@xano/cli 0.0.95-beta.2 → 0.0.95-beta.21

package/dist/commands/workspace/edit/index.js

@@ -35,6 +35,11 @@ Updated workspace: my-workspace (ID: 123)
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        'allow-push': Flags.boolean({
+            allowNo: true,
+            description: 'Enable or disable direct CLI push to this workspace (not applicable on Free plan)',
+            required: false,
+        }),
         description: Flags.string({
             char: 'd',
             description: 'New description for the workspace',
@@ -102,9 +107,12 @@ Updated workspace: my-workspace (ID: 123)
         if (flags['require-token'] !== undefined) {
             body.documentation = { require_token: flags['require-token'] };
         }
+        if (flags['allow-push'] !== undefined) {
+            body.preferences = { allow_push: flags['allow-push'] };
+        }
         // Check if at least one field is being updated
         if (Object.keys(body).length === 0) {
-            this.error('No fields specified to update. Use --name, --description, --swagger, or --require-token flags.\n' +
+            this.error('No fields specified to update. Use --name, --description, --swagger, --require-token, or --allow-push flags.\n' +
                 'Example: xano workspace edit 123 --name "new-name"');
         }
         // Construct the API URL
@@ -114,8 +122,8 @@ Updated workspace: my-workspace (ID: 123)
             const response = await this.verboseFetch(apiUrl, {
                 body: JSON.stringify(body),
                 headers: {
-                    'accept': 'application/json',
-                    'Authorization': `Bearer ${profile.access_token}`,
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
                     'Content-Type': 'application/json',
                 },
                 method: 'PUT',
@@ -124,7 +132,7 @@ Updated workspace: my-workspace (ID: 123)
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
-            const workspace = await response.json();
+            const workspace = (await response.json());
             // Output results
             if (flags.output === 'json') {
                 this.log(JSON.stringify(workspace, null, 2));
@@ -141,6 +149,9 @@ Updated workspace: my-workspace (ID: 123)
                 if (workspace.documentation?.require_token !== undefined) {
                     this.log(`  Require Token: ${workspace.documentation.require_token}`);
                 }
+                if (workspace.preferences?.allow_push !== undefined) {
+                    this.log(`  Allow Push: ${workspace.preferences.allow_push}`);
+                }
             }
         }
         catch (error) {
@@ -157,8 +168,7 @@ Updated workspace: my-workspace (ID: 123)
         const credentialsPath = path.join(configDir, 'credentials.yaml');
         // Check if credentials file exists
         if (!fs.existsSync(credentialsPath)) {
-            this.error(`Credentials file not found at ${credentialsPath}\n` +
-                `Create a profile using 'xano profile create'`);
+            this.error(`Credentials file not found at ${credentialsPath}\n` + `Create a profile using 'xano profile create'`);
         }
         // Read credentials file
         try {

package/dist/commands/workspace/get/index.js

@@ -73,8 +73,8 @@ Workspace: my-workspace (ID: 123)
         try {
             const response = await this.verboseFetch(apiUrl, {
                 headers: {
-                    'accept': 'application/json',
-                    'Authorization': `Bearer ${profile.access_token}`,
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
                 },
                 method: 'GET',
             }, flags.verbose, profile.access_token);
@@ -82,7 +82,7 @@ Workspace: my-workspace (ID: 123)
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
-            const workspace = await response.json();
+            const workspace = (await response.json());
             // Output results
             if (flags.output === 'json') {
                 this.log(JSON.stringify(workspace, null, 2));
@@ -94,13 +94,16 @@ Workspace: my-workspace (ID: 123)
                     this.log(`  Description: ${workspace.description}`);
                 }
                 if (workspace.created_at) {
-                    const createdDate = new Date(workspace.created_at * 1000).toISOString().split('T')[0];
+                    const createdDate = new Date(workspace.created_at).toISOString().split('T')[0];
                     this.log(`  Created: ${createdDate}`);
                 }
                 if (workspace.updated_at) {
-                    const updatedDate = new Date(workspace.updated_at * 1000).toISOString().split('T')[0];
+                    const updatedDate = new Date(workspace.updated_at).toISOString().split('T')[0];
                     this.log(`  Updated: ${updatedDate}`);
                 }
+                if (workspace.preferences?.allow_push !== undefined) {
+                    this.log(`  Allow Push: ${workspace.preferences.allow_push}`);
+                }
             }
         }
         catch (error) {
@@ -117,8 +120,7 @@ Workspace: my-workspace (ID: 123)
         const credentialsPath = path.join(configDir, 'credentials.yaml');
         // Check if credentials file exists
         if (!fs.existsSync(credentialsPath)) {
-            this.error(`Credentials file not found at ${credentialsPath}\n` +
-                `Create a profile using 'xano profile create'`);
+            this.error(`Credentials file not found at ${credentialsPath}\n` + `Create a profile using 'xano profile create'`);
         }
         // Read credentials file
         try {

package/dist/commands/workspace/list/index.d.ts

@@ -3,6 +3,7 @@ export default class WorkspaceList extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        latest: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/commands/workspace/list/index.js

@@ -45,6 +45,10 @@ Available workspaces:
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        latest: Flags.boolean({
+            default: false,
+            description: 'Sort by newest first (descending ID)',
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -78,8 +82,8 @@ Available workspaces:
         try {
             const response = await this.verboseFetch(apiUrl, {
                 headers: {
-                    'accept': 'application/json',
-                    'Authorization': `Bearer ${profile.access_token}`,
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
                 },
                 method: 'GET',
             }, flags.verbose, profile.access_token);
@@ -87,7 +91,7 @@ Available workspaces:
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
-            const data = await response.json();
+            const data = (await response.json());
             // Handle different response formats
             let workspaces;
             if (Array.isArray(data)) {
@@ -99,6 +103,9 @@ Available workspaces:
             else {
                 this.error('Unexpected API response format');
             }
+            if (flags.latest) {
+                workspaces.sort((a, b) => b.id - a.id);
+            }
             // Output results
             if (flags.output === 'json') {
                 this.log(JSON.stringify(workspaces, null, 2));
@@ -111,11 +118,12 @@ Available workspaces:
                 else {
                     this.log('Available workspaces:');
                     for (const workspace of workspaces) {
+                        const created = workspace.created_at ? ` (created: ${workspace.created_at.split(' ')[0]})` : '';
                         if (workspace.id === undefined) {
-                            this.log(`  - ${workspace.name}`);
+                            this.log(`  - ${workspace.name}${created}`);
                         }
                         else {
-                            this.log(`  - ${workspace.name} (ID: ${workspace.id})`);
+                            this.log(`  - ${workspace.name} (ID: ${workspace.id})${created}`);
                         }
                     }
                 }
@@ -135,8 +143,7 @@ Available workspaces:
         const credentialsPath = path.join(configDir, 'credentials.yaml');
         // Check if credentials file exists
         if (!fs.existsSync(credentialsPath)) {
-            this.error(`Credentials file not found at ${credentialsPath}\n` +
-                `Create a profile using 'xano profile:create'`);
+            this.error(`Credentials file not found at ${credentialsPath}\n` + `Create a profile using 'xano profile:create'`);
         }
         // Read credentials file
         try {

package/dist/commands/workspace/push/index.d.ts

@@ -30,5 +30,7 @@ export default class Push extends BaseCommand {
      * type subdirectory name then filename for deterministic ordering.
      */
     private collectFiles;
+    private renderBadIndexes;
+    private renderBadReferences;
     private loadCredentials;
 }

package/dist/commands/workspace/push/index.js

@@ -6,6 +6,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import BaseCommand from '../../../base-command.js';
 import { buildDocumentKey, findFilesWithGuid, parseDocument } from '../../../utils/document-parser.js';
+import { checkReferences, checkTableIndexes } from '../../../utils/reference-checker.js';
 export default class Push extends BaseCommand {
     static args = {
         directory: Args.string({
@@ -250,10 +251,10 @@ Push functions but exclude test files
         let dryRunPreview = null;
         if (flags['dry-run'] || !flags.force) {
             const dryRunParams = new URLSearchParams(queryParams);
-            // Request delete info in dry-run so we can show remote-only items (skip for partial)
-            if (!isPartial) {
-                dryRunParams.set('delete', 'true');
-            }
+            // Always request delete info in dry-run so we can:
+            // 1. Show remote-only items (in --sync mode)
+            // 2. Know what exists on the server (to filter unresolved reference warnings)
+            dryRunParams.set('delete', 'true');
             const dryRunUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/multidoc/dry-run?${dryRunParams.toString()}`;
             try {
                 const dryRunResponse = await this.verboseFetch(dryRunUrl, {
@@ -282,6 +283,28 @@ Push functions but exclude test files
                     }
                     else {
                         const errorText = await dryRunResponse.text();
+                        // Check if push is disabled on this workspace
+                        try {
+                            const errorJson = JSON.parse(errorText);
+                            if (errorJson.message?.includes('Push is disabled')) {
+                                this.log('');
+                                this.log(ux.colorize('red', ux.colorize('bold', 'Direct push is disabled to protect your production workspace from unintended changes.')));
+                                this.log(ux.colorize('dim', 'Use your sandbox environment to test and review changes before applying them to your production workspace.'));
+                                this.log('');
+                                this.log(ux.colorize('dim', 'To apply changes to the workspace, use the sandbox review flow:'));
+                                this.log(`  ${ux.colorize('cyan', 'xano sandbox push')}    ${ux.colorize('dim', '— push changes to your sandbox')}`);
+                                this.log(`  ${ux.colorize('cyan', 'xano sandbox review')}  ${ux.colorize('dim', '— edit any logic, inspect the snapshot diff, and promote changes to the workspace')}`);
+                                this.log('');
+                                this.log(ux.colorize('dim', 'To enable direct push, go to Workspace Settings → CLI → Allow Direct Workspace Push.'));
+                                this.log('');
+                                this.log(ux.colorize('dim', "Note: Free plan instances don't include sandbox environments, so direct push is always enabled."));
+                                this.log('');
+                                return;
+                            }
+                        }
+                        catch {
+                            // Not JSON, fall through
+                        }
                         this.warn(`Push preview failed (${dryRunResponse.status}). Skipping preview.`);
                         if (flags.verbose) {
                             this.log(ux.colorize('dim', errorText));
@@ -306,6 +329,16 @@ Push functions but exclude test files
                     // Check if the server returned a valid dry-run response
                     if (preview && preview.summary) {
                         this.renderPreview(preview, shouldDelete, workspaceId, flags.verbose, isPartial);
+                        // Check for bad cross-references, using dry-run operations to avoid false positives
+                        const badRefs = checkReferences(documentEntries, preview.operations);
+                        if (badRefs.length > 0) {
+                            this.renderBadReferences(badRefs);
+                        }
+                        // Check for indexes referencing non-existent schema fields
+                        const badIndexes = checkTableIndexes(documentEntries);
+                        if (badIndexes.length > 0) {
+                            this.renderBadIndexes(badIndexes);
+                        }
                         // Check for critical errors that must block the push
                         const criticalOps = preview.operations.filter((op) => op.details?.includes('exception:') || op.details?.includes('mvp:placeholder'));
                         if (criticalOps.length > 0) {
@@ -424,6 +457,14 @@ Push functions but exclude test files
                 }
             }
         }
+        // Show bad references in force mode (preview mode shows them inline)
+        if (flags.force) {
+            const badRefs = checkReferences(documentEntries);
+            if (badRefs.length > 0) {
+                this.log('');
+                this.renderBadReferences(badRefs);
+            }
+        }
         // For partial pushes, filter to only changed documents
         if (isPartial && dryRunPreview) {
             const changedKeys = new Set(dryRunPreview.operations
@@ -465,6 +506,16 @@ Push functions but exclude test files
                     if (errorJson.payload?.param) {
                         errorMessage += `\n  Parameter: ${errorJson.payload.param}`;
                     }
+                    // Provide clear guidance when push is disabled
+                    if (errorJson.message?.includes('Push is disabled')) {
+                        this.error(`Direct push is disabled to protect your production workspace from unintended changes.\n` +
+                            `Use your sandbox environment to test and review changes before applying them to your production workspace.\n\n` +
+                            `Alternatively, use sandbox commands:\n` +
+                            `  xano sandbox push ${args.directory}\n` +
+                            `  xano sandbox review\n\n` +
+                            `To enable direct push, go to Workspace Settings → CLI → Allow Direct Workspace Push.\n\n` +
+                            `Note: Free plan instances don't include sandbox environments, so direct push is always enabled.`);
+                    }
                 }
                 catch {
                     errorMessage += `\n${errorText}`;
@@ -635,7 +686,7 @@ Push functions but exclude test files
                 const color = op.action === 'update' || op.action === 'update_field' ? 'yellow' : 'green';
                 const actionLabel = op.action.toUpperCase();
                 this.log(`  ${ux.colorize(color, actionLabel.padEnd(16))} ${op.type.padEnd(18)} ${op.name}`);
-                if (op.details) {
+                if (verbose && op.details) {
                     this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', op.details)}`);
                 }
                 if (verbose && op.reason) {
@@ -656,7 +707,7 @@ Push functions but exclude test files
                 const color = op.action === 'truncate' || op.action === 'alter_field' ? 'yellow' : 'red';
                 const actionLabel = op.action.toUpperCase();
                 this.log(`  ${ux.colorize(color, actionLabel.padEnd(16))} ${op.type.padEnd(18)} ${op.name}`);
-                if (op.details) {
+                if (verbose && op.details) {
                     this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', op.details)}`);
                 }
                 if (verbose && op.reason) {
@@ -709,6 +760,30 @@ Push functions but exclude test files
         }
         return files.sort();
     }
+    renderBadIndexes(badIndexes) {
+        this.log('');
+        this.log(ux.colorize('red', ux.colorize('bold', '=== CRITICAL: Invalid Indexes ===')));
+        this.log('');
+        this.log(ux.colorize('red', 'The following tables have indexed referencing fields that do not exist in the schema, which may cause related issues.'));
+        this.log('');
+        for (const idx of badIndexes) {
+            this.log(`  ${ux.colorize('red', 'CRITICAL'.padEnd(16))} ${'table'.padEnd(18)} ${idx.table}`);
+            this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', `${idx.indexType} index → field "${idx.field}" does not exist in schema`)}`);
+        }
+        this.log('');
+    }
+    renderBadReferences(badRefs) {
+        this.log(ux.colorize('yellow', ux.colorize('bold', '=== Unresolved References ===')));
+        this.log('');
+        this.log(ux.colorize('yellow', "The following references point to objects that don't exist in this push or on the server."));
+        this.log(ux.colorize('yellow', 'These will become placeholder statements after import.'));
+        this.log('');
+        for (const ref of badRefs) {
+            this.log(`  ${ux.colorize('yellow', 'WARNING'.padEnd(16))} ${ref.sourceType.padEnd(18)} ${ref.source}`);
+            this.log(`  ${' '.repeat(16)} ${' '.repeat(18)} ${ux.colorize('dim', `${ref.statementType} → ${ref.targetType} "${ref.target}" does not exist`)}`);
+        }
+        this.log('');
+    }
     loadCredentials() {
         const configDir = path.join(os.homedir(), '.xano');
         const credentialsPath = path.join(configDir, 'credentials.yaml');

package/dist/utils/reference-checker.d.ts

@@ -0,0 +1,57 @@
+/**
+ * A reference from one document to another (e.g., function.run "bad" references function "bad").
+ */
+export interface BadReference {
+    /** Name of the source document containing the reference */
+    source: string;
+    /** Type of the source document (e.g., "function") */
+    sourceType: string;
+    /** The statement type that creates the reference (e.g., "function.run") */
+    statementType: string;
+    /** The referenced name that doesn't exist */
+    target: string;
+    /** The target type being referenced (e.g., "function") */
+    targetType: string;
+}
+/**
+ * Build a registry of all defined object names from parsed documents.
+ * Returns a Map of type → Set of names.
+ */
+export declare function buildRegistry(documents: Array<{
+    content: string;
+}>): Map<string, Set<string>>;
+/**
+ * Build a registry of server-known object names from dry-run operations.
+ * Any object that appears in the dry-run (create, update, unchanged, delete) exists
+ * either locally or on the server.
+ */
+export declare function buildServerRegistry(operations: Array<{
+    name: string;
+    type: string;
+}>): Map<string, Set<string>>;
+/**
+ * Check all documents for cross-references that point to names not in the registry.
+ *
+ * When serverOperations is provided (from dry-run), references are checked against
+ * both local files AND server-known objects, eliminating false positives for objects
+ * that exist on the server but aren't in the push set.
+ */
+export declare function checkReferences(documents: Array<{
+    content: string;
+    filePath: string;
+}>, serverOperations?: Array<{
+    name: string;
+    type: string;
+}>): BadReference[];
+export interface BadIndex {
+    field: string;
+    indexType: string;
+    table: string;
+}
+/**
+ * Check table documents for indexes that reference fields not in the schema.
+ * Parses the XanoScript table format to extract schema field names and index field names.
+ */
+export declare function checkTableIndexes(documents: Array<{
+    content: string;
+}>): BadIndex[];

package/dist/utils/reference-checker.js

@@ -0,0 +1,232 @@
+import { parseDocument } from './document-parser.js';
+/**
+ * All known cross-reference patterns in XanoScript.
+ *
+ * Each pattern matches a statement keyword followed by a quoted or unquoted name.
+ * The first capture group extracts the name (stripping quotes if present).
+ */
+const REFERENCE_PATTERNS = [
+    { keyword: 'function.run', regex: /^\s*function\.run\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'function' },
+    { keyword: 'function.call', regex: /^\s*function\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'function' },
+    { keyword: 'addon.call', regex: /^\s*addon\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'addon' },
+    { keyword: 'task.call', regex: /^\s*task\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'task' },
+    { keyword: 'tool.call', regex: /^\s*tool\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'tool' },
+    { keyword: 'middleware.call', regex: /^\s*middleware\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'middleware' },
+    { keyword: 'ai.agent.run', regex: /^\s*ai\.agent\.run\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'agent' },
+    { keyword: 'trigger.call', regex: /^\s*trigger\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'trigger' },
+    { keyword: 'action.call', regex: /^\s*action\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm, targetType: 'action' },
+    {
+        keyword: 'workflow_test.call',
+        regex: /^\s*workflow_test\.call\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm,
+        targetType: 'workflow_test',
+    },
+    // db.* statements reference tables: db.get, db.query, db.add, db.edit, db.add_or_edit, db.delete, db.bulk_add, db.bulk_delete, db.count
+    {
+        keyword: 'db.*',
+        regex: /^\s*db\.(?:get|query|add|edit|add_or_edit|delete|bulk_add|bulk_delete|count)\s+("(?:[^"\\]|\\.)*"|[^\s{]+)/gm,
+        targetType: 'table',
+    },
+    // Schema foreign key references: table = "name" inside field definitions
+    { keyword: 'table (FK)', regex: /\btable\s*=\s*"([^"]*)"/gm, targetType: 'table' },
+];
+/**
+ * Strip surrounding quotes from a name if present.
+ */
+function stripQuotes(name) {
+    if (name.startsWith('"') && name.endsWith('"')) {
+        return name.slice(1, -1);
+    }
+    return name;
+}
+/**
+ * Map from XanoScript document types to the canonical type used in the registry.
+ * Some types are aliases (agent, mcp_server → toolset bucket, but referenced as "agent").
+ */
+/* eslint-disable camelcase */
+const TYPE_ALIASES = {
+    agent: 'agent',
+    mcp_server: 'agent',
+    toolset: 'agent',
+};
+/* eslint-enable camelcase */
+/**
+ * Normalize a document type to its canonical registry type.
+ */
+function normalizeType(type) {
+    return TYPE_ALIASES[type] ?? type;
+}
+/**
+ * Build a registry of all defined object names from parsed documents.
+ * Returns a Map of type → Set of names.
+ */
+export function buildRegistry(documents) {
+    const registry = new Map();
+    for (const doc of documents) {
+        const parsed = parseDocument(doc.content);
+        if (!parsed)
+            continue;
+        const type = normalizeType(parsed.type);
+        if (!registry.has(type)) {
+            registry.set(type, new Set());
+        }
+        registry.get(type).add(parsed.name);
+    }
+    return registry;
+}
+/**
+ * Build a registry of server-known object names from dry-run operations.
+ * Any object that appears in the dry-run (create, update, unchanged, delete) exists
+ * either locally or on the server.
+ */
+export function buildServerRegistry(operations) {
+    const registry = new Map();
+    for (const op of operations) {
+        const type = normalizeType(op.type);
+        if (!registry.has(type)) {
+            registry.set(type, new Set());
+        }
+        // Operation names for queries include the verb (e.g., "path/{id} DELETE")
+        // but references use just the name, so strip the verb suffix
+        const name = op.name.replace(/\s+(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/, '');
+        registry.get(type).add(name);
+    }
+    return registry;
+}
+/**
+ * Check all documents for cross-references that point to names not in the registry.
+ *
+ * When serverOperations is provided (from dry-run), references are checked against
+ * both local files AND server-known objects, eliminating false positives for objects
+ * that exist on the server but aren't in the push set.
+ */
+export function checkReferences(documents, serverOperations) {
+    const registry = buildRegistry(documents);
+    // Merge server-known names into the registry
+    if (serverOperations) {
+        const serverRegistry = buildServerRegistry(serverOperations);
+        for (const [type, names] of serverRegistry) {
+            if (!registry.has(type)) {
+                registry.set(type, new Set());
+            }
+            for (const name of names) {
+                registry.get(type).add(name);
+            }
+        }
+    }
+    const badRefs = [];
+    for (const doc of documents) {
+        const parsed = parseDocument(doc.content);
+        if (!parsed)
+            continue;
+        for (const pattern of REFERENCE_PATTERNS) {
+            // Reset regex state for each document
+            pattern.regex.lastIndex = 0;
+            let match;
+            while ((match = pattern.regex.exec(doc.content)) !== null) {
+                const rawName = stripQuotes(match[1]);
+                // Skip empty names only for action.call (valid for integration actions)
+                if (!rawName && pattern.keyword === 'action.call')
+                    continue;
+                const { targetType } = pattern;
+                const knownNames = registry.get(targetType);
+                if (!knownNames || !knownNames.has(rawName)) {
+                    badRefs.push({
+                        source: parsed.name,
+                        sourceType: parsed.type,
+                        statementType: pattern.keyword,
+                        target: rawName,
+                        targetType,
+                    });
+                }
+            }
+        }
+    }
+    return badRefs;
+}
+/**
+ * Check table documents for indexes that reference fields not in the schema.
+ * Parses the XanoScript table format to extract schema field names and index field names.
+ */
+export function checkTableIndexes(documents) {
+    const badIndexes = [];
+    for (const doc of documents) {
+        const parsed = parseDocument(doc.content);
+        if (!parsed || parsed.type !== 'table')
+            continue;
+        const schemaFields = extractSchemaFields(doc.content);
+        const indexes = extractIndexes(doc.content);
+        for (const idx of indexes) {
+            for (const field of idx.fields) {
+                if (!schemaFields.has(field)) {
+                    badIndexes.push({
+                        field,
+                        indexType: idx.type,
+                        table: parsed.name,
+                    });
+                }
+            }
+        }
+    }
+    return badIndexes;
+}
+function extractSchemaFields(content) {
+    // id and created_at are auto-added during import
+    const fields = new Set(['id', 'created_at']);
+    // Find the schema block by matching braces
+    const schemaStart = content.match(/\bschema\s*\{/);
+    if (!schemaStart || schemaStart.index === undefined)
+        return fields;
+    let depth = 0;
+    let blockStart = -1;
+    let blockEnd = -1;
+    for (let i = schemaStart.index; i < content.length; i++) {
+        if (content[i] === '{') {
+            if (depth === 0)
+                blockStart = i + 1;
+            depth++;
+        }
+        else if (content[i] === '}') {
+            depth--;
+            if (depth === 0) {
+                blockEnd = i;
+                break;
+            }
+        }
+    }
+    if (blockStart < 0 || blockEnd < 0)
+        return fields;
+    const schemaBlock = content.slice(blockStart, blockEnd);
+    // Match field declarations: "type name" or "type name?" or "type name?=default"
+    const fieldRegex = /^\s*\w+\s+(\w+)[?\s{]/gm;
+    let match;
+    while ((match = fieldRegex.exec(schemaBlock)) !== null) {
+        fields.add(match[1]);
+    }
+    return fields;
+}
+function extractIndexes(content) {
+    const indexes = [];
+    // Match the index array: index = [ ... ]
+    const indexMatch = content.match(/\bindex\s*=\s*\[([\s\S]*?)\n\s*\]/);
+    if (!indexMatch)
+        return indexes;
+    const indexBlock = indexMatch[1];
+    // Match each index object: {type: "btree", field: [{name: "col", op: "desc"}]}
+    const entryRegex = /\{([^}]+)\}/g;
+    let match;
+    while ((match = entryRegex.exec(indexBlock)) !== null) {
+        const entry = match[1];
+        const typeMatch = entry.match(/type:\s*"(\w+)"/);
+        const type = typeMatch ? typeMatch[1] : 'unknown';
+        const fieldNames = [];
+        const nameRegex = /name:\s*"(\w*)"/g;
+        let nameMatch;
+        while ((nameMatch = nameRegex.exec(entry)) !== null) {
+            fieldNames.push(nameMatch[1]);
+        }
+        if (fieldNames.length > 0) {
+            indexes.push({ fields: fieldNames, type });
+        }
+    }
+    return indexes;
+}