@xanots/sdk 0.0.4 → 0.0.6

package/dist/{workspace-command-RALSEJSW.js → workspace-command-LX5S5N2H.js}

@@ -1,12 +1,12 @@
 import {
   fetchWorkspaceBundle,
   runCodegenCommand
-} from "./chunk-VKD3EBKG.js";
+} from "./chunk-TYBB7ON3.js";
 import "./chunk-ZOYMZZ3S.js";
 import {
   resolveOutputTarget
-} from "./chunk-AJ7JQ4OU.js";
-import "./chunk-ACQCK4DT.js";
+} from "./chunk-AAFBSOSD.js";
+import "./chunk-OR43PDCW.js";
 import {
   printMicroserviceSection,
   readMicroservices
@@ -14,35 +14,35 @@ import {
 import {
   ENV_WORKSPACE,
   getAccessToken
-} from "./chunk-C56BC2FY.js";
-import "./chunk-7REDODS2.js";
+} from "./chunk-SG4UBJ47.js";
+import "./chunk-LLWK6H77.js";
 import "./chunk-QTNO2WD6.js";
 import "./chunk-ZUTSMMAG.js";
 import "./chunk-X4DVXBFY.js";
-import "./chunk-EAIR6VUL.js";
+import "./chunk-4HDOP7LH.js";
 import {
   isMachineOutput,
   writeJson
 } from "./chunk-NUQCEOKA.js";
-import "./chunk-7SISR3CS.js";
+import "./chunk-2SUCC4DV.js";
 import "./chunk-ZSYZTGJH.js";
 import {
   fetchOrExplain,
   httpFailure
 } from "./chunk-3IGNIP6R.js";
-import "./chunk-PXXLBXOP.js";
+import "./chunk-JRGDLAEA.js";
 import "./chunk-LU7TRWMC.js";
-import "./chunk-WGDAOOXG.js";
-import "./chunk-QUUB7HYK.js";
-import "./chunk-6DHJVLYP.js";
+import "./chunk-MU3O43L2.js";
+import "./chunk-P5C2YKAM.js";
+import "./chunk-Q77KNEUL.js";
 import "./chunk-4BXJGVZ3.js";
-import "./chunk-CYJ7R3AD.js";
-import "./chunk-DUC3PXDG.js";
+import "./chunk-GC7ZQHW7.js";
+import "./chunk-SOCYCBYG.js";
 import {
   removedSubcommand,
   unknownSubcommand
-} from "./chunk-KGNJM4LN.js";
-import "./chunk-MFIHIS6B.js";
+} from "./chunk-JQLR64UC.js";
+import "./chunk-OLQLJY5T.js";
 import "./chunk-GNPVYOPB.js";
 import {
   formatFields,
@@ -50,12 +50,12 @@ import {
   step,
   success
 } from "./chunk-EZG76F7R.js";
-import "./chunk-BPEEGJJA.js";
-import "./chunk-YYSJAAJM.js";
-import "./chunk-YUPQOLFX.js";
+import "./chunk-3FQD3QME.js";
+import "./chunk-OKNSR7MT.js";
+import "./chunk-CQBJNFDK.js";
 import "./chunk-WHOJWOSV.js";
 import "./chunk-5XZ744TS.js";
-import "./chunk-YUBJLB6G.js";
+import "./chunk-EFH4NFPY.js";
 
 // src/emit/workspace-command.ts
 import { writeFileSync } from "fs";
@@ -69,6 +69,10 @@ async function runWorkspaceCommand(args) {
       return runExport(args);
     case "codegen":
       return runCodegenCommand(args, { kind: "workspace" });
+    case "branch": {
+      const { runBranchCommand } = await import("./branch-commands-R4FR75UW.js");
+      return runBranchCommand(args);
+    }
     case "deploy":
       throw removedSubcommand("workspace", "deploy");
     default:
@@ -156,4 +160,4 @@ async function runExport(args) {
 export {
   runWorkspaceCommand
 };
-//# sourceMappingURL=workspace-command-RALSEJSW.js.map
+//# sourceMappingURL=workspace-command-LX5S5N2H.js.map

package/guides/cli.md

@@ -28,6 +28,7 @@ xanots lock prune --no-verify --entry=xano/index.ts --yes dbo:notes  # …or dro
 xanots lock adopt live-export.json --entry=xano/index.ts --yes  # seed the lock from a live engine export
 
 xanots login                               # OAuth sign-in (once) — pick the instance + workspace at consent
+xanots login --paste                       # …when the browser can't reach this machine's 127.0.0.1 (remote shell, container, Codespace)
 xanots workspace details                   # which instance/workspace am I bound to, and via which credential?
 xanots deploy ./xano/index.ts              # compile + import into a live ephemeral (the dev loop) → URL
 xanots deploy ./xano/index.ts --dest sandbox             # …or your throwaway singleton sandbox

package/guides/deploying.md

@@ -21,6 +21,24 @@ The credential caches by default in a **shared** `~/.xanots/auth.json`, reusable
 from **any** project directory — so a single `xanots login` covers all your projects.
 Override the OAuth host with `--origin`/`$XANO_ORIGIN` and the loopback port with `--port`.
 
+**When the browser can't reach this machine** — a remote shell, a container, a
+Codespace — the `127.0.0.1` redirect lands nowhere and `login` waits five minutes for a
+callback that will never arrive. Run `xanots login --paste` instead. It binds nothing:
+it prints the authorize URL, you finish signing in in whatever browser you have, and
+your browser then fails to load the `127.0.0.1` callback — which is expected. Paste that
+URL back from the address bar (or just the `code=` value out of it) and the sign-in
+completes. Everything else is identical, including the instance and workspace you pick
+at consent.
+
+Two things follow from how the code is bound. The paste has to happen in the same run
+that printed the URL, so `--paste` needs a terminal — for automation use the environment
+credential instead (see [Environment variables](environment.md)). And `--port` still
+matters under `--paste`, not because anything binds it, but because it is part of the
+redirect URL's identity.
+
+Note this is **not** what `XANO_NO_BROWSER` does: that only suppresses the browser
+launch, and still needs the redirect to arrive here.
+
 Running `login` again when a usable credential is already cached prints what you're
 signed in to and stops, rather than spending another browser round trip — pass `--force`
 to sign in anyway. That guard is also what keeps `login` from silently replacing a

package/guides/environment.md

@@ -20,7 +20,7 @@ are what you get when the variable is unset.
 | `XANO_GLOBAL_CONFIG` | Moves the **shared** credential cache off `~/.xanots/auth.json`. Only changes where the global cache lives; the project-local `./.xano/auth.json` and the `XANO_CONFIG`/`--config` override are unaffected. |
 | `XANO_CLIENT_FILE` | Moves the OAuth **client-registration** cache off `~/.xano/xanots-clients.json`. That file holds the `client_id` minted per auth host + redirect URI, not a credential. |
 | `XANO_ORIGIN` | OAuth host to sign in against, instead of the default — the same thing `--origin` does. |
-| `XANO_NO_BROWSER` | Set to anything non-empty and `xanots login` will **not** launch a browser; it prints the authorize URL to stderr for you to open yourself. The loopback server still runs and still waits for the redirect, so the flow completes once you visit the URL. For a machine that has no browser to launch, or a remote shell. |
+| `XANO_NO_BROWSER` | Set to anything non-empty and `xanots login` will **not** launch a browser; it prints the authorize URL to stderr for you to open yourself. The loopback server still runs and still waits for the redirect, so the flow completes only if the browser you open it in can reach this machine's `127.0.0.1`. For a machine that has no browser to launch. When the browser is on a **different** machine, that redirect cannot arrive — use `xanots login --paste` instead. |
 
 **`xanots validate`** — its own target, deliberately separate from the deploy login
 

package/guides/scaffold.md

@@ -12,8 +12,9 @@ What `xanots init` writes, the two frontend presets, theming, add-ons, and the S
 `--marketplace <pkg>` (repeatable, comma-separated; installs add-ons and
 registers them — below), `--force` (scaffold into a non-empty folder),
 `--no-install` (skip `npm install`).
-In a terminal, `init` prompts for the framework, the theme, and the AI files;
-every prompt has a default, so pressing enter three times is a valid answer.
+In a terminal, `init` prompts for the framework and the AI files; every prompt
+has a default, so pressing enter twice is a valid answer. The look is never
+prompted for — it comes from the flags above, or from `xanots onboard`.
 The starter backend is empty but already compiles and deploys — grow it from the
 walkthrough in `xano/EXAMPLE.md`.
 

package/llms/statements-calls.md

@@ -13,7 +13,7 @@ Auth & calls:
 - `s.stream.from_request({ url, method?, …tls, as? })` — streaming external HTTP request (`mvp:streaming_api_request`); same typed field surface as `s.api.request` (no description/output envelope). `url` is REQUIRED — it shares `api.request`'s engine declaration, which has no default.
 - `s.webflow.request({ path, method?, …tls, as? })` — Webflow API request (`mvp:connect_webflow_api_request`); like `s.api.request` but addressed by `path` (host is engine-supplied), and `path` is REQUIRED — the engine rejects an empty one. No `headers`: the engine builds its own from the workspace's Webflow connection and ignores an authored value.
 - `s.task.call` / `s.tool.call` / `s.trigger.call` / `s.middleware.call` / `s.addon.call` — same `{ <target>, input?, as? }` shape against the named kind. `s.task.call` and `s.trigger.call` are WORKFLOW-TEST ONLY (see Gotchas in `llms.txt`); `s.tool.call`, `s.middleware.call` and `s.addon.call` run from any stack.
-- `s.action.call({ action, package?, input?, as? })` / `s.action.package.call(…)` — invoke a marketplace action; `package` is its slug.
+- `s.action.call({ actionId, input?, registry?, as? })` / `s.action.package.call({ traceId, versionId, slug, input?, registry?, as? })` — invoke an installed action. Ids are SUPPLIED, never derived from a name: an action is installed onto the instance, so its identity is assigned at install and differs per instance — read them off a call in a pulled workspace. The package form needs all three parts; they are one composite and two of them address nothing. `registry` is the action's own settings, `input` the per-call arguments.
 - `s.cloud.job({ image, command, args?, secret?, template?, await?, as? })` — launch a containerized job. `image`/`command` are REQUIRED; omitted → `Missing param`. ⚠ `await` is SECONDS (default 60), not a boolean.
 - `s.cloud.job.status({ id, as? })` · `s.cloud.job.await({ ids, timeout, as? })` — poll one job, or block on several (`ids` a list `Value`, `timeout` in seconds; both required).
 

package/llms/statements-data.md

@@ -16,7 +16,8 @@ primary key `id`):
 - `s.db.del({ table, fieldName?, fieldValue, as? })` — delete by field match.
 - `s.db.add({ table, row?, data?, output?, as? })` — insert; `row` is a partial keyed by column.
   - A row CELL takes a tagged `Value`, a nested object of sub-keys, or a bare JS literal typed against that column: `row: { is_hidden: true, notes: "…" }` encodes exactly as `{ is_hidden: c.bool(true), notes: c.text("…") }`. The tag comes from the COLUMN, not the literal — `10` on an `f.decimal()` column is `const:decimal`, not `const:int` — so a literal contradicting its column is a compile error on a `f.*`-schema table (`{ is_hidden: "yes" }` on an `f.bool()` column) and throws at encode on a raw-`ColumnDef[]` one. An `f.enum()` column keeps its member union. A column with no literal form — obj/json/list/geo/vector/file — still needs `c.obj`/`c.array`.
-  - `null` is accepted on EVERY column, including ones that refuse every other literal, and encodes `const:null` — a write OF null, not the same as omitting the key (omitted takes the column's type default on `add`: `[]` for a list, `{}` for obj/json, else `null`; on `edit` it is left untouched). A column's `nullable` is not consulted; the engine refuses a null it forbids.
+  - `null` is accepted on EVERY column, including ones that refuse every other literal, and encodes `const:null` — a write OF null, not the same as omitting the key. A column's `nullable` is not consulted at encode; the engine refuses a null it forbids.
+  - Omitting a key on `add` writes the column's type default — declared `default` if set, `[]` for a list, `{}` for obj/json, else `null`. That `null` is EMITTED, not what the row holds: the engine applies the column's nullability, so a `nullable` column keeps `null` and a non-nullable one lands on its type's zero value (`""`, `0`, `false`). Set the cell when the stored value matters. On `edit` an omitted key keeps its stored value.
   - An `f.password()` cell takes the PLAINTEXT — the column hashes on write, so a pre-hashed value, or a hashing filter on the cell, stores a hash of a hash that `security.check_password` can never match.
 - `s.db.edit({ table, fieldName?, fieldValue, row?, data?, output?, as? })` — update by field match.
 - `s.db.patch({ table, fieldName?, fieldValue, data, output?, as? })` — merge a partial (`data` is an object value).

package/llms-full.txt

@@ -1,4 +1,4 @@
-# xanots v0.0.4
+# xanots v0.0.6
 
 > TypeScript SDK that compiles a typed Xano workspace into the importable packageExport JSON bundle.
 
@@ -796,7 +796,8 @@ primary key `id`):
 - `s.db.del({ table, fieldName?, fieldValue, as? })` — delete by field match.
 - `s.db.add({ table, row?, data?, output?, as? })` — insert; `row` is a partial keyed by column.
   - A row CELL takes a tagged `Value`, a nested object of sub-keys, or a bare JS literal typed against that column: `row: { is_hidden: true, notes: "…" }` encodes exactly as `{ is_hidden: c.bool(true), notes: c.text("…") }`. The tag comes from the COLUMN, not the literal — `10` on an `f.decimal()` column is `const:decimal`, not `const:int` — so a literal contradicting its column is a compile error on a `f.*`-schema table (`{ is_hidden: "yes" }` on an `f.bool()` column) and throws at encode on a raw-`ColumnDef[]` one. An `f.enum()` column keeps its member union. A column with no literal form — obj/json/list/geo/vector/file — still needs `c.obj`/`c.array`.
-  - `null` is accepted on EVERY column, including ones that refuse every other literal, and encodes `const:null` — a write OF null, not the same as omitting the key (omitted takes the column's type default on `add`: `[]` for a list, `{}` for obj/json, else `null`; on `edit` it is left untouched). A column's `nullable` is not consulted; the engine refuses a null it forbids.
+  - `null` is accepted on EVERY column, including ones that refuse every other literal, and encodes `const:null` — a write OF null, not the same as omitting the key. A column's `nullable` is not consulted at encode; the engine refuses a null it forbids.
+  - Omitting a key on `add` writes the column's type default — declared `default` if set, `[]` for a list, `{}` for obj/json, else `null`. That `null` is EMITTED, not what the row holds: the engine applies the column's nullability, so a `nullable` column keeps `null` and a non-nullable one lands on its type's zero value (`""`, `0`, `false`). Set the cell when the stored value matters. On `edit` an omitted key keeps its stored value.
   - An `f.password()` cell takes the PLAINTEXT — the column hashes on write, so a pre-hashed value, or a hashing filter on the cell, stores a hash of a hash that `security.check_password` can never match.
 - `s.db.edit({ table, fieldName?, fieldValue, row?, data?, output?, as? })` — update by field match.
 - `s.db.patch({ table, fieldName?, fieldValue, data, output?, as? })` — merge a partial (`data` is an object value).
@@ -901,7 +902,7 @@ Auth & calls:
 - `s.stream.from_request({ url, method?, …tls, as? })` — streaming external HTTP request (`mvp:streaming_api_request`); same typed field surface as `s.api.request` (no description/output envelope). `url` is REQUIRED — it shares `api.request`'s engine declaration, which has no default.
 - `s.webflow.request({ path, method?, …tls, as? })` — Webflow API request (`mvp:connect_webflow_api_request`); like `s.api.request` but addressed by `path` (host is engine-supplied), and `path` is REQUIRED — the engine rejects an empty one. No `headers`: the engine builds its own from the workspace's Webflow connection and ignores an authored value.
 - `s.task.call` / `s.tool.call` / `s.trigger.call` / `s.middleware.call` / `s.addon.call` — same `{ <target>, input?, as? }` shape against the named kind. `s.task.call` and `s.trigger.call` are WORKFLOW-TEST ONLY (see Gotchas in `llms.txt`); `s.tool.call`, `s.middleware.call` and `s.addon.call` run from any stack.
-- `s.action.call({ action, package?, input?, as? })` / `s.action.package.call(…)` — invoke a marketplace action; `package` is its slug.
+- `s.action.call({ actionId, input?, registry?, as? })` / `s.action.package.call({ traceId, versionId, slug, input?, registry?, as? })` — invoke an installed action. Ids are SUPPLIED, never derived from a name: an action is installed onto the instance, so its identity is assigned at install and differs per instance — read them off a call in a pulled workspace. The package form needs all three parts; they are one composite and two of them address nothing. `registry` is the action's own settings, `input` the per-call arguments.
 - `s.cloud.job({ image, command, args?, secret?, template?, await?, as? })` — launch a containerized job. `image`/`command` are REQUIRED; omitted → `Missing param`. ⚠ `await` is SECONDS (default 60), not a boolean.
 - `s.cloud.job.status({ id, as? })` · `s.cloud.job.await({ ids, timeout, as? })` — poll one job, or block on several (`ids` a list `Value`, `timeout` in seconds; both required).
 

package/llms.txt

@@ -1,4 +1,4 @@
-# xanots v0.0.4
+# xanots v0.0.6
 
 > TypeScript SDK that compiles a typed Xano workspace into the importable packageExport JSON bundle.
 

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "xanots",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "TypeScript SDK that compiles a typed Xano workspace into the importable packageExport JSON bundle.",
   "coverage": {
     "objectKinds": {
@@ -9076,9 +9076,13 @@
           "flag": "--local",
           "description": "Use the project-local ./.xano/auth.json instead of the shared cache"
         },
+        {
+          "flag": "--paste",
+          "description": "Sign in without the loopback callback: open the printed URL in any browser and paste the redirect back. For a host whose 127.0.0.1 the browser cannot reach — remote shell, container, Codespace. Needs a terminal."
+        },
         {
           "flag": "--port <n>",
-          "description": "Fixed loopback callback port (default: ephemeral)"
+          "description": "Loopback callback port (default: 47100)"
         },
         {
           "flag": "--scope \"<list>\"",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xanots/sdk",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "XanoTS — your Xano backend as TypeScript. `xanots deploy` ships your typed workspace (and an optional static frontend) to a live, auto-expiring ephemeral environment and prints its URL. init → deploy → URL.",
   "keywords": [
     "xanots",

package/dist/chunk-ALNQCWAW.js

@@ -1,29 +0,0 @@
-import {
-  UsageError
-} from "./chunk-KGNJM4LN.js";
-import {
-  style
-} from "./chunk-EZG76F7R.js";
-
-// src/emit/prompt.ts
-import { createInterface } from "readline";
-async function confirm(message, opts) {
-  if (process.stdin.isTTY !== true) {
-    throw new UsageError(
-      `Cannot ask for confirmation: stdin is not a terminal. Re-run with ${opts.flag} to confirm without being asked.`,
-      { helpFor: opts.helpFor }
-    );
-  }
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((res) => rl.question(`${style.yellow("?")} ${message} (y/N) `, res));
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
-}
-
-export {
-  confirm
-};
-//# sourceMappingURL=chunk-ALNQCWAW.js.map

package/dist/init-command-GJUPWTKA.js

@@ -1,30 +0,0 @@
-import {
-  projectShellFiles,
-  runInitCommand,
-  sanitizeAppName
-} from "./chunk-EAIR6VUL.js";
-import {
-  resolveAiFlags
-} from "./chunk-7SISR3CS.js";
-import "./chunk-ZSYZTGJH.js";
-import "./chunk-WGDAOOXG.js";
-import "./chunk-QUUB7HYK.js";
-import "./chunk-6DHJVLYP.js";
-import "./chunk-DUC3PXDG.js";
-import "./chunk-KGNJM4LN.js";
-import "./chunk-MFIHIS6B.js";
-import "./chunk-GNPVYOPB.js";
-import "./chunk-EZG76F7R.js";
-import "./chunk-BPEEGJJA.js";
-import "./chunk-YYSJAAJM.js";
-import "./chunk-YUPQOLFX.js";
-import "./chunk-WHOJWOSV.js";
-import "./chunk-5XZ744TS.js";
-import "./chunk-YUBJLB6G.js";
-export {
-  projectShellFiles,
-  resolveAiFlags,
-  runInitCommand,
-  sanitizeAppName
-};
-//# sourceMappingURL=init-command-GJUPWTKA.js.map