@xano/cli 0.0.95-beta.1 → 0.0.95-beta.11

package/dist/commands/workspace/get/index.js

@@ -73,8 +73,8 @@ Workspace: my-workspace (ID: 123)
         try {
             const response = await this.verboseFetch(apiUrl, {
                 headers: {
-                    'accept': 'application/json',
-                    'Authorization': `Bearer ${profile.access_token}`,
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
                 },
                 method: 'GET',
             }, flags.verbose, profile.access_token);
@@ -82,7 +82,7 @@ Workspace: my-workspace (ID: 123)
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
-            const workspace = await response.json();
+            const workspace = (await response.json());
             // Output results
             if (flags.output === 'json') {
                 this.log(JSON.stringify(workspace, null, 2));
@@ -94,13 +94,16 @@ Workspace: my-workspace (ID: 123)
                     this.log(`  Description: ${workspace.description}`);
                 }
                 if (workspace.created_at) {
-                    const createdDate = new Date(workspace.created_at * 1000).toISOString().split('T')[0];
+                    const createdDate = new Date(workspace.created_at).toISOString().split('T')[0];
                     this.log(`  Created: ${createdDate}`);
                 }
                 if (workspace.updated_at) {
-                    const updatedDate = new Date(workspace.updated_at * 1000).toISOString().split('T')[0];
+                    const updatedDate = new Date(workspace.updated_at).toISOString().split('T')[0];
                     this.log(`  Updated: ${updatedDate}`);
                 }
+                if (workspace.preferences?.allow_push !== undefined) {
+                    this.log(`  Allow Push: ${workspace.preferences.allow_push}`);
+                }
             }
         }
         catch (error) {
@@ -117,8 +120,7 @@ Workspace: my-workspace (ID: 123)
         const credentialsPath = path.join(configDir, 'credentials.yaml');
         // Check if credentials file exists
         if (!fs.existsSync(credentialsPath)) {
-            this.error(`Credentials file not found at ${credentialsPath}\n` +
-                `Create a profile using 'xano profile create'`);
+            this.error(`Credentials file not found at ${credentialsPath}\n` + `Create a profile using 'xano profile create'`);
         }
         // Read credentials file
         try {

package/dist/commands/workspace/list/index.d.ts

@@ -3,6 +3,7 @@ export default class WorkspaceList extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        latest: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/commands/workspace/list/index.js

@@ -45,6 +45,10 @@ Available workspaces:
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        latest: Flags.boolean({
+            default: false,
+            description: 'Sort by newest first (descending ID)',
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -78,8 +82,8 @@ Available workspaces:
         try {
             const response = await this.verboseFetch(apiUrl, {
                 headers: {
-                    'accept': 'application/json',
-                    'Authorization': `Bearer ${profile.access_token}`,
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
                 },
                 method: 'GET',
             }, flags.verbose, profile.access_token);
@@ -87,7 +91,7 @@ Available workspaces:
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
-            const data = await response.json();
+            const data = (await response.json());
             // Handle different response formats
             let workspaces;
             if (Array.isArray(data)) {
@@ -99,6 +103,9 @@ Available workspaces:
             else {
                 this.error('Unexpected API response format');
             }
+            if (flags.latest) {
+                workspaces.sort((a, b) => b.id - a.id);
+            }
             // Output results
             if (flags.output === 'json') {
                 this.log(JSON.stringify(workspaces, null, 2));
@@ -111,11 +118,12 @@ Available workspaces:
                 else {
                     this.log('Available workspaces:');
                     for (const workspace of workspaces) {
+                        const created = workspace.created_at ? ` (created: ${workspace.created_at.split(' ')[0]})` : '';
                         if (workspace.id === undefined) {
-                            this.log(`  - ${workspace.name}`);
+                            this.log(`  - ${workspace.name}${created}`);
                         }
                         else {
-                            this.log(`  - ${workspace.name} (ID: ${workspace.id})`);
+                            this.log(`  - ${workspace.name} (ID: ${workspace.id})${created}`);
                         }
                     }
                 }
@@ -135,8 +143,7 @@ Available workspaces:
         const credentialsPath = path.join(configDir, 'credentials.yaml');
         // Check if credentials file exists
         if (!fs.existsSync(credentialsPath)) {
-            this.error(`Credentials file not found at ${credentialsPath}\n` +
-                `Create a profile using 'xano profile:create'`);
+            this.error(`Credentials file not found at ${credentialsPath}\n` + `Create a profile using 'xano profile:create'`);
         }
         // Read credentials file
         try {

package/dist/commands/workspace/push/index.d.ts

@@ -30,5 +30,6 @@ export default class Push extends BaseCommand {
      * type subdirectory name then filename for deterministic ordering.
      */
     private collectFiles;
+    private renderBadReferences;
     private loadCredentials;
 }

package/dist/commands/workspace/push/index.js

@@ -6,6 +6,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import BaseCommand from '../../../base-command.js';
 import { buildDocumentKey, findFilesWithGuid, parseDocument } from '../../../utils/document-parser.js';
+import { checkReferences } from '../../../utils/reference-checker.js';
 export default class Push extends BaseCommand {
     static args = {
         directory: Args.string({
@@ -250,10 +251,10 @@ Push functions but exclude test files
         let dryRunPreview = null;
         if (flags['dry-run'] || !flags.force) {
             const dryRunParams = new URLSearchParams(queryParams);
-            // Request delete info in dry-run so we can show remote-only items (skip for partial)
-            if (!isPartial) {
-                dryRunParams.set('delete', 'true');
-            }
+            // Always request delete info in dry-run so we can:
+            // 1. Show remote-only items (in --sync mode)
+            // 2. Know what exists on the server (to filter unresolved reference warnings)
+            dryRunParams.set('delete', 'true');
             const dryRunUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/multidoc/dry-run?${dryRunParams.toString()}`;
             try {
                 const dryRunResponse = await this.verboseFetch(dryRunUrl, {
@@ -282,6 +283,25 @@ Push functions but exclude test files
                     }
                     else {
                         const errorText = await dryRunResponse.text();
+                        // Check if push is disabled on this workspace
+                        try {
+                            const errorJson = JSON.parse(errorText);
+                            if (errorJson.message?.includes('Push is disabled')) {
+                                this.log('');
+                                this.log(ux.colorize('red', ux.colorize('bold', 'Direct push to this workspace is disabled.')));
+                                this.log(ux.colorize('dim', 'To apply changes to the workspace, use the sandbox review flow:'));
+                                this.log(`  ${ux.colorize('cyan', 'xano sandbox push')}    ${ux.colorize('dim', '— push changes to your sandbox')}`);
+                                this.log(`  ${ux.colorize('cyan', 'xano sandbox review')}  ${ux.colorize('dim', '— edit any logic, inspect the snapshot diff, and promote changes to the workspace')}`);
+                                this.log('');
+                                this.log(ux.colorize('dim', 'To enable direct push, go to Workspace Settings → CLI → Allow Direct Workspace Push.'));
+                                this.log(ux.colorize('dim', 'Note: This setting does not apply to Free plan instances.'));
+                                this.log('');
+                                return;
+                            }
+                        }
+                        catch {
+                            // Not JSON, fall through
+                        }
                         this.warn(`Push preview failed (${dryRunResponse.status}). Skipping preview.`);
                         if (flags.verbose) {
                             this.log(ux.colorize('dim', errorText));
@@ -306,6 +326,11 @@ Push functions but exclude test files
                     // Check if the server returned a valid dry-run response
                     if (preview && preview.summary) {
                         this.renderPreview(preview, shouldDelete, workspaceId, flags.verbose, isPartial);
+                        // Check for bad cross-references, using dry-run operations to avoid false positives
+                        const badRefs = checkReferences(documentEntries, preview.operations);
+                        if (badRefs.length > 0) {
+                            this.renderBadReferences(badRefs);
+                        }
                         // Check for critical errors that must block the push
                         const criticalOps = preview.operations.filter((op) => op.details?.includes('exception:') || op.details?.includes('mvp:placeholder'));
                         if (criticalOps.length > 0) {
@@ -424,6 +449,14 @@ Push functions but exclude test files
                 }
             }
         }
+        // Show bad references in force mode (preview mode shows them inline)
+        if (flags.force) {
+            const badRefs = checkReferences(documentEntries);
+            if (badRefs.length > 0) {
+                this.log('');
+                this.renderBadReferences(badRefs);
+            }
+        }
         // For partial pushes, filter to only changed documents
         if (isPartial && dryRunPreview) {
             const changedKeys = new Set(dryRunPreview.operations
@@ -465,6 +498,15 @@ Push functions but exclude test files
                     if (errorJson.payload?.param) {
                         errorMessage += `\n  Parameter: ${errorJson.payload.param}`;
                     }
+                    // Provide clear guidance when push is disabled
+                    if (errorJson.message?.includes('Push is disabled')) {
+                        this.error(`Push is disabled for this workspace.\n\n` +
+                            `To enable, go to Workspace Settings and turn on "Allow Push".\n` +
+                            `Note: This setting does not apply to Free plan instances.\n\n` +
+                            `Alternatively, use sandbox commands:\n` +
+                            `  xano sandbox push ${args.directory}\n` +
+                            `  xano sandbox impersonate`);
+                    }
                 }
                 catch {
                     errorMessage += `\n${errorText}`;
@@ -635,7 +677,7 @@ Push functions but exclude test files
                 const color = op.action === 'update' || op.action === 'update_field' ? 'yellow' : 'green';
                 const actionLabel = op.action.toUpperCase();
                 this.log(`  ${ux.colorize(color, actionLabel.padEnd(16))} ${op.type.padEnd(18)} ${op.name}`);
-                if (op.details) {
+                if (verbose && op.details) {
                     this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', op.details)}`);
                 }
                 if (verbose && op.reason) {
@@ -656,7 +698,7 @@ Push functions but exclude test files
                 const color = op.action === 'truncate' || op.action === 'alter_field' ? 'yellow' : 'red';
                 const actionLabel = op.action.toUpperCase();
                 this.log(`  ${ux.colorize(color, actionLabel.padEnd(16))} ${op.type.padEnd(18)} ${op.name}`);
-                if (op.details) {
+                if (verbose && op.details) {
                     this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', op.details)}`);
                 }
                 if (verbose && op.reason) {
@@ -709,6 +751,18 @@ Push functions but exclude test files
         }
         return files.sort();
     }
+    renderBadReferences(badRefs) {
+        this.log(ux.colorize('yellow', ux.colorize('bold', '=== Unresolved References ===')));
+        this.log('');
+        this.log(ux.colorize('yellow', "The following references point to objects that don't exist in this push or on the server."));
+        this.log(ux.colorize('yellow', 'These will become placeholder statements after import.'));
+        this.log('');
+        for (const ref of badRefs) {
+            this.log(`  ${ux.colorize('yellow', 'WARNING'.padEnd(16))} ${ref.sourceType.padEnd(18)} ${ref.source}`);
+            this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', `${ref.statementType} → ${ref.targetType} "${ref.target}" does not exist`)}`);
+        }
+        this.log('');
+    }
     loadCredentials() {
         const configDir = path.join(os.homedir(), '.xano');
         const credentialsPath = path.join(configDir, 'credentials.yaml');

package/dist/utils/reference-checker.d.ts

@@ -0,0 +1,45 @@
+/**
+ * A reference from one document to another (e.g., function.run "bad" references function "bad").
+ */
+export interface BadReference {
+    /** Name of the source document containing the reference */
+    source: string;
+    /** Type of the source document (e.g., "function") */
+    sourceType: string;
+    /** The statement type that creates the reference (e.g., "function.run") */
+    statementType: string;
+    /** The referenced name that doesn't exist */
+    target: string;
+    /** The target type being referenced (e.g., "function") */
+    targetType: string;
+}
+/**
+ * Build a registry of all defined object names from parsed documents.
+ * Returns a Map of type → Set of names.
+ */
+export declare function buildRegistry(documents: Array<{
+    content: string;
+}>): Map<string, Set<string>>;
+/**
+ * Build a registry of server-known object names from dry-run operations.
+ * Any object that appears in the dry-run (create, update, unchanged, delete) exists
+ * either locally or on the server.
+ */
+export declare function buildServerRegistry(operations: Array<{
+    name: string;
+    type: string;
+}>): Map<string, Set<string>>;
+/**
+ * Check all documents for cross-references that point to names not in the registry.
+ *
+ * When serverOperations is provided (from dry-run), references are checked against
+ * both local files AND server-known objects, eliminating false positives for objects
+ * that exist on the server but aren't in the push set.
+ */
+export declare function checkReferences(documents: Array<{
+    content: string;
+    filePath: string;
+}>, serverOperations?: Array<{
+    name: string;
+    type: string;
+}>): BadReference[];

package/dist/utils/reference-checker.js

@@ -0,0 +1,137 @@
+import { parseDocument } from './document-parser.js';
+/**
+ * All known cross-reference patterns in XanoScript.
+ *
+ * Each pattern matches a statement keyword followed by a quoted or unquoted name.
+ * The first capture group extracts the name (stripping quotes if present).
+ */
+const REFERENCE_PATTERNS = [
+    { keyword: 'function.run', regex: /^\s*function\.run\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'function' },
+    { keyword: 'function.call', regex: /^\s*function\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'function' },
+    { keyword: 'addon.call', regex: /^\s*addon\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'addon' },
+    { keyword: 'task.call', regex: /^\s*task\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'task' },
+    { keyword: 'tool.call', regex: /^\s*tool\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'tool' },
+    { keyword: 'middleware.call', regex: /^\s*middleware\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'middleware' },
+    { keyword: 'ai.agent.run', regex: /^\s*ai\.agent\.run\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'agent' },
+    { keyword: 'trigger.call', regex: /^\s*trigger\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'trigger' },
+    { keyword: 'action.call', regex: /^\s*action\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'action' },
+    {
+        keyword: 'workflow_test.call',
+        regex: /^\s*workflow_test\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm,
+        targetType: 'workflow_test',
+    },
+];
+/**
+ * Strip surrounding quotes from a name if present.
+ */
+function stripQuotes(name) {
+    if (name.startsWith('"') && name.endsWith('"')) {
+        return name.slice(1, -1);
+    }
+    return name;
+}
+/**
+ * Map from XanoScript document types to the canonical type used in the registry.
+ * Some types are aliases (agent, mcp_server → toolset bucket, but referenced as "agent").
+ */
+/* eslint-disable camelcase */
+const TYPE_ALIASES = {
+    agent: 'agent',
+    mcp_server: 'agent',
+    toolset: 'agent',
+};
+/* eslint-enable camelcase */
+/**
+ * Normalize a document type to its canonical registry type.
+ */
+function normalizeType(type) {
+    return TYPE_ALIASES[type] ?? type;
+}
+/**
+ * Build a registry of all defined object names from parsed documents.
+ * Returns a Map of type → Set of names.
+ */
+export function buildRegistry(documents) {
+    const registry = new Map();
+    for (const doc of documents) {
+        const parsed = parseDocument(doc.content);
+        if (!parsed)
+            continue;
+        const type = normalizeType(parsed.type);
+        if (!registry.has(type)) {
+            registry.set(type, new Set());
+        }
+        registry.get(type).add(parsed.name);
+    }
+    return registry;
+}
+/**
+ * Build a registry of server-known object names from dry-run operations.
+ * Any object that appears in the dry-run (create, update, unchanged, delete) exists
+ * either locally or on the server.
+ */
+export function buildServerRegistry(operations) {
+    const registry = new Map();
+    for (const op of operations) {
+        const type = normalizeType(op.type);
+        if (!registry.has(type)) {
+            registry.set(type, new Set());
+        }
+        // Operation names for queries include the verb (e.g., "path/{id} DELETE")
+        // but references use just the name, so strip the verb suffix
+        const name = op.name.replace(/\s+(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/, '');
+        registry.get(type).add(name);
+    }
+    return registry;
+}
+/**
+ * Check all documents for cross-references that point to names not in the registry.
+ *
+ * When serverOperations is provided (from dry-run), references are checked against
+ * both local files AND server-known objects, eliminating false positives for objects
+ * that exist on the server but aren't in the push set.
+ */
+export function checkReferences(documents, serverOperations) {
+    const registry = buildRegistry(documents);
+    // Merge server-known names into the registry
+    if (serverOperations) {
+        const serverRegistry = buildServerRegistry(serverOperations);
+        for (const [type, names] of serverRegistry) {
+            if (!registry.has(type)) {
+                registry.set(type, new Set());
+            }
+            for (const name of names) {
+                registry.get(type).add(name);
+            }
+        }
+    }
+    const badRefs = [];
+    for (const doc of documents) {
+        const parsed = parseDocument(doc.content);
+        if (!parsed)
+            continue;
+        for (const pattern of REFERENCE_PATTERNS) {
+            // Reset regex state for each document
+            pattern.regex.lastIndex = 0;
+            let match;
+            while ((match = pattern.regex.exec(doc.content)) !== null) {
+                const rawName = stripQuotes(match[1]);
+                // Skip empty names (e.g., action.call "" is valid for integration actions)
+                if (!rawName)
+                    continue;
+                const { targetType } = pattern;
+                const knownNames = registry.get(targetType);
+                if (!knownNames || !knownNames.has(rawName)) {
+                    badRefs.push({
+                        source: parsed.name,
+                        sourceType: parsed.type,
+                        statementType: pattern.keyword,
+                        target: rawName,
+                        targetType,
+                    });
+                }
+            }
+        }
+    }
+    return badRefs;
+}