@xanots/sdk 0.0.5 → 0.0.7

package/CHANGELOG.md

@@ -11,6 +11,35 @@ listed here.
 
 ---
 
+## 0.0.6 — The action identity fix
+
+_2026-08-28_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.6)
+
+`action.call` and `action.package.call` now take the identity the instance assigned at install
+instead of deriving one from a name. A derived id is well-formed and addresses nothing, so those
+calls exported clean and never resolved — if you have either in a workspace, this is a call-site
+change you need to make. Alongside it: a lock-file false positive that refused a legal workspace,
+and a grounding correction about what an omitted column on `db.add` actually stores.
+
+- ⚠️ `action.call` takes the id the instance assigned, not one derived from a name
+- One canonical on two different kinds is no longer a lock error
+- An omitted column on `db.add` lands on its own default, not `null`
+- `xanots init` asks two questions instead of three
+
+---
+
+## 0.0.5 — Sign in without a loopback
+
+_2026-08-26_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.5)
+
+`xanots login` only ever worked when the browser finishing consent could reach your machine's `127.0.0.1`. On a remote shell, a container, or a Codespace it can't — the redirect lands nowhere and login sits there for five minutes before timing out. `xanots login --paste` fixes that: it binds nothing, prints the URL for you to open anywhere, and you paste the redirect back. This release also corrects two documented promises that were wrong, one of which was actively misleading for exactly this case.
+
+- `xanots login --paste` signs you in where the loopback can't be reached
+- `XANO_NO_BROWSER` never covered remote shells, despite saying it did
+- `--port` documented a default it did not have
+
+---
+
 ## 0.0.4 — The markdown your agents read
 
 _2026-08-26_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.4)

package/README.md

@@ -106,9 +106,9 @@ npx @xanots/sdk init my-app && cd my-app
 npm run dev                       # the frontend runs immediately
 ```
 
-In a terminal it asks three questions — framework, theme, AI instruction files — each with a
-default. The theme is shadcn's own: a base color plus an optional accent, rendered into the
-token stylesheet, with a complete dark palette either way.
+In a terminal it asks two questions — framework and AI instruction files — each with a
+default. The theme is a flag, not a question: it is shadcn's own, a base color plus an
+optional accent, rendered into the token stylesheet with a complete dark palette either way.
 
 ```bash
 npx @xanots/sdk init my-app --theme zinc-blue --dark toggle

package/dist/.build-fingerprint

@@ -1 +1 @@
-c0021219c47ba8aba005451538637f3d324faefad89c71468080cbe5bd443fa1
+12b76c8975e939f33a9312372b45a4090256a351870c259c08c96691cbda54af

package/dist/{agent-file-refresh-IJ7GN2FJ.js → agent-file-refresh-4W37DGXS.js}

@@ -3,10 +3,10 @@ import {
   codingAgentDetected,
   isCI,
   refreshAgentFiles
-} from "./chunk-D6OGU2AI.js";
-import "./chunk-7SISR3CS.js";
+} from "./chunk-QIWBCS7N.js";
+import "./chunk-4PE4ZAB7.js";
 import "./chunk-ZSYZTGJH.js";
-import "./chunk-6DHJVLYP.js";
+import "./chunk-Q77KNEUL.js";
 import "./chunk-EZG76F7R.js";
 export {
   CI_ENV_VARS,
@@ -14,4 +14,4 @@ export {
   isCI,
   refreshAgentFiles
 };
-//# sourceMappingURL=agent-file-refresh-IJ7GN2FJ.js.map
+//# sourceMappingURL=agent-file-refresh-4W37DGXS.js.map

package/dist/bin.js

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import {
   maybeNotifyUpdate
-} from "./chunk-ZGA5MUNC.js";
+} from "./chunk-FDKR4YMN.js";
 import {
   readVersion,
   run
-} from "./chunk-MS3BRZAZ.js";
+} from "./chunk-CL2H2WYE.js";
 import {
   exitCodeOf,
   reportFailure
-} from "./chunk-IVP6TS26.js";
-import "./chunk-MFIHIS6B.js";
+} from "./chunk-JQLR64UC.js";
+import "./chunk-OYMR5AMJ.js";
 import "./chunk-GNPVYOPB.js";
 import {
   clearProgress,
   error
 } from "./chunk-EZG76F7R.js";
-import "./chunk-BPEEGJJA.js";
-import "./chunk-F5T45NAM.js";
-import "./chunk-YUPQOLFX.js";
+import "./chunk-FAWNUE2U.js";
+import "./chunk-OKNSR7MT.js";
+import "./chunk-NJGNUVXR.js";
 import "./chunk-WHOJWOSV.js";
 import "./chunk-5XZ744TS.js";
-import "./chunk-YUBJLB6G.js";
+import "./chunk-7JDT4PBU.js";
 
 // src/emit/interrupt.ts
 var EXIT_SIGINT = 130;

package/dist/branch-commands-PBQ36L4A.js

@@ -0,0 +1,134 @@
+import {
+  deleteBranch,
+  listBranches,
+  requireBranch,
+  setLiveBranch
+} from "./chunk-EQW3YT5U.js";
+import {
+  confirm
+} from "./chunk-4PTSTDIG.js";
+import {
+  getAccessToken
+} from "./chunk-3QW5NFZJ.js";
+import "./chunk-BKDJN76G.js";
+import {
+  isMachineOutput,
+  writeJson
+} from "./chunk-NUQCEOKA.js";
+import "./chunk-3IGNIP6R.js";
+import {
+  UsageError
+} from "./chunk-JQLR64UC.js";
+import "./chunk-GNPVYOPB.js";
+import {
+  blank,
+  detail,
+  info,
+  step,
+  success,
+  warn
+} from "./chunk-EZG76F7R.js";
+import "./chunk-OKNSR7MT.js";
+
+// src/emit/branch-commands.ts
+var VERBS = ["list", "set-live", "delete"];
+function assertVerb(verb) {
+  if (verb !== void 0 && VERBS.includes(verb)) return verb;
+  throw new UsageError(
+    verb === void 0 ? `\`xanots workspace branch\` needs a verb: ${VERBS.join(", ")}.` : `\`xanots workspace branch ${verb}\` is not a verb. Expected one of: ${VERBS.join(", ")}.`,
+    { helpFor: { command: "workspace", subcommand: "branch" } }
+  );
+}
+function requireLabel(label, verb) {
+  if (label !== void 0 && label.trim() !== "") return label;
+  throw new UsageError(`\`xanots workspace branch ${verb}\` needs a branch label.`, {
+    helpFor: { command: "workspace", subcommand: "branch" }
+  });
+}
+function renderList(branches, workspaceId) {
+  blank();
+  step(`Branches in workspace #${workspaceId}`);
+  if (branches.length === 0) {
+    detail("none reported");
+    return;
+  }
+  for (const b of branches) {
+    const tags = [b.live ? "live" : "", b.backup ? "backup" : ""].filter(Boolean).join(", ");
+    detail(`${b.label}${tags === "" ? "" : `  (${tags})`}`);
+  }
+  blank();
+  detail("Branches scope logic. Tables and microservices are shared by every branch.");
+}
+async function runBranchCommand(args) {
+  const verb = assertVerb(args.positionals[0]);
+  const auth = await getAccessToken(args);
+  const workspaceId = auth.workspaceId;
+  const target = { baseUrl: auth.instance, workspaceId };
+  const branches = await listBranches(auth, target);
+  if (verb === "list") {
+    if (isMachineOutput(args)) {
+      writeJson({ workspaceId, instance: auth.instance, branches });
+      return;
+    }
+    renderList(branches, workspaceId);
+    return;
+  }
+  const label = requireLabel(args.positionals[1], verb);
+  const branch = requireBranch(branches, label);
+  if (verb === "set-live") {
+    if (branch.live) {
+      success(`Branch "${label}" is already live in workspace #${workspaceId} \u2014 nothing to do.`);
+      if (isMachineOutput(args)) writeJson({ workspaceId, branch: label, setLive: false, alreadyLive: true });
+      return;
+    }
+    const outgoing = branches.find((b) => b.live)?.label;
+    blank();
+    warn(`This is a production cutover for workspace #${workspaceId}.`);
+    if (outgoing !== void 0) detail(`The runtime stops serving "${outgoing}" and starts serving "${label}".`);
+    detail("Table data is unaffected \u2014 it is shared by every branch either way.");
+    blank();
+    if (!args.yes && !args.force) {
+      const ok = await confirm(`Make "${label}" the live branch?`, {
+        flag: "--yes",
+        helpFor: { command: "workspace", subcommand: "branch" }
+      });
+      if (!ok) {
+        info("Cancelled \u2014 the live branch is unchanged.");
+        return;
+      }
+    }
+    await setLiveBranch(auth, { ...target, label });
+    success(`Branch "${label}" is now live in workspace #${workspaceId}.`);
+    if (outgoing !== void 0) {
+      detail(`Roll back with \`xanots workspace branch set-live ${outgoing}\`.`);
+    }
+    if (isMachineOutput(args)) {
+      writeJson({ workspaceId, branch: label, setLive: true, previousBranch: outgoing });
+    }
+    return;
+  }
+  if (branch.live) {
+    throw new UsageError(
+      `Branch "${label}" is the LIVE branch of workspace #${workspaceId} and cannot be deleted.
+Promote another branch first (\`xanots workspace branch set-live <other>\`), then delete this one.`,
+      { helpFor: { command: "workspace", subcommand: "branch" } }
+    );
+  }
+  if (!args.yes && !args.force) {
+    const ok = await confirm(`Delete branch "${label}" from workspace #${workspaceId}?`, {
+      flag: "--yes",
+      helpFor: { command: "workspace", subcommand: "branch" }
+    });
+    if (!ok) {
+      info("Cancelled \u2014 nothing was deleted.");
+      return;
+    }
+  }
+  await deleteBranch(auth, { ...target, label });
+  success(`Deleted branch "${label}" from workspace #${workspaceId}.`);
+  if (isMachineOutput(args)) writeJson({ workspaceId, branch: label, deleted: true });
+}
+export {
+  runBranchCommand
+};
+//# sourceMappingURL=branch-commands-PBQ36L4A.js.map

package/dist/{chunk-CYJ7R3AD.js → chunk-2V3JUXTF.js}

@@ -35,7 +35,7 @@ import {
   registerKind,
   tableColumns,
   withFilters
-} from "./chunk-YUPQOLFX.js";
+} from "./chunk-NJGNUVXR.js";
 import {
   assertPathParamInputs,
   fillPathParams,
@@ -50,8 +50,9 @@ import {
 import {
   deriveGuid,
   realtimeChannelSeedName,
+  resolveQueryRef,
   resolveRef
-} from "./chunk-YUBJLB6G.js";
+} from "./chunk-7JDT4PBU.js";
 
 // src/statements/set-var.ts
 var SET_VAR = "mvp:set_var";
@@ -482,7 +483,7 @@ function functionCall(args) {
 function apiCall(args) {
   args = argsOrEmpty(args);
   assertArg("mvp:workspace_run_endpoint", "api", args.api);
-  const context = { id: resolveRef("query", args.api) };
+  const context = { id: resolveQueryRef(args.api) };
   const headers = coerceHeaders(args.headers);
   if (headers) context.headers = vf(headers);
   if (args.auth) {
@@ -546,29 +547,41 @@ function addonCall(args) {
     input: encodeCallInput(args.input)
   }, args);
 }
+function refuseDerivedIdentity(statement, args) {
+  const legacy = args;
+  if (legacy.action === void 0 && legacy.package === void 0) return;
+  throw new Error(
+    `Statement "${statement}": \`action\`/\`package\` named an action and let the SDK derive its id. An action is a third-party package installed onto the instance, so its id is assigned at install and cannot be derived from a name \u2014 a derived one addresses nothing. Pass the installed id instead: \`actionId\` for action.call, or \`traceId\`/\`versionId\`/\`slug\` for action.package.call. Read them off an existing call in a pulled workspace.`
+  );
+}
 function actionCall(args) {
   args = argsOrEmpty(args);
-  assertArg("mvp:action", "action", args.action);
+  refuseDerivedIdentity("mvp:action", args);
+  assertArg("mvp:action", "actionId", args.actionId);
   return annotate({
     name: "mvp:action",
-    context: { run_version: { id: resolveRef("function", args.action) } },
+    context: { run_version: { id: args.actionId } },
     as: args.as,
     input: encodeCallInput(args.input),
-    settings_registry: []
+    settings_registry: encodeCallInput(args.registry)
   }, args);
 }
 function actionPackageCall(args) {
   args = argsOrEmpty(args);
+  refuseDerivedIdentity("mvp:action_package", args);
+  assertArg("mvp:action_package", "traceId", args.traceId);
+  assertArg("mvp:action_package", "versionId", args.versionId);
+  assertArg("mvp:action_package", "slug", args.slug);
   return annotate({
     name: "mvp:action_package",
     context: {
-      action: { trace_id: "" },
-      package: { slug: args.package ?? "" },
-      package_version: { id: "" }
+      action: { trace_id: args.traceId },
+      package: { slug: args.slug },
+      package_version: { id: args.versionId }
     },
     as: args.as,
     input: encodeCallInput(args.input),
-    settings_registry: []
+    settings_registry: encodeCallInput(args.registry)
   }, args);
 }
 function workflowTestCall(args) {
@@ -3721,4 +3734,4 @@ export {
   workspaceKind,
   workspaceConfig
 };
-//# sourceMappingURL=chunk-CYJ7R3AD.js.map
+//# sourceMappingURL=chunk-2V3JUXTF.js.map

package/dist/{chunk-OR43PDCW.js → chunk-3EYUR3TX.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-NDZFBZHC.js";
 import {
   getAccessToken
-} from "./chunk-SG4UBJ47.js";
+} from "./chunk-3QW5NFZJ.js";
 import {
   isMachineOutput,
   writeJson
@@ -97,4 +97,4 @@ export {
   fetchSandboxDetails,
   runSandboxDetailsCommand
 };
-//# sourceMappingURL=chunk-OR43PDCW.js.map
+//# sourceMappingURL=chunk-3EYUR3TX.js.map

package/dist/{chunk-SG4UBJ47.js → chunk-3QW5NFZJ.js}

@@ -7,12 +7,14 @@ import {
   globalAuthFilePath,
   localAuthFilePath,
   oauthErrorCode,
+  oauthErrorResponse,
   readCredential,
   resolveAuthFilePath,
   resolveAuthHost,
+  resolveOAuthErrorCode,
   resolveScope,
   writeCredential
-} from "./chunk-LLWK6H77.js";
+} from "./chunk-BKDJN76G.js";
 import {
   detail,
   hostLabel,
@@ -40,7 +42,26 @@ function refreshAccessToken(authHost, clientId, refreshToken, scope) {
   return provider.refresh(refreshToken, { scope });
 }
 function isTransientRefreshError(err) {
-  return oauthErrorCode(err) === void 0;
+  if (oauthErrorCode(err) !== void 0) return false;
+  const res = oauthErrorResponse(err);
+  if (res === void 0) return true;
+  return res.status >= 500;
+}
+async function describeRefreshFailure(err) {
+  const base = err instanceof Error ? err.message : String(err);
+  const res = oauthErrorResponse(err);
+  if (res === void 0) return base;
+  const parts = [`HTTP ${res.status}`];
+  const code = await resolveOAuthErrorCode(err);
+  if (code !== void 0) parts.push(code);
+  else if (!res.bodyUsed) {
+    try {
+      const text = (await res.clone().text()).trim();
+      if (text !== "") parts.push(text.length > 200 ? `${text.slice(0, 197)}\u2026` : text);
+    } catch {
+    }
+  }
+  return `${base} (${parts.join(" \u2014 ")})`;
 }
 async function refreshWithRetry(authHost, clientId, refreshToken, scope) {
   try {
@@ -215,8 +236,8 @@ async function refreshUnderLock(authFilePath, saved) {
     try {
       set = await refreshWithRetry(current.auth_host, current.client_id, current.refresh_token, current.scope);
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (oauthErrorCode(err) === "invalid_grant") {
+      const message = await describeRefreshFailure(err);
+      if (await resolveOAuthErrorCode(err) === "invalid_grant") {
         clearCredential(authFilePath);
         throw new Error(
           `Session for ${instance} has expired or was revoked (the refresh token was rejected). Run \`xanots login\` to sign in again.`
@@ -251,4 +272,4 @@ export {
   envMetaCredentialVarsSet,
   getAccessToken
 };
-//# sourceMappingURL=chunk-SG4UBJ47.js.map
+//# sourceMappingURL=chunk-3QW5NFZJ.js.map

package/dist/{chunk-7SISR3CS.js → chunk-4PE4ZAB7.js}

@@ -5,7 +5,7 @@ import {
   defaultThemeChoice,
   reactPreset,
   themeGuidanceSection
-} from "./chunk-6DHJVLYP.js";
+} from "./chunk-Q77KNEUL.js";
 import {
   detail,
   step,
@@ -31,7 +31,7 @@ that reads well, type-checks, and is wrong. Read before writing:
    conditions are for.
 3. \`node_modules/@xanots/sdk/manifest.json\` \u2014 only for per-entry detail neither
    carries: a statement's full field schema with engine defaults, a filter's
-   complete argument list. Grep or \`jq\` the one entry you need; it is ~55k
+   complete argument list. Grep or \`jq\` the one entry you need; it is ~65k
    tokens, so never read it whole.
 
 The published types and JSDoc (\`node_modules/@xanots/sdk/**/*.d.ts\`) are that
@@ -442,4 +442,4 @@ export {
   resolveAiPresets,
   scaffoldProject
 };
-//# sourceMappingURL=chunk-7SISR3CS.js.map
+//# sourceMappingURL=chunk-4PE4ZAB7.js.map

package/dist/{chunk-PGBK64U5.js → chunk-4PTSTDIG.js}

@@ -1,6 +1,6 @@
 import {
   UsageError
-} from "./chunk-IVP6TS26.js";
+} from "./chunk-JQLR64UC.js";
 import {
   style
 } from "./chunk-EZG76F7R.js";
@@ -56,4 +56,4 @@ export {
   confirm,
   promptLine
 };
-//# sourceMappingURL=chunk-PGBK64U5.js.map
+//# sourceMappingURL=chunk-4PTSTDIG.js.map

package/dist/{live-diff-FP4SFNT4.js → chunk-5HCDZ2XN.js}

@@ -11,10 +11,19 @@ function rows(bundle, key) {
   return Array.isArray(value) ? value.filter((r) => r !== null && typeof r === "object") : [];
 }
 function columnsOf(table) {
+  return new Set(typedColumnsOf(table).keys());
+}
+function typedColumnsOf(table) {
+  const out = /* @__PURE__ */ new Map();
   const schema = table.schema;
-  if (!Array.isArray(schema)) return /* @__PURE__ */ new Set();
-  const names = schema.map((c) => c !== null && typeof c === "object" ? c.name : void 0).filter((n) => typeof n === "string" && n !== "");
-  return new Set(names);
+  if (!Array.isArray(schema)) return out;
+  for (const entry of schema) {
+    if (entry === null || typeof entry !== "object") continue;
+    const { name, type } = entry;
+    if (typeof name !== "string" || name === "") continue;
+    out.set(name, typeof type === "string" ? type : "");
+  }
+  return out;
 }
 function identify(table) {
   const guid = table.guid;
@@ -69,6 +78,56 @@ function diffAgainstLive(outgoing, live, opts) {
   }
   return { droppedColumns, unchangedEnv };
 }
+function sharedSchemaChanges(outgoing, live, opts = {}) {
+  if (live === void 0) return void 0;
+  const changes = [];
+  for (const kind of ["dbo", "microservice"]) {
+    const liveRows = new Map(rows(live, kind).map((r) => [identify(r), r]));
+    const outgoingRows = new Map(rows(outgoing, kind).map((r) => [identify(r), r]));
+    for (const [key, out] of outgoingRows) {
+      const current = liveRows.get(key);
+      const name = nameOf(out);
+      if (current === void 0) {
+        changes.push({ kind, name, action: "create" });
+        continue;
+      }
+      const details = kind === "dbo" ? tableDelta(current, out) : objectDelta(current, out);
+      if (details.length > 0) changes.push({ kind, name, action: "alter", details });
+    }
+    if (opts.prune === true) {
+      for (const [key, current] of liveRows) {
+        if (!outgoingRows.has(key)) changes.push({ kind, name: nameOf(current), action: "remove" });
+      }
+    }
+  }
+  return changes;
+}
+function tableDelta(live, outgoing) {
+  const details = [];
+  const before = typedColumnsOf(live);
+  const after = typedColumnsOf(outgoing);
+  const liveName = nameOf(live);
+  const outgoingName = nameOf(outgoing);
+  if (liveName !== outgoingName) details.push(`renamed from "${liveName}" to "${outgoingName}"`);
+  for (const [column, type] of after) {
+    const current = before.get(column);
+    if (current === void 0) {
+      details.push(`add column "${column}"`);
+    } else if (current !== type) {
+      details.push(`retype column "${column}" (${current} \u2192 ${type})`);
+    }
+  }
+  for (const column of before.keys()) {
+    if (!after.has(column)) details.push(`drop column "${column}"`);
+  }
+  return details;
+}
+function objectDelta(live, outgoing) {
+  const liveName = nameOf(live);
+  const outgoingName = nameOf(outgoing);
+  if (liveName !== outgoingName) return [`renamed from "${liveName}" to "${outgoingName}"`];
+  return deepEqual(normalize(live), normalize(outgoing)) ? [] : ["configuration differs"];
+}
 var WORKSPACE_KEY = "workspace";
 var ENV_KEY = "env";
 var SETTINGS_KEYS_COMPARED_ELSEWHERE = /* @__PURE__ */ new Set([WORKSPACE_KEY, ENV_KEY, "canonical"]);
@@ -189,8 +248,10 @@ function compareToLive(outgoing, live) {
   }
   return { converged: compared > 0 && differingCount === 0, compared, differing, differingCount, liveOnly };
 }
+
 export {
-  compareToLive,
-  diffAgainstLive
+  diffAgainstLive,
+  sharedSchemaChanges,
+  compareToLive
 };
-//# sourceMappingURL=live-diff-FP4SFNT4.js.map
+//# sourceMappingURL=chunk-5HCDZ2XN.js.map