@xano/sdk 1.0.0

package/dist/node.js

@@ -0,0 +1,969 @@
+import {
+  secretsPhrase
+} from "./chunk-SAVJUS2X.js";
+import {
+  secretsCarriedBy
+} from "./chunk-45UIT5T2.js";
+import "./chunk-HRVBLCVJ.js";
+import "./chunk-YHEFQUQB.js";
+import {
+  authorFiles,
+  exportBundleJson,
+  loadDefault,
+  parseArgs,
+  readsFreeName,
+  resolveKnowledge,
+  run
+} from "./chunk-ETO6LGLD.js";
+import "./chunk-ZIY7RNUT.js";
+import {
+  classifyEnv,
+  declaredEnv,
+  parseEnvFile
+} from "./chunk-DAD3ONIS.js";
+import "./chunk-HHN734BU.js";
+import "./chunk-LPECSJ2J.js";
+import "./chunk-6NNTNXN7.js";
+import "./chunk-QCNYHBL7.js";
+import "./chunk-2ZUEE4EK.js";
+import "./chunk-AN6BL47T.js";
+import "./chunk-ET4Y4XCB.js";
+import "./chunk-SWBF2LTK.js";
+import "./chunk-UZ6QQWJT.js";
+import "./chunk-A3UDOZB6.js";
+import "./chunk-2MNLRIOX.js";
+import "./chunk-3M4LFYNQ.js";
+import "./chunk-AM4FKL4J.js";
+import "./chunk-Q325JKYB.js";
+import "./chunk-STSFNCY4.js";
+import "./chunk-I4F5TCJH.js";
+import {
+  allLandings
+} from "./chunk-5QU2P5CA.js";
+import "./chunk-ZYJP6BOO.js";
+import "./chunk-QO6BVGS5.js";
+import "./chunk-JZGVVJSI.js";
+import "./chunk-7G3CTU7I.js";
+import "./chunk-6PBR37LN.js";
+import "./chunk-T5KELPAR.js";
+import "./chunk-622HUCZT.js";
+import "./chunk-NAQDMEHV.js";
+import {
+  backendDirIn
+} from "./chunk-5A2PLKZB.js";
+import "./chunk-AHJWCYQO.js";
+import "./chunk-DX4QR4B2.js";
+import "./chunk-6QXLMMT3.js";
+import "./chunk-ZFDZKNGG.js";
+import "./chunk-FWD7AL6N.js";
+import "./chunk-2GNFDZA2.js";
+import "./chunk-JTUKLCXS.js";
+import "./chunk-4KHEMC32.js";
+import {
+  hostedFileResolver,
+  isMissingFile
+} from "./chunk-U64O2MXY.js";
+import {
+  projectRootFrom
+} from "./chunk-ROY4YAEQ.js";
+import {
+  readLockFile,
+  writeLockFile
+} from "./chunk-P2HAGF6H.js";
+import "./chunk-TLQE7ZN3.js";
+import "./chunk-WRBKLYSJ.js";
+import "./chunk-3LDULPRE.js";
+import "./chunk-XW6KISBB.js";
+import "./chunk-AWQ7BQTQ.js";
+import "./chunk-EUUUMY7J.js";
+import "./chunk-YLDALTWZ.js";
+import "./chunk-5FBYXK5P.js";
+import "./chunk-LLNZGEFK.js";
+import "./chunk-QXTKSOFI.js";
+import "./chunk-X2NL4KUO.js";
+import {
+  QUERY_AGGREGATE_NAMES,
+  QUERY_FILTER_NAMES,
+  QUERY_FILTER_SPECS,
+  defineFunction,
+  every,
+  fileUrl,
+  fl,
+  qf
+} from "./chunk-IGOLHKWF.js";
+import {
+  TEST_EXPECT_TYPES,
+  expect,
+  respond
+} from "./chunk-3KZCLN4Z.js";
+import "./chunk-OPHB5ORL.js";
+import "./chunk-UCQ2VUTG.js";
+import "./chunk-DGWHAVRG.js";
+import "./chunk-JGE7CAWB.js";
+import {
+  LocalFileNotFoundError
+} from "./chunk-PTHVMXZI.js";
+import {
+  compile
+} from "./chunk-MJ4ZVHKN.js";
+import {
+  actionCall,
+  actionPackageCall,
+  addon,
+  addonCall,
+  agent,
+  agentTrigger,
+  aiAgentRun,
+  apiCall,
+  arrayMap,
+  arrayUnion,
+  bitwiseAnd,
+  bitwiseOr,
+  bitwiseXor,
+  cloudJob,
+  cloudJobAwait,
+  cloudJobStatus,
+  comment,
+  createAuthToken,
+  debugLog,
+  die,
+  emit,
+  emitBundle,
+  errorTrigger,
+  expectToThrow,
+  forLoop,
+  foreachBreak,
+  foreachContinue,
+  foreachLoop,
+  foreachRemove,
+  functionCall,
+  functionRun,
+  getRawInput,
+  group,
+  ipLookup,
+  knowledge,
+  knowledgeDir,
+  knowledgeFile,
+  mathAdd,
+  mathDiv,
+  mathMul,
+  mathSub,
+  mcpServer,
+  mcpServerTrigger,
+  middleware,
+  middlewareCall,
+  objectEntries,
+  objectKeys,
+  objectValues,
+  postProcess,
+  prompt,
+  realtimeChannel,
+  realtimeChannelTrigger,
+  realtimeEvent,
+  realtimeMessage,
+  realtimeServer,
+  realtimeServerTrigger,
+  realtimeTrigger,
+  resource,
+  returnValue,
+  s,
+  serializeBundle,
+  setVar,
+  switchCase,
+  switchStatement,
+  tableTrigger,
+  task,
+  taskCall,
+  textAppend,
+  textPrepend,
+  tool,
+  toolCall,
+  triggerCall,
+  tryCatch,
+  updateVar,
+  whileLoop,
+  workflowTest,
+  workflowTestCall,
+  workspaceTrigger
+} from "./chunk-MXHSQOC4.js";
+import {
+  query,
+  test,
+  toSearchParams
+} from "./chunk-6IUMKYWI.js";
+import {
+  typedEnv,
+  workspaceConfig
+} from "./chunk-2CMJZDCL.js";
+import {
+  XANO_ORIGIN,
+  Xano,
+  workspace
+} from "./chunk-CTMO46PK.js";
+import "./chunk-ZDPP6RKB.js";
+import {
+  obj
+} from "./chunk-K5BBGTYZ.js";
+import "./chunk-LQCMKAJ7.js";
+import {
+  apiGroup,
+  cond,
+  dbAdd,
+  dbAddOrEdit,
+  dbBulkAdd,
+  dbBulkDelete,
+  dbBulkPatch,
+  dbBulkUpdate,
+  dbDel,
+  dbDirectQuery,
+  dbEdit,
+  dbExternalQuery,
+  dbGet,
+  dbHas,
+  dbIncrement,
+  dbPatch,
+  dbQuery,
+  dbSchema,
+  dbTransaction,
+  dbTruncate,
+  guard,
+  ignored,
+  microservice
+} from "./chunk-YGZHHAAB.js";
+import "./chunk-XVBGLISP.js";
+import "./chunk-6HO3NCSJ.js";
+import "./chunk-5V5XU32D.js";
+import {
+  isRepresentableName
+} from "./chunk-GSGDWJB5.js";
+import {
+  and,
+  cmp,
+  conditional,
+  expr,
+  mixed,
+  or,
+  seedFile,
+  table
+} from "./chunk-HVRUQXGD.js";
+import "./chunk-ERVIASGL.js";
+import "./chunk-4POWHT2K.js";
+import "./chunk-H2V3N23D.js";
+import {
+  SCAFFOLD_SECRETS_REMEDY,
+  documentationScopeFlagLabel
+} from "./chunk-3JDU4VRL.js";
+import "./chunk-WTPZRR4I.js";
+import "./chunk-UTI5G6OJ.js";
+import {
+  emitDiagnostic
+} from "./chunk-2EZ3ZJZZ.js";
+import {
+  createLockContext,
+  emptyLock,
+  mergeObserved,
+  serializeLock,
+  validateLockModel
+} from "./chunk-6MR5TI5V.js";
+import "./chunk-5ZSO4T2G.js";
+import {
+  hostedFile,
+  hostedIconOwners,
+  isHostedFile
+} from "./chunk-XNCP4KYO.js";
+import "./chunk-AKNCFVKZ.js";
+import {
+  annotate,
+  statements
+} from "./chunk-YU4HSQW7.js";
+import "./chunk-TFFGOFVZ.js";
+import "./chunk-L5JYN3NM.js";
+import "./chunk-G554NZNI.js";
+import {
+  f,
+  input
+} from "./chunk-N5GKCWE5.js";
+import {
+  LAMBDA_BINDINGS,
+  LAMBDA_CODE_FILTERS,
+  LAMBDA_GLOBALS,
+  LAMBDA_MODULE_GLOBALS,
+  LAMBDA_STATEMENTS,
+  assertLambdaBody,
+  auth,
+  c,
+  caught,
+  col,
+  decodeIdentifier,
+  decodeIdentifierEscapes,
+  env,
+  extractFunction,
+  filter,
+  inp,
+  lam,
+  lambdaSyntaxError,
+  lambdaValue,
+  out,
+  readFunction,
+  ref,
+  resp,
+  setting,
+  sys,
+  toolset,
+  withFilters
+} from "./chunk-OXA6PSZT.js";
+import {
+  SourceReader,
+  SourceShapeError,
+  lineOf,
+  maskNonCode,
+  tokenize
+} from "./chunk-VAX3UZOY.js";
+import "./chunk-NZOWWHU5.js";
+import {
+  getLockedCanonical,
+  getLockedGuid,
+  isLockSeeded,
+  resetLockOverrides,
+  seedLockOverrides,
+  seededLockSource
+} from "./chunk-4BW2SG2N.js";
+import "./chunk-TTEIYD5P.js";
+import "./chunk-CIMQZRRE.js";
+import "./chunk-OHX6MIUZ.js";
+import "./chunk-36JUQZVQ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/values/lambda-file.ts
+import { readFileSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+import { fileURLToPath } from "url";
+var PREFIX = "lam.file";
+var LOADER_FRAME = /[/\\]node_modules[/\\](?:\.pnpm[/\\][^/\\]+[/\\]node_modules[/\\])?(?:vite-node|vite|vitest|tsx|ts-node|jiti|esbuild-register|@esbuild-kit)[/\\]/;
+var SELF = fileURLToPath(import.meta.url);
+function stackFiles() {
+  const previous = Error.prepareStackTrace;
+  let sites;
+  try {
+    Error.prepareStackTrace = (_error, callSites) => callSites;
+    sites = new Error().stack;
+  } finally {
+    Error.prepareStackTrace = previous;
+  }
+  if (Array.isArray(sites)) {
+    return sites.slice(1).map((site) => site.getFileName() ?? site.getScriptNameOrSourceURL?.() ?? "").filter((file2) => typeof file2 === "string" && file2 !== "");
+  }
+  const files = [];
+  for (const line of String(typeof sites === "string" ? sites : new Error().stack ?? "").split("\n").slice(1)) {
+    const match = /\((.*?):\d+:\d+\)\s*$/.exec(line) ?? /at (.*?):\d+:\d+\s*$/.exec(line);
+    if (match?.[1] !== void 0) files.push(match[1]);
+  }
+  return files;
+}
+function callerDir() {
+  const frames = [];
+  for (const raw of stackFiles()) {
+    if (raw.startsWith("node:")) continue;
+    const path = raw.startsWith("file:") ? fileURLToPath(raw) : raw;
+    if (path === SELF) continue;
+    frames.push(path);
+  }
+  const authored = frames.find((p) => !LOADER_FRAME.test(p));
+  return dirname(authored ?? frames[0] ?? process.cwd());
+}
+function defaultExport(source, path) {
+  const reader = new SourceReader(tokenize(source));
+  const { toks } = reader;
+  const at = (k2) => `${path}:${lineOf(source, reader.offset(k2))}`;
+  let found;
+  let k = 0;
+  try {
+    while (k < toks.length) {
+      const t = toks[k];
+      if (reader.isP(k, ";")) {
+        k++;
+        continue;
+      }
+      if (t.kind === "string" && (reader.isP(k + 1, ";") || toks[k + 1] === void 0 || toks[k + 1].nl)) {
+        k++;
+        continue;
+      }
+      if (reader.isId(k, "export") && reader.isId(k + 1, "default")) {
+        if (found !== void 0) throw new Error(`${PREFIX}: ${at(k)} has more than one \`export default\`.`);
+        const first = k + 2;
+        const head = toks[first];
+        if (!(reader.isP(first, "(") || reader.isP(first, "<") || head?.kind === "id" && !reader.isId(first, "class"))) {
+          throw new Error(
+            `${PREFIX}: ${at(first)} default-exports something that is not a function. Export the lambda itself: \`export default ({ $this }: LambdaBindings<"map">) => \u2026\`.`
+          );
+        }
+        const { end } = parseDefault(reader, first, at);
+        found = [reader.offset(first), toks[end - 1].end];
+        k = end;
+        continue;
+      }
+      if (isTypeOnly(reader, k)) {
+        k = skipTypeOnly(reader, k);
+        continue;
+      }
+      if (reader.isId(k, "export")) {
+        throw new Error(
+          `${PREFIX}: ${at(k)} exports something besides its default. Only the default export's BODY is sent to the engine, so a second export is undefined at runtime \u2014 the engine returns that failure as diagnostic text in the value slot rather than as an error. A lambda module is one \`export default\` function and nothing else: move it inside that function.`
+        );
+      }
+      if (reader.isId(k, "import")) {
+        throw new Error(
+          `${PREFIX}: ${at(k)} imports a value at the top level, which the engine never resolves \u2014 only the default export's body is sent, so the import is undefined at runtime. Use \`import type\` for types, or reach a dependency through the PRELOADED globals, which need no specifier and are the only route that works on every instance: ${LAMBDA_MODULE_GLOBALS.join(", ")} (plus ${LAMBDA_GLOBALS.join(" / ")}, fetch, Buffer, TextEncoder). A scaffolded project's \`xano/lambdas/tsconfig.json\` declares them for the type checker (\`@xano/sdk/lambda-globals\`; keep it in a tsconfig of the lambdas' own, as its globals reach the whole program).`
+        );
+      }
+      let n = k;
+      if (reader.isId(n, "async")) n++;
+      const declared = /^(?:const|let|var|function|class|enum)$/.test(toks[n]?.text ?? "") && reader.isId(n + 1) ? toks[n + 1].text : t.text;
+      throw new Error(
+        `${PREFIX}: ${at(k)} declares \`${declared}\` at the top level, and only the default export's BODY is sent to the engine \u2014 anything beside it is undefined at runtime, and the engine returns that failure as diagnostic text in the value slot rather than as an error. Move it inside the default-exported function.`
+      );
+    }
+  } catch (e) {
+    if (e instanceof SourceShapeError) {
+      throw new Error(
+        `${PREFIX}: could not read ${path}:${lineOf(source, e.offset)} (${e.message}), so the default export's body cannot be located with certainty. A lambda module is one \`export default\` function \u2014 \`export default ({ $var }: \u2026) => \u2026\` or \`export default function ({ $var }: \u2026) { \u2026 }\` \u2014 plus type-only imports and declarations.`
+      );
+    }
+    throw e;
+  }
+  if (found === void 0) {
+    throw new Error(
+      `${PREFIX}: ${path} has no \`export default\`. A lambda module is one default-exported function whose first parameter destructures the bindings \u2014 \`export default ({ $this }: LambdaBindings<"map">) => \u2026\`.`
+    );
+  }
+  return found;
+}
+function assertNoSelfReference(exported, path) {
+  const name = readFunction(exported, `${PREFIX}: ${path}`).name;
+  if (name === void 0) return;
+  if (!readsFreeName(maskNonCode(decodeIdentifierEscapes(exported)), decodeIdentifier(name))) return;
+  throw new Error(
+    `${PREFIX}: ${path} default-exports \`function ${name}\` and reads \`${name}\` inside it, but only the function's BODY is sent to the engine \u2014 the name is not bound at runtime, so the reference is undefined there. For recursion, declare a helper inside the body (\`const walk = (node) => \u2026walk(child)\u2026\`) and call it.`
+  );
+}
+function parseDefault(reader, first, at) {
+  const { end } = reader.parseFunctionExpression(first);
+  const next = reader.toks[end];
+  const declaration = reader.isId(first, "function") || reader.isId(first, "async") && reader.isId(first + 1, "function");
+  if (next === void 0 || reader.isP(end, ";") || declaration) return { end };
+  if (next.nl && !reader.continues(next)) return { end };
+  throw new Error(
+    `${PREFIX}: ${at(end)} default-exports an expression that continues past the function (\`${next.text}\`), so what is exported is not the function itself. Export the lambda itself: \`export default ({ $this }: LambdaBindings<"map">) => \u2026\`.`
+  );
+}
+function isTypeOnly(reader, k) {
+  const n = reader.isId(k, "export") ? k + 1 : k;
+  if (reader.isId(n, "interface") && reader.isId(n + 1)) return true;
+  if (reader.isId(n, "type") && (reader.isId(n + 1) || reader.isP(n + 1, "{") || reader.isP(n + 1, "*"))) return true;
+  if (n === k && reader.isId(k, "declare") && !reader.toks[k + 1]?.nl) return true;
+  if (n !== k || !reader.isId(k, "import")) return false;
+  if (reader.isId(k + 1, "type") && !(reader.isId(k + 2, "from") && reader.toks[k + 3]?.kind === "string")) return true;
+  if (!reader.isP(k + 1, "{")) return false;
+  const close = reader.close(k + 1);
+  const specifiers = [[]];
+  for (let j = k + 2; j < close; j++) {
+    if (reader.isP(j, ",")) specifiers.push([]);
+    else specifiers[specifiers.length - 1].push(j);
+  }
+  const named = specifiers.filter((s2) => s2.length > 0);
+  return named.length > 0 && named.every((s2) => reader.isId(s2[0], "type") && s2.length > 1);
+}
+function skipTypeOnly(reader, k) {
+  let n = reader.isId(k, "export") ? k + 1 : k;
+  if (reader.isId(n, "type") && reader.isId(n + 1) && (reader.isP(n + 2, "=") || reader.isP(n + 2, "<"))) {
+    n += 2;
+    if (reader.isP(n, "<")) n = reader.skipAngle(n);
+    if (!reader.isP(n, "=")) reader.fail("a type alias without `=`", n);
+    n = reader.skipType(n + 1);
+    return reader.isP(n, ";") ? n + 1 : n;
+  }
+  if (reader.isId(n, "interface")) {
+    n += 2;
+    if (reader.isP(n, "<")) n = reader.skipAngle(n);
+    if (reader.isId(n, "extends")) {
+      n = reader.skipType(n + 1, true);
+      while (reader.isP(n, ",")) n = reader.skipType(n + 1, true);
+    }
+    if (!reader.isP(n, "{")) reader.fail("an interface without a body", n);
+    return reader.close(n) + 1;
+  }
+  return reader.statementEnd(k);
+}
+function file(path, opts) {
+  const resolved = isAbsolute(path) ? path : resolve(callerDir(), path);
+  let source;
+  try {
+    source = readFileSync(resolved, "utf8");
+  } catch (err) {
+    throw new (isMissingFile(err) ? LocalFileNotFoundError : Error)(
+      `${PREFIX}: ${isMissingFile(err) ? "no file at" : "cannot read"} ${resolved} (resolved from ${JSON.stringify(path)}, relative to the calling module rather than the working directory).`
+    );
+  }
+  const [start, end] = defaultExport(source, resolved);
+  const exported = source.slice(start, end);
+  assertNoSelfReference(exported, resolved);
+  const { body, captureReads } = extractFunction(exported, `${PREFIX}: ${resolved}`);
+  assertBodyParses(body, source, start + readFunction(exported, `${PREFIX}: ${resolved}`).body[0], resolved);
+  return lambdaValue(body, opts, `${PREFIX}(${path})`, false, captureReads);
+}
+function assertBodyParses(body, source, bodyStart, path) {
+  const error = lambdaSyntaxError(body);
+  if (error === void 0) return;
+  const first = bodyStart + Math.max(source.slice(bodyStart).search(/\S/), 0);
+  const line = lineOf(source, first) + error.line - 1;
+  const text = source.split("\n")[line - 1] ?? error.lineText;
+  throw new Error(
+    `${PREFIX}: ${path}:${line}: the lambda body does not parse \u2014 ${error.message} (\`${text.trim()}\`). A body that does not parse cannot run.`
+  );
+}
+var lam2 = { ...lam, file };
+
+// src/emit/write.ts
+import { accessSync, chmodSync, constants, existsSync, mkdirSync, realpathSync, statSync, writeFileSync } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join, relative, resolve as resolve2 } from "path";
+function writeArtifact(fn, path, opts = {}) {
+  writeFileSync(path, emit(fn, opts) + "\n", "utf8");
+}
+function writeBundle(xano, path, opts = {}) {
+  const declared = declaredEnv(xano.workspaceSettings());
+  const fileValues = opts.envFile !== void 0 ? parseEnvFile(opts.envFile, "writeBundle envFile") : {};
+  const badNames = [...declared.map((e) => e.name), ...Object.keys(fileValues), ...Object.keys(opts.env ?? {})].filter(
+    (n) => !isRepresentableName(n)
+  );
+  if (badNames.length > 0) {
+    throw new Error(
+      `writeBundle: ${[...new Set(badNames)].map((n) => JSON.stringify(n)).join(", ")} ${badNames.length === 1 ? "is not a usable env var name" : "are not usable env var names"}. A name is letters, digits and \`_\`, and does not start with a digit (e.g. STRIPE_KEY).`
+    );
+  }
+  const env2 = classifyEnv({
+    fileValues,
+    flagValues: { ...opts.env ?? {} },
+    declaredNames: declared.map((e) => e.name),
+    declaredValues: Object.fromEntries(declared.map((e) => [e.name, e.value]))
+  });
+  const docs = resolveDocumentationTokens(xano, opts);
+  const registry = authorFiles(originOf(xano))[0];
+  const lock = openLock(opts.lock, {
+    out: path,
+    ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
+    authored: [authorFiles(new Error())[0], registry].filter((f2) => f2 !== void 0),
+    ...registry !== void 0 ? { registry } : {},
+    strict: opts.strict === true
+  });
+  const bundle = xano.export({
+    ...lock !== void 0 ? { lock: lock.ctx } : {},
+    ...opts.strict !== void 0 ? { strict: opts.strict } : {},
+    knowledge: resolveKnowledge(xano.knowledge()),
+    hostedFiles: hostedFileResolver(),
+    ...Object.keys(env2.values).length > 0 ? { envOverrides: env2.values } : {},
+    documentationTokens: docs.values,
+    ...docs.allowEmpty.size > 0 ? { allowEmptyDocToken: docs.allowEmpty } : {},
+    secretsRemedy: WRITE_BUNDLE_REMEDY
+  });
+  if (env2.clearing.length > 0) {
+    const one = env2.clearing.length === 1;
+    const message = `writeBundle: ${one ? "declared env var" : "declared env vars"} ${env2.clearing.join(", ")} ${one ? "has" : "have"} no value, so this bundle clears ${one ? "it" : "them"} if it is imported. Pass \`env: { NAME: "value" }\` or \`envFile: ${JSON.stringify(shownPath(join(lock !== void 0 ? dirname2(lock.path) : backendDirIn(projectRootFrom(registry !== void 0 ? dirname2(registry) : process.cwd())), ".env")))}\`.`;
+    if (opts.strict === true) throw new Error(message);
+    emitDiagnostic({ severity: "warning", code: "workspace-env.unsupplied", message });
+  }
+  if (env2.additions.length > 0) {
+    const one = env2.additions.length === 1;
+    const message = `writeBundle: env ${env2.additions.join(", ")} ${one ? "is" : "are"} not declared in \`workspaceConfig({ env })\` and will be ADDED if this bundle is imported. Declare ${one ? "it" : "them"} there with an empty value; if this is a typo, this is the only place you will see it.`;
+    if (opts.strict === true) throw new Error(message);
+    emitDiagnostic({ severity: "warning", code: "workspace-env.undeclared", message });
+  }
+  const owners = hostedIconOwners(bundle.payload ?? {});
+  if (owners.length > 0) {
+    emitDiagnostic({
+      severity: "warning",
+      code: "export.hosted-files-omitted",
+      message: `writeBundle: the bundle names hostedFile() icons whose files it does not carry: ${owners.join(", ")}. Deploying the file is refused; \`xanosdk deploy <entry>\` ships the files.`
+    });
+  }
+  prepareBundlePath(path);
+  if (lock !== void 0) lock.commit();
+  writeBundleFile(path, serializeBundle(bundle, opts) + "\n", secretsCarriedBy(bundle));
+}
+function originOf(xano) {
+  const origin = xano[XANO_ORIGIN];
+  return origin instanceof Error ? origin : new Error();
+}
+function prepareBundlePath(path) {
+  const dir = dirname2(resolve2(path));
+  try {
+    mkdirSync(dir, { recursive: true });
+    accessSync(existsSync(path) ? path : dir, constants.W_OK);
+  } catch (err) {
+    throw new Error(
+      `writeBundle: cannot write ${path} \u2014 ${err.message}. Pass a path in a directory you can write.`
+    );
+  }
+}
+var WRITE_BUNDLE_REMEDY = {
+  ...SCAFFOLD_SECRETS_REMEDY,
+  supply: (scope) => `documentationTokens: { ${JSON.stringify(scope)}: "<value>" }`,
+  allowEmpty: (scope) => `allowEmptyDocToken: [${JSON.stringify(scope)}]`
+};
+function resolveDocumentationTokens(xano, opts) {
+  const declared = xano.documentationTokenNames();
+  const labelOf = (d) => documentationScopeFlagLabel(d.scope);
+  const keyFor = (scope, option) => {
+    const byKey = declared.find((d) => d.key === scope);
+    if (byKey !== void 0) return byKey.key;
+    const ws = declared.find((d) => d.scope.kind === "workspace");
+    if (scope === "workspace" && ws !== void 0) return ws.key;
+    const groups2 = declared.filter((d) => d.scope.kind === "api_group" && labelOf(d) === scope);
+    if (groups2.length === 1) return groups2[0].key;
+    if (groups2.length > 1) {
+      throw new Error(
+        `writeBundle: \`${option}\` scope ${JSON.stringify(scope)} names ${groups2.length} API groups \u2014 use the key for the one you mean: ${groups2.map((d) => JSON.stringify(d.key)).join(", ")}.`
+      );
+    }
+    const known = [...new Set(declared.map(labelOf))];
+    throw new Error(
+      `writeBundle: \`${option}\`: no documentation gate is declared for ${JSON.stringify(scope)}.` + (known.length === 0 ? ` This workspace declares none \u2014 a gate is \`documentation: { require_token: true }\`.` : ` Declared: ${known.map((n) => JSON.stringify(n)).join(", ")}.`)
+    );
+  };
+  const values = /* @__PURE__ */ Object.create(null);
+  for (const [scope, value] of Object.entries(opts.documentationTokens ?? {})) {
+    if (value === void 0) continue;
+    const key = keyFor(scope, "documentationTokens");
+    if (typeof value !== "string" || value.trim() === "") {
+      throw new Error(
+        `writeBundle: \`documentationTokens\` ${JSON.stringify(scope)} is ${typeof value === "string" ? "empty" : `${value === null ? "null" : typeof value}, not a string`}. An empty value is refused: to clear a gate on purpose, say so with \`allowEmptyDocToken: [${JSON.stringify(scope)}]\`.`
+      );
+    }
+    values[key] = value;
+  }
+  const allowEmpty = new Set((opts.allowEmptyDocToken ?? []).map((scope) => keyFor(scope, "allowEmptyDocToken")));
+  const cleared = declared.filter((d) => !Object.hasOwn(values, d.key) && allowEmpty.has(d.key));
+  if (cleared.length > 0) {
+    emitDiagnostic({
+      severity: "warning",
+      code: "doc-token.cleared",
+      message: `writeBundle: documentation tokens for ${cleared.map((d) => JSON.stringify(labelOf(d))).join(", ")} are sent EMPTY (allowEmptyDocToken). Whatever gate the target holds for ${cleared.length === 1 ? "that doc site" : "those doc sites"} is cleared, and its docs become publicly readable.`
+    });
+  }
+  const unsupplied = declared.filter((d) => d.gated && !Object.hasOwn(values, d.key) && !allowEmpty.has(d.key));
+  if (unsupplied.some((d) => d.scope.kind === "workspace")) {
+    emitDiagnostic({
+      severity: "warning",
+      code: "doc-token.unsupplied",
+      message: `writeBundle: the workspace declares a documentation gate and no token was supplied; no \`documentation\` key is emitted, so this bundle leaves the workspace's gate as it is rather than clearing it \u2014 and cannot restore it either.`
+    });
+  }
+  const groups = unsupplied.filter((d) => d.scope.kind === "api_group" && !d.published);
+  if (groups.length > 0) {
+    const one = groups.length === 1;
+    emitDiagnostic({
+      severity: "warning",
+      code: "doc-token.unsupplied",
+      message: `writeBundle: ${groups.map((d) => JSON.stringify(labelOf(d))).join(", ")} ${one ? "declares" : "declare"} a documentation gate with no token. A group's \`documentation\` key is written as the engine default when it is absent, so these bytes CLEAR that gate on import. ${one ? "That group does" : "Those groups do"} not publish docs (\`swagger\` is off), so nothing is exposed. Pass \`documentationTokens: { ${JSON.stringify(labelOf(groups[0]))}: "<value>" }\`.`
+    });
+  }
+  return { values, allowEmpty };
+}
+function writeBundleFile(path, content, secrets) {
+  if (secrets.length === 0) {
+    writeFileSync(path, content, "utf8");
+    return;
+  }
+  writeFileSync(path, content, { encoding: "utf8", mode: 384 });
+  if (!statSync(path).isFile()) return;
+  chmodSync(path, 384);
+  emitDiagnostic({
+    severity: "warning",
+    code: "secrets.cleartext-export",
+    message: `${path} carries ${secretsPhrase(secrets)} in cleartext \u2014 written owner-only (0600); do not commit it.`
+  });
+}
+function openLock(option, hints) {
+  const discovered = join(backendDirIn(projectRootFrom(process.cwd())), "xano.lock");
+  if (option === false) {
+    if (existsSync(discovered) && parses(discovered)) {
+      throw new Error(
+        `writeBundle: \`lock: false\` refused \u2014 ${shownPath(discovered)} pins this project's identities, and building without it derives guids from names, so every object it pins under another guid is deleted and recreated wherever the bundle lands. Drop \`lock: false\`, or delete the lock if you mean to abandon those identities.`
+      );
+    }
+    return void 0;
+  }
+  if (option !== void 0 && !existsSync(dirname2(resolve2(option)))) {
+    const dir = relative(process.cwd(), dirname2(resolve2(option))) || dirname2(resolve2(option));
+    throw new Error(
+      `writeBundle: \`lock: ${JSON.stringify(option)}\`: ${dir}/ doesn't exist \u2014 create it, or pass a \`lock\` path in an existing directory.`
+    );
+  }
+  const lockPath = option !== void 0 ? resolve2(option) : defaultLockPath(discovered, hints);
+  if (lockPath === void 0) return void 0;
+  const exists = existsSync(lockPath);
+  const model = exists ? readLockFile(lockPath) : emptyLock();
+  assertSeeded(model, lockPath);
+  const original = exists ? serializeLock(model) : void 0;
+  const ctx = createLockContext(model);
+  const landingsDir = lockPath === discovered ? process.cwd() : projectRootFrom(dirname2(lockPath));
+  return {
+    path: lockPath,
+    ctx,
+    commit: () => {
+      const landed = new Set(allLandings(landingsDir, model).flatMap(([, record]) => Object.values(record).map((e) => e.guid)));
+      const { lock: merged } = mergeObserved(model, ctx.observed, { landedGuids: landed });
+      validateLockModel(merged, lockPath, ctx.observed);
+      if (!exists && Object.keys(merged.objects).length === 0) return;
+      if (serializeLock(merged) !== original) writeLockFile(lockPath, merged);
+    }
+  };
+}
+function defaultLockPath(discovered, hints) {
+  const seeded = seededLockSource();
+  if (seeded !== void 0) {
+    if (existsSync(discovered) && !samePath(discovered, seeded)) {
+      throw new Error(
+        `writeBundle: the seeded lock is ${shownPath(seeded)}, but the cwd's project has ${shownPath(discovered)} \u2014 pass \`lock: ${JSON.stringify(shownPath(seeded))}\` to name the one this bundle builds against.`
+      );
+    }
+    return seeded;
+  }
+  const origin = hints.registry !== void 0 ? [join(dirname2(hints.registry), "xano.lock"), join(backendDirIn(projectRootFrom(dirname2(hints.registry))), "xano.lock")] : [];
+  const originLock = origin.find((p) => existsSync(p));
+  if (existsSync(discovered)) {
+    if (originLock !== void 0 && !samePath(originLock, discovered)) {
+      throw new Error(
+        `writeBundle: the registry was created in the project of ${shownPath(originLock)}, but the cwd's project has ${shownPath(discovered)} \u2014 pass \`lock: ${JSON.stringify(shownPath(originLock))}\` to name the one this bundle builds against.`
+      );
+    }
+    return discovered;
+  }
+  const elsewhere = hints.registry !== void 0 && !samePath(projectRootFrom(dirname2(hints.registry)), projectRootFrom(process.cwd()));
+  if (existsSync(dirname2(discovered)) && !elsewhere) return discovered;
+  const nearby = [
+    ...hints.envFile !== void 0 ? [join(dirname2(resolve2(hints.envFile)), "xano.lock"), join(backendDirIn(projectRootFrom(dirname2(resolve2(hints.envFile)))), "xano.lock")] : [],
+    join(backendDirIn(projectRootFrom(dirname2(resolve2(hints.out)))), "xano.lock"),
+    ...hints.authored.flatMap((file2) => [join(dirname2(file2), "xano.lock"), join(backendDirIn(projectRootFrom(dirname2(file2))), "xano.lock")])
+  ].find((p) => existsSync(p));
+  if (nearby !== void 0) return nearby;
+  if (isLockSeeded()) {
+    throw new Error(
+      `writeBundle: a lock is seeded, but no \`xano.lock\` was found from the cwd (${process.cwd()}) \u2014 it is not inside a project with a backend directory. Pass \`lock: "<path>/xano.lock"\` (the file you seeded).`
+    );
+  }
+  const message = `writeBundle: built without a lock \u2014 no \`xano.lock\` was found from the cwd (${process.cwd()}), the output path, \`envFile\`, or the modules that built the registry and called this. Nothing pins identities: guids are derived from names, so a renamed object lands as a new one. Pass \`lock: "<path>/xano.lock"\` to build against one, or \`lock: false\` to build without one on purpose.`;
+  if (hints.strict) throw new Error(message);
+  emitDiagnostic({ severity: "warning", code: "lock.not-found", message });
+  return void 0;
+}
+function samePath(a, b) {
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return resolve2(a) === resolve2(b);
+  }
+}
+function assertSeeded(lock, lockPath) {
+  const unseeded = Object.entries(lock.objects).some(
+    ([key, e]) => !isLockSeeded() || e.guid !== void 0 && getLockedGuid(key) !== e.guid || e.canonical !== void 0 && getLockedCanonical(key) !== e.canonical
+  );
+  if (!unseeded) return;
+  const shown = shownPath(lockPath);
+  throw new Error(
+    `writeBundle: ${shown} pins this project's identities, but it was not seeded before the workspace module loaded, so the bundle would carry name-derived guids. Seed it first \u2014 \`seedLockOverrides(readLockFile(${JSON.stringify(shown)}))\`, then import the entry \u2014 or run \`xanosdk export <entry> --out <path>\`.`
+  );
+}
+function shownPath(path) {
+  for (const p of [path, realOrSelf(path)]) {
+    const rel = relative(process.cwd(), p);
+    if (rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel)) return rel;
+  }
+  return path;
+}
+function realOrSelf(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    try {
+      return join(realpathSync(dirname2(path)), path.slice(dirname2(path).length + 1));
+    } catch {
+      return path;
+    }
+  }
+}
+function parses(lockPath) {
+  try {
+    readLockFile(lockPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+export {
+  LAMBDA_BINDINGS,
+  LAMBDA_CODE_FILTERS,
+  LAMBDA_GLOBALS,
+  LAMBDA_MODULE_GLOBALS,
+  LAMBDA_STATEMENTS,
+  QUERY_AGGREGATE_NAMES,
+  QUERY_FILTER_NAMES,
+  QUERY_FILTER_SPECS,
+  TEST_EXPECT_TYPES,
+  Xano,
+  actionCall,
+  actionPackageCall,
+  addon,
+  addonCall,
+  agent,
+  agentTrigger,
+  aiAgentRun,
+  and,
+  annotate,
+  apiCall,
+  apiGroup,
+  arrayMap,
+  arrayUnion,
+  assertLambdaBody,
+  auth,
+  bitwiseAnd,
+  bitwiseOr,
+  bitwiseXor,
+  c,
+  caught,
+  cloudJob,
+  cloudJobAwait,
+  cloudJobStatus,
+  cmp,
+  col,
+  comment,
+  compile,
+  cond,
+  conditional,
+  createAuthToken,
+  dbAdd,
+  dbAddOrEdit,
+  dbBulkAdd,
+  dbBulkDelete,
+  dbBulkPatch,
+  dbBulkUpdate,
+  dbDel,
+  dbDirectQuery,
+  dbEdit,
+  dbExternalQuery,
+  dbGet,
+  dbHas,
+  dbIncrement,
+  dbPatch,
+  dbQuery,
+  dbSchema,
+  dbTransaction,
+  dbTruncate,
+  debugLog,
+  defineFunction,
+  die,
+  emit,
+  emitBundle,
+  env,
+  errorTrigger,
+  every,
+  expect,
+  expectToThrow,
+  exportBundleJson,
+  expr,
+  f,
+  fileUrl,
+  filter,
+  fl,
+  forLoop,
+  foreachBreak,
+  foreachContinue,
+  foreachLoop,
+  foreachRemove,
+  functionCall,
+  functionRun,
+  getRawInput,
+  group,
+  guard,
+  hostedFile,
+  ignored,
+  inp,
+  input,
+  ipLookup,
+  isHostedFile,
+  knowledge,
+  knowledgeDir,
+  knowledgeFile,
+  lam2 as lam,
+  loadDefault,
+  mathAdd,
+  mathDiv,
+  mathMul,
+  mathSub,
+  mcpServer,
+  mcpServerTrigger,
+  microservice,
+  middleware,
+  middlewareCall,
+  mixed,
+  obj,
+  objectEntries,
+  objectKeys,
+  objectValues,
+  or,
+  out,
+  parseArgs,
+  postProcess,
+  prompt,
+  qf,
+  query,
+  readLockFile,
+  realtimeChannel,
+  realtimeChannelTrigger,
+  realtimeEvent,
+  realtimeMessage,
+  realtimeServer,
+  realtimeServerTrigger,
+  realtimeTrigger,
+  ref,
+  resetLockOverrides,
+  resource,
+  resp,
+  respond,
+  returnValue,
+  run,
+  s,
+  seedFile,
+  seedLockOverrides,
+  setVar,
+  setting,
+  statements,
+  switchCase,
+  switchStatement,
+  sys,
+  table,
+  tableTrigger,
+  task,
+  taskCall,
+  test,
+  textAppend,
+  textPrepend,
+  toSearchParams,
+  tool,
+  toolCall,
+  toolset,
+  triggerCall,
+  tryCatch,
+  typedEnv,
+  updateVar,
+  whileLoop,
+  withFilters,
+  workflowTest,
+  workflowTestCall,
+  workspace,
+  workspaceConfig,
+  workspaceTrigger,
+  writeArtifact,
+  writeBundle,
+  writeLockFile
+};
+//# sourceMappingURL=node.js.map