@xanots/sdk 0.0.4 → 0.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/CHANGELOG.md +21 -10
  2. package/README.md +7 -3
  3. package/dist/.build-fingerprint +1 -0
  4. package/dist/{agent-file-refresh-IJ7GN2FJ.js → agent-file-refresh-6XT23SLU.js} +4 -4
  5. package/dist/bin.js +8 -8
  6. package/dist/branch-commands-R4FR75UW.js +134 -0
  7. package/dist/{chunk-7SISR3CS.js → chunk-2SUCC4DV.js} +2 -2
  8. package/dist/{chunk-BPEEGJJA.js → chunk-3FQD3QME.js} +3 -3
  9. package/dist/{chunk-EAIR6VUL.js → chunk-4HDOP7LH.js} +8 -67
  10. package/dist/chunk-4PTSTDIG.js +59 -0
  11. package/dist/{live-diff-FP4SFNT4.js → chunk-5HCDZ2XN.js} +67 -6
  12. package/dist/{chunk-5WGEURVI.js → chunk-6AAT2AYQ.js} +21 -1
  13. package/dist/{chunk-AJ7JQ4OU.js → chunk-AAFBSOSD.js} +3 -3
  14. package/dist/{chunk-VWGJQTNA.js → chunk-CEFYM6N5.js} +4 -4
  15. package/dist/{chunk-YUPQOLFX.js → chunk-CQBJNFDK.js} +2 -2
  16. package/dist/{chunk-FN4OQT2J.js → chunk-CU5VOSTW.js} +4 -4
  17. package/dist/{chunk-YUBJLB6G.js → chunk-EFH4NFPY.js} +6 -3
  18. package/dist/chunk-EQW3YT5U.js +159 -0
  19. package/dist/{chunk-CYJ7R3AD.js → chunk-GC7ZQHW7.js} +22 -10
  20. package/dist/{chunk-KGNJM4LN.js → chunk-JQLR64UC.js} +6 -5
  21. package/dist/{chunk-PXXLBXOP.js → chunk-JRGDLAEA.js} +2 -2
  22. package/dist/{chunk-7REDODS2.js → chunk-LLWK6H77.js} +20 -2
  23. package/dist/{chunk-WGDAOOXG.js → chunk-MU3O43L2.js} +3 -3
  24. package/dist/{chunk-YYSJAAJM.js → chunk-OKNSR7MT.js} +51 -3
  25. package/dist/{chunk-MFIHIS6B.js → chunk-OLQLJY5T.js} +2 -2
  26. package/dist/{chunk-ACQCK4DT.js → chunk-OR43PDCW.js} +2 -2
  27. package/dist/{chunk-QUUB7HYK.js → chunk-P5C2YKAM.js} +2 -2
  28. package/dist/{chunk-D6OGU2AI.js → chunk-P5OAM3G2.js} +2 -2
  29. package/dist/{chunk-6DHJVLYP.js → chunk-Q77KNEUL.js} +1 -1
  30. package/dist/{chunk-SWIXWJIY.js → chunk-QVSUMHNN.js} +3 -3
  31. package/dist/{chunk-C56BC2FY.js → chunk-SG4UBJ47.js} +2 -2
  32. package/dist/{chunk-DUC3PXDG.js → chunk-SOCYCBYG.js} +54 -27
  33. package/dist/{chunk-VKD3EBKG.js → chunk-TYBB7ON3.js} +58 -38
  34. package/dist/{chunk-VTIL47DT.js → chunk-W5NOKYEG.js} +6 -2
  35. package/dist/{chunk-DGSF2Q5H.js → chunk-WJYB7DSI.js} +2 -2
  36. package/dist/{chunk-T6N3VMMO.js → chunk-Y7BARS25.js} +2 -2
  37. package/dist/cli.d.ts +36 -3
  38. package/dist/cli.js +7 -7
  39. package/dist/{codegen-command-Z7WQMOJ7.js → codegen-command-6XXOIQ25.js} +18 -18
  40. package/dist/{completion-4GYN752B.js → completion-A6BZ3XGU.js} +8 -7
  41. package/dist/{deploy-command-M2S4HHLC.js → deploy-command-MTQQXPOO.js} +16 -16
  42. package/dist/{env-target-GSFCYHKZ.js → env-target-C5JFLDK3.js} +6 -6
  43. package/dist/{ephemeral-command-6WJW7LP6.js → ephemeral-command-K3UJSDS4.js} +13 -13
  44. package/dist/index.d.ts +67 -24
  45. package/dist/index.js +6 -6
  46. package/dist/init-command-AY4KSXR5.js +30 -0
  47. package/dist/internal.js +13 -11
  48. package/dist/{io-7VIA5SON.js → io-65CJNLYI.js} +3 -3
  49. package/dist/live-diff-QK4KC2FJ.js +12 -0
  50. package/dist/{lock-KXOJIGCG.js → lock-PDFCNYUW.js} +2 -2
  51. package/dist/{lock-commands-7IH7RSSP.js → lock-commands-MC6I3MZA.js} +8 -8
  52. package/dist/{login-command-QM5SBBI2.js → login-command-LCOOOPO2.js} +139 -36
  53. package/dist/{logout-command-THPASOHM.js → logout-command-J2AG5NKC.js} +2 -2
  54. package/dist/{marketplace-command-463DT7O7.js → marketplace-command-BCOAAN2I.js} +3 -3
  55. package/dist/{meta-client-OW5WKWW7.js → meta-client-57ZWVHST.js} +2 -2
  56. package/dist/node.js +10 -10
  57. package/dist/{profile-command-EUWPVWED.js → profile-command-ZPC2DPFV.js} +3 -3
  58. package/dist/{release-command-M4CVNTWL.js → release-command-V4K4IORX.js} +193 -25
  59. package/dist/{sandbox-details-command-BRII3QHG.js → sandbox-details-command-DMY2KGA2.js} +4 -4
  60. package/dist/{sandbox-export-command-PCZ5FL4U.js → sandbox-export-command-R6QMEK3D.js} +5 -5
  61. package/dist/scaffold.d.ts +10 -13
  62. package/dist/scaffold.js +3 -3
  63. package/dist/{test-command-U4G5Y3UM.js → test-command-OEBIGOPP.js} +8 -8
  64. package/dist/{upgrade-command-CKJ4BS2P.js → upgrade-command-52AAZ3NV.js} +13 -13
  65. package/dist/{validate-command-S5N37JRP.js → validate-command-KTLPSSH7.js} +10 -10
  66. package/dist/{workspace-command-RALSEJSW.js → workspace-command-LX5S5N2H.js} +24 -20
  67. package/guides/cli.md +1 -0
  68. package/guides/deploying.md +18 -0
  69. package/guides/environment.md +1 -1
  70. package/guides/scaffold.md +3 -2
  71. package/llms/statements-calls.md +1 -1
  72. package/llms/statements-data.md +2 -1
  73. package/llms-full.txt +4 -3
  74. package/llms.txt +1 -1
  75. package/manifest.json +6 -2
  76. package/package.json +1 -1
  77. package/dist/chunk-ALNQCWAW.js +0 -29
  78. package/dist/init-command-GJUPWTKA.js +0 -30
@@ -1,10 +1,10 @@
1
1
  import {
2
2
  getEnvironment,
3
3
  readEphemeralState
4
- } from "./chunk-DGSF2Q5H.js";
4
+ } from "./chunk-WJYB7DSI.js";
5
5
  import {
6
6
  sandboxBaseUrl
7
- } from "./chunk-ACQCK4DT.js";
7
+ } from "./chunk-OR43PDCW.js";
8
8
  import {
9
9
  fetchReadOrExplain,
10
10
  httpFailure
@@ -66,7 +66,7 @@ async function resolveMetaTarget(auth, opts, deps = {}) {
66
66
  case "sandbox":
67
67
  return resolveSandbox(auth);
68
68
  case "ephemeral": {
69
- const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-6WJW7LP6.js")).resolveLive;
69
+ const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-K3UJSDS4.js")).resolveLive;
70
70
  return resolveEphemeral(auth, opts.name, { ...deps, resolveLive });
71
71
  }
72
72
  }
@@ -75,4 +75,4 @@ async function resolveMetaTarget(auth, opts, deps = {}) {
75
75
  export {
76
76
  resolveMetaTarget
77
77
  };
78
- //# sourceMappingURL=chunk-VWGJQTNA.js.map
78
+ //# sourceMappingURL=chunk-CEFYM6N5.js.map
@@ -19,7 +19,7 @@ import {
19
19
  lockKey,
20
20
  resolveRef,
21
21
  sha1Bytes
22
- } from "./chunk-YUBJLB6G.js";
22
+ } from "./chunk-EFH4NFPY.js";
23
23
 
24
24
  // src/types/xdo.ts
25
25
  var TAGS = [
@@ -4068,4 +4068,4 @@ export {
4068
4068
  serializeBundle,
4069
4069
  emitBundle
4070
4070
  };
4071
- //# sourceMappingURL=chunk-YUPQOLFX.js.map
4071
+ //# sourceMappingURL=chunk-CQBJNFDK.js.map
@@ -6,7 +6,7 @@ import {
6
6
  realtimeChannelGuid,
7
7
  realtimeServerRefName,
8
8
  resolveRealtimeServerRef
9
- } from "./chunk-CYJ7R3AD.js";
9
+ } from "./chunk-GC7ZQHW7.js";
10
10
  import {
11
11
  assertCanonical,
12
12
  assertOneOf,
@@ -25,7 +25,7 @@ import {
25
25
  resolveAuthRef,
26
26
  resolveMockKeys,
27
27
  warnLiveDatasource
28
- } from "./chunk-YUPQOLFX.js";
28
+ } from "./chunk-CQBJNFDK.js";
29
29
  import {
30
30
  encodeStatement
31
31
  } from "./chunk-5XZ744TS.js";
@@ -35,7 +35,7 @@ import {
35
35
  lockKey,
36
36
  realtimeMessageSeedName,
37
37
  resolveRef
38
- } from "./chunk-YUBJLB6G.js";
38
+ } from "./chunk-EFH4NFPY.js";
39
39
 
40
40
  // src/kinds/canonical.ts
41
41
  function resolveCanonicalToken(label, payloadKey, accessor, def, override) {
@@ -667,4 +667,4 @@ export {
667
667
  addonKind,
668
668
  addon
669
669
  };
670
- //# sourceMappingURL=chunk-FN4OQT2J.js.map
670
+ //# sourceMappingURL=chunk-CU5VOSTW.js.map
@@ -447,11 +447,14 @@ function validateLockObjects(raw, path) {
447
447
  guidOwners.set(guid, key);
448
448
  }
449
449
  if (typeof canonical === "string") {
450
- const owner = canonicalOwners.get(canonical);
450
+ const scope = isWorkspaceKey ? WORKSPACE_KEY : key.slice(0, key.indexOf(":"));
451
+ let owners = canonicalOwners.get(scope);
452
+ if (owners === void 0) canonicalOwners.set(scope, owners = /* @__PURE__ */ new Map());
453
+ const owner = owners.get(canonical);
451
454
  if (owner !== void 0) {
452
455
  fail(path, `entries "${owner}" and "${key}" share the same canonical (${canonical}).`);
453
456
  }
454
- canonicalOwners.set(canonical, key);
457
+ owners.set(canonical, key);
455
458
  }
456
459
  const entry = {};
457
460
  if (typeof guid === "string") entry.guid = guid;
@@ -680,4 +683,4 @@ export {
680
683
  adoptFromBundle,
681
684
  mergeObserved
682
685
  };
683
- //# sourceMappingURL=chunk-YUBJLB6G.js.map
686
+ //# sourceMappingURL=chunk-EFH4NFPY.js.map
@@ -0,0 +1,159 @@
1
+ import {
2
+ describeTransportFailure,
3
+ httpFailure
4
+ } from "./chunk-3IGNIP6R.js";
5
+
6
+ // src/deploy/branch.ts
7
+ var BRANCH_TIMEOUT_MS = 3e4;
8
+ var DEFAULT_BRANCH_LABEL = "v1";
9
+ function endpoint(baseUrl, workspaceId, suffix = "") {
10
+ return `${baseUrl.replace(/\/$/, "")}/api:meta/workspace/${workspaceId}/branch${suffix}`;
11
+ }
12
+ function assertUsableBranchLabel(label, flag) {
13
+ if (label.trim() === "") {
14
+ throw new Error(
15
+ `\`${flag}\` needs a branch label and was given an empty one.
16
+ The engine does not reject an empty label \u2014 it would create a branch with no name, which cannot be selected, promoted or deleted afterwards.`
17
+ );
18
+ }
19
+ if (label === DEFAULT_BRANCH_LABEL) {
20
+ throw new Error(
21
+ `\`${flag}=${DEFAULT_BRANCH_LABEL}\` names the workspace's DEFAULT branch, which is reserved.
22
+ The engine does not store it as an ordinary branch, so it is not caught by an "already exists" check \u2014 targeting it does not stage anything, it writes to the branch every workspace starts on.
23
+ Pick a different label, or drop the flag to release to whichever branch is currently live.`
24
+ );
25
+ }
26
+ }
27
+ async function call(auth, url, init, action) {
28
+ let res;
29
+ try {
30
+ res = await fetch(url, {
31
+ signal: AbortSignal.timeout(BRANCH_TIMEOUT_MS),
32
+ ...init,
33
+ // MERGED, never spread over: a caller passing `Content-Type` would
34
+ // otherwise replace the whole header object and send the request
35
+ // unauthenticated, which reads as a 401 from the endpoint rather than as
36
+ // the local mistake it is. Caller keys win on conflict; `Authorization` is
37
+ // not a key any caller here sets.
38
+ headers: {
39
+ accept: "application/json",
40
+ Authorization: `Bearer ${auth.access_token}`,
41
+ ...init.headers ?? {}
42
+ }
43
+ });
44
+ } catch (err) {
45
+ throw new Error(`${action} could not reach ${url}: ${describeTransportFailure(err)}`, { cause: err });
46
+ }
47
+ const text = await res.text();
48
+ if (!res.ok) {
49
+ throw new Error(httpFailure(action, { status: res.status, statusText: res.statusText }, text));
50
+ }
51
+ return text;
52
+ }
53
+ function toRecord(entry) {
54
+ if (entry === null || typeof entry !== "object") return void 0;
55
+ const row = entry;
56
+ const label = row.label;
57
+ if (typeof label !== "string" || label === "") return void 0;
58
+ return {
59
+ ...typeof row.id === "number" ? { id: row.id } : {},
60
+ label,
61
+ // Absent means false: the list shape omits `live` on non-live rows.
62
+ live: row.live === true,
63
+ backup: row.backup === true,
64
+ ...typeof row.created_at === "string" ? { createdAt: row.created_at } : {}
65
+ };
66
+ }
67
+ async function listBranches(auth, opts) {
68
+ const text = await call(auth, endpoint(opts.baseUrl, opts.workspaceId), { method: "GET" }, "list branches");
69
+ let parsed;
70
+ try {
71
+ parsed = JSON.parse(text);
72
+ } catch {
73
+ throw new Error(`list branches: could not parse the response as JSON:
74
+ ${text}`);
75
+ }
76
+ if (!Array.isArray(parsed)) {
77
+ throw new Error(`list branches: expected an array of branches, got:
78
+ ${text}`);
79
+ }
80
+ return parsed.map(toRecord).filter((b) => b !== void 0);
81
+ }
82
+ function liveBranchLabel(branches) {
83
+ return branches.find((b) => b.live)?.label;
84
+ }
85
+ async function createBranch(auth, opts) {
86
+ assertUsableBranchLabel(opts.label, "branch label");
87
+ const text = await call(
88
+ auth,
89
+ endpoint(opts.baseUrl, opts.workspaceId),
90
+ {
91
+ method: "POST",
92
+ headers: { "Content-Type": "application/json" },
93
+ body: JSON.stringify({
94
+ source_branch: opts.sourceBranch ?? DEFAULT_BRANCH_LABEL,
95
+ label: opts.label,
96
+ description: opts.description ?? ""
97
+ })
98
+ },
99
+ "create branch"
100
+ );
101
+ let parsed;
102
+ try {
103
+ parsed = JSON.parse(text);
104
+ } catch {
105
+ throw new Error(`create branch: could not parse the response as JSON:
106
+ ${text}`);
107
+ }
108
+ const record = toRecord(parsed);
109
+ if (record === void 0) {
110
+ throw new Error(`create branch: the response named no branch:
111
+ ${text}`);
112
+ }
113
+ return record;
114
+ }
115
+ async function setLiveBranch(auth, opts) {
116
+ await call(
117
+ auth,
118
+ `${endpoint(opts.baseUrl, opts.workspaceId, `/${encodeURIComponent(opts.label)}/live`)}`,
119
+ { method: "POST" },
120
+ "set live branch"
121
+ );
122
+ }
123
+ async function deleteBranch(auth, opts) {
124
+ await call(
125
+ auth,
126
+ endpoint(opts.baseUrl, opts.workspaceId, `/${encodeURIComponent(opts.label)}`),
127
+ { method: "DELETE" },
128
+ "delete branch"
129
+ );
130
+ }
131
+ function assertBranchAbsent(branches, label) {
132
+ if (!branches.some((b) => b.label === label)) return;
133
+ throw new Error(
134
+ `A branch named "${label}" already exists in this workspace.
135
+ Releasing into it is not offered: it would be a fresh import over a branch someone may be reviewing, and the SDK cannot tell those apart.
136
+ Pick a label that is free, or delete "${label}" first with \`xanots workspace branch delete ${label}\`.`
137
+ );
138
+ }
139
+ function requireBranch(branches, label) {
140
+ const found = branches.find((b) => b.label === label);
141
+ if (found !== void 0) return found;
142
+ const known = branches.map((b) => b.label).join(", ");
143
+ throw new Error(
144
+ `This workspace has no branch named "${label}".
145
+ ` + (known === "" ? `It reports no branches at all.` : `It has: ${known}`)
146
+ );
147
+ }
148
+
149
+ export {
150
+ assertUsableBranchLabel,
151
+ listBranches,
152
+ liveBranchLabel,
153
+ createBranch,
154
+ setLiveBranch,
155
+ deleteBranch,
156
+ assertBranchAbsent,
157
+ requireBranch
158
+ };
159
+ //# sourceMappingURL=chunk-EQW3YT5U.js.map
@@ -35,7 +35,7 @@ import {
35
35
  registerKind,
36
36
  tableColumns,
37
37
  withFilters
38
- } from "./chunk-YUPQOLFX.js";
38
+ } from "./chunk-CQBJNFDK.js";
39
39
  import {
40
40
  assertPathParamInputs,
41
41
  fillPathParams,
@@ -51,7 +51,7 @@ import {
51
51
  deriveGuid,
52
52
  realtimeChannelSeedName,
53
53
  resolveRef
54
- } from "./chunk-YUBJLB6G.js";
54
+ } from "./chunk-EFH4NFPY.js";
55
55
 
56
56
  // src/statements/set-var.ts
57
57
  var SET_VAR = "mvp:set_var";
@@ -546,29 +546,41 @@ function addonCall(args) {
546
546
  input: encodeCallInput(args.input)
547
547
  }, args);
548
548
  }
549
+ function refuseDerivedIdentity(statement, args) {
550
+ const legacy = args;
551
+ if (legacy.action === void 0 && legacy.package === void 0) return;
552
+ throw new Error(
553
+ `Statement "${statement}": \`action\`/\`package\` named an action and let the SDK derive its id. An action is a third-party package installed onto the instance, so its id is assigned at install and cannot be derived from a name \u2014 a derived one addresses nothing. Pass the installed id instead: \`actionId\` for action.call, or \`traceId\`/\`versionId\`/\`slug\` for action.package.call. Read them off an existing call in a pulled workspace.`
554
+ );
555
+ }
549
556
  function actionCall(args) {
550
557
  args = argsOrEmpty(args);
551
- assertArg("mvp:action", "action", args.action);
558
+ refuseDerivedIdentity("mvp:action", args);
559
+ assertArg("mvp:action", "actionId", args.actionId);
552
560
  return annotate({
553
561
  name: "mvp:action",
554
- context: { run_version: { id: resolveRef("function", args.action) } },
562
+ context: { run_version: { id: args.actionId } },
555
563
  as: args.as,
556
564
  input: encodeCallInput(args.input),
557
- settings_registry: []
565
+ settings_registry: encodeCallInput(args.registry)
558
566
  }, args);
559
567
  }
560
568
  function actionPackageCall(args) {
561
569
  args = argsOrEmpty(args);
570
+ refuseDerivedIdentity("mvp:action_package", args);
571
+ assertArg("mvp:action_package", "traceId", args.traceId);
572
+ assertArg("mvp:action_package", "versionId", args.versionId);
573
+ assertArg("mvp:action_package", "slug", args.slug);
562
574
  return annotate({
563
575
  name: "mvp:action_package",
564
576
  context: {
565
- action: { trace_id: "" },
566
- package: { slug: args.package ?? "" },
567
- package_version: { id: "" }
577
+ action: { trace_id: args.traceId },
578
+ package: { slug: args.slug },
579
+ package_version: { id: args.versionId }
568
580
  },
569
581
  as: args.as,
570
582
  input: encodeCallInput(args.input),
571
- settings_registry: []
583
+ settings_registry: encodeCallInput(args.registry)
572
584
  }, args);
573
585
  }
574
586
  function workflowTestCall(args) {
@@ -3721,4 +3733,4 @@ export {
3721
3733
  workspaceKind,
3722
3734
  workspaceConfig
3723
3735
  };
3724
- //# sourceMappingURL=chunk-CYJ7R3AD.js.map
3736
+ //# sourceMappingURL=chunk-GC7ZQHW7.js.map
@@ -18,8 +18,9 @@ import {
18
18
  liveCommandNames,
19
19
  liveSubcommandNames,
20
20
  renderArgs,
21
- suggest
22
- } from "./chunk-YYSJAAJM.js";
21
+ suggest,
22
+ visibleFlags
23
+ } from "./chunk-OKNSR7MT.js";
23
24
 
24
25
  // src/emit/help.ts
25
26
  function table(rows, s, indent = " ", fixedWidth) {
@@ -96,7 +97,7 @@ function renderCommandHelp(command, s = stdoutStyle()) {
96
97
  lines.push("", s.bold("Subcommands"), ...table(rows, s));
97
98
  }
98
99
  lines.push(...argSection(spec.args, s));
99
- lines.push(...flagSection(spec.flags, s));
100
+ lines.push(...flagSection(visibleFlags(spec), s));
100
101
  lines.push(...exampleSection(spec.example, s));
101
102
  if (subs.length > 0) {
102
103
  lines.push("", s.dim(`Run \`xanots ${command} <subcommand> --help\` for a subcommand's flags.`));
@@ -113,7 +114,7 @@ function renderSubcommandHelp(command, sub, s = stdoutStyle()) {
113
114
  `${s.dim("Usage:")} xanots ${command} ${sub}${args ? ` ${args}` : ""} ${s.dim("[options]")}`
114
115
  ];
115
116
  lines.push(...argSection(spec.args, s));
116
- lines.push(...flagSection(spec.flags, s));
117
+ lines.push(...flagSection(visibleFlags(spec), s));
117
118
  lines.push(...exampleSection(spec.example, s));
118
119
  return lines.join("\n") + "\n";
119
120
  }
@@ -245,4 +246,4 @@ export {
245
246
  reportFailure,
246
247
  exitCodeOf
247
248
  };
248
- //# sourceMappingURL=chunk-KGNJM4LN.js.map
249
+ //# sourceMappingURL=chunk-JQLR64UC.js.map
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  c,
3
3
  resp
4
- } from "./chunk-YUPQOLFX.js";
4
+ } from "./chunk-CQBJNFDK.js";
5
5
 
6
6
  // src/values/expect.ts
7
7
  var TEST_EXPECT_TYPES = [
@@ -90,4 +90,4 @@ export {
90
90
  TEST_EXPECT_TYPES,
91
91
  expect
92
92
  };
93
- //# sourceMappingURL=chunk-PXXLBXOP.js.map
93
+ //# sourceMappingURL=chunk-JRGDLAEA.js.map
@@ -130,6 +130,8 @@ var OpenIdProvider = class {
130
130
  configPromise;
131
131
  /** The client_id the resolved config uses — set once `build()` completes. */
132
132
  resolvedClientId;
133
+ /** The issuer the resolved config discovered — set once `build()` completes. */
134
+ resolvedIssuer;
133
135
  redirectUri() {
134
136
  if (!this.opts.redirectUri) {
135
137
  throw new Error("OpenIdProvider: redirectUri is required for the authorize/exchange flow.");
@@ -147,6 +149,19 @@ var OpenIdProvider = class {
147
149
  }
148
150
  return this.resolvedClientId;
149
151
  }
152
+ /**
153
+ * The authorization server's issuer, as resolved by discovery. Only the paste
154
+ * login mode needs it: a pasted BARE code carries no `iss`, and the AS
155
+ * advertises issuer support, so one has to be supplied for the response to
156
+ * validate at all. Same lifecycle guard as `clientId()` — valid once the
157
+ * configuration has resolved.
158
+ */
159
+ issuer() {
160
+ if (!this.resolvedIssuer) {
161
+ throw new Error("OpenIdProvider.issuer() called before the configuration was resolved.");
162
+ }
163
+ return this.resolvedIssuer;
164
+ }
150
165
  async build() {
151
166
  const server = new URL(this.opts.authHost);
152
167
  const options = server.protocol === "http:" ? { execute: [client.allowInsecureRequests] } : void 0;
@@ -166,13 +181,15 @@ var OpenIdProvider = class {
166
181
  });
167
182
  }
168
183
  this.resolvedClientId = clientId;
169
- return client.discovery(
184
+ const config = await client.discovery(
170
185
  server,
171
186
  clientId,
172
187
  { token_endpoint_auth_method: "none" },
173
188
  client.None(),
174
189
  options
175
190
  );
191
+ this.resolvedIssuer = config.serverMetadata().issuer;
192
+ return config;
176
193
  }
177
194
  config() {
178
195
  return this.configPromise ??= this.build();
@@ -180,6 +197,7 @@ var OpenIdProvider = class {
180
197
  async reset() {
181
198
  this.configPromise = void 0;
182
199
  this.resolvedClientId = void 0;
200
+ this.resolvedIssuer = void 0;
183
201
  if (this.opts.redirectUri) {
184
202
  clearClient({ authHost: this.opts.authHost, redirectUri: this.opts.redirectUri });
185
203
  }
@@ -465,4 +483,4 @@ export {
465
483
  resolveScope,
466
484
  assertHttpsOrigin
467
485
  };
468
- //# sourceMappingURL=chunk-7REDODS2.js.map
486
+ //# sourceMappingURL=chunk-LLWK6H77.js.map
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  renderThemeScript
3
- } from "./chunk-QUUB7HYK.js";
3
+ } from "./chunk-P5C2YKAM.js";
4
4
  import {
5
5
  defaultThemeChoice,
6
6
  iconLibraryOf,
7
7
  reactPreset
8
- } from "./chunk-6DHJVLYP.js";
8
+ } from "./chunk-Q77KNEUL.js";
9
9
 
10
10
  // src/emit/frontend-svelte.ts
11
11
  var CODE_CLASS = "bg-muted rounded px-1.5 py-0.5 font-mono text-sm";
@@ -842,4 +842,4 @@ export {
842
842
  allFrontendPresets,
843
843
  resolveFrameworkFlag
844
844
  };
845
- //# sourceMappingURL=chunk-WGDAOOXG.js.map
845
+ //# sourceMappingURL=chunk-MU3O43L2.js.map
@@ -73,7 +73,11 @@ var FLAGS = {
73
73
  guest: { spec: "--guest, -g", summary: "Mint a read-only guest session (browse only)" },
74
74
  "url-only": { spec: "--url-only, -u", summary: "Print the dashboard URL instead of opening a browser" },
75
75
  prompt: { spec: "--prompt", summary: "Print only the add-on wiring prompt, for piping to a coding agent" },
76
- port: { spec: "--port <n>", summary: "Fixed loopback callback port (default: ephemeral)" },
76
+ port: { spec: "--port <n>", summary: "Loopback callback port (default: 47100)" },
77
+ paste: {
78
+ spec: "--paste",
79
+ summary: "Sign in without the loopback callback: open the printed URL in any browser and paste the redirect back. For a host whose 127.0.0.1 the browser cannot reach \u2014 remote shell, container, Codespace. Needs a terminal."
80
+ },
77
81
  scope: { spec: '--scope "<list>"', summary: "OAuth scopes to request (default: the built-in set)" },
78
82
  runtime: { spec: "--runtime", summary: "After the round-trip, run each deployed function and report" },
79
83
  capture: { spec: "--capture", summary: "Write each round-tripped function's fetched JSON" },
@@ -138,6 +142,19 @@ var FLAGS = {
138
142
  "reset-data": { spec: "--reset-data", summary: "Empty every table the bundle carries before importing" },
139
143
  seed: { spec: "--seed", summary: "Write the bundle's table rows (off by default)" },
140
144
  replace: { spec: "--replace", summary: "Wipe the workspace and import in its place, instead of merging" },
145
+ branch: {
146
+ spec: "--branch <label>",
147
+ summary: "Release to this branch instead of the live one (stages logic; schema is shared)"
148
+ },
149
+ "set-live": { spec: "--set-live", summary: "Promote the branch to live once the import lands" },
150
+ "allow-shared-schema-changes": {
151
+ spec: "--allow-shared-schema-changes",
152
+ summary: "Proceed even though table/microservice changes reach every branch"
153
+ },
154
+ "backup-branch": {
155
+ spec: "--backup-branch[=<label>]",
156
+ summary: "Snapshot the live branch before importing, so the release can be rolled back"
157
+ },
141
158
  open: { spec: "--open", summary: "Open the deployed URL in your browser when it lands" },
142
159
  // ── Global (accepted by every command; see GLOBAL_FLAGS) ───────────────
143
160
  json: {
@@ -312,6 +329,10 @@ var COMMANDS = {
312
329
  "reset-data",
313
330
  "seed",
314
331
  "replace",
332
+ "branch",
333
+ "set-live",
334
+ "allow-shared-schema-changes",
335
+ "backup-branch",
315
336
  "yes",
316
337
  { key: "force", summary: "Skip the confirmation prompt (same as --yes)" },
317
338
  "static",
@@ -323,6 +344,13 @@ var COMMANDS = {
323
344
  ...COMPILE,
324
345
  ...AUTH
325
346
  ],
347
+ // Branch-targeted releases are built and tested, but the instance-side
348
+ // support they need is not live yet, so they stay off every discovery
349
+ // surface for now. The flags still parse and run — and the release refuses
350
+ // outright unless the server confirms the branch it planned against, so an
351
+ // instance without support fails closed rather than overwriting production.
352
+ // Delete this line (and nothing else) to announce them.
353
+ unreleasedFlags: ["branch", "set-live", "allow-shared-schema-changes", "backup-branch"],
326
354
  example: "xanots release ./index.ts --dry-run"
327
355
  },
328
356
  validate: {
@@ -361,6 +389,19 @@ var COMMANDS = {
361
389
  flags: ["path", { key: "name", summary: "Output basename (default: `workspace`)" }, ...AUTH],
362
390
  example: "xanots workspace export --path -"
363
391
  },
392
+ branch: {
393
+ // Hidden until instance-side branch support ships — see
394
+ // `release.unreleasedFlags`. The verb works; it is just not advertised.
395
+ unreleased: true,
396
+ summary: "List, promote, or delete its branches",
397
+ display: "workspace branch <list|set-live|delete> [label]",
398
+ args: [
399
+ { name: "verb", required: true },
400
+ { name: "label", required: false }
401
+ ],
402
+ flags: ["yes", ...AUTH],
403
+ example: "xanots workspace branch list"
404
+ },
364
405
  codegen: {
365
406
  summary: "Decode it into a runnable XanoTS project",
366
407
  args: [{ name: "path", required: true, path: true }],
@@ -481,6 +522,7 @@ var COMMANDS = {
481
522
  summary: "OAuth sign-in \u2014 shared cache, or --local per project",
482
523
  flags: [
483
524
  "local",
525
+ "paste",
484
526
  "port",
485
527
  "scope",
486
528
  "origin",
@@ -622,7 +664,12 @@ function flagValues(ref) {
622
664
  function liveSubcommandNames(command) {
623
665
  const subs = getCommand(command)?.subcommands;
624
666
  if (!subs) return [];
625
- return Object.entries(subs).filter(([, spec]) => spec.removed === void 0).map(([name]) => name);
667
+ return Object.entries(subs).filter(([, spec]) => spec.removed === void 0 && spec.unreleased === void 0).map(([name]) => name);
668
+ }
669
+ function visibleFlags(spec) {
670
+ const hidden = spec.unreleasedFlags;
671
+ if (!spec.flags || !hidden || hidden.length === 0) return spec.flags;
672
+ return spec.flags.filter((ref) => !hidden.includes(flagKey(ref)));
626
673
  }
627
674
  function distance(a, b) {
628
675
  let row = Array.from({ length: b.length + 1 }, (_, j) => j);
@@ -668,6 +715,7 @@ export {
668
715
  flagSummary,
669
716
  flagValues,
670
717
  liveSubcommandNames,
718
+ visibleFlags,
671
719
  suggest
672
720
  };
673
- //# sourceMappingURL=chunk-YYSJAAJM.js.map
721
+ //# sourceMappingURL=chunk-OKNSR7MT.js.map
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  parseLock,
6
6
  serializeLock
7
- } from "./chunk-YUBJLB6G.js";
7
+ } from "./chunk-EFH4NFPY.js";
8
8
 
9
9
  // src/lock/io.ts
10
10
  import { readFileSync, existsSync } from "fs";
@@ -35,4 +35,4 @@ export {
35
35
  readLockFile,
36
36
  writeLockFile
37
37
  };
38
- //# sourceMappingURL=chunk-MFIHIS6B.js.map
38
+ //# sourceMappingURL=chunk-OLQLJY5T.js.map
@@ -4,7 +4,7 @@ import {
4
4
  } from "./chunk-NDZFBZHC.js";
5
5
  import {
6
6
  getAccessToken
7
- } from "./chunk-C56BC2FY.js";
7
+ } from "./chunk-SG4UBJ47.js";
8
8
  import {
9
9
  isMachineOutput,
10
10
  writeJson
@@ -97,4 +97,4 @@ export {
97
97
  fetchSandboxDetails,
98
98
  runSandboxDetailsCommand
99
99
  };
100
- //# sourceMappingURL=chunk-ACQCK4DT.js.map
100
+ //# sourceMappingURL=chunk-OR43PDCW.js.map
@@ -5,7 +5,7 @@ import {
5
5
  fontImports,
6
6
  fontThemeVars,
7
7
  orderedTokens
8
- } from "./chunk-6DHJVLYP.js";
8
+ } from "./chunk-Q77KNEUL.js";
9
9
 
10
10
  // src/emit/init-templates.ts
11
11
  function sdkDep(sdkVersion) {
@@ -887,4 +887,4 @@ export {
887
887
  renderCnUtil,
888
888
  renderApiTs
889
889
  };
890
- //# sourceMappingURL=chunk-QUUB7HYK.js.map
890
+ //# sourceMappingURL=chunk-P5C2YKAM.js.map
@@ -5,7 +5,7 @@ import {
5
5
  presetFilePath,
6
6
  renderPreset,
7
7
  upsertManagedBlock
8
- } from "./chunk-7SISR3CS.js";
8
+ } from "./chunk-2SUCC4DV.js";
9
9
  import {
10
10
  warn
11
11
  } from "./chunk-EZG76F7R.js";
@@ -92,4 +92,4 @@ export {
92
92
  isCI,
93
93
  refreshAgentFiles
94
94
  };
95
- //# sourceMappingURL=chunk-D6OGU2AI.js.map
95
+ //# sourceMappingURL=chunk-P5OAM3G2.js.map
@@ -2041,4 +2041,4 @@ export {
2041
2041
  iconLibraryOf,
2042
2042
  reactPreset
2043
2043
  };
2044
- //# sourceMappingURL=chunk-6DHJVLYP.js.map
2044
+ //# sourceMappingURL=chunk-Q77KNEUL.js.map
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  compileBundle
3
- } from "./chunk-DUC3PXDG.js";
3
+ } from "./chunk-SOCYCBYG.js";
4
4
  import {
5
5
  missingArgument
6
- } from "./chunk-KGNJM4LN.js";
6
+ } from "./chunk-JQLR64UC.js";
7
7
 
8
8
  // src/emit/bundle-input.ts
9
9
  import { existsSync, readFileSync } from "fs";
@@ -34,4 +34,4 @@ export {
34
34
  assertBundleInput,
35
35
  loadBundleText
36
36
  };
37
- //# sourceMappingURL=chunk-SWIXWJIY.js.map
37
+ //# sourceMappingURL=chunk-QVSUMHNN.js.map
@@ -12,7 +12,7 @@ import {
12
12
  resolveAuthHost,
13
13
  resolveScope,
14
14
  writeCredential
15
- } from "./chunk-7REDODS2.js";
15
+ } from "./chunk-LLWK6H77.js";
16
16
  import {
17
17
  detail,
18
18
  hostLabel,
@@ -251,4 +251,4 @@ export {
251
251
  envMetaCredentialVarsSet,
252
252
  getAccessToken
253
253
  };
254
- //# sourceMappingURL=chunk-C56BC2FY.js.map
254
+ //# sourceMappingURL=chunk-SG4UBJ47.js.map