappingURL=chunk-APOR6TCV.js.map

package/dist/{chunk-YYSJAAJM.js → chunk-F5T45NAM.js}

@@ -73,7 +73,11 @@ var FLAGS = {
   guest: { spec: "--guest, -g", summary: "Mint a read-only guest session (browse only)" },
   "url-only": { spec: "--url-only, -u", summary: "Print the dashboard URL instead of opening a browser" },
   prompt: { spec: "--prompt", summary: "Print only the add-on wiring prompt, for piping to a coding agent" },
-  port: { spec: "--port <n>", summary: "Fixed loopback callback port (default: ephemeral)" },
+  port: { spec: "--port <n>", summary: "Loopback callback port (default: 47100)" },
+  paste: {
+    spec: "--paste",
+    summary: "Sign in without the loopback callback: open the printed URL in any browser and paste the redirect back. For a host whose 127.0.0.1 the browser cannot reach \u2014 remote shell, container, Codespace. Needs a terminal."
+  },
   scope: { spec: '--scope "<list>"', summary: "OAuth scopes to request (default: the built-in set)" },
   runtime: { spec: "--runtime", summary: "After the round-trip, run each deployed function and report" },
   capture: { spec: "--capture", summary: "Write each round-tripped function's fetched JSON" },
@@ -481,6 +485,7 @@ var COMMANDS = {
     summary: "OAuth sign-in \u2014 shared cache, or --local per project",
     flags: [
       "local",
+      "paste",
       "port",
       "scope",
       "origin",
@@ -670,4 +675,4 @@ export {
   liveSubcommandNames,
   suggest
 };
-//# sourceMappingURL=chunk-YYSJAAJM.js.map
+//# sourceMappingURL=chunk-F5T45NAM.js.map

package/dist/{chunk-KGNJM4LN.js → chunk-IVP6TS26.js}

@@ -19,7 +19,7 @@ import {
   liveSubcommandNames,
   renderArgs,
   suggest
-} from "./chunk-YYSJAAJM.js";
+} from "./chunk-F5T45NAM.js";
 
 // src/emit/help.ts
 function table(rows, s, indent = "  ", fixedWidth) {
@@ -245,4 +245,4 @@ export {
   reportFailure,
   exitCodeOf
 };
-//# sourceMappingURL=chunk-KGNJM4LN.js.map
+//# sourceMappingURL=chunk-IVP6TS26.js.map

package/dist/{chunk-EAIR6VUL.js → chunk-KXCPZUUM.js}

@@ -44,10 +44,10 @@ import {
 } from "./chunk-6DHJVLYP.js";
 import {
   readVersion
-} from "./chunk-DUC3PXDG.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   UsageError
-} from "./chunk-KGNJM4LN.js";
+} from "./chunk-IVP6TS26.js";
 import {
   blank,
   detail,
@@ -529,4 +529,4 @@ export {
   projectShellFiles,
   runInitCommand
 };
-//# sourceMappingURL=chunk-EAIR6VUL.js.map
+//# sourceMappingURL=chunk-KXCPZUUM.js.map

package/dist/{chunk-7REDODS2.js → chunk-LLWK6H77.js}

@@ -130,6 +130,8 @@ var OpenIdProvider = class {
   configPromise;
   /** The client_id the resolved config uses — set once `build()` completes. */
   resolvedClientId;
+  /** The issuer the resolved config discovered — set once `build()` completes. */
+  resolvedIssuer;
   redirectUri() {
     if (!this.opts.redirectUri) {
       throw new Error("OpenIdProvider: redirectUri is required for the authorize/exchange flow.");
@@ -147,6 +149,19 @@ var OpenIdProvider = class {
     }
     return this.resolvedClientId;
   }
+  /**
+   * The authorization server's issuer, as resolved by discovery. Only the paste
+   * login mode needs it: a pasted BARE code carries no `iss`, and the AS
+   * advertises issuer support, so one has to be supplied for the response to
+   * validate at all. Same lifecycle guard as `clientId()` — valid once the
+   * configuration has resolved.
+   */
+  issuer() {
+    if (!this.resolvedIssuer) {
+      throw new Error("OpenIdProvider.issuer() called before the configuration was resolved.");
+    }
+    return this.resolvedIssuer;
+  }
   async build() {
     const server = new URL(this.opts.authHost);
     const options = server.protocol === "http:" ? { execute: [client.allowInsecureRequests] } : void 0;
@@ -166,13 +181,15 @@ var OpenIdProvider = class {
       });
     }
     this.resolvedClientId = clientId;
-    return client.discovery(
+    const config = await client.discovery(
       server,
       clientId,
       { token_endpoint_auth_method: "none" },
       client.None(),
       options
     );
+    this.resolvedIssuer = config.serverMetadata().issuer;
+    return config;
   }
   config() {
     return this.configPromise ??= this.build();
@@ -180,6 +197,7 @@ var OpenIdProvider = class {
   async reset() {
     this.configPromise = void 0;
     this.resolvedClientId = void 0;
+    this.resolvedIssuer = void 0;
     if (this.opts.redirectUri) {
       clearClient({ authHost: this.opts.authHost, redirectUri: this.opts.redirectUri });
     }
@@ -465,4 +483,4 @@ export {
   resolveScope,
   assertHttpsOrigin
 };
-//# sourceMappingURL=chunk-7REDODS2.js.map
+//# sourceMappingURL=chunk-LLWK6H77.js.map

package/dist/{chunk-DUC3PXDG.js → chunk-MS3BRZAZ.js}

@@ -9,7 +9,7 @@ import {
   unknownFlag,
   unknownHelpTopic,
   unknownSubcommand
-} from "./chunk-KGNJM4LN.js";
+} from "./chunk-IVP6TS26.js";
 import {
   readLockFile,
   writeLockFile
@@ -30,7 +30,7 @@ import {
   getSubcommand,
   isCommand,
   suggest
-} from "./chunk-YYSJAAJM.js";
+} from "./chunk-F5T45NAM.js";
 import {
   FILTER_NAMES,
   KNOWLEDGE_DIR,
@@ -395,6 +395,7 @@ function parseArgs(argv) {
   let authHost;
   let authFile;
   let useLocal = false;
+  let paste = false;
   let allWorkspaces = false;
   let guest = false;
   let urlOnly = false;
@@ -515,6 +516,8 @@ function parseArgs(argv) {
       authFile = arg.slice("--config=".length);
     } else if (arg === "--local") {
       useLocal = true;
+    } else if (arg === "--paste") {
+      paste = true;
     } else if (arg === "--all-workspaces") {
       allWorkspaces = true;
     } else if (arg === "--guest" || arg === "-g") {
@@ -686,6 +689,7 @@ function parseArgs(argv) {
     authHost,
     authFile,
     local: useLocal,
+    paste,
     allWorkspaces,
     guest,
     urlOnly,
@@ -928,11 +932,11 @@ async function run(argv) {
     return;
   }
   if (command === "init") {
-    const { runInitCommand } = await import("./init-command-GJUPWTKA.js");
+    const { runInitCommand } = await import("./init-command-NCRPVFGE.js");
     return runInitCommand(args);
   }
   if (command === "completion") {
-    const { isCompletionShell, runCompletionCommand, COMPLETION_SHELLS } = await import("./completion-4GYN752B.js");
+    const { isCompletionShell, runCompletionCommand, COMPLETION_SHELLS } = await import("./completion-GHP5RRLQ.js");
     const shell = args.positionals[0];
     if (shell === void 0 || !isCompletionShell(shell)) {
       throw new UsageError(
@@ -943,31 +947,31 @@ async function run(argv) {
     return runCompletionCommand(shell);
   }
   if (command === "upgrade") {
-    const { runUpgradeCommand } = await import("./upgrade-command-CKJ4BS2P.js");
+    const { runUpgradeCommand } = await import("./upgrade-command-M2DZ3ZPD.js");
     return runUpgradeCommand(args);
   }
   if (command === "lock") {
-    const { runLockCommand } = await import("./lock-commands-7IH7RSSP.js");
+    const { runLockCommand } = await import("./lock-commands-6UONZW26.js");
     return runLockCommand(args);
   }
   if (command === "login") {
-    const { runLoginCommand } = await import("./login-command-QM5SBBI2.js");
+    const { runLoginCommand } = await import("./login-command-SG7IWTHW.js");
     return runLoginCommand(args);
   }
   if (command === "logout") {
-    const { runLogoutCommand } = await import("./logout-command-THPASOHM.js");
+    const { runLogoutCommand } = await import("./logout-command-J2AG5NKC.js");
     return runLogoutCommand(args);
   }
   if (command === "deploy") {
-    const { runDeployCommand } = await import("./deploy-command-M2S4HHLC.js");
+    const { runDeployCommand } = await import("./deploy-command-XOH76USO.js");
     return runDeployCommand(args);
   }
   if (command === "ephemeral") {
-    const { runEphemeralCommand } = await import("./ephemeral-command-6WJW7LP6.js");
+    const { runEphemeralCommand } = await import("./ephemeral-command-46SL27GJ.js");
     return runEphemeralCommand(args);
   }
   if (command === "release") {
-    const { runReleaseCommand } = await import("./release-command-M4CVNTWL.js");
+    const { runReleaseCommand } = await import("./release-command-FKQ6E3TD.js");
     return runReleaseCommand(args);
   }
   if (command === "sandbox") {
@@ -975,47 +979,47 @@ async function run(argv) {
       throw removedSubcommand("sandbox", "deploy");
     }
     if (args.subcommand === "details") {
-      const { runSandboxDetailsCommand } = await import("./sandbox-details-command-BRII3QHG.js");
+      const { runSandboxDetailsCommand } = await import("./sandbox-details-command-DMY2KGA2.js");
       return runSandboxDetailsCommand(args);
     }
     if (args.subcommand === "export") {
-      const { runSandboxExportCommand } = await import("./sandbox-export-command-PCZ5FL4U.js");
+      const { runSandboxExportCommand } = await import("./sandbox-export-command-R6QMEK3D.js");
       return runSandboxExportCommand(args);
     }
     if (args.subcommand === "codegen") {
-      const { runCodegenCommand } = await import("./codegen-command-Z7WQMOJ7.js");
+      const { runCodegenCommand } = await import("./codegen-command-BLOS3GR3.js");
       return runCodegenCommand(args, { kind: "sandbox" });
     }
     throw unknownSubcommand("sandbox", args.subcommand);
   }
   if (command === "test") {
-    const { runTestCommand } = await import("./test-command-U4G5Y3UM.js");
+    const { runTestCommand } = await import("./test-command-56IAEYHX.js");
     return runTestCommand(args);
   }
   if (command === "workspace") {
-    const { runWorkspaceCommand } = await import("./workspace-command-RALSEJSW.js");
+    const { runWorkspaceCommand } = await import("./workspace-command-HZS43PHJ.js");
     return runWorkspaceCommand(args);
   }
   if (command === "codegen") {
-    const { runCodegenCommand } = await import("./codegen-command-Z7WQMOJ7.js");
+    const { runCodegenCommand } = await import("./codegen-command-BLOS3GR3.js");
     return runCodegenCommand(args, { kind: "file" });
   }
   if (command === "profile") {
     if (args.subcommand !== "me") {
       throw unknownSubcommand("profile", args.subcommand);
     }
-    const { runProfileCommand } = await import("./profile-command-EUWPVWED.js");
+    const { runProfileCommand } = await import("./profile-command-ZPC2DPFV.js");
     return runProfileCommand(args);
   }
   if (command === "whoami") {
-    const { runProfileCommand } = await import("./profile-command-EUWPVWED.js");
+    const { runProfileCommand } = await import("./profile-command-ZPC2DPFV.js");
     return runProfileCommand(args);
   }
   if (command === "marketplace") {
     if (!["list", "search", "details", "install"].includes(args.subcommand ?? "")) {
       throw unknownSubcommand("marketplace", args.subcommand);
     }
-    const marketplace = await import("./marketplace-command-463DT7O7.js");
+    const marketplace = await import("./marketplace-command-NKTQ3VPS.js");
     if (args.subcommand === "list") return marketplace.runMarketplaceListCommand(args);
     if (args.subcommand === "search") return marketplace.runMarketplaceSearchCommand(args);
     if (args.subcommand === "details") return marketplace.runMarketplaceDetailsCommand(args);
@@ -1025,7 +1029,7 @@ async function run(argv) {
     throw unknownCommand("push");
   }
   if (command === "validate") {
-    const { runValidateCommand } = await import("./validate-command-S5N37JRP.js");
+    const { runValidateCommand } = await import("./validate-command-CIBQJND7.js");
     return runValidateCommand(args);
   }
   if (command !== "compile" && command !== "export" && command !== "paths" && command !== "routes") {
@@ -1290,4 +1294,4 @@ export {
   exportBundleJson,
   compileBundle
 };
-//# sourceMappingURL=chunk-DUC3PXDG.js.map
+//# sourceMappingURL=chunk-MS3BRZAZ.js.map

package/dist/{chunk-VKD3EBKG.js → chunk-OARSPAIE.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-ZOYMZZ3S.js";
 import {
   getAccessToken
-} from "./chunk-C56BC2FY.js";
+} from "./chunk-SG4UBJ47.js";
 import {
   exportWorkspaceBundle
 } from "./chunk-QTNO2WD6.js";
@@ -27,7 +27,7 @@ import {
   resolveFrontendPreset,
   resolveThemeChoice,
   sanitizeAppName
-} from "./chunk-EAIR6VUL.js";
+} from "./chunk-KXCPZUUM.js";
 import {
   XANO_DIR,
   resolveAiPresets,
@@ -71,10 +71,10 @@ import {
 import {
   loadDefault,
   readVersion
-} from "./chunk-DUC3PXDG.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   UsageError
-} from "./chunk-KGNJM4LN.js";
+} from "./chunk-IVP6TS26.js";
 import {
   blank,
   detail,
@@ -6731,7 +6731,7 @@ async function fetchBundle(args, source) {
   if (source.kind === "sandbox") {
     const auth3 = await getAccessToken(args);
     step("Reading the sandbox workspace");
-    const { fetchSandboxBundle } = await import("./sandbox-export-command-PCZ5FL4U.js");
+    const { fetchSandboxBundle } = await import("./sandbox-export-command-R6QMEK3D.js");
     return {
       bundle: await fetchSandboxBundle(auth3),
       origin: { source: "sandbox", origin: auth3.instance }
@@ -6745,7 +6745,7 @@ async function fetchBundle(args, source) {
       );
     }
     const auth3 = await getAccessToken(args);
-    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-6WJW7LP6.js");
+    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-46SL27GJ.js");
     const summary = await resolveLive(auth3, auth3.workspaceId, name);
     step(`Reading ephemeral "${name}"`);
     return {
@@ -7014,4 +7014,4 @@ export {
   verifyCrashEntry,
   blameGeneratedFile
 };
-//# sourceMappingURL=chunk-VKD3EBKG.js.map
+//# sourceMappingURL=chunk-OARSPAIE.js.map

package/dist/{chunk-ACQCK4DT.js → chunk-OR43PDCW.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-NDZFBZHC.js";
 import {
   getAccessToken
-} from "./chunk-C56BC2FY.js";
+} from "./chunk-SG4UBJ47.js";
 import {
   isMachineOutput,
   writeJson
@@ -97,4 +97,4 @@ export {
   fetchSandboxDetails,
   runSandboxDetailsCommand
 };
-//# sourceMappingURL=chunk-ACQCK4DT.js.map
+//# sourceMappingURL=chunk-OR43PDCW.js.map

package/dist/chunk-PGBK64U5.js

@@ -0,0 +1,59 @@
+import {
+  UsageError
+} from "./chunk-IVP6TS26.js";
+import {
+  style
+} from "./chunk-EZG76F7R.js";
+
+// src/emit/prompt.ts
+import { createInterface } from "readline";
+async function confirm(message, opts) {
+  if (process.stdin.isTTY !== true) {
+    throw new UsageError(
+      `Cannot ask for confirmation: stdin is not a terminal. Re-run with ${opts.flag} to confirm without being asked.`,
+      { helpFor: opts.helpFor }
+    );
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((res) => rl.question(`${style.yellow("?")} ${message} (y/N) `, res));
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+var MAX_EMPTY_ANSWERS = 3;
+async function promptLine(message, opts) {
+  if (process.stdin.isTTY !== true) {
+    throw new UsageError(
+      `Cannot prompt: stdin is not a terminal. ${opts.noTtyHint}`,
+      { helpFor: opts.helpFor }
+    );
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    for (let attempt = 0; attempt < MAX_EMPTY_ANSWERS; attempt++) {
+      const onClose = () => settle(null);
+      let settle;
+      const answer = await new Promise((resolve) => {
+        settle = resolve;
+        rl.once("close", onClose);
+        rl.question(`${style.yellow("?")} ${message} `, resolve);
+      }).finally(() => rl.off("close", onClose));
+      if (answer === null) throw new UsageError(`Input ended before an answer arrived. ${opts.noTtyHint}`);
+      const trimmed = answer.trim();
+      if (trimmed !== "") return trimmed;
+      process.stderr.write(`${style.yellow("!")} A value is required.
+`);
+    }
+    throw new UsageError(`No value entered. ${opts.noTtyHint}`, { helpFor: opts.helpFor });
+  } finally {
+    rl.close();
+  }
+}
+
+export {
+  confirm,
+  promptLine
+};
+//# sourceMappingURL=chunk-PGBK64U5.js.map

package/dist/{chunk-SWIXWJIY.js → chunk-QA5ICJ4M.js}

@@ -1,9 +1,9 @@
 import {
   compileBundle
-} from "./chunk-DUC3PXDG.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   missingArgument
-} from "./chunk-KGNJM4LN.js";
+} from "./chunk-IVP6TS26.js";
 
 // src/emit/bundle-input.ts
 import { existsSync, readFileSync } from "fs";
@@ -34,4 +34,4 @@ export {
   assertBundleInput,
   loadBundleText
 };
-//# sourceMappingURL=chunk-SWIXWJIY.js.map
+//# sourceMappingURL=chunk-QA5ICJ4M.js.map

package/dist/{chunk-C56BC2FY.js → chunk-SG4UBJ47.js}

@@ -12,7 +12,7 @@ import {
   resolveAuthHost,
   resolveScope,
   writeCredential
-} from "./chunk-7REDODS2.js";
+} from "./chunk-LLWK6H77.js";
 import {
   detail,
   hostLabel,
@@ -251,4 +251,4 @@ export {
   envMetaCredentialVarsSet,
   getAccessToken
 };
-//# sourceMappingURL=chunk-C56BC2FY.js.map
+//# sourceMappingURL=chunk-SG4UBJ47.js.map

package/dist/{chunk-VTIL47DT.js → chunk-W5NOKYEG.js}

@@ -2,6 +2,9 @@
 import { createServer } from "http";
 import { spawn } from "child_process";
 var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+function loopbackRedirectUri(port, callbackPath) {
+  return `http://127.0.0.1:${port}${callbackPath}`;
+}
 function formatDuration(ms) {
   const seconds = Math.round(ms / 1e3);
   if (seconds < 60) return `${seconds} second${seconds === 1 ? "" : "s"}`;
@@ -81,7 +84,7 @@ function startCallbackServer(opts) {
     });
     server.listen(port ?? 0, "127.0.0.1", () => {
       const boundPort = server.address().port;
-      redirectUri = `http://127.0.0.1:${boundPort}${callbackPath}`;
+      redirectUri = loopbackRedirectUri(boundPort, callbackPath);
       resolveListener({
         redirectUri,
         waitForCallback,
@@ -119,7 +122,8 @@ function openBrowser(url) {
 }
 
 export {
+  loopbackRedirectUri,
   startCallbackServer,
   openBrowser
 };
-//# sourceMappingURL=chunk-VTIL47DT.js.map
+//# sourceMappingURL=chunk-W5NOKYEG.js.map

package/dist/{chunk-DGSF2Q5H.js → chunk-WJYB7DSI.js}

@@ -1,6 +1,6 @@
 import {
   ensureGitignored
-} from "./chunk-7REDODS2.js";
+} from "./chunk-LLWK6H77.js";
 import {
   atomicWrite
 } from "./chunk-GNPVYOPB.js";
@@ -57,4 +57,4 @@ export {
   setEnvironment,
   clearEnvironment
 };
-//# sourceMappingURL=chunk-DGSF2Q5H.js.map
+//# sourceMappingURL=chunk-WJYB7DSI.js.map

package/dist/{chunk-T6N3VMMO.js → chunk-ZGA5MUNC.js}

@@ -1,6 +1,6 @@
 import {
   readVersion
-} from "./chunk-DUC3PXDG.js";
+} from "./chunk-MS3BRZAZ.js";
 import {
   atomicWrite
 } from "./chunk-GNPVYOPB.js";
@@ -170,4 +170,4 @@ export {
   upgradeCommand,
   maybeNotifyUpdate
 };
-//# sourceMappingURL=chunk-T6N3VMMO.js.map
+//# sourceMappingURL=chunk-ZGA5MUNC.js.map

package/dist/cli.d.ts

@@ -141,8 +141,15 @@ interface ParsedArgs {
     urlOnly: boolean;
     /** `marketplace details --prompt`: print the add-on's agent prompt alone, for piping. */
     prompt: boolean;
-    /** `login --port <n>`: fixed loopback callback port (default: an ephemeral port). */
+    /** `login --port <n>`: loopback callback port (default: `DEFAULT_PORT`, 47100). */
     port: number | undefined;
+    /**
+     * `login --paste`: skip the loopback callback server and read the redirect back
+     * from the user, for a host whose 127.0.0.1 the browser cannot reach (remote
+     * shell, container, Codespace). Distinct from `XANO_NO_BROWSER`, which only
+     * suppresses the browser launch and still needs the redirect to arrive.
+     */
+    paste: boolean;
     /** `login --scope "<space list>"`: OAuth scopes to request (default: the built-in xano-cli set). */
     scope: string | undefined;
     /** `validate --runtime`: after import + round-trip, run each deployed function and report. */