@xano/sdk 1.0.0

package/dist/chunk-MXHSQOC4.js

@@ -0,0 +1,3061 @@
+import {
+  assertPathParamInputs,
+  defaultCache,
+  encodeResponse,
+  encodeTests,
+  fillPathParams,
+  parsePathParams,
+  queryKind,
+  warnUnboundReturn
+} from "./chunk-6IUMKYWI.js";
+import {
+  workspaceKind
+} from "./chunk-2CMJZDCL.js";
+import {
+  Xano,
+  encodeMcpOauth,
+  refuseUnknown,
+  standaloneDefKind
+} from "./chunk-CTMO46PK.js";
+import {
+  resolveAuthRef
+} from "./chunk-ZDPP6RKB.js";
+import {
+  obj
+} from "./chunk-K5BBGTYZ.js";
+import {
+  GENERATED_SPECS,
+  apiGroupKind,
+  assertSslConsistency,
+  coerceBool,
+  coerceHeaders,
+  coerceHttpFields,
+  coerceInt,
+  coerceObj,
+  coerceScalar,
+  coerceText,
+  dbAdd,
+  dbAddOrEdit,
+  dbBulkAdd,
+  dbBulkDelete,
+  dbBulkPatch,
+  dbBulkUpdate,
+  dbDel,
+  dbDirectQuery,
+  dbEdit,
+  dbExternalQuery,
+  dbGet,
+  dbHas,
+  dbIncrement,
+  dbPatch,
+  dbQuery,
+  dbSchema,
+  dbTransaction,
+  dbTruncate,
+  declaredServicePorts,
+  encodeEval,
+  encodeFromSpec,
+  encodeSearch,
+  encodeSort,
+  generated,
+  isIgnored,
+  isValue,
+  microserviceKind,
+  noteMicroserviceHandleHost,
+  noteToolsetTarget,
+  precondition,
+  qualifyAggregateEvals,
+  registerSpec,
+  resolveEnumValue,
+  throwError
+} from "./chunk-YGZHHAAB.js";
+import {
+  assertCanonical,
+  assertStoredName,
+  buildMiddlewareBlock,
+  clear,
+  encodeContainerHistory,
+  encodeHistory
+} from "./chunk-5V5XU32D.js";
+import {
+  assertKnownKeys,
+  conditional,
+  encodeExpression,
+  encodeRuntimeCondition,
+  tableKind
+} from "./chunk-HVRUQXGD.js";
+import {
+  brandDef
+} from "./chunk-ERVIASGL.js";
+import {
+  assertDefShape,
+  emptyMiddleware,
+  encodeTags,
+  registerKind,
+  resolveMockKeys
+} from "./chunk-4POWHT2K.js";
+import {
+  nearestKey
+} from "./chunk-WTPZRR4I.js";
+import {
+  emitDiagnostic
+} from "./chunk-2EZ3ZJZZ.js";
+import {
+  lockKey
+} from "./chunk-6MR5TI5V.js";
+import {
+  HOSTED_FILE_SCHEME,
+  isHostedFile,
+  pendingHostedSrc
+} from "./chunk-XNCP4KYO.js";
+import {
+  ANNOTATION_KEYS,
+  OPTION_KEYS,
+  annotate,
+  encodeStack,
+  encodeStatement,
+  isRegisteredStatement,
+  registerFactoryPaths,
+  registerStatement
+} from "./chunk-YU4HSQW7.js";
+import {
+  impliedInputs,
+  isTriggerObjType
+} from "./chunk-G554NZNI.js";
+import {
+  encodeInput
+} from "./chunk-N5GKCWE5.js";
+import {
+  barePatternRefusal,
+  c,
+  inp,
+  isTaggedValue,
+  ref,
+  reversedOperandRefusal
+} from "./chunk-OXA6PSZT.js";
+import {
+  deriveGuid,
+  noteHandleRef,
+  realtimeChannelSeedName,
+  realtimeMessageSeedName,
+  resolveQueryRef,
+  resolveRef
+} from "./chunk-NZOWWHU5.js";
+import {
+  getLockedCanonical
+} from "./chunk-4BW2SG2N.js";
+import {
+  argsOrEmpty,
+  assertArg,
+  assertNewVarName,
+  assertStatements,
+  assertValueArg,
+  assertVarName,
+  describeArg,
+  describeEntry,
+  isRecordArg,
+  isTaggedArg,
+  presentValueArg
+} from "./chunk-CIMQZRRE.js";
+
+// src/statements/set-var.ts
+var SET_VAR = "mvp:set_var";
+var UPDATE_VAR = "mvp:update_var";
+function setVar(as, value, a) {
+  assertNewVarName("s.set_var", as);
+  assertValueArg("s.set_var", "value", value);
+  assertKnownKeys(`Statement "s.set_var": options`, a, OPTION_KEYS);
+  return annotate(
+    {
+      name: SET_VAR,
+      as,
+      context: { value: value.value, tag: value.tag, filters: value.filters }
+    },
+    a
+  );
+}
+function updateVar(name, value, a) {
+  assertVarName("s.update_var", name);
+  assertValueArg("s.update_var", "value", value);
+  assertKnownKeys(`Statement "s.update_var": options`, a, ANNOTATION_KEYS);
+  return annotate(
+    {
+      name: UPDATE_VAR,
+      context: { name, value: value.value, tag: value.tag, filters: value.filters },
+      output: { filters: [] }
+    },
+    a
+  );
+}
+registerStatement(SET_VAR, setVar);
+registerStatement(UPDATE_VAR, updateVar);
+
+// src/statements/special/control-flow.ts
+function asValue(arg) {
+  return "tag" in arg ? arg : arg.value;
+}
+function valueContext(statement, arg) {
+  assertArg(statement, "value", arg);
+  const value = arg !== null && (typeof arg === "object" || typeof arg === "function") ? asValue(arg) : void 0;
+  if (value === null || typeof value !== "object" && typeof value !== "function" || typeof value.tag !== "string") {
+    throw new Error(
+      `Statement "${statement}": argument "value" must be a value (\`c.*\`, \`ref()\`, \`inp()\`, \u2026) \u2014 got ${describeEntry(arg)}.`
+    );
+  }
+  return { value: value.value, tag: value.tag, filters: value.filters };
+}
+function returnValue(value, a) {
+  const context = valueContext("s.return", value);
+  assertKnownKeys(`Statement "s.return": options`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:return", context }, a);
+}
+function die(value, a) {
+  const context = valueContext("s.debug.stop", value);
+  assertKnownKeys(`Statement "s.debug.stop": options`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:die", context }, a);
+}
+function debugLog(value, a) {
+  const context = valueContext("s.debug.log", value);
+  assertKnownKeys(`Statement "s.debug.log": options`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:debug_log", context }, a);
+}
+function foreachBreak(a) {
+  assertKnownKeys(`Statement "s.foreach_break"`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:foreach_break", context: {} }, a);
+}
+function foreachContinue(a) {
+  assertKnownKeys(`Statement "s.foreach_continue"`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:foreach_continue", context: {} }, a);
+}
+function foreachRemove(a) {
+  assertKnownKeys(`Statement "s.foreach_remove"`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:foreach_remove", context: {} }, a);
+}
+registerStatement("mvp:return", returnValue);
+registerStatement("mvp:die", die);
+registerStatement("mvp:debug_log", debugLog);
+registerStatement("mvp:foreach_break", foreachBreak);
+registerStatement("mvp:foreach_continue", foreachContinue);
+registerStatement("mvp:foreach_remove", foreachRemove);
+
+// src/statements/special/loops.ts
+function valueFields(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+function run(body) {
+  return body.map(encodeStatement);
+}
+var FOR_KEYS = /* @__PURE__ */ Object.keys({ as: 1, count: 1, body: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function forLoop(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.for"`, args, FOR_KEYS);
+  assertArg("s.for", "as", args.as);
+  assertNewVarName("s.for", args.as, "as");
+  assertValueArg("s.for", "count", args.count);
+  assertStatements("s.for", "body", args.body);
+  return annotate({
+    name: "mvp:for",
+    context: { as: args.as, cnt: valueFields(args.count), run: run(args.body) },
+    input: []
+  }, args);
+}
+var FOREACH_KEYS = /* @__PURE__ */ Object.keys({ as: 1, list: 1, body: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function foreachLoop(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.foreach"`, args, FOREACH_KEYS);
+  assertArg("s.foreach", "as", args.as);
+  assertNewVarName("s.foreach", args.as, "as");
+  assertValueArg("s.foreach", "list", args.list);
+  assertStatements("s.foreach", "body", args.body);
+  return annotate({
+    name: "mvp:foreach",
+    context: { as: args.as, list: valueFields(args.list), run: run(args.body) },
+    input: []
+  }, args);
+}
+var WHILE_KEYS = /* @__PURE__ */ Object.keys({ when: 1, body: 1, disabled: 1, description: 1, mock: 1 });
+function whileLoop(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.while"`, args, WHILE_KEYS);
+  assertArg("s.while", "when", args.when);
+  assertStatements("s.while", "body", args.body);
+  return annotate({
+    name: "mvp:while",
+    context: { expr: encodeRuntimeCondition(args.when, "s.while `when`"), run: run(args.body) },
+    input: []
+  }, args);
+}
+function group(body, a) {
+  assertStatements("s.group", "body", body);
+  assertKnownKeys(`Statement "s.group": options`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:group", context: { run: run(body) }, input: [] }, a);
+}
+registerStatement("mvp:for", forLoop);
+registerStatement("mvp:foreach", foreachLoop);
+registerStatement("mvp:while", whileLoop);
+registerStatement("mvp:group", group);
+
+// src/statements/special/branch.ts
+function valueFields2(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+function run2(body) {
+  return body.map(encodeStatement);
+}
+var SWITCH_CASE_KEYS = /* @__PURE__ */ Object.keys({ when: 1, body: 1, break: 1, disabled: 1, description: 1, mock: 1 });
+function switchCase(args, where = "") {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.switch"${where === "" ? "" : `: argument "${where.slice(0, -1)}"`}`, args, SWITCH_CASE_KEYS);
+  assertValueArg("s.switch", `${where}when`, args.when);
+  assertStatements("s.switch", `${where}body`, args.body);
+  const context = { value: valueFields2(args.when) };
+  if (args.break !== void 0) {
+    context.break = args.break;
+  }
+  context.if = { run: run2(args.body) };
+  return annotate({ name: "mvp:switch_case", context, input: [] }, args);
+}
+var SWITCH_KEYS = /* @__PURE__ */ Object.keys({ on: 1, cases: 1, default: 1, disabled: 1, description: 1, mock: 1 });
+function switchStatement(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.switch"`, args, SWITCH_KEYS);
+  assertValueArg("s.switch", "on", args.on);
+  assertArg("s.switch", "cases", args.cases);
+  if (!Array.isArray(args.cases)) {
+    throw new Error(`Statement "s.switch": argument "cases" must be an array of { when, body } cases \u2014 got ${describeEntry(args.cases)}.`);
+  }
+  if (args.default !== void 0 && args.default !== null) assertStatements("s.switch", "default", args.default);
+  return annotate({
+    name: "mvp:switch",
+    context: {
+      value: valueFields2(args.on),
+      elif: {
+        run: args.cases.map((c2, i) => {
+          if (c2 === null || typeof c2 !== "object") {
+            throw new Error(
+              `Statement "s.switch": argument "cases[${i}]" must be a { when, body } case \u2014 got ${describeEntry(c2)}.`
+            );
+          }
+          return encodeStatement(switchCase(c2, `cases[${i}].`));
+        })
+      },
+      else: { run: run2(args.default ?? []) }
+    },
+    input: []
+  }, args);
+}
+function tryCatch(args) {
+  return tryCatchStatement(argsOrEmpty(args));
+}
+var TRY_CATCH_KEYS = /* @__PURE__ */ Object.keys({ try: 1, catch: 1, finally: 1, disabled: 1, description: 1, mock: 1 });
+function tryCatchStatement(args) {
+  assertKnownKeys(`Statement "s.try_catch"`, args, TRY_CATCH_KEYS);
+  assertStatements("s.try_catch", "try", args.try);
+  if (args.catch !== void 0 && args.catch !== null) assertStatements("s.try_catch", "catch", args.catch);
+  if (args.finally !== void 0 && args.finally !== null) assertStatements("s.try_catch", "finally", args.finally);
+  return annotate({
+    name: "mvp:try_catch",
+    context: {
+      if: { run: run2(args.try) },
+      else: { run: run2(args.catch ?? []) },
+      then: { run: run2(args.finally ?? []) }
+    },
+    input: []
+  }, args);
+}
+registerStatement("mvp:switch", switchStatement);
+registerStatement("mvp:switch_case", switchCase);
+registerStatement("mvp:try_catch", tryCatch);
+
+// src/statements/special/async-runtime.ts
+function encodeAsyncRuntime(runtime) {
+  if (!runtime) return void 0;
+  if (runtime.mode !== "async-dedicated") return { mode: runtime.mode };
+  return {
+    mode: runtime.mode,
+    cpu: runtime.cpu ?? "",
+    memory: runtime.memory ?? "",
+    timeout: runtime.timeout === void 0 ? "" : String(runtime.timeout),
+    max_retry: runtime.maxRetry === void 0 ? "" : String(runtime.maxRetry)
+  };
+}
+
+// src/statements/special/calls.ts
+function vf(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+function encodeCallInput(input, statement, field2 = "input") {
+  if (input === void 0 || input === null) return [];
+  if (typeof input !== "object" || Array.isArray(input) || isTaggedValue(input)) {
+    throw new Error(
+      `Statement "${statement}": argument "${field2}" must be a { name: value } record \u2014 got ${describeEntry(input)}.`
+    );
+  }
+  return Object.entries(input).filter(([, v]) => v !== void 0).map(([name, v]) => ({ name, ...vf(coerceScalar(v)), ...isIgnored(v) ? { ignore: true } : {} }));
+}
+function fnId(fn) {
+  return fn === null ? "" : resolveRef("function", fn, `Statement "s.function.run": argument "fn"`);
+}
+var FUNCTION_RUN_KEYS = /* @__PURE__ */ Object.keys({ fn: 1, as: 1, input: 1, runtime: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function functionRun(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.function.run"`, args, FUNCTION_RUN_KEYS);
+  assertArg("s.function.run", "fn", args.fn, { nullable: true });
+  return annotate({
+    name: "mvp:function",
+    context: { function: { id: fnId(args.fn) } },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.function.run"),
+    runtime: encodeAsyncRuntime(args.runtime)
+  }, args);
+}
+var FUNCTION_CALL_KEYS = /* @__PURE__ */ Object.keys({ fn: 1, as: 1, input: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function functionCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.function.call"`, args, FUNCTION_CALL_KEYS);
+  assertArg("s.function.call", "fn", args.fn);
+  return annotate({
+    name: "mvp:workspace_run_function",
+    context: { id: resolveRef("function", args.fn, `Statement "s.function.call": argument "fn"`) },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.function.call")
+  }, args);
+}
+function deliveredName(name) {
+  return name.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("-");
+}
+function asDelivered(headers) {
+  if (headers === void 0 || headers === null) return void 0;
+  if (isTaggedValue(headers) || typeof headers !== "object") return headers;
+  if (Array.isArray(headers)) {
+    return headers.map((line) => {
+      if (typeof line !== "string") return line;
+      const colon = line.indexOf(":");
+      return colon === -1 ? line : deliveredName(line.slice(0, colon)) + line.slice(colon);
+    });
+  }
+  const delivered = {};
+  for (const [name, value] of Object.entries(headers)) {
+    const as = deliveredName(name);
+    if (Object.hasOwn(delivered, as)) {
+      throw new Error(
+        `Statement "s.api.call": headers name "${as}" twice (as ${JSON.stringify(name)} and another spelling) \u2014 a real request delivers both under that one name, so only one can reach the endpoint.`
+      );
+    }
+    delivered[as] = value;
+  }
+  return delivered;
+}
+var API_CALL_KEYS = /* @__PURE__ */ Object.keys({ api: 1, query: 1, as: 1, input: 1, headers: 1, auth: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function apiCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.api.call"`, args, API_CALL_KEYS);
+  if (args.query !== void 0 && args.api === void 0) {
+    throw new Error(`Statement "s.api.call": the endpoint goes in \`api\`, not \`query\` \u2014 s.api.call({ api: myQuery, \u2026 }).`);
+  }
+  assertArg("s.api.call", "api", args.api);
+  const context = { id: resolveQueryRef(args.api, `Statement "s.api.call": argument "api"`) };
+  const headers = coerceHeaders(asDelivered(args.headers), `Statement "s.api.call": argument "headers"`);
+  if (headers) context.headers = vf(headers);
+  if (args.auth !== void 0 && args.auth !== null) {
+    const auth = args.auth;
+    const token = isRecordArg(auth) ? auth.token : void 0;
+    if (!isRecordArg(auth) || typeof token !== "string" && !isTaggedArg(token)) {
+      throw new Error(
+        `Statement "s.api.call": argument "auth" must be { token, ignoreExpiration? } with token a string or a tagged value \u2014 got ${isRecordArg(auth) ? `token ${describeEntry(token)}` : describeEntry(auth)}.`
+      );
+    }
+    context.token = typeof args.auth.token === "string" ? args.auth.token : vf(args.auth.token);
+    if (args.auth.ignoreExpiration) context.token_ignore_expiration = true;
+  }
+  return annotate({
+    name: "mvp:workspace_run_endpoint",
+    context,
+    as: args.as,
+    input: encodeCallInput(args.input, "s.api.call")
+  }, args);
+}
+var TASK_CALL_KEYS = /* @__PURE__ */ Object.keys({ task: 1, as: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function taskCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.task.call"`, args, TASK_CALL_KEYS);
+  assertArg("s.task.call", "task", args.task);
+  return annotate({
+    name: "mvp:workspace_run_task",
+    context: { id: resolveRef("task", args.task, `Statement "s.task.call": argument "task"`) },
+    as: args.as,
+    input: []
+  }, args);
+}
+var TOOL_CALL_KEYS = /* @__PURE__ */ Object.keys({ tool: 1, as: 1, input: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function toolCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.tool.call"`, args, TOOL_CALL_KEYS);
+  assertArg("s.tool.call", "tool", args.tool);
+  return annotate({
+    name: "mvp:workspace_run_tool",
+    context: { id: resolveRef("tool", args.tool, `Statement "s.tool.call": argument "tool"`) },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.tool.call")
+  }, args);
+}
+var TRIGGER_CALL_KEYS = /* @__PURE__ */ Object.keys({ trigger: 1, as: 1, input: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function triggerCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.trigger.call"`, args, TRIGGER_CALL_KEYS);
+  assertArg("s.trigger.call", "trigger", args.trigger);
+  return annotate({
+    name: "mvp:workspace_run_trigger",
+    context: { id: resolveRef("trigger", args.trigger, `Statement "s.trigger.call": argument "trigger"`) },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.trigger.call")
+  }, args);
+}
+var MIDDLEWARE_CALL_KEYS = /* @__PURE__ */ Object.keys({ middleware: 1, as: 1, input: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function middlewareCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.middleware.call"`, args, MIDDLEWARE_CALL_KEYS);
+  assertArg("s.middleware.call", "middleware", args.middleware);
+  return annotate({
+    name: "mvp:workspace_run_middleware",
+    context: { id: resolveRef("middleware", args.middleware, `Statement "s.middleware.call": argument "middleware"`) },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.middleware.call")
+  }, args);
+}
+var ADDON_CALL_KEYS = /* @__PURE__ */ Object.keys({ addon: 1, as: 1, input: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function addonCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.addon.call"`, args, ADDON_CALL_KEYS);
+  assertArg("s.addon.call", "addon", args.addon);
+  return annotate({
+    name: "mvp:workspace_run_addon",
+    context: { id: resolveRef("addon", args.addon, `Statement "s.addon.call": argument "addon"`) },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.addon.call")
+  }, args);
+}
+function refuseDerivedIdentity(statement, args) {
+  const legacy = args;
+  if (legacy.action === void 0 && legacy.package === void 0) return;
+  throw new Error(
+    `Statement "${statement}": \`action\`/\`package\` named an action and let the SDK derive its id. An action is a third-party package installed onto the instance, so its id is assigned at install and cannot be derived from a name \u2014 a derived one addresses nothing. Pass the installed id instead: \`actionId\` for action.call, or \`traceId\`/\`versionId\`/\`slug\` for action.package.call. Read them off an existing call in a pulled workspace.`
+  );
+}
+var ACTION_CALL_KEYS = /* @__PURE__ */ Object.keys({ actionId: 1, as: 1, input: 1, registry: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function actionCall(args) {
+  args = argsOrEmpty(args);
+  refuseDerivedIdentity("s.action.call", args);
+  assertKnownKeys(`Statement "s.action.call"`, args, ACTION_CALL_KEYS);
+  assertArg("s.action.call", "actionId", args.actionId);
+  return annotate({
+    name: "mvp:action",
+    context: { run_version: { id: args.actionId } },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.action.call"),
+    settings_registry: encodeCallInput(args.registry, "s.action.call", "registry")
+  }, args);
+}
+var ACTION_PACKAGE_CALL_KEYS = /* @__PURE__ */ Object.keys({ traceId: 1, versionId: 1, slug: 1, as: 1, input: 1, registry: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function actionPackageCall(args) {
+  args = argsOrEmpty(args);
+  refuseDerivedIdentity("s.action.package.call", args);
+  assertKnownKeys(`Statement "s.action.package.call"`, args, ACTION_PACKAGE_CALL_KEYS);
+  assertArg("s.action.package.call", "traceId", args.traceId);
+  assertArg("s.action.package.call", "versionId", args.versionId);
+  assertArg("s.action.package.call", "slug", args.slug);
+  return annotate({
+    name: "mvp:action_package",
+    context: {
+      action: { trace_id: args.traceId },
+      package: { slug: args.slug },
+      package_version: { id: args.versionId }
+    },
+    as: args.as,
+    input: encodeCallInput(args.input, "s.action.package.call"),
+    settings_registry: encodeCallInput(args.registry, "s.action.package.call", "registry")
+  }, args);
+}
+var WORKFLOW_TEST_CALL_KEYS = /* @__PURE__ */ Object.keys({ workflowTest: 1, as: 1, datasource: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function workflowTestCall(args) {
+  args = argsOrEmpty(args);
+  assertKnownKeys(`Statement "s.workflow_test.call"`, args, WORKFLOW_TEST_CALL_KEYS);
+  assertArg("s.workflow_test.call", "workflowTest", args.workflowTest);
+  return annotate({
+    name: "mvp:workspace_run_workflow_test",
+    context: {
+      datasource: args.datasource ?? "",
+      id: resolveRef("workflow_test", args.workflowTest, `Statement "s.workflow_test.call": argument "workflowTest"`)
+    },
+    as: args.as,
+    input: []
+  }, args);
+}
+registerStatement("mvp:function", functionRun);
+registerStatement("mvp:action", actionCall);
+registerStatement("mvp:action_package", actionPackageCall);
+registerStatement("mvp:workspace_run_workflow_test", workflowTestCall);
+registerStatement("mvp:workspace_run_function", functionCall);
+registerStatement("mvp:workspace_run_endpoint", apiCall);
+registerStatement("mvp:workspace_run_task", taskCall);
+registerStatement("mvp:workspace_run_tool", toolCall);
+registerStatement("mvp:workspace_run_trigger", triggerCall);
+registerStatement("mvp:workspace_run_middleware", middlewareCall);
+registerStatement("mvp:workspace_run_addon", addonCall);
+
+// src/statements/special/input-enums.ts
+var SPECIAL_INPUT_ENUMS = {
+  "mvp:get_input": { encoding: ["json", "yaml", "x-www-form-urlencoded", "none"] },
+  "mvp:cloud_job": { template: ["micro", "small", "medium", "large", "xlarge"] },
+  "mvp:call_agent": { version: ["v4", "v5"] }
+};
+function specialEnumValue(stored, statement, field2, input, provided, note) {
+  const values = SPECIAL_INPUT_ENUMS[stored][input];
+  if (typeof provided !== "string") presentValueArg(statement, field2, provided);
+  try {
+    return resolveEnumValue(statement, field2, values, provided);
+  } catch (err) {
+    if (note !== void 0 && err instanceof Error) err.message = `${err.message} ${note}`;
+    throw err;
+  }
+}
+
+// src/statements/special/ai-cloud.ts
+function vf2(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+var AI_AGENT_RUN_KEYS = /* @__PURE__ */ Object.keys({ agent: 1, as: 1, args: 1, allowToolExecution: 1, version: 1, runtime: 1, resultShape: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function aiAgentRun(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.ai.agent.run"`, a, AI_AGENT_RUN_KEYS);
+  assertArg("s.ai.agent.run", "agent", a.agent);
+  const input = [];
+  if (a.args !== void 0 && a.args !== null) {
+    if (!isTaggedValue(a.args) && (typeof a.args !== "object" || Array.isArray(a.args))) {
+      throw new Error(
+        `Statement "s.ai.agent.run": argument "args" must be a { name: value } record or a tagged value \u2014 got ${describeEntry(a.args)}.`
+      );
+    }
+    const argsValue = isTaggedValue(a.args) ? a.args : obj(a.args);
+    input.push({ name: "args", ...vf2(argsValue) });
+  }
+  if (presentValueArg("s.ai.agent.run", "allowToolExecution", a.allowToolExecution))
+    input.push({ name: "allow_tool_execution", ...vf2(a.allowToolExecution) });
+  if (a.version !== void 0 && a.version !== null) {
+    input.push({ name: "version", ...vf2(specialEnumValue("mvp:call_agent", "s.ai.agent.run", "version", "version", a.version)) });
+  }
+  const stmt = {
+    name: "mvp:call_agent",
+    context: { toolset: { id: resolveRef("toolset", a.agent, `Statement "s.ai.agent.run": argument "agent"`, "agent") } },
+    as: a.as ?? "",
+    input
+  };
+  const runtime = encodeAsyncRuntime(a.runtime);
+  if (runtime) stmt.runtime = runtime;
+  return annotate(stmt, a);
+}
+var CLOUD_JOB_KEYS = /* @__PURE__ */ Object.keys({ as: 1, image: 1, command: 1, args: 1, secret: 1, template: 1, await: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function cloudJob(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.cloud.job"`, a, CLOUD_JOB_KEYS);
+  assertValueArg("s.cloud.job", "image", a.image);
+  assertValueArg("s.cloud.job", "command", a.command);
+  const input = [];
+  input.push({ name: "image", ...vf2(a.image) });
+  input.push({ name: "command", ...vf2(a.command) });
+  if (presentValueArg("s.cloud.job", "args", a.args)) input.push({ name: "args", ...vf2(a.args) });
+  if (presentValueArg("s.cloud.job", "secret", a.secret)) input.push({ name: "secret", ...vf2(a.secret) });
+  if (a.template !== void 0 && a.template !== null) {
+    input.push({ name: "template", ...vf2(specialEnumValue("mvp:cloud_job", "s.cloud.job", "template", "template", a.template)) });
+  }
+  if (presentValueArg("s.cloud.job", "await", a.await)) input.push({ name: "await", ...vf2(a.await) });
+  return annotate({ name: "mvp:cloud_job", context: {}, as: a.as ?? "", input }, a);
+}
+var CLOUD_JOB_AWAIT_KEYS = /* @__PURE__ */ Object.keys({ as: 1, ids: 1, timeout: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function cloudJobAwait(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.cloud.job.await"`, a, CLOUD_JOB_AWAIT_KEYS);
+  assertValueArg("s.cloud.job.await", "ids", a.ids);
+  assertValueArg("s.cloud.job.await", "timeout", a.timeout);
+  return annotate({
+    name: "mvp:cloud_job_await",
+    context: {},
+    as: a.as ?? "",
+    input: [
+      { name: "ids", ...vf2(a.ids) },
+      { name: "timeout", ...vf2(a.timeout) }
+    ]
+  }, a);
+}
+var CLOUD_JOB_STATUS_KEYS = /* @__PURE__ */ Object.keys({ as: 1, id: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function cloudJobStatus(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.cloud.job.status"`, a, CLOUD_JOB_STATUS_KEYS);
+  assertValueArg("s.cloud.job.status", "id", a.id);
+  return annotate({
+    name: "mvp:cloud_job_status",
+    context: {},
+    as: a.as ?? "",
+    input: [{ name: "id", ...vf2(a.id) }]
+  }, a);
+}
+registerStatement("mvp:call_agent", aiAgentRun);
+registerStatement("mvp:cloud_job", cloudJob);
+registerStatement("mvp:cloud_job_await", cloudJobAwait);
+registerStatement("mvp:cloud_job_status", cloudJobStatus);
+
+// src/statements/special/misc.ts
+function vf3(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+function isTransformRecord(t) {
+  return !isTaggedValue(t) && !Array.isArray(t);
+}
+function assertArrayMapTransform(t) {
+  const where = 'Statement "s.array.map": argument "transform"';
+  if (isTaggedValue(t)) return;
+  if (Array.isArray(t)) {
+    t.forEach((pair, i) => {
+      const ok = typeof pair === "object" && pair !== null && isTaggedValue(pair.key) && isTaggedValue(pair.value);
+      if (!ok) {
+        throw new Error(`${where.slice(0, -1)}[${i}]" must be a { key, value } pair of tagged values \u2014 got ${describeEntry(pair)}.`);
+      }
+    });
+    return;
+  }
+  if (typeof t !== "object" || t === null) {
+    throw new Error(
+      `${where} must be a tagged value, a { key: value } record, or a list of { key, value } pairs \u2014 got ${describeEntry(t)}.`
+    );
+  }
+  for (const [key, value] of Object.entries(t)) {
+    if (!isTaggedValue(value)) {
+      throw new Error(`${where.slice(0, -1)}.${key}" must be a tagged value (\`c.*\`, \`ref()\`, \u2026) \u2014 got ${describeEntry(value)}.`);
+    }
+  }
+}
+var ARRAY_MAP_KEYS = /* @__PURE__ */ Object.keys({ source: 1, as: 1, transform: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function arrayMap(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.array.map"`, a, ARRAY_MAP_KEYS);
+  assertValueArg("s.array.map", "source", a.source);
+  const context = { output_type: "value", collection: vf3(a.source) };
+  if (a.transform !== void 0 && a.transform !== null) {
+    assertArrayMapTransform(a.transform);
+    const pairs = isTransformRecord(a.transform) ? Object.entries(a.transform).map(([key, value]) => ({ key: c.text(key), value })) : Array.isArray(a.transform) ? a.transform : void 0;
+    if (pairs) {
+      if (pairs.length === 0) {
+        throw new Error(
+          "Statement \"s.array.map\": an object `transform` needs at least one key \u2014 the engine's object branch iterates `transform_object` and an empty one maps every item to `{}`. Pass a record of values (`{ id: ref('$this') }`), a list of `{ key, value }` pairs, or a single value for the scalar form."
+        );
+      }
+      context.output_type = "object";
+      context.transform_object = pairs.map(({ key, value }) => ({
+        attribute_key: vf3(key),
+        attribute_value: vf3(value)
+      }));
+    } else {
+      context.transform_value = vf3(a.transform);
+    }
+  }
+  return annotate({ name: "mvp:array_map", context, as: a.as ?? "", input: [] }, a);
+}
+var ARRAY_UNION_KEYS = /* @__PURE__ */ Object.keys({ source: 1, with: 1, as: 1, transform: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function arrayUnion(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.array.union"`, a, ARRAY_UNION_KEYS);
+  assertValueArg("s.array.union", "source", a.source);
+  assertValueArg("s.array.union", "with", a.with);
+  const context = { left: vf3(a.source), right: vf3(a.with) };
+  if (presentValueArg("s.array.union", "transform", a.transform)) context.transform_value = vf3(a.transform);
+  return annotate({ name: "mvp:array_union", context, as: a.as ?? "", input: [] }, a);
+}
+function comment(text = "", a) {
+  if (typeof text !== "string") {
+    throw new Error(`Statement "s.comment": argument "text" must be the comment as a string \u2014 got ${describeEntry(text)}.`);
+  }
+  assertKnownKeys(`Statement "s.comment": options`, a, ANNOTATION_KEYS);
+  return annotate({ name: "mvp:comment", description: text, context: {}, input: [] }, a);
+}
+var GET_RAW_INPUT_KEYS = /* @__PURE__ */ Object.keys({ as: 1, encoding: 1, excludeMiddleware: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function getRawInput(a = {}) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.util.get_raw_input"`, a, GET_RAW_INPUT_KEYS);
+  return annotate({
+    name: "mvp:get_input",
+    context: {},
+    as: a.as ?? "",
+    // Both entries are `?=` optionals in the engine schema (`encoding?=json`,
+    // `exclude_middleware_modification?=false`) and Xano's editor writes neither
+    // for a plain body capture — so they are emitted only when authored.
+    input: [
+      ...a.encoding !== void 0 && a.encoding !== null ? [{ name: "encoding", ...vf3(specialEnumValue(
+        "mvp:get_input",
+        "s.util.get_raw_input",
+        "encoding",
+        "encoding",
+        a.encoding,
+        '`"none"` binds the body\'s bytes as one string \u2014 what a signature check over the raw body needs.'
+      )) }] : [],
+      ...presentValueArg("s.util.get_raw_input", "excludeMiddleware", a.excludeMiddleware) ? [{ name: "exclude_middleware_modification", ...vf3(a.excludeMiddleware) }] : []
+    ]
+  }, a);
+}
+function postProcess(body, a) {
+  assertStatements("s.util.post_process", "body", body);
+  assertKnownKeys(`Statement "s.util.post_process": options`, a, ANNOTATION_KEYS);
+  return annotate(
+    { name: "mvp:post_process", context: { run: body.map(encodeStatement) }, input: [] },
+    a
+  );
+}
+var REALTIME_EVENT_KEYS = /* @__PURE__ */ Object.keys({ channel: 1, data: 1, authTable: 1, authId: 1, disabled: 1, description: 1, mock: 1 });
+function realtimeEvent(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.api.realtime_event"`, a, REALTIME_EVENT_KEYS);
+  assertValueArg("s.api.realtime_event", "channel", a.channel);
+  assertValueArg("s.api.realtime_event", "data", a.data);
+  assertValueArg("s.api.realtime_event", "authId", a.authId);
+  const auth = { row_id: vf3(a.authId) };
+  if (a.authTable !== void 0 && a.authTable !== null)
+    auth.dbo_id = resolveRef("dbo", a.authTable, `Statement "s.api.realtime_event": argument "authTable"`);
+  return annotate({
+    name: "mvp:realtime_event",
+    context: { channel: vf3(a.channel), data: vf3(a.data), auth },
+    input: []
+  }, a);
+}
+var REALTIME_PUBLISH_KEYS = /* @__PURE__ */ Object.keys({ server: 1, channel: 1, data: 1, message: 1, authTable: 1, authId: 1, disabled: 1, description: 1, mock: 1 });
+function realtimePublish(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.realtime.publish"`, a, REALTIME_PUBLISH_KEYS);
+  const server = publishServerValue(a.server);
+  const channel = typeof a.channel === "string" ? c.text(a.channel) : a.channel;
+  if (!channel || channel.value === "") {
+    throw new Error(
+      'Statement "s.realtime.publish": required argument "channel" is missing \u2014 the filled-in channel path to publish onto (use `realtimeChannel().getChannel({\u2026})`).'
+    );
+  }
+  assertValueArg("s.realtime.publish", "channel", channel);
+  assertFilledChannel(channel);
+  assertValueArg("s.realtime.publish", "data", a.data);
+  const context = {
+    realtime_server: server,
+    channel: vf3(channel),
+    data: vf3(a.data)
+  };
+  if (a.message !== void 0 && a.message !== null) {
+    assertValueArg("s.realtime.publish", "message", a.message);
+    context.message = vf3(a.message);
+  }
+  const auth = {};
+  if (a.authTable !== void 0 && a.authTable !== null)
+    auth.dbo_id = resolveRef("dbo", a.authTable, `Statement "s.realtime.publish": argument "authTable"`);
+  if (a.authId !== void 0 && a.authId !== null) {
+    assertValueArg("s.realtime.publish", "authId", a.authId);
+    auth.row_id = vf3(a.authId);
+  }
+  if (Object.keys(auth).length > 0) context.auth = auth;
+  return annotate({ name: "mvp:realtime_publish", context, input: [] }, a);
+}
+function assertFilledChannel(channel) {
+  if (!channel.tag.startsWith("const")) return;
+  if (typeof channel.value !== "string" || !/[{}]/.test(channel.value)) return;
+  throw new Error(
+    `Statement "s.realtime.publish": \`channel\` is "${channel.value}", which is still a TEMPLATE \u2014 its {param} was never filled in, so this publishes onto a path no client can join, and the engine swallows the miss silently. Fill it in with \`channel.getChannel({ \u2026 })\` (e.g. \`c.text(rooms.getChannel({ room_id: 42 }))\`), or build the path at runtime from a \`ref\`/\`inp\`.`
+  );
+}
+function publishServerValue(server) {
+  if (typeof server === "string") {
+    if (server === "") throw new Error(`Statement "s.realtime.publish": required argument "server" is missing \u2014 the owning realtime server's name.`);
+    return { value: server, tag: "const", filters: [] };
+  }
+  if (server && typeof server === "object" && "tag" in server) return vf3(server);
+  const name = server && typeof server === "object" ? server.name : void 0;
+  if (!name) {
+    throw new Error(
+      'Statement "s.realtime.publish": required argument "server" is missing \u2014 pass the `realtimeServer()` handle, its name, or a value naming it.'
+    );
+  }
+  return { value: name, tag: "const", filters: [] };
+}
+var CREATE_AUTH_TOKEN_KEYS = /* @__PURE__ */ Object.keys({ table: 1, id: 1, extras: 1, expiration: 1, as: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function createAuthToken(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.security.create_auth_token"`, a, CREATE_AUTH_TOKEN_KEYS);
+  assertValueArg("s.security.create_auth_token", "id", a.id);
+  assertArg("s.security.create_auth_token", "table", a.table, { nullable: true });
+  const extras = typeof a.extras === "object" && a.extras !== null && !Array.isArray(a.extras) && !isTaggedValue(a.extras) ? obj(a.extras) : a.extras;
+  return annotate({
+    name: "mvp:create_auth",
+    context: {},
+    as: a.as ?? "",
+    // Entry order and optionality come straight from the engine's own input
+    // schema — `id`, `dbtable`, `extras?={}`, `expiration?=86400`. Xano's editor
+    // writes this shape, so this is what a pulled workspace has.
+    input: [
+      { name: "id", ...vf3(a.id) },
+      {
+        name: "dbtable",
+        value: a.table === null ? "" : resolveRef("dbo", a.table, `Statement "s.security.create_auth_token": argument "table"`),
+        tag: "const",
+        filters: []
+      },
+      ...presentValueArg("s.security.create_auth_token", "extras", extras) ? [{ name: "extras", ...vf3(extras) }] : [],
+      ...presentValueArg("s.security.create_auth_token", "expiration", a.expiration) ? [{ name: "expiration", ...vf3(a.expiration) }] : []
+    ]
+  }, a);
+}
+var EXPECT_TO_THROW_KEYS = /* @__PURE__ */ Object.keys({ body: 1, exception: 1, disabled: 1, description: 1, mock: 1 });
+function expectToThrow(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.expect.to_throw"`, a, EXPECT_TO_THROW_KEYS);
+  assertStatements("s.expect.to_throw", "body", a.body);
+  const context = { run: a.body.map(encodeStatement) };
+  if (presentValueArg("s.expect.to_throw", "exception", a.exception)) context.value1 = vf3(a.exception);
+  return annotate({ name: "mvp:test_expect_to_throw", context, input: [] }, a);
+}
+var EXPECT_TO_MATCH_KEYS = /* @__PURE__ */ Object.keys({ expr: 1, value: 1, disabled: 1, description: 1, mock: 1 });
+function expectToMatch(a = {}) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.expect.to_match"`, a, EXPECT_TO_MATCH_KEYS);
+  if (a.value !== void 0 && a.value !== null) assertValueArg("s.expect.to_match", "value", a.value);
+  if (a.expr !== void 0 && a.expr !== null) assertValueArg("s.expect.to_match", "expr", a.expr);
+  const reversed = reversedOperandRefusal(a.value, a.expr);
+  if (reversed) {
+    throw new Error(
+      `Statement "s.expect.to_match": ${reversed} \u2014 \`expr\` is the value under test and \`value\` is the pattern.`
+    );
+  }
+  if (a.value) {
+    const refusal = barePatternRefusal(a.value);
+    if (refusal) throw new Error(`Statement "s.expect.to_match": ${refusal}.`);
+  }
+  return generated.expect.to_match(a);
+}
+registerStatement("mvp:array_map", arrayMap);
+registerStatement("mvp:array_union", arrayUnion);
+registerStatement("mvp:comment", comment);
+registerStatement("mvp:get_input", getRawInput);
+registerStatement("mvp:post_process", postProcess);
+registerStatement("mvp:realtime_event", realtimeEvent);
+registerStatement("mvp:realtime_publish", realtimePublish);
+registerStatement("mvp:create_auth", createAuthToken);
+registerStatement("mvp:test_expect_to_throw", expectToThrow);
+
+// src/statements/special/ip-lookup.ts
+var IP_LOOKUP_KEYS = /* @__PURE__ */ Object.keys({ value: 1, as: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function ipLookup(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.util.ip_lookup"`, a, IP_LOOKUP_KEYS);
+  return generated.util.ip_lookup({
+    as: a.as,
+    value: a.value,
+    disabled: a.disabled,
+    description: a.description,
+    asFilters: a.asFilters,
+    // Read off the authored object at runtime; the generated arg type omits it.
+    ...{ mock: a.mock }
+  });
+}
+
+// src/statements/generated/catalog.ts
+for (const spec2 of GENERATED_SPECS) {
+  if (!isRegisteredStatement(spec2.name)) registerSpec(spec2);
+}
+var specByName = new Map(GENERATED_SPECS.map((s2) => [s2.name, s2]));
+function spec(name) {
+  const s2 = specByName.get(name);
+  if (!s2) throw new Error(`Generated catalog is missing expected statement "${name}".`);
+  return s2;
+}
+function mutation(name) {
+  const s2 = spec(name);
+  return (varName, value) => encodeFromSpec(s2, { name: varName, value });
+}
+function objectOp(name) {
+  const s2 = spec(name);
+  return (as, value) => encodeFromSpec(s2, { as, value });
+}
+var mathAdd = mutation("mvp:math_add");
+var mathSub = mutation("mvp:math_sub");
+var mathMul = mutation("mvp:math_mul");
+var mathDiv = mutation("mvp:math_div");
+var bitwiseAnd = mutation("mvp:bitwise_and");
+var bitwiseOr = mutation("mvp:bitwise_or");
+var bitwiseXor = mutation("mvp:bitwise_xor");
+var textAppend = mutation("mvp:text_append");
+var textPrepend = mutation("mvp:text_prepend");
+var objectKeys = objectOp("mvp:object_keys");
+var objectValues = objectOp("mvp:object_values");
+var objectEntries = objectOp("mvp:object_entries");
+var GENERATED_STATEMENT_NAMES = GENERATED_SPECS.map((s2) => s2.name);
+
+// src/statements/special/api-request.ts
+var API_REQUEST_KEYS = /* @__PURE__ */ Object.keys({ as: 1, url: 1, output: 1, method: 1, params: 1, headers: 1, timeout: 1, follow_location: 1, verify_host: 1, verify_peer: 1, ca_certificate: 1, certificate: 1, certificate_pass: 1, private_key: 1, private_key_pass: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function apiRequest(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.api.request"`, a, API_REQUEST_KEYS);
+  assertSslConsistency('Statement "s.api.request"', a);
+  return generated.api.request({
+    as: a.as,
+    url: coerceText(a.url, `Statement "s.api.request": argument "url"`),
+    ...coerceHttpFields(a),
+    disabled: a.disabled,
+    description: a.description,
+    output: a.output,
+    asFilters: a.asFilters,
+    // Read off the authored object at runtime; the generated arg type omits it.
+    ...{ mock: a.mock }
+  });
+}
+var STREAM_FROM_REQUEST_KEYS = /* @__PURE__ */ Object.keys({ as: 1, url: 1, method: 1, params: 1, headers: 1, timeout: 1, follow_location: 1, verify_host: 1, verify_peer: 1, ca_certificate: 1, certificate: 1, certificate_pass: 1, private_key: 1, private_key_pass: 1, disabled: 1, description: 1, mock: 1 });
+function streamFromRequest(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.stream.from_request"`, a, STREAM_FROM_REQUEST_KEYS);
+  assertSslConsistency('Statement "s.stream.from_request"', a);
+  return annotate(generated.stream.from_request({
+    as: a.as,
+    url: coerceText(a.url, `Statement "s.stream.from_request": argument "url"`),
+    ...coerceHttpFields(a, "s.stream.from_request")
+  }), a);
+}
+var WEBFLOW_REQUEST_KEYS = [.../* @__PURE__ */ Object.keys({ as: 1, path: 1, method: 1, params: 1, timeout: 1, follow_location: 1, verify_host: 1, verify_peer: 1, ca_certificate: 1, certificate: 1, certificate_pass: 1, private_key: 1, private_key_pass: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 }), "headers"];
+function webflowRequest(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.webflow.request"`, a, WEBFLOW_REQUEST_KEYS);
+  assertSslConsistency('Statement "s.webflow.request"', a);
+  return generated.webflow.request({
+    as: a.as,
+    path: coerceText(a.path, `Statement "s.webflow.request": argument "path"`),
+    ...coerceHttpFields(a, "s.webflow.request"),
+    disabled: a.disabled,
+    description: a.description,
+    asFilters: a.asFilters,
+    // Read off the authored object at runtime; the generated arg type omits it.
+    ...{ mock: a.mock }
+  });
+}
+
+// src/statements/special/microservice.ts
+function resolveMicroserviceHost(host, port) {
+  if (isValue(host)) {
+    if (port !== void 0) {
+      const v = host;
+      const literal = typeof v.tag === "string" && v.tag.startsWith("const") && typeof v.value === "string" && !v.filters?.length;
+      throw new Error(
+        literal ? `Statement "s.microservice.request": \`port\` is not joined onto a \`c.text(...)\` \`host\`. Pass the name as a plain string (\`host: ${JSON.stringify(v.value)}, port: ${String(port)}\`), or spell the port in the text (\`c.text("${String(v.value)}:${String(port)}")\`).` : 'Statement "s.microservice.request": `port` cannot be joined onto a dynamic `host` at build time. Build the joined `"name:port"` string in the value itself instead.'
+      );
+    }
+    return host;
+  }
+  if (typeof host === "string") {
+    if (port !== void 0 && host.includes(":")) {
+      throw new Error(
+        `Statement "s.microservice.request": \`host\` already carries a port ("${host}"), so \`port: ${String(port)}\` is ambiguous. Pass the port once \u2014 either joined into \`host\` or as \`port\`.`
+      );
+    }
+    return port === void 0 ? host : `${host}:${port}`;
+  }
+  return defHost(host, port);
+}
+function defHost(host, port) {
+  const declared = declaredServicePorts(host);
+  if (port !== void 0) {
+    if (declared.length > 0 && !declared.includes(String(port))) {
+      throw new Error(
+        `Statement "s.microservice.request": microservice "${host.name}" does not expose port ${String(port)}. It declares: ${declared.join(", ")}.`
+      );
+    }
+    return `${host.name}:${port}`;
+  }
+  if (declared.length === 1) return `${host.name}:${declared[0]}`;
+  if (declared.length === 0) return host.name;
+  throw new Error(
+    `Statement "s.microservice.request": microservice "${host.name}" declares ${declared.length} ports (${declared.join(", ")}), so \`port\` is required to pick one.`
+  );
+}
+var MICROSERVICE_DEFAULTS = {
+  method: "GET",
+  params: {},
+  headers: [],
+  timeout: 10,
+  follow_location: true
+};
+var MICROSERVICE_KEYS = /* @__PURE__ */ Object.keys({ as: 1, host: 1, port: 1, path: 1, method: 1, params: 1, headers: 1, timeout: 1, follow_location: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function microserviceRequest(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.microservice.request"`, a, MICROSERVICE_KEYS);
+  assertArg("s.microservice.request", "host", a.host);
+  assertArg("s.microservice.request", "path", a.path);
+  const statement = generated.microservice.request({
+    as: a.as,
+    host: coerceText(resolveMicroserviceHost(a.host, a.port), `Statement "s.microservice.request": argument "host"`),
+    path: coerceText(a.path, `Statement "s.microservice.request": argument "path"`),
+    // `??` (not `||`) so an explicit `false`/`0`/`""` is honored, not defaulted.
+    method: coerceText(a.method ?? MICROSERVICE_DEFAULTS.method, `Statement "s.microservice.request": argument "method"`),
+    params: coerceObj(a.params ?? MICROSERVICE_DEFAULTS.params, `Statement "s.microservice.request": argument "params"`),
+    headers: coerceHeaders(a.headers ?? MICROSERVICE_DEFAULTS.headers, `Statement "s.microservice.request": argument "headers"`),
+    timeout: coerceInt(a.timeout ?? MICROSERVICE_DEFAULTS.timeout, `Statement "s.microservice.request": argument "timeout"`),
+    follow_location: coerceBool(a.follow_location ?? MICROSERVICE_DEFAULTS.follow_location, `Statement "s.microservice.request": argument "follow_location"`),
+    disabled: a.disabled,
+    description: a.description,
+    asFilters: a.asFilters,
+    // Read off the authored object at runtime; the generated arg type omits it.
+    ...{ mock: a.mock }
+  });
+  const host = a.host;
+  if (host !== null && typeof host === "object" && !isValue(host)) noteMicroserviceHandleHost(statement, host.name);
+  return statement;
+}
+
+// src/statements/special/closed-sets.ts
+var STORAGE_ACCESS = ["public", "private"];
+var HEADER_DUPLICATES = ["replace", "append"];
+function assertClosed(factory, field2, values, got) {
+  if (got === void 0 || typeof got === "string" && values.includes(got)) return;
+  throw new Error(
+    `Statement "${factory}": argument "${field2}" accepts only ${values.map((v) => JSON.stringify(v)).join(" | ")} \u2014 got ${typeof got === "string" ? JSON.stringify(got) : String(got)}.`
+  );
+}
+function field(a, key) {
+  return a !== null && typeof a === "object" ? a[key] : void 0;
+}
+function createAttachment(a) {
+  assertClosed("s.storage.create_attachment", "access", STORAGE_ACCESS, field(a, "access"));
+  return generated.storage.create_attachment(a);
+}
+function createAudio(a) {
+  assertClosed("s.storage.create_audio", "access", STORAGE_ACCESS, field(a, "access"));
+  return generated.storage.create_audio(a);
+}
+function createImage(a) {
+  assertClosed("s.storage.create_image", "access", STORAGE_ACCESS, field(a, "access"));
+  return generated.storage.create_image(a);
+}
+function createVideo(a) {
+  assertClosed("s.storage.create_video", "access", STORAGE_ACCESS, field(a, "access"));
+  return generated.storage.create_video(a);
+}
+function setHeader(a) {
+  assertClosed("s.util.set_header", "duplicates", HEADER_DUPLICATES, field(a, "duplicates"));
+  return generated.util.set_header(a);
+}
+
+// src/statements/special/lambda-args.ts
+function lambda(a) {
+  if (a !== null && typeof a === "object" && a.capture !== void 0) {
+    throw new Error(
+      'Statement "s.lambda": `capture` is not a field of s.lambda \u2014 it is an option of lam.fn: `code: lam.fn(fn, { capture: { \u2026 } })`.'
+    );
+  }
+  return generated.lambda(a);
+}
+
+// src/statements/special/mcp.ts
+function vf4(v) {
+  return { value: v.value, tag: v.tag, filters: v.filters };
+}
+var FORM_TYPES = ["text", "email", "date", "int", "decimal", "bool", "enum"];
+function assertFormField(field2) {
+  const at = `Statement "s.mcp.elicit": \`input.${field2.name}\``;
+  const list = field2.style?.type === "list";
+  if (field2.type === "password" || field2.sensitive === true) {
+    throw new Error(`${at}: a form must not collect secrets (the MCP spec forbids it), so a password or sensitive field is refused.`);
+  }
+  if (Array.isArray(field2.children) && field2.children.length > 0) {
+    throw new Error(`${at}: nested objects are not supported \u2014 an MCP form is a flat set of fields.`);
+  }
+  if (!FORM_TYPES.includes(field2.type)) {
+    throw new Error(`${at}: "${field2.type}" cannot be asked in an MCP form. Use one of ${FORM_TYPES.join(", ")}.`);
+  }
+  if (list && field2.type !== "enum") {
+    throw new Error(`${at}: only an enum may be a list (a multi-select) in an MCP form.`);
+  }
+}
+var MCP_ELICIT_KEYS = /* @__PURE__ */ Object.keys({ key: 1, message: 1, input: 1, as: 1, asFilters: 1, disabled: 1, description: 1, mock: 1 });
+function mcpElicit(a) {
+  a = argsOrEmpty(a);
+  assertKnownKeys(`Statement "s.mcp.elicit"`, a, MCP_ELICIT_KEYS);
+  const key = typeof a.key === "string" ? c.text(a.key) : a.key;
+  const message = typeof a.message === "string" ? c.text(a.message) : a.message;
+  assertValueArg("s.mcp.elicit", "key", key);
+  if (key.tag === "const" && key.value === "") {
+    throw new Error(`Statement "s.mcp.elicit": \`key\` is empty. Give each elicit a short stable name, unique in the stack.`);
+  }
+  assertValueArg("s.mcp.elicit", "message", message);
+  const fields = a.input ?? {};
+  if (typeof fields !== "object" || fields === null || Array.isArray(fields)) {
+    throw new Error(
+      `Statement "s.mcp.elicit": argument "input" must be a { field: input.*() } record \u2014 got ${describeArg(fields)}.`
+    );
+  }
+  const schema = Object.entries(fields).map(([name, d]) => {
+    if (typeof d !== "object" || d === null || typeof d.type !== "string") {
+      throw new Error(`Statement "s.mcp.elicit": \`input.${name}\` must be an input descriptor (\`input.text()\`, \u2026) \u2014 got ${describeArg(d)}.`);
+    }
+    const { market_item: _marketItem, ...field2 } = encodeInput(name, d);
+    return field2;
+  });
+  for (const field2 of schema) assertFormField(field2);
+  return annotate(
+    {
+      name: "mvp:mcp_elicit",
+      as: a.as ?? "",
+      context: { schema },
+      // Entry order is the engine's own: `key`, then `message`.
+      input: [
+        { name: "key", ...vf4(key) },
+        { name: "message", ...vf4(message) }
+      ]
+    },
+    a
+  );
+}
+registerStatement("mvp:mcp_elicit", mcpElicit);
+
+// src/statements/s.ts
+var externalQuery = (engine) => ({
+  direct_query: (a) => dbExternalQuery({ ...a, engine })
+});
+var cloudJobNs = Object.assign(cloudJob, { await: cloudJobAwait, status: cloudJobStatus });
+var s = {
+  ...generated,
+  // Typed overrides of generated factories: `precondition` narrows `error_type`
+  // to the status-bearing enum, and `throw` documents that it returns HTTP 200
+  // (use `precondition` for a status-observable rejection).
+  precondition,
+  throw: throwError,
+  // Typed refusal of `capture`, which belongs to `lam.fn` — the bare TS2353 the
+  // generated factory produced implied dropping the field rather than moving
+  // the body. Same bytes.
+  lambda,
+  // Hand-authored specials (not in the codegen'd catalog).
+  set_var: setVar,
+  update_var: updateVar,
+  conditional,
+  comment,
+  for: forLoop,
+  foreach: foreachLoop,
+  while: whileLoop,
+  group,
+  switch: switchStatement,
+  try_catch: tryCatch,
+  return: returnValue,
+  foreach_break: foreachBreak,
+  foreach_continue: foreachContinue,
+  foreach_remove: foreachRemove,
+  // Call family — invoke another workspace object. `api.call`/`api.realtime_event`
+  // merge into the generated `api` namespace; the rest are new namespaces.
+  // `api.request` (and `stream.from_request`/`webflow.request`/`microservice.request`
+  // below) are typed hand-authored overrides of their generated factories.
+  function: { run: functionRun, call: functionCall },
+  action: { call: actionCall, package: { call: actionPackageCall } },
+  workflow_test: { call: workflowTestCall },
+  api: { ...generated.api, call: apiCall, realtime_event: realtimeEvent, request: apiRequest },
+  // Microservices are a top-level feature: the `microservice()` def and the
+  // statement that calls one live side by side. The override is load-bearing —
+  // `...generated` above already exposes the RAW generated factory here, and it
+  // has none of the defaulting that lets a call name only `host` and `path`.
+  microservice: { ...generated.microservice, request: microserviceRequest },
+  // `realtime.publish` is the CURRENT-layer send statement (`api.realtime_event` is the
+  // superseded one); `get_session` beside it is generated.
+  realtime: { ...generated.realtime, publish: realtimePublish },
+  stream: { ...generated.stream, from_request: streamFromRequest },
+  webflow: { ...generated.webflow, request: webflowRequest },
+  task: { call: taskCall },
+  tool: { call: toolCall },
+  // MCP server stacks (tool / prompt / resource): ask the client's user mid-call,
+  // and report progress (generated). `oauth` is the MCP sign-in hand-off a
+  // login page's stack runs (generated; `export()` checks revoke's one-of target).
+  mcp: { ...generated.mcp, elicit: mcpElicit },
+  trigger: { call: triggerCall },
+  middleware: { call: middlewareCall },
+  addon: { call: addonCall },
+  // Database family — merges into the generated `db` namespace.
+  db: {
+    ...generated.db,
+    add: dbAdd,
+    edit: dbEdit,
+    add_or_edit: dbAddOrEdit,
+    get: dbGet,
+    del: dbDel,
+    has: dbHas,
+    patch: dbPatch,
+    truncate: dbTruncate,
+    schema: dbSchema,
+    direct_query: dbDirectQuery,
+    query: dbQuery,
+    increment: dbIncrement,
+    transaction: dbTransaction,
+    bulk: { add: dbBulkAdd, delete: dbBulkDelete, patch: dbBulkPatch, update: dbBulkUpdate },
+    external: {
+      mssql: externalQuery("mssql"),
+      mysql: externalQuery("mysql"),
+      oracle: externalQuery("oracle"),
+      postgres: externalQuery("postgres"),
+      snowflake: externalQuery("snowflake")
+    }
+  },
+  // AI agent + cloud jobs.
+  ai: { ...generated.ai, agent: { run: aiAgentRun } },
+  cloud: { ...generated.cloud, job: cloudJobNs },
+  // Array map/union, expect.to_throw, auth-token, raw-input/post-process merge
+  // into their generated namespaces.
+  array: {
+    ...generated.array,
+    map: arrayMap,
+    union: arrayUnion,
+    // Typed overrides of the generated factories: same bytes, plus the element
+    // an accumulator gains, which `InferResponse` reads off the list it traces.
+    push: generated.array.push,
+    unshift: generated.array.unshift,
+    merge: generated.array.merge
+  },
+  expect: { ...generated.expect, to_throw: expectToThrow, to_match: expectToMatch },
+  security: { ...generated.security, create_auth_token: createAuthToken, create_uuid: generated.security.create_uuid },
+  // The generated factory, typed: `object.keys` always binds a list of the
+  // object's key names, so `ref("<as>")` traces to `string[]`, not `unknown`.
+  object: { ...generated.object, keys: generated.object.keys },
+  util: {
+    ...generated.util,
+    get_raw_input: getRawInput,
+    get_input: getRawInput,
+    post_process: postProcess,
+    // Typed override of the generated factory: same bytes, plus the nested
+    // result shape a `ref` into the bound var has no other way to learn.
+    ip_lookup: ipLookup,
+    // `duplicates` is a closed set the codegen ships as a bare `string`.
+    set_header: setHeader
+  },
+  // `access` is a closed set the codegen ships as a bare `string`, and it
+  // defaults to `public` — a misspelled `"private"` would serve the file to
+  // the world with no compile-time signal.
+  storage: {
+    ...generated.storage,
+    create_attachment: createAttachment,
+    create_audio: createAudio,
+    create_image: createImage,
+    create_video: createVideo
+  }
+};
+registerFactoryPaths(s, "s");
+function registerAllStatements() {
+  registerFactoryPaths(s, "s");
+}
+
+// src/kinds/realtime-channel.ts
+function realtimeServerRefName(context, server) {
+  const name = typeof server === "string" ? server : server?.name;
+  if (!name) {
+    throw new Error(`${context}: \`server\` is required \u2014 a channel path is unique only within its realtime server.`);
+  }
+  return name;
+}
+function resolveRealtimeServerRef(context, server) {
+  if (typeof server !== "string" && server?.guid) return server.guid;
+  return deriveGuid("realtime_server", realtimeServerRefName(context, server));
+}
+function encodeRealtimeChannel(def) {
+  if (!def.name) throw new Error("realtimeChannel: `name` is required (the channel path).");
+  const context = `realtimeChannel "${def.name}"`;
+  assertChannelPathParams(def);
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    active: def.active ?? true,
+    server: { id: resolveRealtimeServerRef(context, def.server) },
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d)),
+    anonymous_clients: def.anonymousClients ?? false,
+    presence: def.presence ?? false,
+    publish: {
+      who: def.publish?.who ?? "nobody",
+      direct: def.publish?.direct ?? false
+    },
+    conversation: {
+      enabled: def.conversation?.enabled ?? false,
+      limit: def.conversation?.limit ?? 0,
+      ttl: def.conversation?.ttl ?? 0
+    },
+    delivery: {
+      guarantee: def.delivery?.guarantee ?? "at_most_once",
+      per_recipient: def.delivery?.perRecipient ?? false
+    },
+    rate_limit: { messages_per_minute: def.rateLimit?.messagesPerMinute ?? 0 },
+    history: encodeContainerHistory("message", def.history),
+    ...def.middleware !== void 0 ? { middleware: buildMiddlewareBlock(def.middleware) } : {},
+    tag: encodeTags(def.tags)
+  };
+}
+var realtimeChannelKind = {
+  name: "channel",
+  payloadKey: "channel",
+  encode: encodeRealtimeChannel,
+  guidOf: (def) => realtimeChannelGuid(def)
+};
+registerKind(realtimeChannelKind);
+function channelPathParams(path) {
+  return parsePathParams(`realtimeChannel "${path}"`, path);
+}
+function assertChannelPathParams(def) {
+  const context = `realtimeChannel "${def.name}"`;
+  assertStoredName(context, def.name, "route");
+  assertChannelSegments(context, def.name);
+  const params = parsePathParams(context, def.name);
+  assertPathParamInputs(context, params, def.input);
+  return params;
+}
+function assertChannelSegments(context, name) {
+  const segments = name.split("/");
+  if (segments.includes("")) {
+    const fixed = segments.filter((seg) => seg !== "").join("/");
+    throw new Error(
+      `${context}: a channel path cannot have an empty segment (a leading, trailing or doubled "/") \u2014 the join matching rejects it rather than collapsing it, so no client could ever join this channel. ` + (fixed ? `Write "${fixed}".` : `Name the channel, e.g. "lobby".`)
+    );
+  }
+  const partial = segments.find((seg) => /[{}]/.test(seg) && !/^\{[^/{}]+\}$/.test(seg));
+  if (partial !== void 0) {
+    throw new Error(
+      `${context}: the segment "${partial}" embeds a {param} \u2014 in a channel path a {param} must be the WHOLE segment ("rooms/{room_id}"). Anything else is matched as literal text, so no joined path would match it. Make the param its own segment, e.g. "rooms/x/{room_id}".`
+    );
+  }
+}
+function realtimeChannel(def) {
+  assertChannelPathParams(def);
+  const context = `realtimeChannel "${def.name}"`;
+  const getChannel = (params) => fillPathParams(context, "getChannel()", def.name, params);
+  return brandDef({ ...def, getChannel }, "channel");
+}
+function realtimeChannelGuid(def) {
+  const guid = def.guid || deriveGuid("channel", realtimeChannelSeedName(realtimeServerRefName(`realtimeChannel "${def.name}"`, def.server), def.name));
+  noteHandleRef(guid);
+  return guid;
+}
+
+// src/kinds/trigger-handle.ts
+function accessor(base) {
+  const fn = (path) => inp(`${base}.${path}`);
+  return Object.assign(fn, inp(base));
+}
+function buildTriggerHandle(objType, toolsetType) {
+  const handle = {};
+  for (const { name } of impliedInputs(objType, toolsetType)) {
+    handle[name] = accessor(name);
+  }
+  return handle;
+}
+
+// src/kinds/trigger.ts
+function baseMeta() {
+  return {
+    database: {
+      datasource: [],
+      search: { expression: [] },
+      action: { delete: false, insert: false, truncate: false, update: false }
+    },
+    toolset: { action: { connection: false } },
+    workspace: { action: { branch_live: false, branch_merge: false, branch_new: false } },
+    workspace_realtime_channel: { action: { message: false, join: false } },
+    // The two realtime lifecycle groups. Every trigger type carries the WHOLE
+    // skeleton with only its own group's flags set — verified against a live
+    // engine capture, which emits all six groups for a table trigger, a workspace
+    // trigger, and both realtime lifecycle triggers alike.
+    realtime_server: { action: { connect: false, disconnect: false } },
+    channel: { action: { join: false, leave: false, deliver: false } }
+  };
+}
+function assertSearchMatchesActions(name, expression, action) {
+  if (action.truncate) {
+    throw new Error(
+      `tableTrigger "${name}": \`search\` is not supported with the \`truncate\` action \u2014 a truncate fires once for the whole table, with no row to test.`
+    );
+  }
+  const operands = collectOperands(expression);
+  for (const [enabled, forbidden] of [
+    [action.insert, "OLD"],
+    [action.delete, "NEW"]
+  ]) {
+    if (!enabled) continue;
+    const hit = operands.find((o) => o.startsWith(`${forbidden}.`));
+    if (hit !== void 0) {
+      const act = forbidden === "OLD" ? "insert" : "delete";
+      throw new Error(
+        `tableTrigger "${name}": \`search\` reads \`${hit}\`, which does not exist for the \`${act}\` action this trigger is enabled for. Use ${forbidden === "OLD" ? "`NEW.*`" : "`OLD.*`"}, or split the actions into separate triggers.`
+      );
+    }
+  }
+}
+function collectOperands(node) {
+  if (Array.isArray(node)) return node.flatMap(collectOperands);
+  if (node === null || typeof node !== "object") return [];
+  const out = [];
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "operand" && typeof value === "string") out.push(value);
+    else out.push(...collectOperands(value));
+  }
+  return out;
+}
+function encodeTrigger(def) {
+  if (!def.name) throw new Error("trigger: `name` is required.");
+  if (!isTriggerObjType(def.objType)) {
+    throw new Error(
+      `trigger "${def.name}": \`objType\` is ${describeEntry(def.objType)}, so this is not a trigger def \u2014 build one with tableTrigger, realtimeTrigger, realtimeServerTrigger, realtimeChannelTrigger, mcpServerTrigger, agentTrigger, workspaceTrigger or errorTrigger.`
+    );
+  }
+  const xdo = {
+    name: def.name,
+    active: def.active ?? true,
+    description: def.description ?? "",
+    obj_id: def.objId ?? 0,
+    obj_type: def.objType,
+    history: encodeHistory("trigger", def.history),
+    output: [],
+    meta: def.meta,
+    tag: encodeTags(def.tags),
+    // Inputs are implied by type (fixed by Xano, not user-editable) — always
+    // inject the canonical per-type array, never a user-supplied map.
+    input: impliedInputs(def.objType, def.toolsetType),
+    run: encodeStack("trigger", def.name, def.stack)
+  };
+  if (def.hasResult) {
+    xdo.result = encodeResponse(def.response);
+  } else {
+    xdo.result = [];
+  }
+  return xdo;
+}
+var RESPONSE_ARGS = ["response", "responseShape"];
+function triggerActions(factory, args, keys) {
+  const actions = args.actions;
+  if (typeof actions === "object" && actions !== null) {
+    refuseUnknown(`${factory} "${String(args.name)}" \`actions\``, actions, keys);
+  }
+  return Object.fromEntries(keys.map((k) => [k, actions?.[k] ?? false]));
+}
+function triggerArgs(factory, args, own) {
+  assertKnownKeys(`${factory} "${args.name}"`, args, [
+    "name",
+    "guid",
+    "description",
+    "active",
+    "objId",
+    "tags",
+    "history",
+    "diagnostics",
+    "stack",
+    ...own
+  ]);
+}
+function tableTrigger(args) {
+  triggerArgs("tableTrigger", args, ["table", "datasources", "actions", "search"]);
+  const meta = baseMeta();
+  assertDefShape("trigger", args);
+  meta.database.datasource = (args.datasources ?? []).map((tag) => ({ tag }));
+  meta.database.action = triggerActions("tableTrigger", args, ["delete", "insert", "truncate", "update"]);
+  if (args.search !== void 0) {
+    const encoded = encodeExpression(args.search);
+    assertSearchMatchesActions(args.name, encoded.expression, meta.database.action);
+    meta.database.search = encoded;
+  }
+  const objId = args.table !== void 0 ? resolveRef("dbo", args.table) : args.objId;
+  const t = buildTriggerHandle("database");
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId,
+    objType: "database",
+    hasResult: false,
+    meta,
+    stack: triggerStack(args.name, args.stack, t)
+  }, "trigger");
+}
+function realtimeTrigger(args) {
+  triggerArgs("realtimeTrigger", args, ["actions", ...RESPONSE_ARGS]);
+  const meta = baseMeta();
+  meta.workspace_realtime_channel.action = triggerActions("realtimeTrigger", args, ["message", "join"]);
+  const t = buildTriggerHandle("workspace_realtime_channel");
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: args.objId,
+    objType: "workspace_realtime_channel",
+    hasResult: true,
+    meta,
+    // The `?? []` fallback matches `S`'s own `readonly []` default (which is what
+    // `S` resolves to when the callback is omitted); the cast covers the branch
+    // TypeScript cannot tie back to that default.
+    stack: triggerStack(args.name, args.stack, t),
+    // Xano default: echo the `payload` input back. It is a plain
+    // `Value` with no trace, so an omitted callback derives `unknown`.
+    response: args.response !== void 0 ? triggerResponse(args.response, t) : inp("payload")
+  }, "trigger");
+}
+function realtimeServerTrigger(args) {
+  triggerArgs("realtimeServerTrigger", args, ["realtimeServer", "actions", ...RESPONSE_ARGS]);
+  const t = buildTriggerHandle("realtime_server");
+  const serverMeta = baseMeta();
+  serverMeta.realtime_server.action = triggerActions("realtimeServerTrigger", args, ["connect", "disconnect"]);
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: args.realtimeServer !== void 0 ? resolveRef("realtime_server", args.realtimeServer) : args.objId,
+    objType: "realtime_server",
+    hasResult: true,
+    meta: serverMeta,
+    // See the `realtimeTrigger` note: the fallback matches `S`'s own default.
+    stack: triggerStack(args.name, args.stack, t),
+    response: triggerResponse(args.response, t)
+  }, "trigger");
+}
+function realtimeChannelTrigger(args) {
+  triggerArgs("realtimeChannelTrigger", args, ["channel", "actions", ...RESPONSE_ARGS]);
+  const channel = args.channel;
+  if (channel !== void 0 && (typeof channel !== "object" || channel === null || !channel.server)) {
+    throw new Error(
+      `realtimeChannelTrigger ${JSON.stringify(args.name)}: \`channel\` must be a realtimeChannel() handle, which carries its server \u2014 got ${typeof channel === "string" ? `the bare path ${JSON.stringify(channel)}` : String(channel)}. A channel path is unique only within its server. Pass the handle: \`channel: <the realtimeChannel() result>\`.`
+    );
+  }
+  const t = buildTriggerHandle("channel");
+  const channelMeta = baseMeta();
+  channelMeta.channel.action = triggerActions("realtimeChannelTrigger", args, ["join", "leave", "deliver"]);
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: args.channel !== void 0 ? realtimeChannelGuid(args.channel) : args.objId,
+    objType: "channel",
+    hasResult: true,
+    meta: channelMeta,
+    // See the `realtimeTrigger` note: the fallback matches `S`'s own default.
+    stack: triggerStack(args.name, args.stack, t),
+    response: triggerResponse(args.response, t)
+  }, "trigger");
+}
+function mcpServerTrigger(args) {
+  triggerArgs("mcpServerTrigger", args, ["mcpServer", ...RESPONSE_ARGS]);
+  return toolsetTrigger(args, args.mcpServer, "mcpServer");
+}
+function agentTrigger(args) {
+  triggerArgs("agentTrigger", args, ["agent", ...RESPONSE_ARGS]);
+  return toolsetTrigger(args, args.agent, "agent");
+}
+function workspaceTrigger(args) {
+  triggerArgs("workspaceTrigger", args, ["actions"]);
+  const meta = baseMeta();
+  meta.workspace.action = triggerActions("workspaceTrigger", args, ["branch_live", "branch_merge", "branch_new"]);
+  const t = buildTriggerHandle("workspace");
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: args.objId,
+    objType: "workspace",
+    hasResult: false,
+    meta,
+    stack: triggerStack(args.name, args.stack, t)
+  }, "trigger");
+}
+function errorTrigger(args) {
+  triggerArgs("errorTrigger", args, []);
+  const t = buildTriggerHandle("error");
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: args.objId,
+    objType: "error",
+    hasResult: false,
+    meta: baseMeta(),
+    stack: triggerStack(args.name, args.stack, t)
+  }, "trigger");
+}
+function toolsetTrigger(args, target, field2) {
+  const meta = baseMeta();
+  meta.toolset.action.connection = true;
+  const toolsetType = field2 === "agent" ? "agent" : "mcp";
+  const t = buildTriggerHandle("toolset", toolsetType);
+  const passed = Object.keys(t).filter((name) => name !== "auth");
+  const bound = target !== void 0 ? resolveRef("toolset", target) : void 0;
+  const authoredStack = args.stack !== void 0 && args.stack !== null;
+  if (bound !== void 0) noteToolsetTarget(bound, field2);
+  return brandDef({
+    name: args.name,
+    guid: args.guid,
+    diagnostics: args.diagnostics,
+    description: args.description,
+    active: args.active,
+    tags: args.tags,
+    history: args.history,
+    objId: bound ?? args.objId,
+    objType: "toolset",
+    toolsetType,
+    hasResult: true,
+    meta,
+    // Xano default: copy each input into a like-named stack var.
+    // See the `realtimeTrigger` note on the cast; the default stack's `set_var`
+    // bindings are untraceable anyway, so an omitted callback derives `unknown`.
+    stack: authoredStack ? triggerStack(args.name, args.stack, t) : passed.map((name) => setVar(name, inp(name))),
+    // Xano default: return each input. Over the default stack it reads the
+    // vars that stack set (the stored default); under an author's stack, which
+    // binds none of them, it reads the inputs themselves.
+    response: args.response !== void 0 && args.response !== null ? triggerResponse(args.response, t) : Object.fromEntries(passed.map((name) => [name, authoredStack ? inp(name) : ref(name)]))
+  }, "trigger");
+}
+function triggerStack(name, stack, t) {
+  if (stack === void 0 || stack === null) return [];
+  const steps = typeof stack === "function" && !isTaggedValue(stack) ? stack(t) : stack;
+  if (!Array.isArray(steps)) {
+    const what = typeof stack === "function" ? `the callback returned ${describeEntry(steps)}` : `got ${describeEntry(stack)}`;
+    throw new Error(
+      `Trigger ${JSON.stringify(String(name))}: stack must be a list of steps or a callback (t) => [ ... ] \u2014 ${what}.`
+    );
+  }
+  return steps;
+}
+function triggerResponse(response, t) {
+  if (response === void 0 || response === null) return void 0;
+  return typeof response === "function" && !isTaggedValue(response) ? response(t) : response;
+}
+var triggerKind = {
+  name: "trigger",
+  payloadKey: "trigger",
+  encode: encodeTrigger
+};
+registerKind(triggerKind);
+
+// src/kinds/canonical.ts
+function resolveCanonicalToken(label, payloadKey, accessor2, def, override) {
+  if (override) return override;
+  if (typeof def.canonical === "string" && def.canonical !== "") return def.canonical;
+  const locked = getLockedCanonical(lockKey(payloadKey, def.name));
+  if (locked) return locked;
+  throw new Error(
+    `${label} "${def.name}": cannot resolve the \`canonical\` URL token. Set an explicit \`canonical\` in code, or run \`xanosdk export <entry>\` once (it mints a unique canonical and freezes it in xano.lock) and seed that lock before importing defs \u2014 the CLI does this automatically. As a last resort pass one directly (e.g. \`${accessor2}({ canonical: "..." })\`). (Minting here is unsafe \u2014 canonicals must be unique per instance across all workspaces, so they are only generated at locked export.)`
+  );
+}
+
+// src/kinds/mcp-metadata.ts
+var ICON_KEYS = ["src", "mimeType", "sizes", "theme"];
+var ICON_MIME_TYPES = ["image/png", "image/jpeg", "image/webp"];
+var ICON_DATA_MAX_BYTES = 65536;
+var ICON_URL_MAX_LENGTH = 2048;
+function iconSrcProblem(src) {
+  const lower = src.toLowerCase();
+  if (src.startsWith(HOSTED_FILE_SCHEME)) {
+    return /^xanosdk-file:\/\/[^/\s]+\/[^/\s]+$/.test(src) ? void 0 : "a xanosdk-file: src must be xanosdk-file://<canonical>/<name>";
+  }
+  if (/^\/vault\/[^/\s]+\/[^/\s]+\/[^/\s]+\/[^/\s]+$/.test(src)) {
+    return src.length > ICON_URL_MAX_LENGTH ? `src is longer than ${ICON_URL_MAX_LENGTH} characters` : void 0;
+  }
+  if (lower.startsWith("https://")) {
+    if (src.length > ICON_URL_MAX_LENGTH) return `src is longer than ${ICON_URL_MAX_LENGTH} characters`;
+    let host = "";
+    try {
+      host = new URL(src).host;
+    } catch {
+    }
+    if (host === "" || /\s/.test(src)) return "src is not a valid https URL";
+    return void 0;
+  }
+  if (lower.startsWith("data:")) {
+    const m = /^data:([a-z0-9.+/-]+);base64,([A-Za-z0-9+/]*={0,2})$/i.exec(src);
+    if (!m) return "a data: src must be base64 image data (data:image/png;base64,\u2026)";
+    const mime = m[1].toLowerCase();
+    if (!ICON_MIME_TYPES.includes(mime)) {
+      return `a data: src must be ${ICON_MIME_TYPES.join(", ")} \u2014 got "${mime}" (SVG is refused: it can carry script)`;
+    }
+    const payload = m[2];
+    if (payload === "") return "a data: src must be base64 image data (data:image/png;base64,\u2026)";
+    const padding = payload.endsWith("==") ? 2 : payload.endsWith("=") ? 1 : 0;
+    if (payload.length / 4 * 3 - padding > ICON_DATA_MAX_BYTES) {
+      return `a data: src is larger than ${ICON_DATA_MAX_BYTES} bytes`;
+    }
+    return void 0;
+  }
+  const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):/.exec(src)?.[1] ?? src.slice(0, 20);
+  return `src must be https: or a data: image \u2014 got "${scheme}"`;
+}
+function encodeIcons(owner, icons) {
+  if (icons === void 0 || icons.length === 0) return void 0;
+  if (!Array.isArray(icons)) throw new Error(`${owner} \`icons\`: expected a list of { src, mimeType?, sizes?, theme? }.`);
+  return icons.map((icon, i) => {
+    const at = `${owner} \`icons[${i}]\``;
+    if (icon === null || typeof icon !== "object") throw new Error(`${at}: expected { src, mimeType?, sizes?, theme? }.`);
+    refuseUnknown(at, icon, ICON_KEYS);
+    const hosted = isHostedFile(icon.src) ? icon.src : void 0;
+    if (hosted === void 0) {
+      if (typeof icon.src !== "string" || icon.src.trim() === "") throw new Error(`${at}: an icon needs a \`src\`.`);
+      const srcProblem = iconSrcProblem(icon.src);
+      if (srcProblem) throw new Error(`${at}: ${srcProblem}.`);
+    }
+    if (icon.mimeType !== void 0 && !ICON_MIME_TYPES.includes(String(icon.mimeType).toLowerCase())) {
+      throw new Error(`${at}: \`mimeType\` must be one of ${ICON_MIME_TYPES.join(", ")} \u2014 got "${String(icon.mimeType)}".`);
+    }
+    for (const size of icon.sizes ?? []) {
+      if (typeof size !== "string" || !/^(\d{1,5}x\d{1,5}|any)$/.test(size)) {
+        throw new Error(`${at}: each of \`sizes\` must be "WxH" (e.g. "48x48") or "any" \u2014 got ${JSON.stringify(size)}.`);
+      }
+    }
+    if (icon.theme !== void 0 && icon.theme !== "light" && icon.theme !== "dark") {
+      throw new Error(`${at}: \`theme\` must be "light" or "dark" \u2014 got ${JSON.stringify(icon.theme)}.`);
+    }
+    const out = {
+      src: "",
+      mime_type: icon.mimeType ?? null,
+      sizes: [...icon.sizes ?? []],
+      theme: icon.theme ?? null
+    };
+    out.src = hosted === void 0 ? icon.src : pendingHostedSrc(out, hosted, {
+      field: at,
+      allowedMimes: ICON_MIME_TYPES,
+      requirePublic: true,
+      ...icon.mimeType !== void 0 ? { declaredMime: String(icon.mimeType).toLowerCase() } : {}
+    });
+    return out;
+  });
+}
+function encodeTitle(owner, title) {
+  if (title === void 0 || title === "") return void 0;
+  if (typeof title !== "string") throw new Error(`${owner} \`title\`: expected a string.`);
+  return title;
+}
+var TOOL_ANNOTATION_WIRE = {
+  readOnlyHint: "read_only_hint",
+  destructiveHint: "destructive_hint",
+  idempotentHint: "idempotent_hint",
+  openWorldHint: "open_world_hint"
+};
+function encodeToolAnnotations(owner, annotations) {
+  if (annotations === void 0) return void 0;
+  const at = `${owner} \`annotations\``;
+  if (annotations === null || typeof annotations !== "object") throw new Error(`${at}: expected an object of boolean hints.`);
+  refuseUnknown(at, annotations, Object.keys(TOOL_ANNOTATION_WIRE));
+  const out = {
+    read_only_hint: null,
+    destructive_hint: null,
+    idempotent_hint: null,
+    open_world_hint: null
+  };
+  let any = false;
+  for (const [key, wire] of Object.entries(TOOL_ANNOTATION_WIRE)) {
+    const value = annotations[key];
+    if (value === void 0) continue;
+    if (typeof value !== "boolean") throw new Error(`${at}: \`${key}\` must be true or false \u2014 got ${JSON.stringify(value)}.`);
+    out[wire] = value;
+    any = true;
+  }
+  return any ? out : void 0;
+}
+var RESOURCE_ANNOTATION_KEYS = ["audience", "priority", "lastModified"];
+var ISO_8601 = /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+function encodeResourceAnnotations(owner, annotations) {
+  if (annotations === void 0) return void 0;
+  const at = `${owner} \`annotations\``;
+  if (annotations === null || typeof annotations !== "object") throw new Error(`${at}: expected { audience?, priority?, lastModified? }.`);
+  refuseUnknown(at, annotations, RESOURCE_ANNOTATION_KEYS);
+  const audience = annotations.audience ?? [];
+  for (const who of audience) {
+    if (who !== "user" && who !== "assistant") {
+      throw new Error(`${at}: \`audience\` entries must be "user" or "assistant" \u2014 got ${JSON.stringify(who)}.`);
+    }
+  }
+  const { priority, lastModified } = annotations;
+  if (priority !== void 0 && (typeof priority !== "number" || !Number.isFinite(priority) || priority < 0 || priority > 1)) {
+    throw new Error(`${at}: \`priority\` must be a number from 0 to 1 \u2014 got ${JSON.stringify(priority)}.`);
+  }
+  if (lastModified !== void 0 && (typeof lastModified !== "string" || !ISO_8601.test(lastModified) || Number.isNaN(Date.parse(lastModified)))) {
+    throw new Error(
+      `${at}: \`lastModified\` must be an ISO 8601 date, e.g. "2025-01-12T15:00:58Z" \u2014 got ${JSON.stringify(lastModified)}.`
+    );
+  }
+  if (audience.length === 0 && priority === void 0 && lastModified === void 0) return void 0;
+  return { audience: [...audience], priority: priority ?? null, last_modified: lastModified ?? null };
+}
+var RESOURCE_VARIABLE_TYPES = ["text", "int", "decimal", "bool", "enum", "email", "uuid"];
+function parseResourceUri(owner, uri) {
+  const at = `${owner} \`uri\``;
+  if (typeof uri !== "string" || uri === "") throw new Error(`${at}: a resource needs a uri (e.g. "docs://readme").`);
+  if (uri.length > 2048) throw new Error(`${at}: is longer than 2048 characters.`);
+  if ([...uri].some((ch) => /\s/.test(ch) || ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127)) throw new Error(`${at}: "${uri}" must not contain whitespace.`);
+  if (!/^[A-Za-z][A-Za-z0-9+.-]*:/.test(uri)) throw new Error(`${at}: "${uri}" must start with a scheme, e.g. docs://readme.`);
+  const variables = [];
+  let lastClose = -2;
+  for (let i = 0; i < uri.length; i++) {
+    const ch = uri[i];
+    if (ch === "}") throw new Error(`${at}: "${uri}" has a "}" with no matching "{".`);
+    if (ch !== "{") continue;
+    const close = uri.indexOf("}", i + 1);
+    if (close === -1) throw new Error(`${at}: "${uri}" has an unclosed "{".`);
+    const expression = uri.slice(i + 1, close);
+    if (expression.includes("{")) throw new Error(`${at}: "${uri}" has an unclosed "{".`);
+    if (expression === "") throw new Error(`${at}: "${uri}" has an empty "{}".`);
+    if ("+#./;?&=,!@|".includes(expression[0])) {
+      throw new Error(`${at}: "{${expression}}" uses an operator; only level-1 {name} variables are supported.`);
+    }
+    if (expression.includes(",")) throw new Error(`${at}: "{${expression}}" lists several variables; use one {name} per variable.`);
+    if (expression.includes("*") || expression.includes(":")) {
+      throw new Error(`${at}: "{${expression}}" uses a modifier; only level-1 {name} variables are supported.`);
+    }
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(expression)) throw new Error(`${at}: variable "${expression}" must be letters, digits and _.`);
+    if (variables.includes(expression)) throw new Error(`${at}: variable "${expression}" appears more than once.`);
+    if (lastClose === i - 1) throw new Error(`${at}: "${uri}" has two adjacent variables, which cannot be told apart.`);
+    variables.push(expression);
+    lastClose = close;
+    i = close;
+  }
+  return variables;
+}
+function assertResourceInput(owner, uri, input) {
+  const variables = parseResourceUri(owner, uri);
+  const fields = new Map(input.map((field2) => [field2.name, field2]));
+  for (const variable of variables) {
+    const field2 = fields.get(variable);
+    if (field2 === void 0) {
+      throw new Error(
+        `${owner}: uri variable "${variable}" must be declared in \`input\` (e.g. \`input: { ${variable}: input.text() }\`).`
+      );
+    }
+    if (!RESOURCE_VARIABLE_TYPES.includes(field2.type)) {
+      throw new Error(
+        `${owner}: uri variable "${variable}" must be one of ${RESOURCE_VARIABLE_TYPES.join(", ")} \u2014 got "${field2.type}".`
+      );
+    }
+    if (field2.style?.type === "list") throw new Error(`${owner}: uri variable "${variable}" must be a single value, not a list.`);
+  }
+  for (const name of fields.keys()) {
+    if (variables.includes(name)) continue;
+    throw new Error(
+      variables.length === 0 ? `${owner}: input "${name}" cannot be set \u2014 a static resource has no inputs. Use a uri template ("\u2026/{${name}}") to take one.` : `${owner}: input "${name}" is not a variable of the uri "${uri}". A resource's input is exactly its uri template's variables.`
+    );
+  }
+}
+
+// src/kinds/toolset.ts
+var TOOL_REF_KEYS = ["tool", "id", "enabled", "auth", "type", "resourceUri", "toolMeta"];
+function encodeTool(def) {
+  if (!def.name) throw new Error("tool: `name` is required.");
+  const owner = `tool "${def.name}"`;
+  assertStoredName(owner, def.name, "route");
+  const title = encodeTitle(owner, def.title);
+  const annotations = encodeToolAnnotations(owner, def.annotations);
+  const icons = encodeIcons(owner, def.icons);
+  const output = Object.entries(def.output ?? {}).map(([name, d]) => encodeInput(name, d));
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    instructions: def.instructions ?? "",
+    docs: def.docs ?? "",
+    enabled: def.enabled ?? true,
+    output: [],
+    middleware: buildMiddlewareBlock(def.middleware),
+    tag: encodeTags(def.tags),
+    history: encodeHistory("tool", def.history),
+    toolset: { id: def.toolsetId ?? 0 },
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d)),
+    result: encodeResponse(def.response),
+    run: encodeStack("tool", def.name, def.stack),
+    test: [],
+    // Omitted at their defaults, so a tool that sets none of them keeps the
+    // exact bytes it had before they existed.
+    ...title !== void 0 ? { title } : {},
+    ...annotations !== void 0 ? { annotations } : {},
+    ...icons !== void 0 ? { icons } : {},
+    ...output.length > 0 ? { output_schema: output } : {}
+  };
+}
+var toolKind = {
+  name: "tool",
+  payloadKey: "tool",
+  encode: encodeTool
+};
+registerKind(toolKind);
+function tool(def) {
+  return brandDef(def, "tool");
+}
+function normalizeToolEntry(entry, index, owner) {
+  if (typeof entry === "string") return { tool: entry };
+  if (entry === null || typeof entry !== "object") {
+    throw new Error(
+      `${owner} \`tools[${index}]\`: expected a \`tool()\` handle, a tool name, or a { tool, enabled?, auth? } wrapper (got ${entry === null ? "null" : typeof entry}).`
+    );
+  }
+  const ref2 = entry;
+  if (ref2.tool !== void 0 || ref2.id !== void 0) {
+    refuseUnknown(`${owner} \`tools[${index}]\``, ref2, TOOL_REF_KEYS);
+    return ref2;
+  }
+  if (typeof ref2.name === "string" && ref2.name !== "") {
+    return { tool: ref2 };
+  }
+  if (ref2.name === void 0) refuseUnknown(`${owner} \`tools[${index}]\``, ref2, TOOL_REF_KEYS);
+  throw new Error(
+    `${owner} \`tools[${index}]\`: names no tool. Pass the \`tool()\` handle (\`tools: [saveNote]\`), its name, or a wrapper (\`{ tool: saveNote, auth: users }\`). An entry with neither \`tool\` nor \`id\` encodes to \`id: 0\` \u2014 a reference to nothing, which deploys as a toolset whose tool is silently missing.`
+  );
+}
+function encodeToolRefs(tools, owner = "toolset") {
+  return (tools ?? []).map((entry, index) => {
+    const t = normalizeToolEntry(entry, index, owner);
+    if (t.tool !== void 0 && t.id !== void 0) {
+      throw new Error(`${owner} \`tools[${index}]\`: set either \`tool\` (handle/name) or \`id\` (raw), not both.`);
+    }
+    const id = t.tool !== void 0 ? resolveRef("tool", t.tool) : t.id ?? 0;
+    if (id === 0 || id === "" || id === "0") {
+      emitDiagnostic({
+        severity: "warning",
+        code: "toolset.tool-ref-zero",
+        message: `${owner} \`tools[${index}]\` is \`id: 0\`, which references no tool \u2014 engine ids start at 1. It deploys as a tool entry pointing at nothing, so the toolset simply never calls it, with no error anywhere. Pass the \`tool()\` handle (\`tools: [saveNote]\`) so the reference resolves to its guid.`
+      });
+    }
+    const label = typeof t.tool === "string" ? t.tool : t.tool?.name ?? String(t.id ?? "?");
+    const type = t.type ?? "tool";
+    if (type === "resource" && !t.resourceUri) {
+      throw new Error(
+        `${owner} \`tools[${index}]\` (${label}) is \`type: "resource"\` with no \`resourceUri\`. A resource is addressed BY its URI, so one without it is published and unreachable. Give it a URI, or drop \`type\` to publish the target as a callable tool.`
+      );
+    }
+    const stale = type === "resource" ? t.toolMeta ? "toolMeta" : "" : t.resourceUri ? "resourceUri" : "";
+    if (stale !== "") {
+      throw new Error(
+        `${owner} \`tools[${index}]\` (${label}) is \`type: "${type}"\` and sets \`${stale}\`, which belongs to the other type \u2014 the engine stores it against neither. Remove it, or change \`type\`.`
+      );
+    }
+    return {
+      id,
+      enabled: t.enabled ?? true,
+      auth: resolveAuthRef("toolset tool", label, t.auth),
+      // `"tool"` is the engine's default and is omitted at it, so an ordinary
+      // entry keeps the exact bytes a pulled one has.
+      ...type === "resource" ? { type } : {},
+      ...type === "resource" && t.resourceUri ? { resource_uri: t.resourceUri } : {},
+      ...type === "tool" && t.toolMeta ? { tool_meta: t.toolMeta } : {}
+    };
+  });
+}
+function resolveToolsetCanonical(def, override) {
+  return resolveCanonicalToken("toolset", "toolset", "getPath", def, override);
+}
+function encodeToolsetBase(def, label = "toolset") {
+  assertCanonical(`${label} "${def.name}"`, def.canonical);
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    instructions: def.instructions ?? "",
+    docs: def.docs ?? "",
+    enabled: def.enabled ?? true,
+    canonical: def.canonical ?? "",
+    spec: def.spec ?? "",
+    middleware: emptyMiddleware(),
+    history: encodeContainerHistory("tool", def.history),
+    tag: encodeTags(def.tags),
+    tool: encodeToolRefs(def.tools, `${label} "${def.name}"`)
+  };
+}
+function encodePrimitiveRefs(kind, entries, owner) {
+  if (entries === void 0) return [];
+  const field2 = `${kind}s`;
+  if (!Array.isArray(entries)) throw new Error(`${owner} \`${field2}\`: expected a list of \`${kind}()\` handles.`);
+  const keys = [kind, "id", "enabled", "auth"];
+  const seen = /* @__PURE__ */ new Map();
+  return entries.map((entry, index) => {
+    const at = `${owner} \`${field2}[${index}]\``;
+    let ref2;
+    if (typeof entry === "string") {
+      ref2 = { [kind]: entry };
+    } else if (entry === null || typeof entry !== "object") {
+      throw new Error(`${at}: expected a \`${kind}()\` handle, a name, or a { ${kind}, enabled?, auth? } wrapper.`);
+    } else {
+      const record = entry;
+      if (record[kind] !== void 0 || record.id !== void 0) {
+        refuseUnknown(at, record, keys);
+        ref2 = entry;
+      } else if (typeof record.name === "string" && record.name !== "") {
+        ref2 = { [kind]: entry };
+      } else {
+        refuseUnknown(at, record, keys);
+        throw new Error(`${at}: names no ${kind}. Pass the \`${kind}()\` handle, its name, or { ${kind}: handle, auth? }.`);
+      }
+    }
+    const target = ref2[kind];
+    if (target !== void 0 && ref2.id !== void 0) throw new Error(`${at}: set either \`${kind}\` or \`id\`, not both.`);
+    const id = target !== void 0 ? resolveRef(kind, target, at) : ref2.id ?? 0;
+    if (id === 0) throw new Error(`${at}: \`id: 0\` references no ${kind} \u2014 engine ids start at 1. Pass the \`${kind}()\` handle.`);
+    const first = seen.get(id);
+    if (first !== void 0) throw new Error(`${at}: lists the same ${kind} as \`${field2}[${first}]\`. List each ${kind} once.`);
+    seen.set(id, index);
+    const label = typeof target === "string" ? target : target?.name ?? String(ref2.id);
+    return { id, enabled: ref2.enabled ?? true, auth: resolveAuthRef(`mcpServer ${kind}`, label, ref2.auth) };
+  });
+}
+
+// src/kinds/prompt.ts
+function encodePrompt(def) {
+  if (!def.name) throw new Error("prompt: `name` is required.");
+  const owner = `prompt "${def.name}"`;
+  assertStoredName(owner, def.name, "route");
+  const title = encodeTitle(owner, def.title);
+  const icons = encodeIcons(owner, def.icons);
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    docs: def.docs ?? "",
+    // Omitted at their defaults, like a tool's.
+    ...title !== void 0 ? { title } : {},
+    ...icons !== void 0 ? { icons } : {},
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d)),
+    run: encodeStack("prompt", def.name, def.stack),
+    result: encodeResponse(def.response),
+    middleware: buildMiddlewareBlock(def.middleware),
+    tag: encodeTags(def.tags),
+    history: encodeHistory("prompt", def.history)
+  };
+}
+var promptKind = {
+  name: "prompt",
+  payloadKey: "prompt",
+  encode: encodePrompt
+};
+registerKind(promptKind);
+function prompt(def) {
+  return brandDef(def, "prompt");
+}
+
+// src/kinds/resource.ts
+var MIME_TYPE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*(\s*;.*)?$/;
+function encodeResource(def) {
+  if (!def.name) throw new Error("resource: `name` is required.");
+  const owner = `resource "${def.name}"`;
+  assertStoredName(owner, def.name, "route");
+  if (def.mimeType !== void 0 && def.mimeType !== "" && !MIME_TYPE.test(def.mimeType)) {
+    throw new Error(`${owner} \`mimeType\`: must be a MIME type such as text/markdown \u2014 got ${JSON.stringify(def.mimeType)}.`);
+  }
+  const input = Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d));
+  assertResourceInput(owner, def.uri, input);
+  const title = encodeTitle(owner, def.title);
+  const icons = encodeIcons(owner, def.icons);
+  const annotations = encodeResourceAnnotations(owner, def.annotations);
+  return {
+    name: def.name,
+    uri: def.uri,
+    description: def.description ?? "",
+    docs: def.docs ?? "",
+    mime_type: def.mimeType ?? "",
+    // Omitted at their defaults, like a tool's.
+    ...title !== void 0 ? { title } : {},
+    ...icons !== void 0 ? { icons } : {},
+    ...annotations !== void 0 ? { annotations } : {},
+    input,
+    run: encodeStack("resource", def.name, def.stack),
+    result: encodeResponse(def.response),
+    middleware: buildMiddlewareBlock(def.middleware),
+    tag: encodeTags(def.tags),
+    history: encodeHistory("resource", def.history)
+  };
+}
+var resourceKind = {
+  name: "resource",
+  payloadKey: "resource",
+  encode: encodeResource
+};
+registerKind(resourceKind);
+function resource(def) {
+  return brandDef(def, "resource");
+}
+
+// src/kinds/agent.ts
+function buildProviderConfig(llm) {
+  let config;
+  switch (llm.type) {
+    case "anthropic":
+      config = {
+        apiKey: llm.apiKey ?? "",
+        model: llm.model ?? "",
+        temperature: llm.temperature ?? 1,
+        sendReasoning: llm.sendReasoning ?? true,
+        thinking: llm.thinkingTokens !== void 0 ? { type: "enabled", budgetTokens: llm.thinkingTokens } : { type: "disabled", budgetTokens: "" },
+        baseURL: llm.baseURL ?? "",
+        headers: llm.headers ?? ""
+      };
+      break;
+    case "openai":
+      config = {
+        apiKey: llm.apiKey ?? "",
+        model: llm.model ?? "",
+        temperature: llm.temperature ?? 1,
+        reasoningEffort: llm.reasoningEffort ?? "medium",
+        baseURL: llm.baseURL ?? "",
+        headers: llm.headers ?? "",
+        organization: llm.organization ?? "",
+        project: llm.project ?? "",
+        compatibility: llm.compatibility ?? "strict"
+      };
+      break;
+    case "google-genai":
+      config = {
+        apiKey: llm.apiKey ?? "",
+        model: llm.model ?? "",
+        temperature: llm.temperature ?? 1,
+        useSearchGrounding: llm.searchGrounding ?? false,
+        thinkingConfig: {
+          includeThoughts: llm.includeThoughts ?? false,
+          thinkingBudget: llm.thinkingBudget ?? 0
+        },
+        baseURL: llm.baseURL ?? "",
+        headers: llm.headers ?? "",
+        safetySettings: llm.safetySettings ?? "",
+        dynamicRetrievalConfig: llm.dynamicRetrieval ?? ""
+      };
+      break;
+    case "xano-free":
+      config = {
+        temperature: llm.temperature ?? 1,
+        useSearchGrounding: llm.searchGrounding ?? false,
+        thinkingConfig: {
+          includeThoughts: llm.includeThoughts ?? false,
+          thinkingBudget: llm.thinkingBudget ?? 0
+        },
+        baseURL: llm.baseURL ?? "",
+        headers: llm.headers ?? "",
+        safetySettings: llm.safetySettings ?? "",
+        dynamicRetrievalConfig: llm.dynamicRetrieval ?? ""
+      };
+      break;
+  }
+  return llm.extraConfig ? { ...config, ...llm.extraConfig } : config;
+}
+var LLM_KEYS = {
+  anthropic: ["sendReasoning", "thinkingTokens"],
+  openai: ["reasoningEffort", "organization", "project", "compatibility"],
+  "google-genai": ["searchGrounding", "thinkingBudget", "includeThoughts", "safetySettings", "dynamicRetrieval"],
+  "xano-free": ["searchGrounding", "thinkingBudget", "includeThoughts", "safetySettings", "dynamicRetrieval"]
+};
+function buildAgentSettings(def, owner = "agent") {
+  const llm = def.llm;
+  const provider = Object.hasOwn(LLM_KEYS, llm.type) ? LLM_KEYS[llm.type] : void 0;
+  if (!provider && llm.type !== "") {
+    const types = Object.keys(LLM_KEYS);
+    const near = typeof llm.type === "string" ? nearestKey(llm.type, types) : void 0;
+    throw new Error(
+      `${owner} llm: unknown provider type ${JSON.stringify(llm.type)}${near ? ` \u2014 did you mean "${near}"?` : "."} Expected one of: ${types.join(", ")}.`
+    );
+  }
+  if (provider) {
+    assertKnownKeys(`${owner} llm (${llm.type})`, llm, [
+      "type",
+      "systemPrompt",
+      "maxSteps",
+      "extraConfig",
+      "prompt",
+      "messages",
+      ...llm.type === "xano-free" ? [] : ["apiKey", "model"],
+      "temperature",
+      "baseURL",
+      "headers",
+      ...provider
+    ]);
+  }
+  for (const key of ["temperature", "thinkingTokens", "thinkingBudget"]) {
+    const v = llm[key];
+    if (v === void 0 || v === "") continue;
+    const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
+    if (!Number.isFinite(n)) {
+      throw new Error(
+        `${owner} llm (${llm.type}): \`${key}\` must be a number \u2014 got ${typeof v === "number" ? String(v) : JSON.stringify(v)}.`
+      );
+    }
+    const max = llm.type === "anthropic" ? 1 : 2;
+    if (key === "temperature" && (n < 0 || n > max)) {
+      throw new Error(`${owner} llm (${llm.type}): \`temperature\` must be between 0 and ${max} for this provider \u2014 got ${n}.`);
+    }
+  }
+  if (def.output !== void 0) {
+    if (typeof def.output === "object" && def.output !== null) refuseUnknown(`${owner} \`output\``, def.output, ["schema", "enabled"]);
+    const schema = def.output.schema;
+    if (schema === null || typeof schema !== "object" || Array.isArray(schema)) {
+      throw new Error(
+        `${owner} \`output\`: \`schema\` is required \u2014 a { field: input.*() } record, e.g. \`output: { schema: { summary: input.text() } }\`.`
+      );
+    }
+  }
+  if (llm.prompt !== void 0 && llm.messages !== void 0) {
+    throw new Error(
+      `${owner} llm: \`prompt\` and \`messages\` are two spellings of ONE run prompt and cannot both be set \u2014 the engine stores a single \`prompt_type\`, so one of them would be dropped. Keep \`prompt\` for a plain string, or \`messages\` for a messages template.`
+    );
+  }
+  const promptType = llm.messages !== void 0 ? "messages" : "prompt";
+  return {
+    type: llm.type,
+    system_prompt: llm.systemPrompt ?? "",
+    max_steps: llm.maxSteps ?? 5,
+    prompt_type: promptType,
+    prompt: promptType === "prompt" ? llm.prompt ?? "" : "",
+    prompt_messages: promptType === "messages" ? llm.messages ?? "" : "",
+    structuredOutputs: def.output ? def.output.enabled ?? true : false,
+    structuredOutputsSchema: def.output ? Object.entries(def.output.schema).map(([name, d]) => encodeInput(name, d)) : [],
+    configs: { [llm.type]: buildProviderConfig(llm) }
+  };
+}
+function encodeAgent(def) {
+  if (!def.name) throw new Error("agent: `name` is required.");
+  if (!def.llm) throw new Error(`agent "${def.name}": \`llm\` is required.`);
+  return {
+    ...encodeToolsetBase(def, "agent"),
+    type: "agent",
+    agent_settings: buildAgentSettings(def, `agent "${def.name}"`)
+  };
+}
+var agentKind = {
+  name: "agent",
+  payloadKey: "toolset",
+  encode: encodeAgent
+};
+registerKind(agentKind);
+function agent(def) {
+  const getCanonical = (opts) => resolveToolsetCanonical(def, opts?.canonical);
+  return brandDef({ ...def, getCanonical }, "agent");
+}
+
+// src/kinds/mcp-server.ts
+function assertTenant(tenant) {
+  if (!/^[A-Za-z0-9-]+$/.test(tenant)) {
+    throw new Error(
+      `mcp server: invalid \`tenant\` ${JSON.stringify(tenant)} \u2014 a tenant name is alphanumeric with dashes (e.g. "xxxx-xxxx-xxxx"). It rides as its own "/tenant/<name>" path pair, so "/" cannot appear in it.`
+    );
+  }
+  return tenant;
+}
+function encodeMcpServer(def) {
+  if (!def.name) throw new Error("mcp server: `name` is required.");
+  const owner = `mcpServer "${def.name}"`;
+  const prompts = encodePrimitiveRefs("prompt", def.prompts, owner);
+  const resources = encodePrimitiveRefs("resource", def.resources, owner);
+  const base = {
+    ...encodeToolsetBase(def, "mcpServer"),
+    type: "mcp",
+    // Written only when listed: a server with neither keeps the bytes it had
+    // before prompts and resources existed.
+    ...prompts.length > 0 ? { prompt: prompts } : {},
+    ...resources.length > 0 ? { resource: resources } : {},
+    // Written only when authored: a server without sign-in keeps its bytes.
+    ...def.oauth !== void 0 ? { oauth: encodeMcpOauth(owner, def.oauth) } : {}
+  };
+  return def.llm === void 0 ? base : { ...base, agent_settings: buildAgentSettings({ llm: def.llm, output: def.output }, `mcpServer "${def.name}"`) };
+}
+var mcpServerKind = {
+  name: "mcp_server",
+  payloadKey: "toolset",
+  encode: encodeMcpServer
+};
+registerKind(mcpServerKind);
+function assertNotResolvedEndpointBase(base) {
+  const shape = /(\/x2\/mcp\/(?:tenant\/[^/]+\/)?[^/]+\/)[^/]+(\/stream)$/i;
+  if (!shape.test(base)) return;
+  const redacted = base.replace(shape, "$1<token>$2");
+  throw new Error(
+    `mcp server: \`getUrl\` was given a base URL that already carries an MCP endpoint path (${redacted}). Pass the INSTANCE base URL, not the result of a previous getUrl() \u2014 resolving twice appends a second "/x2/mcp/<canonical>/<token>/stream".`
+  );
+}
+function liftTenantFromBase(base, explicit) {
+  const m = /^((?:https?:\/\/)?[^/]+)\/tenant\/([^/]+)(\/.*)?$/i.exec(base);
+  if (!m) return { base, tenant: explicit };
+  const origin = m[1];
+  const fromBase = m[2];
+  const rest = m[3] ?? "";
+  if (explicit !== void 0 && explicit !== fromBase) {
+    throw new Error(
+      `mcp server: \`getUrl\` was given tenant ${JSON.stringify(explicit)} but the base URL names ${JSON.stringify(fromBase)} (".../tenant/${fromBase}"). Refusing to guess which one you meant \u2014 pass the matching tenant, or a base URL without the "/tenant/<name>" prefix.`
+    );
+  }
+  return { base: `${origin}${rest}`, tenant: assertTenant(fromBase) };
+}
+function mcpServer(def) {
+  const getPath = (opts) => {
+    const tenant = opts?.tenant ? `tenant/${assertTenant(opts.tenant)}/` : "";
+    return `/x2/mcp/${tenant}${resolveToolsetCanonical(def, opts?.canonical)}/${opts?.token || "mcp"}/stream`;
+  };
+  const getUrl = (baseUrl, opts) => {
+    const base = (baseUrl ?? "").trim().replace(/\/+$/, "");
+    if (!base) throw new Error('mcp server: `getUrl` needs a base URL (e.g. "https://x.dev.xano.io").');
+    assertNotResolvedEndpointBase(base);
+    const lifted = liftTenantFromBase(base, opts?.tenant);
+    return `${lifted.base}${getPath({ ...opts, tenant: lifted.tenant })}`;
+  };
+  return brandDef({ ...def, getPath, getUrl }, "mcp_server");
+}
+
+// src/kinds/knowledge.ts
+var KNOWLEDGE_FILE = /* @__PURE__ */ Symbol.for("xanosdk.knowledge.file");
+var KNOWLEDGE_DIR = /* @__PURE__ */ Symbol.for("xanosdk.knowledge.dir");
+function isOsMetadataFile(path, binary) {
+  const base = path.slice(path.lastIndexOf("/") + 1);
+  return binary && /^(?:\.DS_Store|Thumbs\.db|desktop\.ini|\._.*)$/i.test(base);
+}
+function isOsMetadataRow(row) {
+  const { path, content } = row ?? {};
+  return typeof path === "string" && isOsMetadataFile(path, String(content ?? "").includes("\0"));
+}
+function knowledgeFile(path, base) {
+  return { [KNOWLEDGE_FILE]: { path, base: typeof base === "string" ? base : base.href } };
+}
+function knowledgeDir(path, base) {
+  return { [KNOWLEDGE_DIR]: { path, base: typeof base === "string" ? base : base.href } };
+}
+function isKnowledgeFileSource(v) {
+  return typeof v === "object" && v !== null && KNOWLEDGE_FILE in v;
+}
+function isKnowledgeDirSource(v) {
+  return typeof v === "object" && v !== null && KNOWLEDGE_DIR in v;
+}
+function encodeKnowledge(def) {
+  if (!def.name) {
+    throw new Error("knowledge kind: `name` is required.");
+  }
+  if (!isKnowledgeFileSource(def.body)) {
+    throw new Error(
+      `knowledge "${def.name}": \`body\` must be a knowledgeFile("./x.md", import.meta.url) marker. A knowledge body is authored as a markdown FILE, not a string.`
+    );
+  }
+  if (def.refs !== void 0 && !isKnowledgeDirSource(def.refs)) {
+    throw new Error(
+      `knowledge "${def.name}": \`refs\` must be a knowledgeDir("./dir", import.meta.url) marker.`
+    );
+  }
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    // Bodies are read in the compile path; see the module header.
+    content: "",
+    // Not authorable: a user-scoped item is private to one UI user and is
+    // excluded from branch clone and merge, so it has no meaning in source.
+    scope: "workspace",
+    mode: def.mode ?? "auto",
+    knowledge_type: def.type ?? "skill",
+    enabled: def.enabled ?? true,
+    // Instance-owned state, gated on a permission this SDK does not model.
+    locked: false,
+    // Derived by the platform from the stored reference files — never authored.
+    references: [],
+    // Deferred: linked refs never reach an agent's prompt, and the bulk
+    // transport does not carry them.
+    linked_refs: [],
+    tag: encodeTags(def.tags)
+  };
+}
+function knowledge(def) {
+  return brandDef(def, "knowledge");
+}
+var knowledgeKind = {
+  name: "knowledge",
+  payloadKey: "knowledge",
+  encode: encodeKnowledge
+};
+registerKind(knowledgeKind);
+
+// src/kinds/realtime-server.ts
+function resolveRealtimeServerCanonical(def, override) {
+  return resolveCanonicalToken("realtime server", "realtime_server", "getCanonical", def, override);
+}
+function encodeRealtimeServer(def) {
+  if (!def.name) throw new Error("realtimeServer: `name` is required.");
+  assertCanonical(`realtimeServer "${def.name}"`, def.canonical);
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    canonical: def.canonical ?? "",
+    enabled: def.enabled ?? false,
+    history: encodeContainerHistory("message", def.history),
+    ...def.middleware !== void 0 ? { middleware: buildMiddlewareBlock(def.middleware) } : {},
+    tag: encodeTags(def.tags)
+  };
+}
+var realtimeServerKind = {
+  name: "realtime_server",
+  payloadKey: "realtime_server",
+  encode: encodeRealtimeServer
+};
+registerKind(realtimeServerKind);
+function assertTenant2(tenant) {
+  if (!/^[A-Za-z0-9-]+$/.test(tenant)) {
+    throw new Error(
+      `realtime server: invalid \`tenant\` ${JSON.stringify(tenant)} \u2014 a tenant name is alphanumeric with dashes (e.g. "xxxx-xxxx-xxxx"). It rides as a "<tenant>:<canonical>" prefix, so ":" and "/" cannot appear in it.`
+    );
+  }
+  return tenant;
+}
+function assertNotResolvedSocketBase(fn, socketBase, given) {
+  if (!/\/ws\/[^/]+$/i.test(socketBase)) return;
+  throw new Error(
+    `realtime server: \`${fn}\` was given a base URL that already carries a socket path (${given}). Pass the http(s) INSTANCE base URL, not the result of a previous getUrl()/socketUrl() \u2014 resolving twice appends a second "/ws/<canonical>" and drops the tenant.`
+  );
+}
+function assertInstanceBase(fn, given) {
+  const problem = /[?#]/.test(given) ? "a query or fragment" : /\/api:/i.test(given) ? "an API group's /api:<\u2026> path" : void 0;
+  if (problem === void 0) return;
+  throw new Error(
+    `realtime server: \`${fn}\` was given a base URL with ${problem} (${given}). Pass the INSTANCE base URL \u2014 "https://<host>", or "https://<host>/tenant/<name>" \u2014 and the socket path is appended to it.`
+  );
+}
+function liftTenantFromBase2(socketBase, explicit) {
+  const m = /^(wss?:\/\/[^/]+)\/tenant\/([^/]+)(\/.*)?$/i.exec(socketBase);
+  if (!m) return { base: socketBase, tenant: explicit };
+  const origin = m[1];
+  const fromBase = m[2];
+  const rest = m[3] ?? "";
+  if (explicit !== void 0 && explicit !== fromBase) {
+    throw new Error(
+      `realtime server: \`getUrl\` was given tenant ${JSON.stringify(explicit)} but the base URL names ${JSON.stringify(fromBase)} (".../tenant/${fromBase}"). Refusing to guess which one you meant \u2014 pass the matching tenant, or a base URL without the "/tenant/<name>" prefix.`
+    );
+  }
+  return { base: `${origin}${rest}`, tenant: assertTenant2(fromBase) };
+}
+function realtimeServer(def) {
+  const getCanonical = (opts) => resolveRealtimeServerCanonical(def, opts?.canonical);
+  const getPath = (opts) => {
+    const canonical = getCanonical(opts);
+    const prefix = opts?.tenant ? `${assertTenant2(opts.tenant)}:` : "";
+    return `/ws/${prefix}${canonical}`;
+  };
+  const getUrl = (baseUrl, opts) => {
+    const base = baseUrl.trim().replace(/\/+$/, "");
+    if (!base) throw new Error('realtimeServer: `getUrl` needs a base URL (e.g. "https://x.dev.xano.io").');
+    const socketBase = /^wss?:\/\//i.test(base) ? base : /^https?:\/\//i.test(base) ? base.replace(/^http/i, "ws") : `wss://${base}`;
+    assertNotResolvedSocketBase("getUrl", socketBase, base);
+    assertInstanceBase("getUrl", base);
+    const lifted = liftTenantFromBase2(socketBase, opts?.tenant);
+    return `${lifted.base}${getPath({ ...opts, tenant: lifted.tenant })}`;
+  };
+  return brandDef({ ...def, getCanonical, getPath, getUrl }, "realtime_server");
+}
+
+// src/kinds/realtime-message.ts
+function resolveHost(def) {
+  const context = `realtimeMessage "${def.name}"`;
+  if (!def.channel) throw new Error(`${context}: \`channel\` is required.`);
+  const handle = typeof def.channel === "string" ? void 0 : def.channel;
+  if (!handle && def.server === void 0) {
+    throw new Error(
+      `${context}: \`server\` is required when \`channel\` is a bare path \u2014 a channel path is unique only within its realtime server, so "${def.channel}" alone is ambiguous. Pass the \`realtimeChannel()\` handle instead and the server comes with it.`
+    );
+  }
+  const server = def.server ?? handle.server;
+  const serverName = realtimeServerRefName(context, server);
+  if (handle && def.server !== void 0) {
+    const fromHandle = realtimeServerRefName(context, handle.server);
+    if (fromHandle !== serverName) {
+      throw new Error(
+        `${context}: \`server\` is "${serverName}" but the channel handle belongs to "${fromHandle}". Remove \`server\` (the handle already carries it) or bind the message to a channel on "${serverName}".`
+      );
+    }
+  }
+  return {
+    channel: handle ?? { name: def.channel, server },
+    server,
+    serverName
+  };
+}
+function realtimeMessageGuid(def) {
+  if (def.guid) return def.guid;
+  const { channel, serverName } = resolveHost(def);
+  return deriveGuid("message", realtimeMessageSeedName(serverName, channel.name, def.name));
+}
+function encodeRealtimeMessage(def) {
+  if (!def.name) throw new Error("realtimeMessage: `name` is required.");
+  assertStoredName(`realtimeMessage "${def.name}"`, def.name, "plain");
+  const host = resolveHost(def);
+  const channelId = realtimeChannelGuid(host.channel);
+  const serverId = resolveRealtimeServerRef(`realtimeMessage "${def.name}"`, host.server);
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    active: def.active ?? true,
+    channel: { id: channelId },
+    server: { id: serverId },
+    auth: resolveAuthRef("realtimeMessage", def.name, def.auth),
+    deliver_to: def.deliverTo ?? "channel",
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d)),
+    output: [],
+    middleware: buildMiddlewareBlock(def.middleware),
+    run: encodeStack("realtime message", def.name, def.stack),
+    result: encodeResponse(def.response),
+    history: encodeHistory("message", def.history),
+    disabled: def.disabled ?? false,
+    tag: encodeTags(def.tags)
+  };
+}
+var realtimeMessageKind = {
+  name: "message",
+  payloadKey: "message",
+  encode: encodeRealtimeMessage,
+  guidOf: (def) => realtimeMessageGuid(def)
+};
+registerKind(realtimeMessageKind);
+function realtimeMessage(def) {
+  return brandDef(def, "message");
+}
+
+// src/kinds/task.ts
+var SCHEDULE_INSTANT = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})$/;
+function assertScheduleInstant(field2, value) {
+  if (value === void 0) return;
+  const wellShaped = SCHEDULE_INSTANT.test(value);
+  const parsed = wellShaped ? Date.parse(value) : NaN;
+  if (wellShaped && !Number.isNaN(parsed) && isCalendarDate(value)) return;
+  if (wellShaped) {
+    throw new Error(
+      `task schedule: \`${field2}\` is ${JSON.stringify(value)}, which names a date or time that does not exist \u2014 the month must be 01\u201312, the day one that month has, the hour 00\u201323, and minutes/seconds 00\u201359.`
+    );
+  }
+  throw new Error(
+    `task schedule: \`${field2}\` is ${JSON.stringify(value)}, which is not a schedule instant. Write it as "2026-01-01T00:00:00Z" \u2014 a date, a "T" (or a space), a time, and a ZONE ("Z", "+02:00" or "+0000"). The zone is the part most often left off, and without it the value is not an instant at all. The engine stores this string verbatim and does not validate it: a value it cannot parse deploys successfully and the task then never fires, which is indistinguishable from a task whose time has not come yet.`
+  );
+}
+function isCalendarDate(value) {
+  const [y, m, d] = value.slice(0, 10).split("-").map(Number);
+  const day = new Date(Date.UTC(y, m - 1, d));
+  return day.getUTCFullYear() === y && day.getUTCMonth() === m - 1 && day.getUTCDate() === d;
+}
+function encodeSchedule(def) {
+  assertScheduleInstant("startsOn", def.startsOn);
+  assertScheduleInstant("endsOn", def.endsOn);
+  const repeats = def.repeatEnabled ?? def.freq != null;
+  const ends = def.endsEnabled ?? def.endsOn != null;
+  const freq = def.freq ?? 86400;
+  if ((repeats || def.freq != null) && !(typeof freq === "number" && Number.isInteger(freq) && freq > 0)) {
+    throw new Error(
+      `task schedule: \`freq\` is ${typeof freq === "number" ? String(freq) : JSON.stringify(freq)} \u2014 a repeat interval is a positive whole number of seconds (3600 hourly, 86400 daily). Omit \`freq\` for a one-off run.`
+    );
+  }
+  if (ends && def.endsOn !== void 0 && Date.parse(def.endsOn) < Date.parse(def.startsOn)) {
+    throw new Error(
+      `task schedule: \`endsOn\` (${def.endsOn}) is before \`startsOn\` (${def.startsOn}), so the task never runs. Set \`endsOn\` after \`startsOn\`, or drop it to repeat indefinitely.`
+    );
+  }
+  return {
+    starts_on: def.startsOn,
+    repeat: {
+      enabled: repeats,
+      ends: { enabled: ends, on: def.endsOn ?? def.startsOn },
+      freq
+    }
+  };
+}
+function scheduleList(def) {
+  const list = def.schedule;
+  if (list === void 0 || list === null) return [];
+  const bad = Array.isArray(list) ? list.findIndex((e) => typeof e !== "object" || e === null || Array.isArray(e)) : -1;
+  if (!Array.isArray(list) || bad !== -1) {
+    const at = Array.isArray(list) ? `schedule[${bad}]` : "schedule";
+    const got = Array.isArray(list) ? list[bad] : list;
+    throw new Error(
+      `task "${def.name}": \`${at}\` must be ${Array.isArray(list) ? "a { startsOn, freq } entry" : "a list of { startsOn, freq } entries"} \u2014 got ${describeEntry(got)}.`
+    );
+  }
+  return list;
+}
+function encodeTask(def) {
+  if (!def.name) throw new Error("task: `name` is required.");
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    docs: def.docs ?? "",
+    datasource: def.datasource ?? "",
+    active: def.active ?? true,
+    middleware: buildMiddlewareBlock(def.middleware),
+    tag: encodeTags(def.tags),
+    history: encodeHistory("task", def.history),
+    run: encodeStack("task", def.name, def.stack),
+    schedule: encodeTaskSchedule(def)
+  };
+}
+function encodeTaskSchedule(def) {
+  return scheduleList(def).map((entry, i) => {
+    try {
+      return encodeSchedule(entry);
+    } catch (err) {
+      throw new Error(err.message.replace(/^task schedule:/, `task "${def.name}" \`schedule[${i}]\`:`), { cause: err });
+    }
+  });
+}
+var taskKind = {
+  name: "task",
+  payloadKey: "task",
+  encode: encodeTask
+};
+registerKind(taskKind);
+function task(def) {
+  const list = def.schedule;
+  if (Array.isArray(list) && list.every((e) => typeof e === "object" && e !== null && !Array.isArray(e))) encodeTaskSchedule(def);
+  return brandDef(def, "task");
+}
+
+// src/kinds/workflow-test.ts
+function encodeWorkflowTest(def) {
+  if (!def.name) throw new Error("workflowTest: `name` is required.");
+  const datasource = def.datasource ?? "";
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    docs: def.docs ?? "",
+    datasource,
+    active: def.active ?? true,
+    tag: encodeTags(def.tags),
+    run: encodeStack("workflowTest", def.name, def.stack)
+  };
+}
+var workflowTestKind = {
+  name: "workflow_test",
+  payloadKey: "workflow_test",
+  encode: encodeWorkflowTest
+};
+registerKind(workflowTestKind);
+function workflowTest(def) {
+  return brandDef(def, "workflow_test");
+}
+
+// src/kinds/middleware.ts
+function encodeMiddleware(def) {
+  if (!def.name) throw new Error("middleware: `name` is required.");
+  const xdo = {
+    name: def.name,
+    description: def.description ?? "",
+    docs: def.docs ?? "",
+    result_type: def.resultStrategy ?? "merge",
+    exception: def.exceptionPolicy ?? "rethrow",
+    history: encodeHistory("middleware", def.history),
+    tag: encodeTags(def.tags),
+    shared_workspace: { is_shared: false },
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d)),
+    result: encodeResponse(def.response),
+    run: encodeStack("middleware", def.name, def.stack),
+    test: encodeTests(def.tests, "middleware", def.name)
+  };
+  resolveMockKeys(xdo.run, xdo.test, "middleware", def.name);
+  return xdo;
+}
+var middlewareKind = {
+  name: "middleware",
+  payloadKey: "middleware",
+  encode: encodeMiddleware
+};
+registerKind(middlewareKind);
+function middlewareImpl(def) {
+  return brandDef(def, "middleware");
+}
+var middleware = Object.assign(middlewareImpl, { clear });
+
+// src/kinds/addon.ts
+function buildContext(def) {
+  const ctx = { ...def.context ?? {} };
+  if (def.table !== void 0 && ctx.dbo === void 0) {
+    ctx.dbo = def.table === null ? { as: def.tableAlias ?? "", id: "" } : {
+      id: resolveRef("dbo", def.table),
+      // Absent unless authored — writing it unconditionally would change the
+      // bytes of every addon that omits it today.
+      ...def.tableAlias !== void 0 ? { as: def.tableAlias } : {}
+    };
+  }
+  if (def.where !== void 0 && ctx.search === void 0) {
+    const search = encodeSearch(def.where, void 0, `addon "${def.name}"`);
+    if (search !== void 0) ctx.search = search;
+  }
+  const explicitReturn = ctx.return;
+  if (def.cardinality !== void 0 && explicitReturn?.type !== void 0 && explicitReturn.type !== def.cardinality) {
+    throw new Error(
+      `addon: cardinality:"${def.cardinality}" conflicts with an explicit context.return.type "${explicitReturn.type}" \u2014 they shape the graft differently. Set one, not both.`
+    );
+  }
+  const sort = encodeSort(def.sort, `addon "${def.name}"`);
+  const cardinality = def.cardinality ?? "list";
+  if ((cardinality === "count" || cardinality === "exists") && sort.length) {
+    throw new Error(
+      `addon: sort has no effect on cardinality:"${cardinality}" \u2014 it returns one number or boolean, not rows. Drop the sort.`
+    );
+  }
+  if (ctx.return === void 0 && (cardinality === "list" || cardinality === "single") && sort.length) {
+    ctx.return = { type: cardinality, [cardinality]: { sort } };
+  } else if (def.cardinality !== void 0 && def.cardinality !== "list" && ctx.return === void 0) {
+    if (def.cardinality === "aggregate") {
+      const addonAlias = def.table === void 0 || def.table === null ? ctx.dbo?.as ?? "" : typeof def.table === "string" ? def.table : def.table.name;
+      ctx.return = {
+        type: "aggregate",
+        aggregate: {
+          sort: encodeSort(def.sort, `addon "${def.name}"`),
+          eval: encodeEval(qualifyAggregateEvals(def.eval, addonAlias, "eval")) ?? [],
+          group: encodeEval(qualifyAggregateEvals(def.group, addonAlias, "group")) ?? []
+        }
+      };
+    } else {
+      ctx.return = { type: def.cardinality };
+    }
+  }
+  return ctx;
+}
+function buildOutput(output) {
+  if (!output) return { customize: false, items: [] };
+  if (Array.isArray(output)) {
+    return { customize: true, items: output.map((name) => ({ name, children: [] })) };
+  }
+  const block = output;
+  return { customize: block.customize ?? false, items: block.items ?? [] };
+}
+function encodeAddon(def) {
+  if (!def.name) throw new Error("addon: `name` is required.");
+  return {
+    name: def.name,
+    description: def.description ?? "",
+    context: buildContext(def),
+    output: buildOutput(def.output),
+    tag: encodeTags(def.tags),
+    input: Object.entries(def.input ?? {}).map(([name, d]) => encodeInput(name, d))
+  };
+}
+var addonKind = {
+  name: "addon",
+  payloadKey: "addon",
+  encode: encodeAddon
+};
+registerKind(addonKind);
+function addon(def) {
+  return brandDef(def, "addon");
+}
+
+// src/kinds/function.ts
+function encodeFunction(fn) {
+  if (!fn.name) {
+    throw new Error("function kind: `name` is required.");
+  }
+  warnUnboundReturn("function", fn.name, fn.stack, fn.response);
+  const xdo = {
+    name: fn.name,
+    description: fn.description ?? "",
+    docs: fn.docs ?? "",
+    workspace: { id: fn.workspace ?? 0 },
+    branch: { id: 0 },
+    cache: defaultCache(fn.cache),
+    history: encodeHistory("function", fn.history),
+    middleware: buildMiddlewareBlock(fn.middleware),
+    tag: encodeTags(fn.tags),
+    input: Object.entries(fn.input ?? {}).map(
+      ([name, descriptor]) => encodeInput(name, descriptor)
+    ),
+    result: encodeResponse(fn.response),
+    run: encodeStack("function", fn.name, fn.stack),
+    test: encodeTests(fn.tests, "function", fn.name),
+    market_item: { id: 0, version: 0, guid: "" },
+    shared_workspace: { is_shared: false }
+  };
+  resolveMockKeys(xdo.run, xdo.test, "function", fn.name);
+  return xdo;
+}
+var functionKind = {
+  name: "function",
+  payloadKey: "function",
+  encode: encodeFunction
+};
+registerKind(functionKind);
+
+// src/kinds/all.ts
+var ALL_KINDS = [
+  functionKind,
+  triggerKind,
+  toolKind,
+  promptKind,
+  resourceKind,
+  mcpServerKind,
+  agentKind,
+  tableKind,
+  queryKind,
+  apiGroupKind,
+  taskKind,
+  workflowTestKind,
+  middlewareKind,
+  addonKind,
+  microserviceKind,
+  realtimeServerKind,
+  realtimeChannelKind,
+  realtimeMessageKind,
+  knowledgeKind,
+  workspaceKind
+];
+function registerAllKinds() {
+  for (const kind of ALL_KINDS) registerKind(kind);
+}
+registerAllKinds();
+
+// src/emit/emit.ts
+function emit(def, opts = {}) {
+  registerAllKinds();
+  registerAllStatements();
+  const kind = standaloneDefKind(def);
+  if (kind === void 0) {
+    const name = def?.name;
+    throw new Error(
+      `emit: cannot tell what kind of def${typeof name === "string" ? ` "${name}"` : ""} this is \u2014 nothing marks it as a function, table, query, task, tool, agent, \u2026. Build it with its factory (\`defineFunction({...})\`, \`table({...})\`, \`task({...})\`, \u2026) rather than as an object literal or a spread copy.`
+    );
+  }
+  const { entry, warnings } = new Xano().encodeEntry(kind, def, {
+    ...opts.hostedFiles !== void 0 ? { hostedFiles: opts.hostedFiles } : {},
+    ...opts.documentationTokens !== void 0 ? { documentationTokens: opts.documentationTokens } : {}
+  });
+  for (const warning of warnings) emitDiagnostic(warning);
+  return JSON.stringify(entry, null, opts.indent ?? 2);
+}
+function serializeBundle(bundle, opts = {}) {
+  return JSON.stringify(bundle, null, opts.indent ?? 2);
+}
+function emitBundle(xano, opts = {}) {
+  return serializeBundle(xano.export({ strict: opts.strict }), opts);
+}
+
+export {
+  setVar,
+  updateVar,
+  returnValue,
+  die,
+  debugLog,
+  foreachBreak,
+  foreachContinue,
+  foreachRemove,
+  forLoop,
+  foreachLoop,
+  whileLoop,
+  group,
+  switchCase,
+  switchStatement,
+  tryCatch,
+  functionRun,
+  functionCall,
+  apiCall,
+  taskCall,
+  toolCall,
+  triggerCall,
+  middlewareCall,
+  addonCall,
+  actionCall,
+  actionPackageCall,
+  workflowTestCall,
+  aiAgentRun,
+  cloudJob,
+  cloudJobAwait,
+  cloudJobStatus,
+  arrayMap,
+  arrayUnion,
+  comment,
+  getRawInput,
+  postProcess,
+  realtimeEvent,
+  createAuthToken,
+  expectToThrow,
+  ipLookup,
+  mathAdd,
+  mathSub,
+  mathMul,
+  mathDiv,
+  bitwiseAnd,
+  bitwiseOr,
+  bitwiseXor,
+  textAppend,
+  textPrepend,
+  objectKeys,
+  objectValues,
+  objectEntries,
+  GENERATED_STATEMENT_NAMES,
+  STORAGE_ACCESS,
+  HEADER_DUPLICATES,
+  s,
+  encodeRealtimeChannel,
+  realtimeChannelKind,
+  channelPathParams,
+  realtimeChannel,
+  realtimeChannelGuid,
+  encodeTrigger,
+  tableTrigger,
+  realtimeTrigger,
+  realtimeServerTrigger,
+  realtimeChannelTrigger,
+  mcpServerTrigger,
+  agentTrigger,
+  workspaceTrigger,
+  errorTrigger,
+  triggerKind,
+  TOOL_ANNOTATION_WIRE,
+  encodeTool,
+  toolKind,
+  tool,
+  encodeToolRefs,
+  resolveToolsetCanonical,
+  encodeToolsetBase,
+  prompt,
+  resource,
+  encodeAgent,
+  agentKind,
+  agent,
+  encodeMcpServer,
+  mcpServerKind,
+  mcpServer,
+  KNOWLEDGE_FILE,
+  KNOWLEDGE_DIR,
+  isOsMetadataFile,
+  isOsMetadataRow,
+  knowledgeFile,
+  knowledgeDir,
+  isKnowledgeFileSource,
+  isKnowledgeDirSource,
+  encodeKnowledge,
+  knowledge,
+  knowledgeKind,
+  resolveRealtimeServerCanonical,
+  encodeRealtimeServer,
+  realtimeServerKind,
+  realtimeServer,
+  realtimeMessageGuid,
+  encodeRealtimeMessage,
+  realtimeMessageKind,
+  realtimeMessage,
+  encodeSchedule,
+  encodeTask,
+  taskKind,
+  task,
+  encodeWorkflowTest,
+  workflowTestKind,
+  workflowTest,
+  encodeMiddleware,
+  middlewareKind,
+  middleware,
+  encodeAddon,
+  addonKind,
+  addon,
+  encodeFunction,
+  functionKind,
+  registerAllKinds,
+  emit,
+  serializeBundle,
+  emitBundle
+};
+//# sourceMappingURL=chunk-MXHSQOC4.js.map