@xano/sdk 1.0.0

package/dist/chunk-6MR5TI5V.js

@@ -0,0 +1,987 @@
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+import {
+  isPrivateLibraryRow
+} from "./chunk-XNCP4KYO.js";
+import {
+  REFERENCEABLE_KIND_PAYLOAD_KEYS,
+  rawDeriveGuid
+} from "./chunk-NZOWWHU5.js";
+import {
+  getLockedGuid
+} from "./chunk-4BW2SG2N.js";
+import {
+  randomBytes
+} from "./chunk-OHX6MIUZ.js";
+import {
+  article,
+  withArticle
+} from "./chunk-36JUQZVQ.js";
+
+// src/util/sdk-kind.ts
+var SDK_KIND_BY_PAYLOAD_KEY = {
+  dbo: "table",
+  app: "apiGroup",
+  workflow_test: "workflowTest",
+  realtime_server: "realtimeServer",
+  channel: "realtimeChannel",
+  message: "realtimeMessage"
+};
+var TRIGGER_FACTORY = {
+  database: "tableTrigger",
+  workspace_realtime_channel: "realtimeTrigger",
+  realtime_server: "realtimeServerTrigger",
+  channel: "realtimeChannelTrigger",
+  workspace: "workspaceTrigger",
+  error: "errorTrigger"
+};
+function sdkKindName(payloadKey, row) {
+  if (payloadKey === "toolset" && row !== void 0) return row.type === "agent" ? "agent" : "mcpServer";
+  if (payloadKey === "trigger" && typeof row?.obj_type === "string" && Object.hasOwn(TRIGGER_FACTORY, row.obj_type)) {
+    return TRIGGER_FACTORY[row.obj_type];
+  }
+  return (Object.hasOwn(SDK_KIND_BY_PAYLOAD_KEY, payloadKey) ? SDK_KIND_BY_PAYLOAD_KEY[payloadKey] : void 0) ?? payloadKey;
+}
+var PAYLOAD_KEY_BY_SDK_KIND = {
+  ...Object.fromEntries(Object.entries(SDK_KIND_BY_PAYLOAD_KEY).map(([key, kind]) => [kind, key])),
+  mcpServer: "toolset",
+  agent: "toolset"
+};
+
+// src/lock/lock.ts
+var LOCK_VERSION = 1;
+var WORKSPACE_KEY = "workspace";
+var RETIRED_KEYS = /* @__PURE__ */ new Map([
+  [
+    "workspace:realtime",
+    "the legacy workspace-level realtime block is no longer modelled; realtime servers and channels lock under their own keys"
+  ]
+]);
+var LOCK_PAYLOAD_KEYS = new Set(Object.values(REFERENCEABLE_KIND_PAYLOAD_KEYS));
+var CANONICAL_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["app", "toolset", "realtime_server"]);
+function sdkKindName2(payloadKey) {
+  return sdkKindName(payloadKey);
+}
+function acceptedLockKinds() {
+  return [
+    ...new Set([...LOCK_PAYLOAD_KEYS].flatMap((key) => key === "toolset" ? ["mcpServer", "agent"] : [sdkKindName2(key)]))
+  ];
+}
+function toolsetKindsFromPayload(payload, lock) {
+  const kinds = lock === void 0 ? /* @__PURE__ */ new Map() : toolsetKindsFromLock(lock);
+  const rows = payload?.toolset;
+  if (!Array.isArray(rows)) return kinds;
+  for (const row of rows) {
+    if (!row || typeof row !== "object") continue;
+    const { name, type } = row;
+    if (typeof name === "string") kinds.set(name, type === "agent" ? "agent" : "mcpServer");
+  }
+  return kinds;
+}
+function toolsetKindsFromLock(objects) {
+  const kinds = /* @__PURE__ */ new Map();
+  for (const [key, entry] of Object.entries(objects)) {
+    if (key.startsWith("toolset:")) kinds.set(key.slice("toolset:".length), entry.type === "agent" ? "agent" : "mcpServer");
+  }
+  return kinds;
+}
+function displayLockKey(key, toolsetKinds) {
+  const colon = key.indexOf(":");
+  if (colon <= 0) return key;
+  const payloadKey = key.slice(0, colon);
+  if (!LOCK_PAYLOAD_KEYS.has(payloadKey)) return key;
+  const name = key.slice(colon + 1);
+  const kind = payloadKey === "toolset" ? toolsetKinds?.get(name) ?? "mcpServer" : sdkKindName2(payloadKey);
+  return `${kind}:${name}`;
+}
+function fileSpellingNote(keys) {
+  const pairs = /* @__PURE__ */ new Map();
+  for (const key of keys) {
+    const colon = key.indexOf(":");
+    if (colon <= 0) continue;
+    const payloadKey = key.slice(0, colon);
+    if (!LOCK_PAYLOAD_KEYS.has(payloadKey)) continue;
+    const sdk = payloadKey === "toolset" ? "agent/mcpServer" : sdkKindName2(payloadKey);
+    if (sdk !== payloadKey) pairs.set(sdk, payloadKey);
+  }
+  if (pairs.size === 0) return "";
+  return ` (xano.lock spells ${[...pairs].map(([sdk, file]) => `${sdk} as "${file}:"`).join(", ")})`;
+}
+function resolvePayloadKey(kindOrPayloadKey) {
+  if (LOCK_PAYLOAD_KEYS.has(kindOrPayloadKey)) return kindOrPayloadKey;
+  const key = (Object.hasOwn(PAYLOAD_KEY_BY_SDK_KIND, kindOrPayloadKey) ? PAYLOAD_KEY_BY_SDK_KIND[kindOrPayloadKey] : void 0) ?? (Object.hasOwn(REFERENCEABLE_KIND_PAYLOAD_KEYS, kindOrPayloadKey) ? REFERENCEABLE_KIND_PAYLOAD_KEYS[kindOrPayloadKey] : void 0);
+  if (key === void 0) {
+    throw new UnknownLockKindError(
+      `Unknown object kind "${kindOrPayloadKey}". Expected one of: ${acceptedLockKinds().join(", ")}.`
+    );
+  }
+  return key;
+}
+var UnknownLockKindError = class extends Error {
+};
+var LockEntryNotFoundError = class extends Error {
+  name = "LockEntryNotFoundError";
+  /** A named thing that is not there, like every other: `SDK_ERROR`, exit 8. */
+  code = "SDK_ERROR";
+  exitCode = 8;
+  /** The key the reader most likely meant, when one is near — the `--json` failure's `suggestion`. */
+  suggestion;
+  constructor(message, opts = {}) {
+    super(message);
+    this.suggestion = opts.suggestion;
+  }
+};
+var LockRenameConflictError = class extends Error {
+  constructor(message, keys) {
+    super(message);
+    this.keys = keys;
+  }
+  keys;
+  name = "LockRenameConflictError";
+  exitCode = 2;
+};
+var LockImportConflictError = class extends Error {
+  name = "LockImportConflictError";
+  exitCode = 2;
+  /**
+   * The same-kind guid clash behind this refusal, when it is one: which name the
+   * bundle carries the guid under and which the lock pins it to. Only the
+   * workspace source can say which side renamed, so the command that has the
+   * source words the remedy from this.
+   */
+  clash;
+  constructor(message, opts = {}) {
+    super(message);
+    this.clash = opts.clash;
+  }
+};
+function normalizeLockKey(key) {
+  const colon = key.indexOf(":");
+  if (colon <= 0) return key;
+  const kind = key.slice(0, colon);
+  if (LOCK_PAYLOAD_KEYS.has(kind)) return key;
+  const payloadKey = (Object.hasOwn(PAYLOAD_KEY_BY_SDK_KIND, kind) ? PAYLOAD_KEY_BY_SDK_KIND[kind] : void 0) ?? (Object.hasOwn(REFERENCEABLE_KIND_PAYLOAD_KEYS, kind) ? REFERENCEABLE_KIND_PAYLOAD_KEYS[kind] : void 0);
+  return payloadKey === void 0 ? key : `${payloadKey}${key.slice(colon)}`;
+}
+function lockKey(payloadKey, name) {
+  return `${payloadKey}:${name}`;
+}
+function codePinnedTables(bundle, lock, classified) {
+  const out = /* @__PURE__ */ new Map();
+  const payload = bundle?.payload;
+  const rows = payload !== null && typeof payload === "object" ? payload.dbo : void 0;
+  for (const r of Array.isArray(rows) ? rows : []) {
+    const row = r;
+    if (typeof row?.name !== "string" || typeof row.guid !== "string" || row.guid === "") continue;
+    const key = lockKey("dbo", row.name);
+    const entry = lock.objects[key];
+    const merged = classified?.objects[key];
+    const held = entry?.guid;
+    const source = merged ?? entry;
+    const marked = source?.guid_source === "code" && source.guid === row.guid;
+    if (!marked && row.guid === (held ?? rawDeriveGuid(key))) continue;
+    const replaces = [
+      .../* @__PURE__ */ new Set([...held !== void 0 && held !== row.guid ? [held] : [], ...entry?.replaced ?? [], ...merged?.replaced ?? []])
+    ].filter((g) => g !== row.guid);
+    out.set(row.name, { guid: row.guid, ...replaces.length > 0 ? { replaces } : {} });
+  }
+  return out;
+}
+function lockNameForObject(payloadKey, obj, appNameByGuid) {
+  if (payloadKey === "channel" || payloadKey === "message") {
+    const parts = [parentName(obj.server, appNameByGuid)];
+    if (payloadKey === "message") parts.push(parentName(obj.channel, appNameByGuid));
+    return [...parts, obj.name].join("|");
+  }
+  if (payloadKey !== "query") return obj.name;
+  const verb = typeof obj.verb === "string" ? obj.verb : "";
+  const appId = obj.app?.id;
+  let group = "";
+  if (typeof appId === "string" && appId !== "") {
+    group = appNameByGuid.get(appId) ?? appId;
+  } else if (typeof appId === "number" && appId !== 0) {
+    group = `#${appId}`;
+  }
+  return [group, verb, obj.name].join("|");
+}
+function parentName(ref, names) {
+  const id = ref?.id;
+  if (typeof id === "string" && id !== "") return names.get(id) ?? id;
+  return typeof id === "number" && id !== 0 ? `#${id}` : "";
+}
+function identityNamesByGuid(sections) {
+  const map = appNamesByGuid(sections["app"]);
+  for (const key of ["realtime_server", "channel"]) {
+    for (const [guid, name] of appNamesByGuid(sections[key])) map.set(guid, name);
+  }
+  return map;
+}
+function appNamesByGuid(appSection) {
+  const map = /* @__PURE__ */ new Map();
+  if (!Array.isArray(appSection)) return map;
+  for (const row of appSection) {
+    if (!row || typeof row !== "object") continue;
+    const { name, guid } = row;
+    if (typeof name === "string" && typeof guid === "string" && guid !== "") {
+      map.set(guid, name);
+    }
+  }
+  return map;
+}
+var CANONICAL_SOURCES = /* @__PURE__ */ new Set(["code", "minted", "adopted"]);
+var DESTINATION_KEY = /^[^/\s]+\/(?:workspace\/[1-9]\d*|tenant\/[^/\s]+)$/;
+var EPHEMERAL_DESTINATION_KEY = /^[^/\s]+\/ephemeral\/[^/\s]+$/;
+function emptyLock() {
+  return { version: LOCK_VERSION, objects: {} };
+}
+function withObjects(lock, objects) {
+  return lock.landed !== void 0 && Object.keys(lock.landed).length > 0 ? { version: lock.version, objects, landed: lock.landed } : { version: lock.version, objects };
+}
+function findDuplicateRawKey(text) {
+  const stack = [];
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "{") {
+      stack.push(/* @__PURE__ */ new Set());
+      i++;
+    } else if (ch === "[") {
+      stack.push(null);
+      i++;
+    } else if (ch === "}" || ch === "]") {
+      stack.pop();
+      i++;
+    } else if (ch === '"') {
+      let j = i + 1;
+      let value = "";
+      while (j < text.length && text[j] !== '"') {
+        if (text[j] === "\\") {
+          value += text[j] + (text[j + 1] ?? "");
+          j += 2;
+        } else {
+          value += text[j];
+          j++;
+        }
+      }
+      j++;
+      let k = j;
+      while (k < text.length && /\s/.test(text[k])) k++;
+      if (text[k] === ":") {
+        const scope = stack[stack.length - 1];
+        if (scope) {
+          let decoded = value;
+          try {
+            decoded = JSON.parse(`"${value}"`);
+          } catch {
+          }
+          if (scope.has(decoded)) return decoded;
+          scope.add(decoded);
+        }
+      }
+      i = j;
+    } else {
+      i++;
+    }
+  }
+  return void 0;
+}
+function fail(path, message) {
+  throw new Error(`Invalid lock file ${path}: ${message}`);
+}
+function parseLock(text, path = "xano.lock") {
+  return parseLockReport(text, path).lock;
+}
+function parseLockReport(text, path = "xano.lock", opts = {}) {
+  const droppedLandings = [];
+  if (/^(?:<{7}|>{7})(?: |$)|^={7}$/m.test(text)) {
+    fail(
+      path,
+      `it holds unresolved merge-conflict markers (\`<<<<<<<\`, \`=======\`, \`>>>>>>>\`). Resolve it as the union of both sides: keep every entry under \`objects\` (and \`landed\`) from each, delete the markers, and fix the commas. Where both sides renamed one object, two keys then share a guid \u2014 keep the one your code exports and remove the other with \`xanosdk lock prune --identity-only --yes <key>\`.`
+    );
+  }
+  const dup = findDuplicateRawKey(text);
+  if (dup !== void 0) {
+    fail(
+      path,
+      `duplicate key "${dup}" in the raw text (likely a bad merge \u2014 JSON keeps only the last one silently). Resolve the duplicate and re-run.`
+    );
+  }
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (err) {
+    fail(path, `unparseable JSON (${err instanceof Error ? err.message : String(err)}).`);
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    fail(path, "expected a top-level object.");
+  }
+  const obj = data;
+  if (obj.version !== LOCK_VERSION) {
+    fail(
+      path,
+      `unknown version ${JSON.stringify(obj.version)} (this Xano SDK reads version ${LOCK_VERSION}). Upgrade Xano SDK to a release that understands this lock format.`
+    );
+  }
+  if (!obj.objects || typeof obj.objects !== "object" || Array.isArray(obj.objects)) {
+    fail(path, "expected an `objects` map.");
+  }
+  const objects = validateLockObjects(obj.objects, path, opts);
+  const landed = obj.landed === void 0 ? void 0 : validateLanded(obj.landed, path, droppedLandings);
+  return {
+    lock: { version: LOCK_VERSION, objects, ...landed !== void 0 && Object.keys(landed).length > 0 ? { landed } : {} },
+    droppedLandings
+  };
+}
+function validateLanded(raw, path, dropped) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    fail(path, "`landed` must be an object of destination \u2192 landed identities.");
+  }
+  const out = {};
+  for (const [dest, entries] of Object.entries(raw)) {
+    if (EPHEMERAL_DESTINATION_KEY.test(dest)) {
+      dropped.push(dest);
+      continue;
+    }
+    if (!DESTINATION_KEY.test(dest)) {
+      fail(
+        path,
+        `\`landed\` destination "${dest}" is not \`<instance host>/workspace/<id>\` or \`<instance host>/tenant/<name>\`.`
+      );
+    }
+    if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
+      fail(path, `\`landed\` destination "${dest}" must map lock keys to \`{ "guid": \u2026 }\`.`);
+    }
+    const record = {};
+    for (const [key, entryRaw] of Object.entries(entries)) {
+      if (key === WORKSPACE_KEY) fail(path, `\`landed\` under "${dest}" names "${key}", which is not an object a deploy lands.`);
+      validateKey(key, path);
+      const { guid, type } = entryRaw ?? {};
+      if (!entryRaw || typeof entryRaw !== "object" || Array.isArray(entryRaw) || typeof guid !== "string" || guid === "") {
+        fail(path, `\`landed\` entry "${key}" under "${dest}" must be \`{ "guid": "<guid>" }\`.`);
+      }
+      if (type !== void 0 && (type !== "agent" || !key.startsWith("toolset:"))) {
+        fail(path, `\`landed\` entry "${key}" under "${dest}" has \`type\` ${JSON.stringify(type)} \u2014 only an agent's toolset entry carries one, and it is "agent".`);
+      }
+      record[key] = type === "agent" ? { guid, type: "agent" } : { guid };
+    }
+    if (Object.keys(record).length > 0) out[dest] = record;
+  }
+  return out;
+}
+function validateLockModel(lock, label, observed) {
+  if (observed !== void 0) {
+    assertEmittedCanonicalsUnique(observed, label);
+    assertNoCrossKindGuid(lock, observed, label);
+  }
+  validateLockObjects(lock.objects, label);
+}
+function assertNoCrossKindGuid(lock, observed, lockLabel) {
+  const held = /* @__PURE__ */ new Map();
+  for (const [key, entry] of Object.entries(lock.objects)) {
+    if (entry.guid !== void 0 && !(key in observed)) held.set(entry.guid, key);
+  }
+  for (const [key, entry] of Object.entries(observed)) {
+    const other = entry.guid === void 0 ? void 0 : held.get(entry.guid);
+    if (other === void 0 || splitKey(other)[0] === splitKey(key)[0]) continue;
+    const [pin, holder] = [displayLockKey(key), displayLockKey(other)];
+    throw new Error(
+      `${pin} pins guid ${entry.guid} in code (\`guid:\` on the def), but ${lockLabel} holds it for ${holder}. A guid never moves between kinds, so this is not a rename: remove that \`guid:\` and ${pin} takes its own identity. Nothing was written.`
+    );
+  }
+}
+function assertEmittedCanonicalsUnique(observed, lockLabel) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const key of Object.keys(observed).sort()) {
+    const canonical = observed[key].canonical;
+    if (typeof canonical !== "string" || key === WORKSPACE_KEY) continue;
+    const scoped = `${key.slice(0, key.indexOf(":"))}\0${canonical}`;
+    const prior = owners.get(scoped);
+    if (prior === void 0) {
+      owners.set(scoped, key);
+      continue;
+    }
+    const pinned = (k) => observed[k].canonical_source === "code";
+    if (!pinned(prior) && !pinned(key)) continue;
+    const [a, b] = [displayLockKey(prior), displayLockKey(key)];
+    const where = (k, shown) => pinned(k) ? `${shown} pins it in code` : `${shown} carries it from ${lockLabel}`;
+    const fix = pinned(prior) && pinned(key) ? `change or drop the \`canonical\` on one of them` : `change the \`canonical\` ${pinned(prior) ? a : b} pins`;
+    throw new Error(
+      `Two definitions in this project have the same canonical "${canonical}": ${where(prior, a)}, and ${where(key, b)}. A canonical is the object's public URL slug, unique per kind \u2014 ${fix}.`
+    );
+  }
+}
+function duplicateRemedy(keys, lockFile) {
+  if (lockFile === void 0) return "";
+  const prune = (key) => `\`xanosdk lock prune --identity-only --yes ${shellQuote(displayLockKey(key))} --lock=${shellQuote(lockFile)}\``;
+  return keys.length === 2 ? ` If a merge kept both sides of a rename, keep the one your code exports and remove the other: ${prune(keys[0])} or ${prune(keys[1])}.` : ` Keep the one your code exports and remove each of the others: ${keys.map(prune).join(", ")}.`;
+}
+function quotedKeys(keys) {
+  const q = keys.map((k) => `"${k}"`);
+  return q.length === 1 ? q[0] : `${q.slice(0, -1).join(", ")} and ${q.at(-1)}`;
+}
+function failDuplicates(path, shared, lockFile) {
+  if (shared.length === 0) return;
+  const line = (d) => `entries ${quotedKeys(d.keys)} share the same ${d.what}.${duplicateRemedy(d.keys, lockFile)}`;
+  if (shared.length === 1) fail(path, line(shared[0]));
+  fail(
+    path,
+    `${shared.length} identities are each held by more than one entry \u2014 fix all of them:
+` + shared.map((d) => `  - ${line(d)}`).join("\n")
+  );
+}
+function validateLockObjects(raw, path, opts = {}) {
+  const objects = {};
+  const guidOwners = /* @__PURE__ */ new Map();
+  const canonicalOwners = /* @__PURE__ */ new Map();
+  const shared = /* @__PURE__ */ new Map();
+  const share = (id, what, owner, key) => {
+    const seen = shared.get(id);
+    if (seen === void 0) shared.set(id, { what, keys: [owner, key] });
+    else seen.keys.push(key);
+  };
+  for (const [key, entryRaw] of Object.entries(raw)) {
+    validateKey(key, path);
+    if (!entryRaw || typeof entryRaw !== "object" || Array.isArray(entryRaw)) {
+      fail(path, `entry "${key}" must be an object.`);
+    }
+    const { guid, canonical, canonical_source: canonicalSource, type, adopted, imported, guid_source: guidSource, replaced } = entryRaw;
+    if (guidSource !== void 0 && (guidSource !== "code" || guid === void 0)) {
+      fail(
+        path,
+        `entry "${key}" has \`guid_source\` ${JSON.stringify(guidSource)} \u2014 it is either \`"code"\` (the guid is a def's own \`guid:\`) beside a \`guid\`, or absent. Remove the field; the next export writes it.`
+      );
+    }
+    if (replaced !== void 0 && (!Array.isArray(replaced) || replaced.some((g) => typeof g !== "string" || g === "") || !key.startsWith("dbo:"))) {
+      fail(
+        path,
+        `entry "${key}" has \`replaced\` ${JSON.stringify(replaced)} \u2014 only a table entry carries one, as a list of the guids its def's \`guid:\` replaced. Remove the field to stop guarding those tables.`
+      );
+    }
+    if (adopted !== void 0 && adopted !== true) {
+      fail(
+        path,
+        `entry "${key}" has \`adopted\` ${JSON.stringify(adopted)} \u2014 it is either \`true\` (added by \`lock import\`) or absent. Remove the field; the next export clears it for anything the project declares.`
+      );
+    }
+    if (imported !== void 0 && imported !== true) {
+      fail(
+        path,
+        `entry "${key}" has \`imported\` ${JSON.stringify(imported)} \u2014 it is either \`true\` (a guid \`lock import\` took from a live backend) or absent. Remove the field.`
+      );
+    }
+    if (type !== void 0 && (type !== "agent" || !key.startsWith("toolset:"))) {
+      fail(
+        path,
+        `entry "${key}" has \`type\` ${JSON.stringify(type)} \u2014 only an agent's toolset entry carries one, and it is "agent". Remove the field; the next export writes it where it belongs.`
+      );
+    }
+    if (guid !== void 0 && (typeof guid !== "string" || guid === "")) {
+      fail(path, `entry "${key}" has a non-string or empty \`guid\`.`);
+    }
+    if (canonical !== void 0 && (typeof canonical !== "string" || canonical === "")) {
+      fail(path, `entry "${key}" has a non-string or empty \`canonical\`.`);
+    }
+    if (guid === void 0 && canonical === void 0) {
+      fail(path, `entry "${key}" carries neither \`guid\` nor \`canonical\`.`);
+    }
+    if (canonicalSource !== void 0) {
+      if (typeof canonicalSource !== "string" || !CANONICAL_SOURCES.has(canonicalSource)) {
+        fail(
+          path,
+          `entry "${key}" has an unknown \`canonical_source\` ${JSON.stringify(canonicalSource)} \u2014 expected ${[...CANONICAL_SOURCES].map((s) => `"${s}"`).join(", ")}, or omit it. Re-export to have it written for you.`
+        );
+      }
+      if (canonical === void 0) {
+        fail(
+          path,
+          `entry "${key}" has a \`canonical_source\` but no \`canonical\` to classify. Remove the field.`
+        );
+      }
+    }
+    const isWorkspaceKey = key === WORKSPACE_KEY;
+    if (isWorkspaceKey && guid !== void 0) {
+      fail(path, `entry "${key}" cannot carry a \`guid\` (workspace identities are canonical-only).`);
+    }
+    if (!isWorkspaceKey && canonical !== void 0) {
+      const prefix = key.slice(0, key.indexOf(":"));
+      if (!CANONICAL_PAYLOAD_KEYS.has(prefix)) {
+        fail(
+          path,
+          `entry "${key}" cannot carry a \`canonical\` \u2014 only ${[...CANONICAL_PAYLOAD_KEYS].join("/")} objects and the workspace key have one.`
+        );
+      }
+    }
+    if (typeof guid === "string") {
+      const owner = guidOwners.get(guid);
+      if (owner !== void 0 && opts.tolerateDuplicates !== true) share(`guid\0${guid}`, `guid (${guid})`, owner, key);
+      else guidOwners.set(guid, key);
+    }
+    if (typeof canonical === "string") {
+      const scope = isWorkspaceKey ? WORKSPACE_KEY : key.slice(0, key.indexOf(":"));
+      let owners = canonicalOwners.get(scope);
+      if (owners === void 0) canonicalOwners.set(scope, owners = /* @__PURE__ */ new Map());
+      const owner = owners.get(canonical);
+      if (owner !== void 0 && opts.tolerateDuplicates !== true) {
+        share(`canonical\0${scope}\0${canonical}`, `canonical (${canonical})`, owner, key);
+      } else owners.set(canonical, key);
+    }
+    const entry = {};
+    if (typeof guid === "string") entry.guid = guid;
+    if (typeof canonical === "string") entry.canonical = canonical;
+    if (typeof canonicalSource === "string") {
+      entry.canonical_source = canonicalSource;
+    }
+    if (type === "agent") entry.type = "agent";
+    if (adopted === true) entry.adopted = true;
+    if (imported === true) entry.imported = true;
+    if (guidSource === "code") entry.guid_source = "code";
+    if (Array.isArray(replaced) && replaced.length > 0) entry.replaced = [...replaced];
+    objects[key] = entry;
+  }
+  failDuplicates(path, [...shared.values()], opts.lockFile);
+  return objects;
+}
+function validateKey(key, path) {
+  if (key === WORKSPACE_KEY) return;
+  const retired = RETIRED_KEYS.get(key);
+  if (retired !== void 0) {
+    fail(path, `key "${key}" is retired \u2014 ${retired}. Remove the entry.`);
+  }
+  const idx = key.indexOf(":");
+  const prefix = idx === -1 ? key : key.slice(0, idx);
+  const name = idx === -1 ? "" : key.slice(idx + 1);
+  if (prefix === "workspace") {
+    fail(
+      path,
+      `key "${key}" is not a lockable workspace identity (only "${WORKSPACE_KEY}" exists).`
+    );
+  }
+  if (idx === -1 || name === "" || !LOCK_PAYLOAD_KEYS.has(prefix)) {
+    fail(
+      path,
+      `key "${key}" is not \`<payloadKey>:<name>\` with a known payload key (${[...LOCK_PAYLOAD_KEYS].join(", ")}).`
+    );
+  }
+}
+function serializeLock(lock) {
+  const objects = {};
+  for (const key of Object.keys(lock.objects).sort()) {
+    const src = lock.objects[key];
+    const entry = {};
+    if (src.guid !== void 0) entry.guid = src.guid;
+    if (src.canonical !== void 0) entry.canonical = src.canonical;
+    if (src.canonical !== void 0 && src.canonical_source !== void 0) {
+      entry.canonical_source = src.canonical_source;
+    }
+    if (src.type === "agent" && key.startsWith("toolset:")) entry.type = "agent";
+    if (src.adopted === true) entry.adopted = true;
+    if (src.imported === true) entry.imported = true;
+    if (src.guid_source === "code" && src.guid !== void 0) entry.guid_source = "code";
+    if (src.replaced !== void 0 && src.replaced.length > 0 && key.startsWith("dbo:")) entry.replaced = [...src.replaced];
+    objects[key] = entry;
+  }
+  const landed = {};
+  for (const dest of Object.keys(lock.landed ?? {}).sort()) {
+    const src = lock.landed[dest];
+    const keys = Object.keys(src).sort();
+    if (keys.length === 0) continue;
+    const record = {};
+    for (const key of keys) {
+      const e = src[key];
+      record[key] = e.type === "agent" && key.startsWith("toolset:") ? { guid: e.guid, type: "agent" } : { guid: e.guid };
+    }
+    landed[dest] = record;
+  }
+  return JSON.stringify(
+    Object.keys(landed).length > 0 ? { version: lock.version, objects, landed } : { version: lock.version, objects },
+    null,
+    2
+  ) + "\n";
+}
+function mintCanonical() {
+  let bin = "";
+  for (const b of randomBytes(6)) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_");
+}
+function createLockContext(lock = emptyLock()) {
+  return { lock, observed: {}, repinned: [] };
+}
+function recordObserved(ctx, key, identity) {
+  const prior = ctx.observed[key];
+  if (prior?.guid !== void 0 && identity.guid !== void 0 && prior.guid !== identity.guid) {
+    throw new Error(
+      `Two exported objects collapse onto lock key "${displayLockKey(key)}" with different guids (${prior.guid} vs ${identity.guid}) \u2014 two same-kind objects sharing one identity behind explicit guids. The lock cannot track both under one key; rename one of the objects.`
+    );
+  }
+  const entry = ctx.lock.objects[key];
+  if (identity.guid !== void 0 && entry?.guid !== void 0 && identity.guid !== entry.guid) {
+    if (getLockedGuid(key) === entry.guid) {
+      (ctx.repinned ??= []).push({ key, from: entry.guid, to: identity.guid });
+      ctx.observed[key] = { ...ctx.observed[key], ...identity };
+      return;
+    }
+    if (identity.guid === rawDeriveGuid(key)) {
+      throw new Error(
+        `"${displayLockKey(key)}" emitted its name-derived guid (${identity.guid}) but xano.lock pins ${entry.guid}. The lock overrides were not seeded before the workspace module loaded \u2014 programmatic exports must call seedLockOverrides(lock) before importing any def module (the CLI does this automatically). With them seeded, a \`guid:\` the def pins wins over the lock entry.`
+      );
+    }
+    throw new Error(
+      `"${displayLockKey(key)}" has an explicit guid (${identity.guid}) that differs from its xano.lock entry (${entry.guid}), so references resolved through the lock would split from the object itself. Update the xano.lock entry to the explicit guid, or remove the explicit guid from code, then re-export.`
+    );
+  }
+  ctx.observed[key] = { ...ctx.observed[key], ...identity };
+}
+var COMPOSED_QUERY_NAME = /^[^|]*\|[A-Z]+\|[^|]+$/;
+function checkRenameTarget(payloadKey, oldName, newName) {
+  if (oldName === newName) {
+    throw new Error(`The old and new names are both "${newName}" \u2014 there is nothing to move. Name the entry's new name.`);
+  }
+  if (payloadKey === "query") {
+    if (COMPOSED_QUERY_NAME.test(newName)) return;
+    const oldParts = oldName.split("|");
+    const suggestion = oldParts.length === 3 && !newName.includes("|") ? ` \u2014 e.g. "${oldParts[0]}|${oldParts[1]}|${newName}"` : "";
+    throw new Error(
+      `"${newName}" is not a query lock name. A query is locked by its composed identity "<group>|<VERB>|<name>"${suggestion}; an entry under any other name matches nothing an export writes.`
+    );
+  }
+  const realtimeParts = payloadKey === "channel" ? 2 : payloadKey === "message" ? 3 : 0;
+  if (realtimeParts > 0) {
+    const composed = (name) => {
+      const parts = name.split("|");
+      return parts.length === realtimeParts && parts.every((p) => p !== "");
+    };
+    const bad = [oldName, newName].filter((n) => !composed(n));
+    if (bad.length === 0) return;
+    const shape = payloadKey === "channel" ? "<server>|<path>" : "<server>|<channel path>|<name>";
+    const placeholder = shape.split("|").slice(0, -1);
+    const composedFor = (name) => {
+      if (name.includes("|")) return void 0;
+      const other = name === oldName ? newName : oldName;
+      return [...composed(other) ? other.split("|").slice(0, -1) : placeholder, name].join("|");
+    };
+    const examples = bad.map(composedFor).filter((s) => s !== void 0);
+    const kindName = sdkKindName2(payloadKey);
+    throw new Error(
+      (bad.length === 1 ? `"${bad[0]}" is not a ${kindName} lock name.` : `Neither "${oldName}" nor "${newName}" is a ${kindName} lock name.`) + ` It is locked by its composed identity "${shape}"` + (examples.length === 0 ? "" : ` \u2014 e.g. ${examples.map((e) => `"${e}"`).join(" and ")}`) + `; an entry under any other name matches nothing an export writes.`
+    );
+  }
+  if (COMPOSED_QUERY_NAME.test(newName)) {
+    throw new Error(
+      `"${newName}" is a query lock name ("<group>|<VERB>|<name>"), not ${withArticle(sdkKindName2(payloadKey))} name. ${article(sdkKindName2(payloadKey)) === "an" ? "An" : "A"} ${sdkKindName2(payloadKey)} entry is keyed by the object's own name; to move a query entry, use \`lock rename query\`.`
+    );
+  }
+}
+function renameLockEntry(lock, payloadKey, oldName, newName, observed, shownKind = payloadKey === "toolset" ? "mcpServer" : sdkKindName2(payloadKey)) {
+  const oldKey = lockKey(payloadKey, oldName);
+  const newKey = lockKey(payloadKey, newName);
+  const shownOld = `${shownKind}:${oldName}`;
+  const shownNew = `${shownKind}:${newName}`;
+  const entry = lock.objects[oldKey];
+  if (entry === void 0) {
+    throw new LockEntryNotFoundError(
+      `No lock entry "${shownOld}". \`lock rename\` moves an existing entry \u2014 check the kind and old name (kinds: ${acceptedLockKinds().join(", ")}).`
+    );
+  }
+  const objects = { ...lock.objects };
+  let discardedNewcomer;
+  const existing = objects[newKey];
+  const sameIdentity = existing?.guid !== void 0 && existing.guid === entry.guid;
+  if (existing !== void 0 && !sameIdentity) {
+    if (existing.guid !== rawDeriveGuid(newKey) || existing.imported === true || existing.adopted === true || existing.guid_source === "code") {
+      throw new LockRenameConflictError(
+        `Lock entry "${shownNew}" already pins an identity of its own (${existing.guid ?? `canonical ${existing.canonical}`}), so moving "${shownOld}" onto it would lose one of the two. Nothing was written.`,
+        { shownOld, shownNew }
+      );
+    }
+    if (observed === void 0) {
+      throw new Error(
+        `Lock entry "${shownNew}" already exists, and its name-derived guid cannot tell the fresh entry an export appends after a rename from a live object registered as "${newName}". Pass --entry=<path> so the workspace source can say which one it is.`
+      );
+    }
+    if (observed.has(oldKey)) {
+      throw new Error(
+        `"${shownOld}" is still exported by the workspace, so "${shownNew}" is a separate live object, not the renamed one. Moving the entry would give "${newName}" the identity of "${oldName}" and the next deploy would swap or recreate both. Rename the object in code first, then re-run \`lock rename\`.`
+      );
+    }
+    discardedNewcomer = existing;
+  }
+  delete objects[oldKey];
+  const { guid_source: _source, ...moved } = entry;
+  objects[newKey] = existing?.canonical_source === "code" && existing.canonical !== void 0 ? { ...moved, canonical: existing.canonical, canonical_source: "code" } : { ...moved };
+  const movedChildren = [];
+  const children = payloadKey === "app" ? ["query"] : payloadKey === "realtime_server" ? ["channel", "message"] : payloadKey === "channel" ? ["message"] : [];
+  for (const child of children) {
+    for (const key of Object.keys(lock.objects).filter((k) => k.startsWith(`${child}:${oldName}|`))) {
+      const to = `${child}:${newName}|${key.slice(`${child}:${oldName}|`.length)}`;
+      const there = objects[to];
+      if (there !== void 0 && there.guid !== rawDeriveGuid(to)) {
+        throw new LockRenameConflictError(
+          `Lock entry "${to}" already pins an identity of its own (${there.guid ?? `canonical ${there.canonical}`}), so moving "${key}" with its group onto it would lose one of the two. Nothing was written.`,
+          { shownOld: key, shownNew: to }
+        );
+      }
+      objects[to] = { ...objects[key] };
+      delete objects[key];
+      movedChildren.push({ kind: child, from: key, to });
+    }
+  }
+  return { lock: withObjects(lock, objects), discardedNewcomer, movedChildren };
+}
+function adoptFromBundle(lock, bundle, bundlePath) {
+  if (!bundle || typeof bundle !== "object" || Array.isArray(bundle)) {
+    throw new NotABundleError(`${bundlePath} is not a Xano bundle (expected a JSON object with a \`payload\`).`);
+  }
+  const payload = bundle.payload;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new NotABundleError(`${bundlePath} has no \`payload\` \u2014 it is not a Xano bundle.`);
+  }
+  const sections = payload;
+  const objects = { ...lock.objects };
+  for (const key of Object.keys(objects)) objects[key] = { ...objects[key] };
+  const added = [];
+  const changed = [];
+  let canonicalsSeen = false;
+  const imported = /* @__PURE__ */ new Set();
+  const codePinned = [];
+  const applyEntry = (key, incoming) => {
+    const before = objects[key];
+    if (before?.guid_source === "code" && before.guid !== void 0 && incoming.guid !== void 0 && incoming.guid !== before.guid) {
+      codePinned.push({ key, guid: before.guid, live: incoming.guid });
+      return;
+    }
+    imported.add(key);
+    const after = { ...before, ...incoming };
+    if (incoming.canonical !== void 0 && incoming.canonical !== before?.canonical) {
+      if (key === WORKSPACE_KEY) delete after.canonical_source;
+      else after.canonical_source = "adopted";
+    }
+    if (before?.guid !== after.guid) delete after.guid_source;
+    if (after.replaced !== void 0 && after.guid !== void 0 && after.replaced.includes(after.guid)) {
+      const rest = after.replaced.filter((g) => g !== after.guid);
+      if (rest.length > 0) after.replaced = rest;
+      else delete after.replaced;
+    }
+    if (before === void 0) {
+      objects[key] = after;
+      added.push(key);
+    } else if (before.guid !== after.guid || before.canonical !== after.canonical) {
+      changed.push({ key, before, after });
+      objects[key] = after;
+    } else if (before.canonical_source !== after.canonical_source || before.type !== after.type) {
+      objects[key] = after;
+    }
+  };
+  const appNames = identityNamesByGuid(sections);
+  for (const payloadKey of LOCK_PAYLOAD_KEYS) {
+    const arr = sections[payloadKey];
+    if (!Array.isArray(arr)) continue;
+    const namesSeen = /* @__PURE__ */ new Set();
+    for (const obj of arr) {
+      if (!obj || typeof obj !== "object") continue;
+      const o = obj;
+      if (typeof o.name !== "string" || typeof o.guid !== "string" || o.guid === "") continue;
+      const lockName = lockNameForObject(payloadKey, o, appNames);
+      if (namesSeen.has(lockName)) {
+        throw new Error(
+          `${bundlePath} contains two "${payloadKey}" objects with the identity "${lockName}" \u2014 the lock keys identity per kind and cannot represent both. Adoption aborted; rename one of them engine-side, then re-export and re-adopt.`
+        );
+      }
+      namesSeen.add(lockName);
+      const incoming = { guid: o.guid };
+      if (typeof o.canonical === "string" && o.canonical !== "") {
+        incoming.canonical = o.canonical;
+        canonicalsSeen = true;
+      }
+      if (payloadKey === "toolset" && o.type === "agent") incoming.type = "agent";
+      applyEntry(lockKey(payloadKey, lockName), incoming);
+    }
+  }
+  const ws = sections["workspace"];
+  if (ws && typeof ws === "object" && !Array.isArray(ws)) {
+    const w = ws;
+    if (typeof w.canonical === "string" && w.canonical !== "") {
+      canonicalsSeen = true;
+      applyEntry(WORKSPACE_KEY, { canonical: w.canonical });
+    }
+  }
+  const vault = sections["vault"];
+  const vaultCount = Array.isArray(vault) ? vault.length : 0;
+  const privateVaultCount = Array.isArray(vault) ? vault.filter(isPrivateLibraryRow).length : 0;
+  refuseImportedGuidClash(objects, imported, bundlePath, toolsetKindsFromPayload(payload, lock.objects));
+  let validated;
+  try {
+    validated = validateLockObjects(objects, bundlePath);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message.replace(/^Invalid lock file [^:]*: /, "") : String(err);
+    throw new LockImportConflictError(
+      `Adopting ${bundlePath} would leave an invalid lock \u2014 ${detail} Fix the entry named in xano.lock (\`xanosdk lock rename\` or \`xanosdk lock prune --identity-only\`), then re-run the import.`
+    );
+  }
+  const merged = withObjects(lock, validated);
+  return {
+    lock: merged,
+    added: added.sort(),
+    changed,
+    canonicalsSeen,
+    vaultCount,
+    privateVaultCount,
+    seen: [...imported].sort(),
+    codePinned
+  };
+}
+var NotABundleError = class extends Error {
+  name = "NotABundleError";
+};
+function refuseImportedGuidClash(objects, imported, bundlePath, kinds) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const [key, entry] of Object.entries(objects)) {
+    if (entry.guid === void 0) continue;
+    const other = owners.get(entry.guid);
+    if (other === void 0) {
+      owners.set(entry.guid, key);
+      continue;
+    }
+    const live = imported.has(key) ? key : other;
+    const stale = live === key ? other : key;
+    const [liveKind, liveName] = splitKey(live);
+    const [staleKind, staleName] = splitKey(stale);
+    const kindWord = staleKind === "toolset" ? kinds.get(liveName) ?? "mcpServer" : sdkKindName2(staleKind);
+    const sameKindRename = !imported.has(stale) && liveKind === staleKind;
+    const remedy = imported.has(stale) ? `The bundle itself carries that guid twice; export the workspace again and re-import.` : sameKindRename ? `One side renamed it. If the workspace did, rename it in code to "${liveName}" too, then \`xanosdk lock rename ${kindWord} ${staleName} ${liveName}\` and re-run the import. If your source did, the lock already follows it: deploy the rename, then export the workspace again and re-import.` : `Drop the stale entry first \u2014 \`xanosdk lock prune --identity-only ${displayLockKey(stale, kinds)} --yes\` \u2014 then re-run the import.`;
+    const head = `${bundlePath} holds guid ${entry.guid} under "${displayLockKey(live, kinds)}", but the lock already pins it to "${displayLockKey(stale, kinds)}".`;
+    throw new LockImportConflictError(`${head} ${remedy}`, {
+      ...sameKindRename ? {
+        clash: {
+          guid: entry.guid,
+          kind: staleKind,
+          kindWord,
+          workspaceName: liveName,
+          lockName: staleName,
+          workspaceKey: displayLockKey(live, kinds),
+          lockKey: displayLockKey(stale, kinds)
+        }
+      } : {}
+    });
+  }
+}
+function splitKey(key) {
+  const colon = key.indexOf(":");
+  return colon <= 0 ? [key, ""] : [key.slice(0, colon), key.slice(colon + 1)];
+}
+function withoutGuidSources(lock) {
+  const objects = {};
+  for (const [key, entry] of Object.entries(lock.objects)) {
+    const { guid_source: _source, ...rest } = entry;
+    objects[key] = rest;
+  }
+  return withObjects(lock, objects);
+}
+function mergeObserved(lock, observed, opts = {}) {
+  const objects = {};
+  for (const [key, identity] of Object.entries(observed)) {
+    const prior = lock.objects[key];
+    const entry = { ...prior, ...identity };
+    if (identity.type === void 0) delete entry.type;
+    if (identity.guid_source === void 0) delete entry.guid_source;
+    if (key.startsWith("dbo:") && prior?.guid !== void 0 && entry.guid !== void 0 && prior.guid !== entry.guid) {
+      const mayHoldRows = prior.guid_source !== "code" || opts.landedGuids?.has(prior.guid) === true;
+      if (mayHoldRows) entry.replaced = [...prior.replaced ?? [], prior.guid];
+    }
+    if (opts.keepAdopted !== true && entry.adopted === true) {
+      delete entry.adopted;
+      entry.imported = true;
+    }
+    if (lock.objects[key]?.guid !== entry.guid) delete entry.imported;
+    objects[key] = entry;
+  }
+  const liveGuids = new Map(
+    Object.entries(objects).flatMap(([k, e]) => e.guid === void 0 ? [] : [[e.guid, splitKey(k)[0]]])
+  );
+  const liveCanonicals = new Set(
+    Object.values(objects).map((e) => e.canonical).filter(Boolean)
+  );
+  const orphans = [];
+  const dropped = [];
+  const cededCanonicals = [];
+  for (const [key, entry] of Object.entries(lock.objects)) {
+    if (key in objects) continue;
+    if (entry.guid !== void 0 && liveGuids.get(entry.guid) === splitKey(key)[0]) {
+      dropped.push(key);
+      continue;
+    }
+    if (entry.canonical !== void 0 && liveCanonicals.has(entry.canonical)) {
+      const kept = { ...entry };
+      delete kept.canonical;
+      delete kept.canonical_source;
+      if (kept.guid === void 0) {
+        dropped.push(key);
+        continue;
+      }
+      objects[key] = kept;
+      orphans.push(key);
+      cededCanonicals.push(key);
+      continue;
+    }
+    objects[key] = entry;
+    orphans.push(key);
+  }
+  const held = new Set(Object.values(objects).flatMap((e) => e.guid === void 0 ? [] : [e.guid]));
+  for (const [key, entry] of Object.entries(objects)) {
+    if (entry.replaced === void 0) continue;
+    const kept = [...new Set(entry.replaced)].filter((g) => !held.has(g));
+    if (kept.length === entry.replaced.length) continue;
+    const next = { ...entry };
+    if (kept.length > 0) next.replaced = kept;
+    else delete next.replaced;
+    objects[key] = next;
+  }
+  return {
+    lock: withObjects(lock, objects),
+    orphans: orphans.sort(),
+    dropped: dropped.sort(),
+    cededCanonicals: cededCanonicals.sort()
+  };
+}
+
+export {
+  sdkKindName,
+  LOCK_VERSION,
+  WORKSPACE_KEY,
+  LOCK_PAYLOAD_KEYS,
+  CANONICAL_PAYLOAD_KEYS,
+  sdkKindName2,
+  acceptedLockKinds,
+  toolsetKindsFromPayload,
+  toolsetKindsFromLock,
+  displayLockKey,
+  fileSpellingNote,
+  resolvePayloadKey,
+  UnknownLockKindError,
+  LockEntryNotFoundError,
+  LockRenameConflictError,
+  LockImportConflictError,
+  normalizeLockKey,
+  lockKey,
+  codePinnedTables,
+  lockNameForObject,
+  identityNamesByGuid,
+  appNamesByGuid,
+  DESTINATION_KEY,
+  emptyLock,
+  withObjects,
+  parseLock,
+  parseLockReport,
+  validateLockModel,
+  serializeLock,
+  mintCanonical,
+  createLockContext,
+  recordObserved,
+  checkRenameTarget,
+  renameLockEntry,
+  adoptFromBundle,
+  NotABundleError,
+  withoutGuidSources,
+  mergeObserved
+};
+//# sourceMappingURL=chunk-6MR5TI5V.js.map