@xano/developer-mcp 1.0.54 → 1.0.56

package/dist/xanoscript_docs/quickstart.md

@@ -107,10 +107,10 @@ var $data { value = { key: "value" } }
 ### Conditional Logic
 ```xs
 conditional {
-  if (`$status == "active"`) {
+  if ($status == "active") {
     var $result { value = "Active user" }
   }
-  elseif (`$status == "pending"`) {
+  elseif ($status == "pending") {
     var $result { value = "Pending approval" }
   }
   else {
@@ -464,7 +464,7 @@ conditional {
   }
   else {
     throw {
-      name = "APIError",
+      name = "APIError"
       value = "OpenAI API error: " ~ ($api_result.response.status|to_text)
     }
   }
@@ -574,19 +574,28 @@ var $data { value = { customer = $id } }
 var $data { value = { customer: $id } }
 ```
 
-### 9. Throw block with commas
+### 9. Commas in block properties (`=`) vs object literals (`:`)
+
+Block properties use `=` and go on **separate lines with no commas**. Object literals use `:` and **require commas** between entries.
+
 ```xs
-// ❌ Wrong - throw blocks don't use commas
+// ❌ Wrong - block properties don't use commas
 throw {
   name = "Error",
   value = "message"
 }
 
-// ✅ Correct - no commas between properties
+// ✅ Correct - no commas between block properties (=)
 throw {
   name = "Error"
   value = "message"
 }
+
+// ✅ Correct - object literals (:) DO use commas
+db.query "dad_jokes" {
+  sort = {dad_jokes.id: "rand", dad_jokes.joke: "asc"}
+  return = {type: "single"}
+} as $joke
 ```
 
 ### 10. Using $env in run.job input blocks

package/dist/xanoscript_docs/security.md

@@ -10,14 +10,14 @@ Best practices for building secure XanoScript applications.
 
 ## Section Index
 
-- [Authentication](#authentication) (L24) - Tokens, sessions, MFA
-- [Authorization](#authorization) (L186) - Role checks, ownership
-- [Input Validation](#input-validation) (L277) - Type enforcement, sanitization
-- [Data Protection](#data-protection) (L339) - Encryption, hashing, secrets
-- [Rate Limiting](#rate-limiting--abuse-prevention) (L427) - API limits, abuse prevention
-- [Security Headers](#security-headers) (L486) - CORS configuration
-- [Audit Logging](#audit-logging) (L504) - Security event tracking
-- [Best Practices Summary](#best-practices-summary) (L545) - Quick checklist
+- [Authentication](#authentication) - Tokens, sessions, refresh tokens
+- [Authorization](#authorization) - Role checks, ownership
+- [Input Validation](#input-validation) - Type enforcement, sanitization
+- [Data Protection](#data-protection) - Encryption, hashing, secrets
+- [Rate Limiting](#rate-limiting--abuse-prevention) - API limits, abuse prevention
+- [Security Headers](#security-headers) - CORS configuration
+- [Audit Logging](#audit-logging) - Security event tracking
+- [Best Practices Summary](#best-practices-summary) - Quick checklist
 
 ---
 
@@ -162,36 +162,6 @@ function "validate_session" {
 }
 ```
 
-### Multi-Factor Authentication
-
-```xs
-function "verify_mfa" {
-  input {
-    int user_id
-    text code filters=digitOk|min:6|max:6
-  }
-  stack {
-    db.get "user" {
-      field_name = "id"
-      field_value = $input.user_id
-    } as $user
-
-    // Verify TOTP code
-    security.verify_totp {
-      secret = $user.mfa_secret
-      code = $input.code
-      window = 1
-    } as $is_valid
-
-    precondition ($is_valid) {
-      error_type = "accessdenied"
-      error = "Invalid MFA code"
-    }
-  }
-  response = { verified: true }
-}
-```
-
 ---
 
 ## Authorization
@@ -294,7 +264,7 @@ input {
   email email filters=trim|lower
   text password filters=min:8|max:128
   int age filters=min:0|max:150
-  text username filters=trim|lower|min:3|max:20|alphaNumOk
+  text username filters=trim|lower|min:3|max:20|alphaOk|digitOk
 }
 ```
 
@@ -324,9 +294,9 @@ var $safe_content {
   value = $input.content|escape
 }
 
-// For rich text, use allowlist sanitization
+// For rich text, escape HTML entities
 var $sanitized {
-  value = $input.html|html_sanitize:["p", "b", "i", "a"]
+  value = $input.html|escape
 }
 ```
 
@@ -508,8 +478,13 @@ function "record_failed_login" {
   input { text email }
   stack {
     var $key { value = "login_attempts:" ~ $input.email|md5 }
-    redis.incr { key = $key, by = 1 }
-    redis.expire { key = $key, ttl = 900 }
+
+    redis.get { key = $key } as $current
+    redis.set {
+      key = $key
+      data = ($current|to_int ?? 0) + 1
+      ttl = 900
+    }
   }
 }
 

package/dist/xanoscript_docs/syntax/array-filters.md

@@ -0,0 +1,238 @@
+---
+applyTo: ""
+---
+
+# Array Filters & Functions
+
+Complete reference for XanoScript array filters, functional operations, and statement-level array functions.
+
+> **These filters operate on ARRAY values only.** Do not use string filters (`strlen`, `substr`, `split`, `replace`) on arrays. Use `count` for array length, `slice` for sub-arrays, `join` to convert to string.
+
+## Quick Reference
+
+### Array Filters
+
+| Filter | Example | Result |
+|--------|---------|--------|
+| `first` | `[1,2,3]\|first` | `1` |
+| `last` | `[1,2,3]\|last` | `3` |
+| `count` | `[1,2,3]\|count` | `3` |
+| `reverse` | `[1,2,3]\|reverse` | `[3,2,1]` |
+| `unique` | `[1,1,2]\|unique` | `[1,2]` |
+| `flatten` | `[[1,2],[3]]\|flatten` | `[1,2,3]` |
+| `shuffle` | `[1,2,3]\|shuffle` | Random order |
+| `slice` | `[1,2,3,4]\|slice:1:2` | `[2,3]` -- offset 1, length 2 |
+| `push` | `[1,2]\|push:3` | `[1,2,3]` |
+| `pop` | `[1,2,3]\|pop` | `3` |
+| `shift` | `[1,2,3]\|shift` | `1` |
+| `unshift` | `[1,2]\|unshift:0` | `[0,1,2]` |
+| `merge` | `[1,2]\|merge:[3,4]` | `[1,2,3,4]` |
+| `diff` | `[1,2,3]\|diff:[2]` | `[1,3]` |
+| `intersect` | `[1,2,3]\|intersect:[2,3,4]` | `[2,3]` |
+| `join` | `["a","b"]\|join:","` | `"a,b"` |
+| `range` | `\|range:1:5` | `[1,2,3,4,5]` |
+| `..` | `(1..5)` | `[1,2,3,4,5]` |
+
+### Range Operator
+
+```xs
+(1..5)                                      // [1,2,3,4,5]
+(0..10)                                     // [0,1,2,3,4,5,6,7,8,9,10]
+($start..$end)                              // Dynamic range with variables
+```
+
+### Functional Operations
+
+```xs
+// Map - transform each element
+[{v:1},{v:2}]|map:$$.v*2                    // [2,4]
+
+// Filter - keep matching elements
+[1,2,3,4]|filter:$$%2==0                    // [2,4]
+
+// Find - first matching element
+[{id:1},{id:2}]|find:$$.id==2               // {id:2}
+
+// FindIndex - index of first match
+[{id:1},{id:2}]|findIndex:$$.id==2          // 1
+
+// Some - any element matches?
+[1,2,3]|some:$$>2                           // true
+
+// Every - all elements match?
+[2,4,6]|every:$$%2==0                       // true
+
+// Reduce - accumulate to single value
+[1,2,3,4]|reduce:$$+$result:0               // 10
+```
+
+### Array Element Access: `|get` vs `|slice`
+
+> **`|get:N`** returns a **single element** by zero-based index.
+> **`|slice:offset:length`** returns a **sub-array**, skipping `offset` elements and returning the next `length` elements.
+
+| Method | Use For | Example | Result |
+|--------|---------|---------|--------|
+| `\|get:N` | Single element by index (0-based) | `[10,20,30]\|get:0` | `10` |
+| `\|slice:offset:length` | Sub-array -- skip N, take M | `[10,20,30,40]\|slice:1:2` | `[20,30]` |
+| `\|first` | First element | `[10,20,30]\|first` | `10` |
+| `\|last` | Last element | `[10,20,30]\|last` | `30` |
+
+```xs
+var $third { value = $items|get:2 }             // 0-based: 3rd element
+var $page { value = $items|slice:10:5 }          // skip 10, return 5 elements
+```
+
+### Grouping & Indexing
+
+```xs
+// Group by property
+[{g:"a",v:1},{g:"b",v:2},{g:"a",v:3}]|index_by:g
+// {"a":[{g:"a",v:1},{g:"a",v:3}],"b":[{g:"b",v:2}]}
+
+// Sort
+[{n:"z"},{n:"a"}]|sort:n:text:false         // Ascending by n
+```
+
+### Math on Arrays
+
+```xs
+[1,2,3,4]|sum        // 10
+[1,2,3,4]|avg        // 2.5
+[1,2,3,4]|product    // 24
+[5,2,8,1]|array_min  // 1
+[5,2,8,1]|array_max  // 8
+```
+
+### Array Filtering
+
+| Filter | Description | Example |
+|--------|-------------|---------|
+| `filter_empty` | Remove empty values | `$arr\|filter_empty` |
+| `filter_empty_text` | Remove empty strings | `$arr\|filter_empty_text` |
+| `filter_empty_array` | Remove empty arrays | `$arr\|filter_empty_array` |
+| `filter_empty_object` | Remove empty objects | `$arr\|filter_empty_object` |
+| `filter_null` | Remove null values | `$arr\|filter_null` |
+| `filter_zero` | Remove zero values | `$arr\|filter_zero` |
+| `filter_false` | Remove false values | `$arr\|filter_false` |
+
+```xs
+[1, null, "", 0, "text", false]|filter_empty      // [1, "text"]
+["a", "", "b", ""]|filter_empty_text              // ["a", "b"]
+```
+
+### Array Fill Operations
+
+```xs
+|fill:5:"x"                                  // ["x", "x", "x", "x", "x"]
+["a", "b"]|fill_keys:{"a": 1, "b": 2}        // {a: 1, b: 2}
+```
+
+### Deep Merge & Comparison
+
+```xs
+{a: {b: 1}}|merge_recursive:{a: {c: 2}}      // {a: {b: 1, c: 2}}
+[1, 2, 3]|diff_assoc:[2]                     // Associative diff
+[1, 2, 3]|intersect_assoc:[2, 3, 4]          // Associative intersect
+```
+
+## Array Functions (Statement-Level)
+
+Statement-level functions for manipulating arrays within stacks. Unlike filters (e.g., `$arr|push:3`), these are standalone operations.
+
+> **Syntax note:** Functions that use a `{ by = ... }` or `{ value = ... }` block wrap the array in parentheses -- e.g., `array.map ($arr) { ... }`. Functions that use an `if (...)` condition take a bare variable -- e.g., `array.filter $arr if (...) as $result`.
+
+### array.push / array.unshift
+
+```xs
+array.push $shopping_cart { value = "oranges" }
+array.unshift $priority_tasks { value = "urgent meeting" }
+```
+
+### array.pop / array.shift
+
+```xs
+array.pop $completed_tasks as $last_finished_task
+array.shift $waiting_list as $next_customer
+```
+
+### array.merge
+
+```xs
+array.merge $active_users { value = $new_users }
+```
+
+### array.find / array.find_index
+
+```xs
+array.find $customer_ages if ($this > 18) as $first_adult_age
+array.find_index $sale_prices if ($this < 20) as $first_discount_index
+```
+
+### array.has / array.every
+
+```xs
+array.has $team_roles if ($this == "manager") as $has_manager
+array.every $exam_scores if ($this >= 70) as $all_passed
+```
+
+### array.filter / array.filter_count
+
+```xs
+array.filter $temperatures if ($this > 32) as $above_freezing
+array.filter_count $survey_responses if ($this == "yes") as $yes_count
+```
+
+### array.map
+
+```xs
+array.map ($json) {
+  by = $this.email
+} as $emails
+
+array.map ($json) {
+  by = {name: $this.name, gender: $this.gender}
+} as $people
+```
+
+### array.partition / array.group_by
+
+```xs
+array.partition ($json) if ($this.gender == "male") as $is_male
+
+array.group_by ($users) {
+  by = $this.gender
+} as $user_by_gender
+```
+
+### array.union / array.difference / array.intersection
+
+```xs
+array.union ([1,3,5,7,9]) {
+  value = [2,4,6,8]
+  by = $this
+} as $union
+// Result: [1,2,3,4,5,6,7,8,9]
+
+array.difference ([1,2,3,4,5,6,7,8,9]) {
+  value = [2,4,6,8]
+  by = $this
+} as $difference
+// Result: [1,3,5,7,9]
+
+array.intersection ([1,2,3,4,5,6,7,8,9]) {
+  value = [2,4,6,8]
+  by = $this
+} as $intersection
+// Result: [2,4,6,8]
+```
+
+---
+
+## Related Topics
+
+| Topic | Description |
+|-------|-------------|
+| `syntax` | Core operators, conditionals, type filters, error handling |
+| `syntax/string-filters` | String filters, encoding, and security filters |
+| `syntax/functions` | Math and object functions |

package/dist/xanoscript_docs/syntax/functions.md

@@ -0,0 +1,136 @@
+---
+applyTo: ""
+---
+
+# Math & Object Functions
+
+Statement-level math and object functions for XanoScript.
+
+## Quick Reference
+
+### Math Filters
+
+| Filter | Example | Result |
+|--------|---------|--------|
+| `add` | `10\|add:5` | `15` |
+| `subtract` | `10\|subtract:3` | `7` |
+| `multiply` | `10\|multiply:2` | `20` |
+| `divide` | `10\|divide:2` | `5` |
+| `modulus` | `10\|modulus:3` | `1` |
+| `floor` | `2.7\|floor` | `2` |
+| `ceil` | `2.3\|ceil` | `3` |
+| `round` | `2.567\|round:2` | `2.57` |
+| `abs` | `-5\|abs` | `5` |
+| `sqrt` | `9\|sqrt` | `3` |
+| `pow` | `2\|pow:3` | `8` |
+| `min` | `5\|min:3` | `3` |
+| `max` | `5\|max:10` | `10` |
+
+### Trigonometry
+
+```xs
+90|deg2rad                                   // 1.5707963...
+1.5707963|rad2deg                            // 90
+0|sin                                        // 0
+0|cos                                        // 1
+0.785398|tan                                 // ~1 (45 degrees)
+0|asin                                       // 0
+1|acos                                       // 0
+1|atan                                       // 0.785398...
+0|sinh                                       // 0
+0|cosh                                       // 1
+0|tanh                                       // 0
+```
+
+## Math Functions (Statement-Level)
+
+Statement-level functions for arithmetic and bitwise operations. These mutate the target variable directly.
+
+> **Note:** These are different from math filters (e.g., `$x|add:5`) and math domain functions (e.g., `math.add(5, 3)`). Statement-level math functions modify the variable in place.
+
+### math.add / math.sub
+
+```xs
+math.add $cart_total { value = $item_price }
+math.sub $total_cost { value = $discount_amount }
+```
+
+### math.mul / math.div
+
+```xs
+math.mul $base_price { value = $tax_rate }
+math.div $total_time { value = $num_tasks }
+```
+
+### math.bitwise.and / math.bitwise.or / math.bitwise.xor
+
+```xs
+math.bitwise.and $status_flags { value = $check_bit }
+math.bitwise.or $permissions { value = $new_permission }
+math.bitwise.xor $flags { value = $toggle_bit }
+```
+
+### Math Domain Functions
+
+```xs
+math.add(5, 3)                               // 8
+math.sub(10, 4)                              // 6
+math.mul(3, 4)                               // 12
+math.div(20, 5)                              // 4
+math.mod(10, 3)                              // 1
+```
+
+### Bitwise Filters
+
+```xs
+5|bitwise_and:3                              // 1
+5|bitwise_or:3                               // 7
+5|bitwise_xor:3                              // 6
+5|bitwise_not                                // -6
+```
+
+### Logical NOT Filter
+
+```xs
+true|not                                     // false
+false|not                                    // true
+$condition|not                               // Inverts boolean
+```
+
+## Object Functions (Statement-Level)
+
+Statement-level functions for extracting object properties. These return results via the `as` variable.
+
+### object.keys / object.values / object.entries
+
+```xs
+object.keys {
+  value = $user_data
+} as $user_data_keys
+
+object.values {
+  value = $product_info
+} as $product_values
+
+object.entries {
+  value = $settings
+} as $settings_pairs
+```
+
+### Object Domain Functions
+
+```xs
+object.keys({a: 1, b: 2})                    // ["a", "b"]
+object.values({a: 1, b: 2})                  // [1, 2]
+object.entries({a: 1, b: 2})                 // [{key: "a", value: 1}, {key: "b", value: 2}]
+```
+
+---
+
+## Related Topics
+
+| Topic | Description |
+|-------|-------------|
+| `syntax` | Core operators, conditionals, type filters, error handling |
+| `syntax/string-filters` | String filters, encoding, and security filters |
+| `syntax/array-filters` | Array filters and array functions |