Xano CLI 0.6.1

Fixed

• sc-xano --version now derives from the package's authoritative version metadata and reports 0.6.1.
• Release publishing now fails before publication if the built CLI version differs from package.json.
• The OIDC workflow now verifies the published package's registry identity, integrity, SLSA provenance, and clean-install CLI version.

See issue #18 and PR #19.

v0.6.0

Highlights

• Export every supported XanoScript object type with --type all, collision-safe filenames, and honest failure accounting.
• Route credentials correctly across custom domains and canonical .xano.io hosts without replaying unsafe writes.
• Export ordinary and specialized realtime triggers with the correct XanoScript schema.
• Add runtime-aware performance rollups and trace analysis with explicit truncation, identity, suppression, and timing semantics.
• Publish through GitHub Actions using npm trusted publishing (OIDC), with automatic provenance and no long-lived npm publish token.

Validation

The release passed 49 automated tests, a clean TypeScript build, CLI entry-point execution, and package-payload inspection before publication. The packed artifact contains the README, both bundled skills, and the sc-xano binary entry point.

Changes

• #4 — make the repository graveyard-ready
• #5 — complete and collision-safe XanoScript exports
• #6 — credential identity and custom-domain routing
• #8 — realtime-trigger exports
• #12 — reconcile performance-trace documentation
• #13 — runtime performance rollups
• #14 — enriched performance trace analysis
• #16 — npm trusted-publishing workflow
• #17 — 0.6.0 release identity

v0.4.3

What's changed

• Docs: Correct npx skills add to use the GitHub repo form (statechange/xano-cli) instead of the npm-scoped name.

No CLI behavior changes.

v0.4.2

Zero-interaction device flow

CLI now passes the device code in the URL when opening the browser. If you're already logged into State Change, authorization completes automatically — no copy-pasting needed.

v0.4.1

auth init defaults to device flow

• sc-xano auth init now runs the browser-based device code flow by default
• Use sc-xano auth init --api-key <key> for manual API key setup
• Both auth init and auth login use the same device flow

v0.4.0

Device code flow authentication

New sc-xano auth login command authenticates via browser — no more manually copying API keys.

How it works:

1. Run sc-xano auth login
2. Browser opens automatically to auth.statechange.ai/device
3. Enter the code shown in your terminal
4. CLI receives credentials and saves them automatically

Also includes:

• XanoScript for the backend device flow endpoints
• Updated README and skills documentation

v0.3.2

Safety annotations

• Added read-only vs WRITE annotations to CLI help output, README command sections, and AI agent skills
• Write commands (logs set, secure swagger, health clear-history, health restart-tasks) are now clearly marked in all surfaces
• Helps AI agents make safer decisions about which commands to run without confirmation

v0.3.1

• Complete command reference in README — all subcommands, options, and supported types listed
• Add State Change subscription and extension requirements with links
• List all 8 XanoScript object types (function, table, api, task, trigger, mcp_server, addon, middleware)

v0.3.0

Changes

• Breaking: Removed xanoscript convert command — use Xano's own CLI for XanoScript conversion
• Refined positioning: performance analysis, operational insights, and critical security/restart abilities
• Updated README to reference StateChange Extension and subscription requirement
• Reordered command documentation to lead with core capabilities

Upgrading

If you were using sc-xano xanoscript convert, switch to the Xano Developer CLI for conversion. xanoscript generate and xanoscript export-all are unchanged.

v0.2.2

• Lead README with skills install as the primary getting-started path for AI agents