@xano/cli 1.0.6-beta.1 → 1.0.6-beta.3

package/README.md

@@ -594,6 +594,7 @@ xano ephemeral push <tenant_name> -d ./my-ephemeral
 # Open in the browser (or print the URL)
 xano ephemeral impersonate <tenant_name>
 xano ephemeral impersonate <tenant_name> --url-only
+xano ephemeral impersonate <tenant_name> --guest       # read-only session (browse only)
 ```
 
 #### Static hosting for an ephemeral tenant

package/dist/commands/ephemeral/impersonate/index.d.ts

@@ -6,6 +6,7 @@ export default class EphemeralImpersonate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        guest: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'url-only': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/ephemeral/impersonate/index.js

@@ -15,9 +15,16 @@ Opening browser...
 Impersonation successful!
 `,
         `$ xano ephemeral impersonate e4f2-9ab1-xyz1 -o json`,
+        `$ xano ephemeral impersonate e4f2-9ab1-xyz1 --guest --url-only`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        guest: Flags.boolean({
+            char: 'g',
+            default: false,
+            description: 'Mint a read-only guest session (browse only; no schema/data/config changes)',
+            required: false,
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -46,7 +53,7 @@ Impersonation successful!
         }
         const tenantName = args.tenant_name;
         try {
-            const response = await this.getImpersonateResponse(profile, workspaceId, tenantName);
+            const response = await this.getImpersonateResponse(profile, workspaceId, tenantName, flags.guest);
             if (flags.output === 'json') {
                 this.log(JSON.stringify(response, null, 2));
             }
@@ -76,8 +83,9 @@ Impersonation successful!
             }
         }
     }
-    async getImpersonateResponse(profile, workspaceId, tenantName) {
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${encodeURIComponent(tenantName)}/impersonate`;
+    async getImpersonateResponse(profile, workspaceId, tenantName, guest = false) {
+        const query = guest ? '?guest_read_only=true' : '';
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${encodeURIComponent(tenantName)}/impersonate${query}`;
         const { verbose } = await this.parse(EphemeralImpersonate).then((r) => r.flags);
         const response = await this.verboseFetch(apiUrl, {
             headers: {

package/dist/commands/tenant/pull/index.js

@@ -3,7 +3,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, channelPathSegments, parseDocument, } from '../../../utils/document-parser.js';
 export default class Pull extends BaseCommand {
     static description = 'Pull a tenant multidoc from the Xano Metadata API and split into individual files';
     static examples = [
@@ -129,6 +129,9 @@ Pulled 58 documents from tenant my-tenant
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
         const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+        // Resolve a realtime v2 channel path -> owning realtime_server name, so
+        // messages can nest under their channel's server (see resolver docs).
+        const getChannelServer = buildChannelServerResolver(documents);
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
@@ -190,6 +193,53 @@ Pulled 58 documents from tenant my-tenant
                 typeDir = path.join(outputDir, 'realtime', 'trigger');
                 baseName = this.sanitizeFilename(doc.name);
             }
+            else if (doc.type === 'realtime_server') {
+                // Realtime v2 — see workspace/pull for the full rationale. Its own
+                // document is named after itself, mirroring api_group.
+                // realtime_server "chat" → realtime/server/chat/chat.xs
+                typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.name));
+                baseName = this.sanitizeFilename(doc.name);
+            }
+            else if (doc.type === 'channel') {
+                // Realtime v2. The channel owns a directory named after itself (the full
+                // channel name, snake_cased into a single flat segment — like every other
+                // object), and its messages live in a message/ subfolder inside it. It
+                // nests under its owning realtime_server (from `server = "..."`):
+                //   channel "rooms/{room_id}" (server "chat")
+                //     → realtime/server/chat/channel/rooms_room_id/rooms_room_id.xs
+                //
+                // The channel name is snake_cased as a whole (rooms/{room_id} →
+                // rooms_room_id), so there is no path nesting and no bracket escaping —
+                // the on-disk name is a display form; the .xs content keeps the real
+                // name. A channel with no resolvable server (e.g. a pre-server export)
+                // falls back to the legacy flat channel/<path>/_channel.xs layout.
+                if (doc.server) {
+                    typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.server), 'channel', snakeCase(doc.name));
+                    baseName = snakeCase(doc.name);
+                }
+                else {
+                    typeDir = path.join(outputDir, 'channel', ...channelPathSegments(doc.name, snakeCase));
+                    baseName = '_channel';
+                }
+            }
+            else if (doc.type === 'message' && doc.channel) {
+                // Realtime v2 message → nests in a message/ subfolder under its channel,
+                // under that channel's server. The message names only its channel; the
+                // server is resolved by looking that channel up in the same multidoc
+                // (two-pass resolve).
+                //   message "post" on channel "rooms/{room_id}" (server "chat")
+                //     → realtime/server/chat/channel/rooms_room_id/message/post.xs
+                //
+                // Nesting matters beyond tidiness: message names are unique only WITHIN
+                // a channel, so a flat message/ directory would collide when two
+                // channels both define e.g. "say". A channel whose server can't be
+                // resolved falls back to the legacy flat channel/ layout.
+                const messageServer = getChannelServer(doc.channel);
+                typeDir = messageServer
+                    ? path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(messageServer), 'channel', snakeCase(doc.channel), 'message')
+                    : path.join(outputDir, 'channel', ...channelPathSegments(doc.channel, snakeCase));
+                baseName = this.sanitizeFilename(doc.name);
+            }
             else if (doc.type === 'api_group') {
                 // api_group "test" → api/{resolved_folder}/{name}.xs
                 const groupFolder = getApiGroupFolder(doc.name);

package/dist/commands/workspace/git/pull/index.js

@@ -5,7 +5,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
 import BaseCommand, { buildUserAgent } from '../../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, channelPathSegments, parseDocument, } from '../../../../utils/document-parser.js';
 export default class GitPull extends BaseCommand {
     static description = 'Pull XanoScript files from a git repository into a local directory';
     static examples = [
@@ -97,10 +97,13 @@ export default class GitPull extends BaseCommand {
             // Write documents to output directory using the same file tree logic as workspace pull
             fs.mkdirSync(outputDir, { recursive: true });
             const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+            // Resolve a realtime v2 channel path -> owning realtime_server name, so
+            // messages can nest under their channel's server (see resolver docs).
+            const getChannelServer = buildChannelServerResolver(documents);
             const filenameCounters = new Map();
             let writtenCount = 0;
             for (const doc of documents) {
-                const { baseName, typeDir } = this.resolveOutputPath(outputDir, doc, getApiGroupFolder);
+                const { baseName, typeDir } = this.resolveOutputPath(outputDir, doc, getApiGroupFolder, getChannelServer);
                 fs.mkdirSync(typeDir, { recursive: true });
                 // Track duplicates per directory
                 const dirKey = path.relative(outputDir, typeDir);
@@ -325,7 +328,7 @@ export default class GitPull extends BaseCommand {
      * Resolve the output directory and base filename for a parsed document.
      * Uses the same type-to-directory mapping as workspace pull.
      */
-    resolveOutputPath(outputDir, doc, getApiGroupFolder) {
+    resolveOutputPath(outputDir, doc, getApiGroupFolder, getChannelServer) {
         let typeDir;
         let baseName;
         if (doc.type === 'workspace') {
@@ -373,6 +376,53 @@ export default class GitPull extends BaseCommand {
             typeDir = path.join(outputDir, 'realtime', 'trigger');
             baseName = this.sanitizeFilename(doc.name);
         }
+        else if (doc.type === 'realtime_server') {
+            // Realtime v2 — see workspace/pull for the full rationale. Its own
+            // document is named after itself, mirroring api_group.
+            // realtime_server "chat" → realtime/server/chat/chat.xs
+            typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.name));
+            baseName = this.sanitizeFilename(doc.name);
+        }
+        else if (doc.type === 'channel') {
+            // Realtime v2. The channel owns a directory named after itself (the full
+            // channel name, snake_cased into a single flat segment — like every other
+            // object), and its messages live in a message/ subfolder inside it. It
+            // nests under its owning realtime_server (from `server = "..."`):
+            //   channel "rooms/{room_id}" (server "chat")
+            //     → realtime/server/chat/channel/rooms_room_id/rooms_room_id.xs
+            //
+            // The channel name is snake_cased as a whole (rooms/{room_id} →
+            // rooms_room_id), so there is no path nesting and no bracket escaping —
+            // the on-disk name is a display form; the .xs content keeps the real
+            // name. A channel with no resolvable server (e.g. a pre-server export)
+            // falls back to the legacy flat channel/<path>/_channel.xs layout.
+            if (doc.server) {
+                typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.server), 'channel', snakeCase(doc.name));
+                baseName = snakeCase(doc.name);
+            }
+            else {
+                typeDir = path.join(outputDir, 'channel', ...channelPathSegments(doc.name, snakeCase));
+                baseName = '_channel';
+            }
+        }
+        else if (doc.type === 'message' && doc.channel) {
+            // Realtime v2 message → nests in a message/ subfolder under its channel,
+            // under that channel's server. The message names only its channel; the
+            // server is resolved by looking that channel up in the same multidoc
+            // (two-pass resolve).
+            //   message "post" on channel "rooms/{room_id}" (server "chat")
+            //     → realtime/server/chat/channel/rooms_room_id/message/post.xs
+            //
+            // Nesting matters beyond tidiness: message names are unique only WITHIN
+            // a channel, so a flat message/ directory would collide when two
+            // channels both define e.g. "say". A channel whose server can't be
+            // resolved falls back to the legacy flat channel/ layout.
+            const messageServer = getChannelServer(doc.channel);
+            typeDir = messageServer
+                ? path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(messageServer), 'channel', snakeCase(doc.channel), 'message')
+                : path.join(outputDir, 'channel', ...channelPathSegments(doc.channel, snakeCase));
+            baseName = this.sanitizeFilename(doc.name);
+        }
         else if (doc.type === 'api_group') {
             const groupFolder = getApiGroupFolder(doc.name);
             typeDir = path.join(outputDir, 'api', groupFolder);

package/dist/commands/workspace/pull/index.js

@@ -3,7 +3,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, channelPathSegments, parseDocument, } from '../../../utils/document-parser.js';
 import { fetchKnowledge, writeKnowledge } from '../../../utils/knowledge-sync.js';
 export default class Pull extends BaseCommand {
     static description = 'Pull a workspace multidoc from the Xano Metadata API and split into individual files';
@@ -134,6 +134,9 @@ Pulled 58 documents
         // Resolve api_group names to unique folder names, disambiguating collisions
         // where different names produce the same snakeCase (e.g., "Authentication" vs "authentication")
         const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+        // Resolve a realtime v2 channel path -> owning realtime_server name, so
+        // messages can nest under their channel's server (see resolver docs).
+        const getChannelServer = buildChannelServerResolver(documents);
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
@@ -195,6 +198,55 @@ Pulled 58 documents
                 typeDir = path.join(outputDir, 'realtime', 'trigger');
                 baseName = this.sanitizeFilename(doc.name);
             }
+            else if (doc.type === 'realtime_server') {
+                // Realtime v2. The realtime_server is the top-level container that owns
+                // channels (which own messages). Its own document is named after itself
+                // inside its name directory, mirroring api_group (api/<group>/<group>.xs)
+                // — the server name is a simple segment, so no fixed leaf is needed.
+                //   realtime_server "chat" → realtime/server/chat/chat.xs
+                typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.name));
+                baseName = this.sanitizeFilename(doc.name);
+            }
+            else if (doc.type === 'channel') {
+                // Realtime v2. The channel owns a directory named after itself (the full
+                // channel name, snake_cased into a single flat segment — like every other
+                // object), and its messages live in a message/ subfolder inside it. It
+                // nests under its owning realtime_server (from `server = "..."`):
+                //   channel "rooms/{room_id}" (server "chat")
+                //     → realtime/server/chat/channel/rooms_room_id/rooms_room_id.xs
+                //
+                // The channel name is snake_cased as a whole (rooms/{room_id} →
+                // rooms_room_id), so there is no path nesting and no bracket escaping —
+                // the on-disk name is a display form; the .xs content keeps the real
+                // name. A channel with no resolvable server (e.g. a pre-server export)
+                // falls back to the legacy flat channel/<path>/_channel.xs layout.
+                if (doc.server) {
+                    typeDir = path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(doc.server), 'channel', snakeCase(doc.name));
+                    baseName = snakeCase(doc.name);
+                }
+                else {
+                    typeDir = path.join(outputDir, 'channel', ...channelPathSegments(doc.name, snakeCase));
+                    baseName = '_channel';
+                }
+            }
+            else if (doc.type === 'message' && doc.channel) {
+                // Realtime v2 message → nests in a message/ subfolder under its channel,
+                // under that channel's server. The message names only its channel; the
+                // server is resolved by looking that channel up in the same multidoc
+                // (two-pass resolve).
+                //   message "post" on channel "rooms/{room_id}" (server "chat")
+                //     → realtime/server/chat/channel/rooms_room_id/message/post.xs
+                //
+                // Nesting matters beyond tidiness: message names are unique only WITHIN
+                // a channel, so a flat message/ directory would collide when two
+                // channels both define e.g. "say". A channel whose server can't be
+                // resolved falls back to the legacy flat channel/ layout.
+                const messageServer = getChannelServer(doc.channel);
+                typeDir = messageServer
+                    ? path.join(outputDir, 'realtime', 'server', this.sanitizeFilename(messageServer), 'channel', snakeCase(doc.channel), 'message')
+                    : path.join(outputDir, 'channel', ...channelPathSegments(doc.channel, snakeCase));
+                baseName = this.sanitizeFilename(doc.name);
+            }
             else if (doc.type === 'api_group') {
                 // api_group "test" → api/{resolved_folder}/{name}.xs
                 const groupFolder = getApiGroupFolder(doc.name);

package/dist/utils/document-parser.d.ts

@@ -1,9 +1,13 @@
 export interface ParsedDocument {
     apiGroup?: string;
     canonical?: string;
+    /** Owning channel path for realtime v2 `message` documents. */
+    channel?: string;
     content: string;
     guid?: string;
     name: string;
+    /** Owning realtime_server name for realtime v2 `channel` documents. */
+    server?: string;
     type: string;
     verb?: string;
 }
@@ -12,6 +16,48 @@ export interface ParsedDocument {
  * Skips leading comment lines (starting with //) to find the first meaningful line.
  */
 export declare function parseDocument(content: string): null | ParsedDocument;
+/**
+ * Map a realtime v2 channel path onto directory segments.
+ *
+ * A channel name IS a path template — "rooms/{room_id}" — so the directory tree
+ * mirrors it rather than flattening it. That is the whole reason messages nest
+ * under channels: the tree should show the structure, and
+ * "channel/rooms/[room_id]/post.xs" says immediately that `post` lives on a
+ * parameterized rooms channel.
+ *
+ *   "rooms"                    -> ["rooms"]
+ *   "rooms/{room_id}"          -> ["rooms", "[room_id]"]
+ *   "org/{org_id}/room/{id}"   -> ["org", "[org_id]", "room", "[id]"]
+ *
+ * Braces become brackets because "{" and "}" are awkward in shells, while "["
+ * and "]" are legal on every filesystem. They are still glob character classes,
+ * so scripting against a checkout needs the path quoted.
+ *
+ * Escaping the braces rather than dropping them is what keeps a parameterized
+ * channel distinct from a literal one: without it, "rooms/{room_id}" and a
+ * literal channel named "rooms/room_id" collide on the same directory.
+ *
+ * Mirrors Vfs::channelSegment() on the server.
+ */
+export declare function channelPathSegments(name: string, snakeCaseFn: (s: string) => string): string[];
+/**
+ * Build a map of realtime v2 channel path -> owning realtime_server name.
+ *
+ * This is the cross-document lookup the on-disk nesting needs: a `message`
+ * document names its channel (`channel = "..."`), while a `channel` document
+ * names its server (`realtime_server = "..."`). To place a message under
+ * `realtime/server/<server>/channel/<path>/...` we resolve the message's channel
+ * to that channel's server — which the channel document carries. (Messages now
+ * also carry `realtime_server` directly, but resolving via the channel keeps a
+ * single source of truth for the channel→server mapping.)
+ *
+ * Because every pull path parses the WHOLE multidoc into memory before writing,
+ * we can build this map from the `channel` docs in the same batch (a two-pass
+ * resolve), keyed by the channel's own name (its path). A channel with no
+ * `realtime_server` (e.g. a pre-server export) simply isn't in the map, and
+ * callers fall back accordingly.
+ */
+export declare function buildChannelServerResolver(documents: ParsedDocument[]): (channelName: string) => string | undefined;
 /**
  * Build a unique key for a document based on its type, name, verb, and api_group.
  * Used to match server GUID map entries back to local files.

package/dist/utils/document-parser.js

@@ -45,6 +45,25 @@ export function parseDocument(content) {
     if (apiGroupMatch) {
         apiGroup = apiGroupMatch[1];
     }
+    // Extract channel if present (e.g., channel = "rooms/{room_id}").
+    // Realtime v2 messages reference their owning channel by PATH, which is what
+    // nests them under it on disk.
+    let channel;
+    const channelMatch = content.match(/^\s*channel\s*=\s*"([^"]*)"/m);
+    if (channelMatch) {
+        channel = channelMatch[1];
+    }
+    // Extract realtime_server if present (e.g., realtime_server = "chat").
+    // Realtime v2 channels/messages reference their owning realtime_server by NAME
+    // via a top-level `realtime_server = "..."`, which is what nests them under it
+    // on disk (mirrors how a message names its channel via `channel = "..."`).
+    // The keyword is `realtime_server` (renamed from a bare `server` to match the
+    // api_group/mcp_server convention — reference the container by its full type).
+    let server;
+    const serverMatch = content.match(/^\s*realtime_server\s*=\s*"([^"]*)"/m);
+    if (serverMatch) {
+        server = serverMatch[1];
+    }
     // Extract canonical if present (e.g., canonical = "abc123")
     let canonical;
     const canonicalMatch = content.match(/canonical\s*=\s*"([^"]*)"/);
@@ -57,7 +76,62 @@ export function parseDocument(content) {
     if (guidMatch) {
         guid = guidMatch[1];
     }
-    return { apiGroup, canonical, content, guid, name, type, verb };
+    return { apiGroup, canonical, channel, content, guid, name, server, type, verb };
+}
+/**
+ * Map a realtime v2 channel path onto directory segments.
+ *
+ * A channel name IS a path template — "rooms/{room_id}" — so the directory tree
+ * mirrors it rather than flattening it. That is the whole reason messages nest
+ * under channels: the tree should show the structure, and
+ * "channel/rooms/[room_id]/post.xs" says immediately that `post` lives on a
+ * parameterized rooms channel.
+ *
+ *   "rooms"                    -> ["rooms"]
+ *   "rooms/{room_id}"          -> ["rooms", "[room_id]"]
+ *   "org/{org_id}/room/{id}"   -> ["org", "[org_id]", "room", "[id]"]
+ *
+ * Braces become brackets because "{" and "}" are awkward in shells, while "["
+ * and "]" are legal on every filesystem. They are still glob character classes,
+ * so scripting against a checkout needs the path quoted.
+ *
+ * Escaping the braces rather than dropping them is what keeps a parameterized
+ * channel distinct from a literal one: without it, "rooms/{room_id}" and a
+ * literal channel named "rooms/room_id" collide on the same directory.
+ *
+ * Mirrors Vfs::channelSegment() on the server.
+ */
+export function channelPathSegments(name, snakeCaseFn) {
+    // A parameter keeps the author's name verbatim so it matches the `input`
+    // block; only the delimiters are swapped.
+    const isParam = /^\{.*\}$/;
+    return name.split('/').map((segment) => (isParam.test(segment) ? `[${segment.slice(1, -1)}]` : snakeCaseFn(segment)));
+}
+/**
+ * Build a map of realtime v2 channel path -> owning realtime_server name.
+ *
+ * This is the cross-document lookup the on-disk nesting needs: a `message`
+ * document names its channel (`channel = "..."`), while a `channel` document
+ * names its server (`realtime_server = "..."`). To place a message under
+ * `realtime/server/<server>/channel/<path>/...` we resolve the message's channel
+ * to that channel's server — which the channel document carries. (Messages now
+ * also carry `realtime_server` directly, but resolving via the channel keeps a
+ * single source of truth for the channel→server mapping.)
+ *
+ * Because every pull path parses the WHOLE multidoc into memory before writing,
+ * we can build this map from the `channel` docs in the same batch (a two-pass
+ * resolve), keyed by the channel's own name (its path). A channel with no
+ * `realtime_server` (e.g. a pre-server export) simply isn't in the map, and
+ * callers fall back accordingly.
+ */
+export function buildChannelServerResolver(documents) {
+    const channelToServer = new Map();
+    for (const doc of documents) {
+        if (doc.type === 'channel' && doc.server) {
+            channelToServer.set(doc.name, doc.server);
+        }
+    }
+    return (channelName) => channelToServer.get(channelName);
 }
 /**
  * Build a unique key for a document based on its type, name, verb, and api_group.

package/dist/utils/knowledge-sync.d.ts

@@ -17,6 +17,7 @@ export interface KnowledgeObject {
     mode?: string;
     name: string;
     scope?: string;
+    tag?: string[];
 }
 /** A locally-collected object that also remembers its primary file on disk (for GUID writeback). */
 export interface LocalKnowledgeObject extends KnowledgeObject {

package/dist/utils/knowledge-sync.js

@@ -12,7 +12,7 @@ import { dirname, join, relative, sep } from 'node:path';
 // let the server dictate file paths.
 export const KNOWLEDGE_DIR = 'knowledge';
 // ── Frontmatter ──────────────────────────────────────────────────────────────
-const FRONTMATTER_ORDER = ['name', 'description', 'knowledge_type', 'scope', 'inclusion', 'enabled', 'guid'];
+const FRONTMATTER_ORDER = ['name', 'description', 'knowledge_type', 'inclusion', 'tags', 'guid'];
 /**
  * Build a primary `.md` file body: YAML frontmatter (built from the object's
  * structured fields) followed by the markdown content.
@@ -23,12 +23,10 @@ export function buildPrimaryContent(obj) {
     if (obj.description !== undefined)
         meta.description = obj.description;
     meta.knowledge_type = obj.knowledge_type;
-    if (obj.scope !== undefined)
-        meta.scope = obj.scope;
     if (obj.mode !== undefined)
         meta.inclusion = modeToInclusion(obj.mode);
-    if (obj.enabled !== undefined)
-        meta.enabled = obj.enabled;
+    if (obj.tag !== undefined && obj.tag.length > 0)
+        meta.tags = obj.tag;
     if (obj.guid !== undefined)
         meta.guid = obj.guid;
     // Emit keys in a stable, human-friendly order.
@@ -107,6 +105,10 @@ const MODE_TO_INCLUSION = {
 function modeToInclusion(mode) {
     return MODE_TO_INCLUSION[mode] ?? mode;
 }
+/** Parse the on-disk `tags:` frontmatter value into a string array, or `undefined` if absent/malformed. */
+function parseTags(tags) {
+    return Array.isArray(tags) && tags.every((t) => typeof t === 'string') ? tags : undefined;
+}
 // ── Path mapping (CLI-owned layout) ────────────────────────────────────────────
 /**
  * Allocate a unique snake_case folder/file segment per call, suffixing
@@ -246,6 +248,9 @@ export function collectKnowledgeObjects(inputDir, include, exclude) {
         };
         if (typeof meta.guid === 'string')
             obj.guid = meta.guid;
+        const tags = parseTags(meta.tags);
+        if (tags)
+            obj.tag = tags;
         if (knowledgeType === 'skill') {
             const skillFolder = posixPath.slice('skills/'.length, posixPath.indexOf('/SKILL.md'));
             const refPrefix = `skills/${skillFolder}/references/`;
@@ -345,6 +350,7 @@ function canonical(obj) {
         files,
         mode: obj.mode ?? '',
         scope: obj.scope ?? '',
+        tag: [...(obj.tag ?? [])].sort(),
     });
 }
 /**

package/dist/utils/reference-checker.js

@@ -28,6 +28,16 @@ const REFERENCE_PATTERNS = [
     },
     // Schema foreign key references: table = "name" inside field definitions
     { keyword: 'table (FK)', regex: /\btable\s*=\s*"([^"]*)"/gm, targetType: 'table' },
+    // Realtime v2: a channel references its owning realtime_server by name via a
+    // top-level `realtime_server = "..."` (renamed from a bare `server` to match
+    // the api_group/mcp_server convention). The full keyword is unambiguous, so no
+    // false-match against another object type's `server` field.
+    {
+        keyword: 'channel (realtime_server)',
+        regex: /^\s*realtime_server\s*=\s*"([^"]*)"/gm,
+        sourceType: 'channel',
+        targetType: 'realtime_server',
+    },
 ];
 /**
  * Strip surrounding quotes from a name if present.
@@ -119,6 +129,9 @@ export function checkReferences(documents, serverOperations) {
         if (!parsed)
             continue;
         for (const pattern of REFERENCE_PATTERNS) {
+            // Skip patterns scoped to a different source document type.
+            if (pattern.sourceType && pattern.sourceType !== parsed.type)
+                continue;
             // Reset regex state for each document
             pattern.regex.lastIndex = 0;
             let match;