@xano/sdk 1.0.0

package/dist/chunk-OXA6PSZT.js

@@ -0,0 +1,1725 @@
+import {
+  SourceReader,
+  SourceShapeError,
+  lineOf,
+  maskNonCode,
+  tokenize
+} from "./chunk-VAX3UZOY.js";
+import {
+  describeEntry,
+  protoKeyed
+} from "./chunk-CIMQZRRE.js";
+import {
+  article,
+  withArticle
+} from "./chunk-36JUQZVQ.js";
+
+// src/values/lambda-ident.ts
+var IDENT = String.raw`[\p{ID_Start}$_][\p{ID_Continue}$\u200C\u200D]*`;
+var ID_CHAR = String.raw`[\p{ID_Continue}$\u200C\u200D]`;
+var ESCAPE = /\\u(?:([0-9A-Fa-f]{4})|\{([0-9A-Fa-f]{1,6})\})/g;
+var IDENT_NAME = new RegExp(`^${IDENT}$`, "u");
+function decodeIdentifier(name) {
+  return name.replace(ESCAPE, (whole, four, braced) => {
+    const code = parseInt(four ?? braced ?? "", 16);
+    return code <= 1114111 ? String.fromCodePoint(code) : whole;
+  });
+}
+function isQuotedShorthand(prop) {
+  const m = /^\s*(["'])([^"'\\]*(?:\\u[^"'\\]*)*)\1\s*:\s*([^\s:=]+)\s*$/su.exec(prop);
+  if (m === null || !isIdentifierName(m[3])) return false;
+  return decodeIdentifier(m[2]) === decodeIdentifier(m[3]);
+}
+function isIdentifierName(name) {
+  return IDENT_NAME.test(decodeIdentifier(name));
+}
+function decodeIdentifierEscapes(src) {
+  if (!src.includes("\\u")) return src;
+  const mask = maskNonCode(src);
+  let out2 = "";
+  let last = 0;
+  for (const m of mask.matchAll(ESCAPE)) {
+    out2 += src.slice(last, m.index) + decodeIdentifier(m[0]);
+    last = m.index + m[0].length;
+  }
+  return out2 + src.slice(last);
+}
+
+// src/types/xdo.ts
+var TAGS = [
+  "const",
+  "const:int",
+  "const:decimal",
+  "const:bool",
+  "const:array",
+  "const:obj",
+  "const:null",
+  // The engine's native epoch-milliseconds constant (`value:"now"`) — what
+  // `c.now()` emits. Distinct from `const` + a `to_epoch_ms` filter: both
+  // evaluate to the same number (live-verified), but this one needs no filter.
+  "const:epochms",
+  "const:expr",
+  "const:expr2",
+  // A text written as its quoted literal — what `c.text` stores for a value
+  // ending in two or more backslashes, the one text the plain `const` form
+  // does not read back exactly.
+  "const:encoded",
+  "var",
+  "input",
+  "auth",
+  "env",
+  "setting",
+  "col",
+  "output",
+  "response",
+  "trycatch",
+  "toolset"
+];
+
+// src/values/expression-arg.ts
+var EXPRESSION_ARG_FILTERS = {
+  transform: 0
+};
+var UNBOUND_HERE = ["$this", "$parent", "$index", "$result"];
+function withoutStringLiterals(source) {
+  return source.replace(/(['"])(?:\\.|(?!\1)[^\\])*\1?/g, (m) => {
+    const closed = m.length > 1 && m.at(-1) === m[0];
+    return m[0] + " ".repeat(m.length - (closed ? 2 : 1)) + (closed ? m[0] : "");
+  });
+}
+function assertExpressionFilterArgs(name, args) {
+  const slot = Object.hasOwn(EXPRESSION_ARG_FILTERS, name) ? EXPRESSION_ARG_FILTERS[name] : void 0;
+  if (slot === void 0) return;
+  const arg = args[slot];
+  if (!isInspectableSource(arg) || arg.value.trim() === "") return;
+  assertExpressionArg(arg.value, `fl.${name}`);
+}
+function isInspectableSource(arg) {
+  return typeof arg === "object" && arg !== null && arg.tag === "const" && typeof arg.value === "string" && (arg.filters?.length ?? 0) === 0;
+}
+function assertExpressionArg(source, fn2) {
+  const scannable = withoutStringLiterals(source);
+  const unbound = UNBOUND_HERE.find((b) => new RegExp(`\\${b}\\b`).test(scannable));
+  if (unbound !== void 0) {
+    const bare = unbound.slice(1);
+    throw new Error(
+      `${fn2}: \`${unbound}\` is not bound in an expression \u2014 it resolves to null, and the filter still returns HTTP 200 with a wrong answer. ${fn2} takes Xano Expression Engine source, and the piped value arrives in the POSITIONAL slot: write \`$0\` (or \`$$\`) where you wrote \`${unbound}\`. ${unbound === "$this" ? "The engine's own filter description says `$this`; it is wrong. " : ""}\`$var\`, \`$input\`, \`$env\` and \`$auth\` DO resolve. (If a stack variable is genuinely named \`${bare}\`, spell it \`$var.${bare}\`.)`
+    );
+  }
+  const js = /(?<![$\w.])return\b/.test(scannable) && "a `return` statement" || /=>/.test(scannable) && "an arrow function" || /;/.test(scannable) && "a statement separator (`;`)";
+  if (js) {
+    throw new Error(
+      `${fn2}: the expression contains ${js}, so it is being written as a JavaScript body. ${fn2} is NOT a lambda \u2014 it takes Xano Expression Engine source, which is a single expression with no \`return\`. The engine parses it either way: \`return $0 * 2\` throws "Not numeric.", and \`const x = $0; return x\` returns the text "const x" with HTTP 200. Write the expression alone \u2014 \`$0 * 2\` \u2014 using \`$0\` (or \`$$\`) for the piped value. For real JavaScript use \`fl.lambda\`, whose body DOES bind \`$this\`.`
+    );
+  }
+}
+
+// src/values/enum-arg.ts
+var ENUM_ARG_FILTERS = {
+  fsort: {
+    slot: 1,
+    arg: "type",
+    members: ["text", "itext", "natural", "inatural", "number"],
+    why: 'The engine accepts any spelling here and validates none of them: an unrecognized comparator falls through to "itext" and sorts numbers as TEXT, so the array comes back in the wrong order with no error. Only "number" compares numerically.'
+  }
+};
+function assertEnumFilterArgs(name, args) {
+  const spec = Object.hasOwn(ENUM_ARG_FILTERS, name) ? ENUM_ARG_FILTERS[name] : void 0;
+  if (spec === void 0) return;
+  const arg = args[spec.slot];
+  if (!isInspectableConst(arg) || arg.value === "") return;
+  if (spec.members.includes(arg.value)) return;
+  throw new Error(
+    `fl.${name}: \`${spec.arg}\` is ${JSON.stringify(arg.value)}, which is not one of ${spec.members.map((m) => JSON.stringify(m)).join(", ")}. ${spec.why}`
+  );
+}
+function isInspectableConst(arg) {
+  return typeof arg === "object" && arg !== null && arg.tag === "const" && typeof arg.value === "string" && (arg.filters?.length ?? 0) === 0;
+}
+
+// src/values/value.ts
+var REJECT_TAGGED_VALUE = "c.obj/c.array embed a plain JSON constant and cannot contain a tagged value (inp/ref/auth/col/env/c.int/c.text/c.bool/\u2026) \u2014 those serialize as internal representation the engine can't decode. For a computed object response, use a record of values \u2014 `response: { key: value }` \u2014 not `c.obj({ key: value })`. For a request body (`s.api.request({ params })`) a tagged value is fine at the TOP LEVEL of a plain object; nested, wrap the whole body in `obj({...})`, which encodes any depth.";
+function isTaggedValue(x) {
+  return (
+    // A trigger field accessor (`t.new`) is a *callable* Value — a function
+    // carrying the `{value,tag,filters}` props — so `typeof` is "function", not
+    // "object". Accept both, or a bare `t.new` slips past this check, falls
+    // through coerceObj's record path, and trips the c.obj nested-value guard.
+    (typeof x === "object" || typeof x === "function") && x !== null && "value" in x && "filters" in x && Array.isArray(x.filters) && TAGS.includes(x.tag) && // `{ a, __proto__: ref("v") }` inherits all three — a record, not `ref("v")`.
+    !protoKeyed(x)
+  );
+}
+function assertPlainJson(root, helper) {
+  const stack = [[root, ""]];
+  const onPath = /* @__PURE__ */ new Map();
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if (frame.length === 3) {
+      onPath.delete(frame[2]);
+      continue;
+    }
+    const [x, path] = frame;
+    if (typeof x === "object" && x !== null) {
+      const back = onPath.get(x);
+      if (back !== void 0) {
+        throw new Error(
+          `${helper}: value at "${path}" refers back to itself (to ${back === "" ? "the argument" : `the value at "${back}"`}) \u2014 a cycle, which JSON cannot store. Pass a copy without the back-reference.`
+        );
+      }
+    }
+    if (isTaggedValue(x)) {
+      throw new Error(path === "" ? REJECT_TAGGED_VALUE : `${helper}: value at "${path}" is a tagged value. ${REJECT_TAGGED_VALUE}`);
+    }
+    const bad = notJson(x);
+    if (bad !== void 0) {
+      throw new Error(
+        `${helper}: ${path === "" ? "the argument" : `value at "${path}"`} is ${bad} \u2014 ${helper}() stores plain JSON only (strings, finite numbers, booleans, null, lists and plain records). Convert it first: a Date to date.toISOString(), a Map to Object.fromEntries(map), a bigint to Number() or String().`
+      );
+    }
+    if (typeof x === "object" && x !== null) {
+      onPath.set(x, path);
+      stack.push([null, path, x]);
+    }
+    if (Array.isArray(x)) {
+      for (let i = x.length - 1; i >= 0; i--) stack.push([x[i], `${path}[${i}]`]);
+    } else if (typeof x === "object" && x !== null) {
+      const entries = Object.entries(x);
+      for (let i = entries.length - 1; i >= 0; i--) {
+        const [k, v] = entries[i];
+        stack.push([v, joinPath(path, k)]);
+      }
+    }
+  }
+}
+function objTaggedList(a) {
+  assertPlainJson(a, "c.obj");
+  return val(JSON.stringify(a), "const:obj");
+}
+function joinPath(path, key) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) return path === "" ? key : `${path}.${key}`;
+  return `${path}[${JSON.stringify(key)}]`;
+}
+function notJson(x) {
+  switch (typeof x) {
+    case "function":
+      return "a function";
+    case "symbol":
+      return "a symbol";
+    case "bigint":
+      return `a bigint (${String(x)}n)`;
+    case "number":
+      return Number.isFinite(x) ? void 0 : `${String(x)}, which JSON cannot store`;
+    case "object": {
+      if (x === null || Array.isArray(x)) return void 0;
+      const proto = Object.getPrototypeOf(x);
+      if (proto === null || proto === Object.prototype) return void 0;
+      return protoKeyed(x) ? describeEntry(x) : describeInstance(x);
+    }
+    default:
+      return void 0;
+  }
+}
+function describeInstance(x) {
+  const name = x.constructor?.name;
+  if (typeof name !== "string" || name === "") return "a class instance";
+  const builtin = ["Date", "Map", "Set", "WeakMap", "WeakSet", "RegExp", "Promise", "Error"];
+  if (builtin.includes(name)) return `a ${name}`;
+  return `${withArticle(name)} instance`;
+}
+var DECIMAL_LITERAL = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+function val(value, tag, filters = []) {
+  return { value, tag, filters };
+}
+function textConst(s) {
+  return /\\\\$/.test(s) ? val(`(${JSON.stringify(s).slice(0, -3)}\\u005c")`, "const:encoded") : val(s, "const");
+}
+function toPlainValue(v) {
+  if (typeof v !== "function") return v;
+  const { value, tag, filters } = v;
+  if (typeof tag !== "string" || !Array.isArray(filters)) return v;
+  return { value, tag, filters };
+}
+function isPlainRecord(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+var BARE_SET_PATH = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function setPath(key) {
+  if (BARE_SET_PATH.test(key)) return key;
+  return `["${key.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"]`;
+}
+function objMember(m) {
+  if (isPlainRecord(m)) return val("{}", "const:obj", objSetFilters(m));
+  if (Array.isArray(m)) return val(JSON.stringify(m), "const:array");
+  if (m === null) return val("null", "const:null");
+  if (typeof m === "boolean") return val(m ? "true" : "false", "const:bool");
+  if (typeof m === "number") {
+    if (!Number.isFinite(m)) return val("null", "const:null");
+    return Number.isInteger(m) && Number.isSafeInteger(m) ? val(String(m), "const:int") : val(String(m), "const:decimal");
+  }
+  return textConst(String(m));
+}
+function objSetFilters(o) {
+  return Object.entries(o).filter(([, m]) => m !== void 0).map(([key, m]) => filter("set", val(setPath(key), "const"), objMember(m)));
+}
+var PCRE_JS_FLAGS = "imsxu";
+function escapeRegexSlashes(body) {
+  let out2 = "";
+  for (let i = 0; i < body.length; i++) {
+    const ch = body[i];
+    if (ch === "\\") {
+      out2 += ch + (body[i + 1] ?? "");
+      i++;
+      continue;
+    }
+    out2 += ch === "/" ? "\\/" : ch;
+  }
+  return out2;
+}
+function isValidPcreLiteral(s) {
+  if (s.length < 2) return false;
+  const d = s[0];
+  if (/[a-zA-Z0-9\\\s]/.test(d)) return false;
+  const close = { "(": ")", "[": "]", "{": "}", "<": ">" }[d] ?? d;
+  let i = 1;
+  for (; i < s.length; i++) {
+    if (s[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (s[i] === close) break;
+  }
+  if (i >= s.length) return false;
+  return /^[a-zA-Z]*$/.test(s.slice(i + 1));
+}
+function barePatternRefusal(value) {
+  if (value.filters.length > 0 || value.tag !== "const") return null;
+  if (isValidPcreLiteral(value.value)) return null;
+  return `${JSON.stringify(value.value)} is a BARE regex pattern. PHP \`preg_*\` reads the first character as the delimiter, so the engine matches nothing for every input \u2014 the assertion or precondition built on it fails (or passes) against text that plainly should not. Build it with c.regex(${JSON.stringify(value.value)}) instead of c.text(...), which wraps and escapes it into a valid PCRE literal`;
+}
+var REGEX_SUBJECT_SLOT = {
+  regex_test: 0,
+  regex_match: 0,
+  regex_match_all: 0,
+  regex_matches: 0,
+  regex_replace: 1,
+  regex_get_all_matches: 0,
+  regex_get_first_match: 0
+};
+var REGEX_PATTERN_FILTERS = new Set(Object.keys(REGEX_SUBJECT_SLOT));
+var REGEX_METACHARACTERS = /[\\^$.|?*+()[\]{}]/;
+function readablePattern(value) {
+  if (!value || value.tag !== "const") return null;
+  if (Array.isArray(value.filters) && value.filters.length > 0) return null;
+  return isValidPcreLiteral(value.value) ? value.value : null;
+}
+function reversedOperandRefusal(pattern, subject) {
+  const misplaced = readablePattern(subject);
+  if (misplaced === null || !REGEX_METACHARACTERS.test(misplaced)) return null;
+  if (readablePattern(pattern) !== null) return null;
+  return `the OPERANDS are reversed. ${JSON.stringify(misplaced)} is a delimiter-wrapped regex pattern sitting in the SUBJECT slot, which means the pattern and the text it tests were written the other way round. The regex family is pattern-piped \u2014 the piped value is the PATTERN and the argument is the text matched against it, the reverse of every other filter \u2014 so this runs the subject as a pattern and answers false for every input, with HTTP 200 and no error. Swap them: pipe the c.regex(...) pattern and pass the subject as the argument`;
+}
+function reversedRegexOperands(v) {
+  const chain = Array.isArray(v.filters) ? v.filters : [];
+  for (const [i, applied] of chain.entries()) {
+    const slot = Object.hasOwn(REGEX_SUBJECT_SLOT, applied.name) ? REGEX_SUBJECT_SLOT[applied.name] : void 0;
+    if (slot === void 0) continue;
+    const pattern = { value: v.value, tag: v.tag, filters: chain.slice(0, i) };
+    const message = reversedOperandRefusal(pattern, applied.arg?.[slot]);
+    if (message !== null) {
+      return { filter: applied.name, slot, subject: applied.arg?.[slot]?.value ?? "", message };
+    }
+  }
+  return null;
+}
+function intLiteral(n) {
+  if (typeof n === "bigint") return String(n);
+  if (typeof n !== "number" && typeof n !== "string") {
+    throw new Error(`c.int() takes an integer, got ${describeEntry(n)}.`);
+  }
+  if (typeof n === "string") {
+    if (!/^[+-]?\d+$/.test(n)) {
+      throw new Error(
+        `c.int() takes an integer literal as a string (digits, optional sign), got ${JSON.stringify(n)}. For a fractional number use c.decimal(), and for the editor's empty value box use c.blank("const:int").`
+      );
+    }
+    return n;
+  }
+  if (!Number.isInteger(n)) {
+    throw new Error(
+      `c.int() takes an integer, got ${n}. Use c.decimal(${n}) for a fractional number.`
+    );
+  }
+  if (!Number.isSafeInteger(n)) throw new Error(`c.int() was given ${lossyIntegerProblem(n)}`);
+  return String(n);
+}
+var INT64_MAX = 9223372036854775807n;
+function lossyIntegerProblem(n) {
+  const rounded = BigInt(n);
+  const range = rounded > INT64_MAX || rounded < -INT64_MAX - 1n ? ", outside the 64-bit integer range" : "";
+  return `${n}, past Number.MAX_SAFE_INTEGER: a JavaScript number cannot hold it exactly, so the literal was rounded before reaching here (it now reads ${rounded}${range}). Write the exact digits you meant as a string or a bigint literal \u2014 c.int("<digits>") or c.int(<digits>n).`;
+}
+var c = {
+  /**
+   * Plain string constant → `tag:"const"`.
+   *
+   * `null` is accepted alongside a string because the engine stores both: 47
+   * values in the sweep are a bare `const` holding `null` rather than `""`,
+   * mostly ignored statement-input entries the engine never reads. They are
+   * distinct bytes — `normalize` keeps them apart, unlike the `const:obj` blanks
+   * it does canonicalize — so a pull has to be able to spell the null form, and
+   * `c.text(null)` did not type-check.
+   *
+   * Write `c.text("")` for an empty string. The null form is here so a pulled
+   * workspace round-trips, not to be authored.
+   */
+  text(s) {
+    if (typeof s !== "string" && s !== null) {
+      throw new Error(
+        `c.text() takes a string, got ${describeEntry(s)}. ` + (typeof s === "number" ? `A number is c.int()/c.decimal(); as text it is c.text("${String(s)}").` : "A record is c.obj({ \u2026 }), a list c.array([ \u2026 ]).")
+      );
+    }
+    return textConst(s);
+  },
+  /**
+   * Integer constant → `tag:"const:int"`, value stringified (e.g. `"123"`).
+   *
+   * Pass a **string** or `bigint` for an integer outside JavaScript's safe
+   * range: `c.int("9223372036854775807")` is exact, where the number literal
+   * for it silently rounds. The engine's integers are signed 64-bit and it
+   * clamps a value past that range with no error, so the export warns on one
+   * (`value.int-out-of-range`); the string form still stores the digits as
+   * written, which a pulled workspace relies on.
+   *
+   * A `number` that is not an integer, or is past `Number.MAX_SAFE_INTEGER`,
+   * **throws**: by the time such a literal reaches here its precision is already
+   * gone, so encoding it would write a value the caller did not type. The throw
+   * names the string form.
+   */
+  int(n) {
+    return val(intLiteral(n), "const:int");
+  },
+  /**
+   * Decimal constant → `tag:"const:decimal"`.
+   *
+   * Pass a **string** to preserve a stored spelling a number literal cannot
+   * reproduce — `c.decimal("10.00")` keeps its trailing zeros, where
+   * `c.decimal(10)` writes `"10"`. The engine stores decimals as strings either
+   * way, so this is exactness rather than a workaround; prefer the number form
+   * whenever it reproduces the value you want.
+   */
+  decimal(n) {
+    if (typeof n !== "number" && typeof n !== "string" || typeof n === "number" && !Number.isFinite(n)) {
+      throw new Error(`c.decimal() takes a finite number (or its string spelling), got ${describeEntry(n)}.`);
+    }
+    if (typeof n === "string" && !DECIMAL_LITERAL.test(n)) {
+      throw new Error(
+        `c.decimal() takes a number, or a decimal literal as a string (digits, optional sign, point and exponent), got ${JSON.stringify(n)}. For the editor's empty value box use c.blank("const:decimal").`
+      );
+    }
+    return val(String(n), "const:decimal");
+  },
+  /**
+   * The editor's **unconfigured value box** — a value cell added and never
+   * filled in, stored as `{value: "", tag}`.
+   *
+   * This is not a zero, an empty string, or an empty collection. The engine
+   * reads `""` and `"0"` differently, so `c.blank("const:int")` and `c.int(0)`
+   * are different stored values and the SDK will not canonicalize one into the
+   * other. It exists because 13 real values in the survey corpus are in this
+   * state and had no authoring form, so a pull emitted them as annotated
+   * literals with a warning attached — describing a workspace that was fine.
+   *
+   * Constant tags only. A blank `var` or `input` is an unbound REFERENCE, which
+   * is a different defect with a different fix, and is deliberately not
+   * spellable here. `const` and `const:obj` are excluded too: they already have
+   * exact blank forms in `c.text("")` and `c.obj(null)`, and a second spelling
+   * for the same bytes is how two constructors start disagreeing.
+   */
+  blank(tag) {
+    if (typeof tag !== "string" || !tag.startsWith("const:") || tag === "const:obj" || !TAGS.includes(tag)) {
+      throw new Error(
+        `c.blank() takes a constant tag with a blank form \u2014 "const:int", "const:decimal", "const:bool", \u2026 \u2014 got ${describeEntry(tag)}. A blank text is c.text(""), a blank object c.obj(null).`
+      );
+    }
+    return val("", tag);
+  },
+  /** Boolean constant → `"true"`/`"false"` with `tag:"const:bool"`. */
+  bool(b) {
+    if (typeof b === "string" && (b === "true" || b === "false")) return val(b, "const:bool");
+    if (typeof b !== "boolean") {
+      throw new Error(`c.bool() takes true or false, got ${describeEntry(b)}.`);
+    }
+    return val(b ? "true" : "false", "const:bool");
+  },
+  /**
+   * Null constant → value `"null"` (per engine fixture).
+   *
+   * Bare `c.null()` is the plain `const:null`. Pass a tag for the **object-typed
+   * null** the engine writes into a `db.*` statement's `@meta` slot —
+   * `c.null("const:obj")` → `{tag:"const:obj", value:"null"}`, 16 of them across
+   * eight ordinary queries in the survey corpus, which had no spelling and came
+   * back as `rawValue`.
+   *
+   * ⚠ Not the same bytes as `c.obj(null)`, which is the BLANK object
+   * (`value: ""`). Both evaluate to null — the engine JSON-decodes the stored
+   * string and `""` and `"null"` both decode to it — but they are two stored
+   * spellings, and the SDK writes back the one it was given rather than
+   * re-pointing a pulled workspace at the other.
+   */
+  null(tag = "const:null") {
+    if (tag !== "const:null" && tag !== "const:obj") {
+      throw new Error(`c.null() takes no argument, or the tag "const:obj" for an object-typed null \u2014 got ${describeEntry(tag)}.`);
+    }
+    return val("null", tag);
+  },
+  /**
+   * Build a **regex pattern value** for the pattern-piped regex filters
+   * (`fl.regex_test`/`regex_match`/`regex_replace`/…). Xano runs PHP `preg_*`, so
+   * the pattern MUST be delimiter-wrapped — a bare `c.text("^…$")` is an invalid
+   * PCRE and the filter then matches *nothing* for every input, so a precondition
+   * built on it silently rejects all values. This wraps the raw
+   * pattern in `/…/`, escapes any interior `/`, and appends `flags`, so the result
+   * is always valid; `withFilters` rejects a bare `c.text` pattern and points here.
+   *
+   * Pass a JS `RegExp` (source + flags used directly, minus JS-only `g`/`y`/`d`):
+   * `c.regex(/^[^@\s]+@[^@\s]+\.[^@\s]+$/i)`, or a raw body + optional PCRE flags:
+   * `c.regex("^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$", "i")`. The pattern is the piped
+   * value; the filter's `subject` arg is the text tested against it.
+   */
+  regex(pattern, flags) {
+    if (typeof pattern !== "string" && !(pattern instanceof RegExp)) {
+      throw new Error(`c.regex() takes a pattern string or a RegExp \u2014 got ${describeEntry(pattern)}.`);
+    }
+    if (flags === null) flags = void 0;
+    if (flags !== void 0 && typeof flags !== "string") {
+      throw new Error(`c.regex: flags must be letters (e.g. "i", "im"), got ${describeEntry(flags)}.`);
+    }
+    const body = typeof pattern === "string" ? pattern : pattern.source;
+    const raw2 = flags ?? (typeof pattern === "string" ? "" : [...pattern.flags].filter((ch) => PCRE_JS_FLAGS.includes(ch)).join(""));
+    if (!/^[a-zA-Z]*$/.test(raw2)) {
+      throw new Error(`c.regex: flags must be letters (e.g. "i", "im"), got ${JSON.stringify(raw2)}`);
+    }
+    return val(`/${escapeRegexSlashes(body)}/${raw2}`, "const");
+  },
+  /**
+   * Current time as an **epoch-milliseconds** value — the engine's native
+   * `const:epochms` constant. Xano has no `$now` *setting*, so this lives on
+   * `c.*` (a current-time literal) rather than {@link sys} (which emits
+   * `setting("$…")` and would reference a dead `$now` var).
+   *
+   * Emits `{tag:"const:epochms", value:"now"}` — an UNFILTERED value, valid
+   * inline as a `where`/`cmp` operand. The equivalent `text("now") |to_epoch_ms`
+   * chain evaluates to the same epoch-ms number on a live engine, and both
+   * persist verbatim, but the native tag is what the editor writes and needs no
+   * filter to get there. Chain math onto it as usual:
+   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`.
+   *
+   * Inside an `obj()` the tag is flattened into an expression string, where the
+   * identifier `now` alone is the STRING "now" — so `obj()` writes the
+   * `now|to_epochms` coercion that restores this tag's meaning. A `c.now()` used
+   * as a FILTER ARGUMENT there is refused: the coercion cannot be written in
+   * that position. Hoist it with `s.set_var` and `ref()` it.
+   */
+  now() {
+    return val("now", "const:epochms");
+  },
+  /**
+   * Object constant → JSON-string value with `tag:"const:obj"`. Takes **plain
+   * JSON literals only**: nesting a tagged value (`inp`/`ref`/`auth`/`c.*`) is a
+   * compile error and throws at runtime — it would serialize as internal
+   * representation the engine can't decode. For a computed/multi-key object
+   * response use a record of values (`response: { key: value }`), not `c.obj`.
+   *
+   * Called with no argument it is the **empty object**, `{}` — the same default
+   * the editor gives a new object variable, and the only empty form current
+   * editors write.
+   *
+   * Called with an explicit `null` it is the **blank** form (stored `value: ""`),
+   * which the engine evaluates to `null` rather than `{}` — it JSON-decodes the
+   * stored string, and decoding `""` yields null. That is a real difference in
+   * what the statement sees, so the two are separate spellings rather than one
+   * "empty object": `c.obj()` is `{}`, `c.obj(null)` is null.
+   *
+   * ⚠ **Prefer `c.obj()`.** The blank form is legacy — no current editor path
+   * writes it — and it exists here so a pulled workspace round-trips to the
+   * same bytes instead of being quietly re-pointed at `{}`.
+   *
+   * A **populated** object is stored the way the editor stores one: an empty
+   * `{}` base carrying one `set` filter per key. It is NOT a
+   * populated JSON string — that form fails the request at runtime, see
+   * {@link objSetFilters}.
+   *
+   * ⚠ **Zero-based numeric keys come back as a LIST**, not an object:
+   * `c.obj({ "0": "a" })` evaluates to `["a"]`. That is the engine's data model
+   * — a numeric key IS an index there, and the same object decoded from JSON
+   * anywhere else behaves identically — not something this encoding introduces.
+   * A non-zero-based numeric key (`{ "2": … }`) survives as a key. Live-verified.
+   * `export()` warns `value.obj-zero-based-numeric-keys` on the def that carries one.
+   */
+  obj(o) {
+    if (o === null) return val("", "const:obj");
+    const j = o ?? {};
+    if (typeof j !== "object" || Array.isArray(j)) {
+      throw new Error(
+        `c.obj() takes a { key: value } record of plain JSON \u2014 got ${describeEntry(j)}. A number is c.int()/c.decimal(), text c.text(), a list c.array([ \u2026 ]).`
+      );
+    }
+    assertPlainJson(j, "c.obj");
+    if (!isPlainRecord(j)) return val(JSON.stringify(j), "const:obj");
+    return val("{}", "const:obj", objSetFilters(j));
+  },
+  /**
+   * Array constant → JSON-string value with `tag:"const:array"`. Takes **plain
+   * JSON literals only** — like {@link obj}, a nested tagged value is a compile
+   * error and throws at runtime.
+   */
+  array(a) {
+    if (!Array.isArray(a)) {
+      throw new Error(
+        `c.array() takes a list of plain JSON \u2014 got ${describeEntry(a)}. A record is c.obj({ \u2026 }), an empty list c.array([]).`
+      );
+    }
+    assertPlainJson(a, "c.array");
+    return val(JSON.stringify(a), "const:array");
+  },
+  /**
+   * A **Xano Expression Engine** expression, passed through verbatim →
+   * `tag:"const:expr2"`. The string IS the expression, exactly as it would be
+   * typed into the expression editor:
+   *
+   *   c.expression('"Hello, " ~ $input.name')
+   *   c.expression("$var.price * $var.qty")
+   *   c.expression("{ id: $var.user.id, tier: $var.plan }")
+   *
+   * ⚠️ **THE STRING IS NOT VALIDATED.** Xano SDK does not parse it, does not
+   * type-check it, and cannot tell a working expression from a typo — the whole
+   * string is handed to the engine as-is. Nothing here participates in
+   * `InferResponse`, so a var referenced inside it is invisible to the type
+   * system, and a rename that updates every typed `ref()` will NOT update this.
+   * A malformed expression surfaces at RUNTIME, and one that is merely wrong
+   * (`$var.tota1`) surfaces as a wrong answer, not an error. Play at your own
+   * risk until validation exists.
+   *
+   * Prefer the typed surfaces whenever they cover the case: `ref`/`inp`/`col`
+   * for references, `withFilters(..., fl.*)` for transforms, {@link obj} for a
+   * dynamic object (it BUILDS a checked expression for you). Reach for this only
+   * for expression-engine syntax the typed surfaces cannot express — string
+   * concatenation with `~`, inline arithmetic, conditionals.
+   *
+   * NOT the `expr()` condition builder. `expr(col("id"), "=", inp("id"))` builds
+   * a comparison for a `where`; this builds a VALUE from raw expression source.
+   */
+  expression(source) {
+    assertExpressionSource(source, "c.expression");
+    return val(source, "const:expr2");
+  },
+  /**
+   * The **older** expression form → `tag:"const:expr"`, kept because real
+   * workspaces still hold values stored that way and codegen has to bring them
+   * back as something readable. New code wants {@link expression}, which is what
+   * the expression editor writes today.
+   *
+   * ⚠️ Unvalidated passthrough, exactly like {@link expression} — see the
+   * warning there. This one additionally uses the older syntax generation, so an
+   * expression copied out of the current editor may not mean the same thing
+   * here.
+   */
+  expressionLegacy(source) {
+    assertExpressionSource(source, "c.expressionLegacy");
+    return val(source, "const:expr");
+  }
+};
+function assertExpressionSource(source, fn2) {
+  if (typeof source !== "string") {
+    const tagged = isTaggedValue(source);
+    throw new Error(
+      `${fn2}() takes the expression SOURCE as a string, got ${tagged ? "a Value" : describeEntry(source)}. ` + (tagged ? `To reference a value inside an expression, write its path into the string (e.g. ${fn2}("$var.total * 2")). For a comparison in a where/condition use expr(left, op, right) or cmp(...), not ${fn2}().` : `Pass expression-engine source, e.g. ${fn2}('"Hi, " ~ $input.name').`)
+    );
+  }
+  if (source === "") {
+    throw new Error(
+      `${fn2}() was given an empty string, which the engine cannot evaluate. Pass expression source, or use c.text("") for an empty string constant.`
+    );
+  }
+}
+function ref(name, opts) {
+  assertRefName("ref", name, "the variable name");
+  assertNamed("ref", name, 'the variable to read, e.g. ref("total")');
+  const dot = name.indexOf(".");
+  if (opts?.safe && dot !== -1) {
+    const base = name.slice(0, dot);
+    const path = name.slice(dot + 1);
+    return withFilters(val(base, "var"), filter("get", c.text(path), c.null()));
+  }
+  return val(name, "var");
+}
+function assertNoRefOptions(creator, opts) {
+  if (opts === void 0) return;
+  const safe = typeof opts === "object" && opts !== null && "safe" in opts;
+  throw new Error(
+    `${creator}() takes only a name \u2014 ${safe ? "`safe`" : "a second argument"} is a ref() option and would be silently dropped here. Null-safe drilling into a dotted path is implemented on ref() alone: \`ref("owner.id", { safe: true })\` compiles to \`$owner|get:"id"\`, which yields null instead of 500ing when the base is null. To drill safely from ${creator}(), bind it to a variable first (\`s.set_var\`) and ref() that.`
+  );
+}
+function assertRefName(creator, name, what) {
+  if (typeof name === "string") return;
+  throw new Error(`${creator}() takes ${what} as a string \u2014 got ${describeEntry(name)}.`);
+}
+function assertNamed(creator, name, what) {
+  if (name === "") throw new Error(`${creator}() was given an empty name \u2014 pass ${what}.`);
+}
+function refPath(creator, path) {
+  if (path === void 0 || path === null) return "";
+  assertRefName(creator, path, "a dotted path");
+  return path;
+}
+function inp(name, opts) {
+  assertRefName("inp", name, "the input name");
+  assertNoRefOptions("inp", opts);
+  return val(name, "input");
+}
+function col(name, opts) {
+  assertRefName("col", name, "the column name");
+  assertNoRefOptions("col", opts);
+  return val(name, "col");
+}
+function auth(path = "", opts) {
+  assertNoRefOptions("auth", opts);
+  return val(refPath("auth", path), "auth");
+}
+function drill(base, path) {
+  if (path === "") return base;
+  return path.split(".").reduce((out2, seg) => BARE_SET_PATH.test(seg) ? `${out2}.${seg}` : out2 + setPath(seg), base);
+}
+function resp(path = "", opts) {
+  assertNoRefOptions("resp", opts);
+  return val(drill("response", refPath("resp", path)), "response");
+}
+function caught(path, opts) {
+  assertNoRefOptions("caught", opts);
+  return val(refPath("caught", path ?? ""), "trycatch");
+}
+function isToolsetPath(value) {
+  return value === "token" || value === "params" || value.startsWith("params.");
+}
+function toolset(path, opts) {
+  assertRefName("toolset", path, 'a path ("token", "params" or "params.<name>")');
+  assertNoRefOptions("toolset", opts);
+  return val(path, "toolset");
+}
+function env(name, opts) {
+  assertRefName("env", name, "the environment variable name");
+  assertNamed("env", name, 'the environment variable to read, e.g. env("STRIPE_KEY")');
+  assertNoRefOptions("env", opts);
+  return val(name, "setting");
+}
+function setting(name, opts) {
+  assertRefName("setting", name, "the setting name");
+  assertNamed("setting", name, 'the setting to read, e.g. setting("$remote_ip")');
+  assertNoRefOptions("setting", opts);
+  return val(name, "setting");
+}
+var sys = {
+  /** Client IP address (`$remote_ip`, text). Best public-endpoint rate-limit key. */
+  remoteIp: () => val("$remote_ip", "setting"),
+  /** HTTP method of the request — `GET`, `POST`, … (`$request_method`, text). */
+  requestMethod: () => val("$request_method", "setting"),
+  /** Full request URI/path (`$request_uri`, text). */
+  requestUri: () => val("$request_uri", "setting"),
+  /** Raw query-string portion of the URL (`$request_querystring`, text). */
+  requestQueryString: () => val("$request_querystring", "setting"),
+  /** Request headers as an object/map (`$http_headers`, object). */
+  /**
+   * The request's headers, keyed Title-Cased whatever the client sent — a
+   * client's `x-sync-secret` is read as `X-Sync-Secret`, so read that spelling.
+   * `s.api.call` sends header names the same way.
+   */
+  httpHeaders: () => val("$http_headers", "setting"),
+  /** The caller's `Authorization` bearer token, if present (`$request_auth_token`, text). */
+  requestAuthToken: () => val("$request_auth_token", "setting"),
+  /** API base URL for the request (`$api_baseurl`, text). */
+  apiBaseUrl: () => val("$api_baseurl", "setting"),
+  /** Active data source name — e.g. `live` or a branch source (`$datasource`, text). */
+  datasource: () => val("$datasource", "setting"),
+  /** Active branch name (`$branch`, text). */
+  branch: () => val("$branch", "setting"),
+  /** Tenant identifier for multi-tenant instances (`$tenant`, text). */
+  tenant: () => val("$tenant", "setting"),
+  /** Current release number (`$release`, int). */
+  release: () => val("$release", "setting"),
+  /** Platform identifier (`$platform`, int). */
+  platform: () => val("$platform", "setting"),
+  /** `true` when the request is running under the debugger (`$debugger`, bool). */
+  isDebugger: () => val("$debugger", "setting")
+};
+function out(name, opts) {
+  assertRefName("out", name, "the output name");
+  assertNoRefOptions("out", opts);
+  return val(name, "output");
+}
+function filter(name, ...args) {
+  const last = args.reduce((acc, a, i) => a !== void 0 ? i : acc, -1);
+  const hole = args.slice(0, last).findIndex((a) => a === void 0);
+  if (hole !== -1) {
+    throw new Error(
+      `Filter \`${name}\`: argument ${hole + 1} is omitted but argument ${last + 1} is supplied. Filter arguments are positional, so an omitted one in the middle would shift every argument after it into the wrong slot. Pass a value for argument ${hole + 1}, or use the named form \u2014 \`fl.${name}({ \u2026 })\` \u2014 which cannot mis-slot.`
+    );
+  }
+  assertLambdaFilterArgs(name, args);
+  assertExpressionFilterArgs(name, args);
+  assertEnumFilterArgs(name, args);
+  return { name, disabled: false, arg: args.filter((a) => a !== void 0).map(toPlainValue) };
+}
+function withFilters(value, ...filters) {
+  if (!isTaggedValue(value)) {
+    throw new Error(
+      `withFilters: the first argument must be a tagged value (\`c.*\`, \`ref()\`, \`inp()\`, \u2026) \u2014 got ${describeEntry(value)}. It is the value the chain is applied to; the filters follow it.`
+    );
+  }
+  const added = filters.flat(Infinity);
+  const malformed = added.findIndex(
+    (f) => f === null || typeof f !== "object" || typeof f.name !== "string"
+  );
+  if (malformed !== -1) {
+    const got = added[malformed];
+    throw new Error(
+      `withFilters: argument ${malformed} of the filter chain is not a filter \u2014 got ${JSON.stringify(got) ?? String(got)}. Each entry must come from an \`fl.*\` factory (or \`filter(name, ...)\`), which returns \`{name, arg, disabled}\`. A tagged value is not a filter: to pipe one value through another, pass it as a filter ARGUMENT (\`fl.concat(other)\`), not as a chain member.`
+    );
+  }
+  const reversed = reversedRegexOperands({
+    value: value.value,
+    tag: value.tag,
+    filters: [...value.filters, ...added]
+  });
+  if (reversed) {
+    throw new Error(
+      `Regex filter \`${reversed.filter}\`: ${reversed.message} \u2014 \`withFilters(c.regex(\u2026), fl.${reversed.filter}(${reversed.slot === 0 ? "" : "\u2026, "}subject))\`. Naming the argument says which slot is which: \`fl.${reversed.filter}({ subject: \u2026 })\`.`
+    );
+  }
+  const pipedIsBarePattern = barePatternRefusal(value) !== null;
+  const offending = pipedIsBarePattern ? added.find((filter2) => REGEX_PATTERN_FILTERS.has(filter2.name)) : void 0;
+  if (offending) {
+    const escapeHatch = added[0] === offending ? "" : ` If this chain BUILDS the pattern rather than normalizing it, apply the prefix in its own \`withFilters(...)\` call \u2014 the guard only inspects an unfiltered const, so a filtered base passes through untouched.`;
+    throw new Error(
+      `Regex filter \`${offending.name}\` is pattern-piped: the value it filters is the regex PATTERN, which PHP \`preg_*\` requires to be delimiter-wrapped. ${JSON.stringify(value.value)} is a bare pattern, so the engine matches nothing for every input (a precondition on it silently rejects all values). Build it with c.regex(${JSON.stringify(value.value)}) instead of c.text(...).${escapeHatch}`
+    );
+  }
+  return { ...value, filters: [...value.filters, ...added] };
+}
+
+// src/values/lambda.ts
+var LAMBDA_BINDINGS = {
+  // Runs once, over no element and no piped value.
+  "s.lambda": ["$env", "$input", "$var", "$auth"],
+  // Runs once, over the piped value — which it binds as `$this` (NOT `$parent`).
+  "fl.lambda": ["$env", "$input", "$var", "$auth", "$this"],
+  // The array-iterating filters: one run per element.
+  map: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  filter: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  some: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  every: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  find: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  findIndex: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent"],
+  // …plus the accumulator, which is `$result`.
+  reduce: ["$env", "$input", "$var", "$auth", "$this", "$index", "$parent", "$result"]
+};
+var LAMBDA_GLOBALS = ["console", "crypto"];
+var LAMBDA_MODULE_GLOBALS = [
+  "_",
+  "aws4",
+  "axios",
+  "cryptojs",
+  "DateTime",
+  "ethers",
+  "fastXmlParser",
+  "jose",
+  "luxon",
+  "mailparser",
+  "math",
+  "moment",
+  "nodemailer",
+  "socks",
+  "uuid",
+  "utils"
+];
+var LAMBDA_CODE_FILTERS = {
+  lambda: { slot: 0, surface: "fl.lambda" },
+  map: { slot: 0, surface: "map" },
+  filter: { slot: 0, surface: "filter" },
+  some: { slot: 0, surface: "some" },
+  every: { slot: 0, surface: "every" },
+  find: { slot: 0, surface: "find" },
+  findIndex: { slot: 0, surface: "findIndex" },
+  reduce: { slot: 1, surface: "reduce" }
+};
+function assertLambdaFilterArgs(name, args) {
+  const site = Object.hasOwn(LAMBDA_CODE_FILTERS, name) ? LAMBDA_CODE_FILTERS[name] : void 0;
+  if (site === void 0) return;
+  const code = args[site.slot];
+  if (!isInspectableBody(code) || code.value.trim() === "") return;
+  assertLambdaBody(code.value, site.surface, `fl.${name}`);
+}
+var LAMBDA_STATEMENTS = {
+  "mvp:lambda": { field: "code", surface: "s.lambda" }
+};
+function coerceLambdaFields(storedName, authored) {
+  const site = Object.hasOwn(LAMBDA_STATEMENTS, storedName) ? LAMBDA_STATEMENTS[storedName] : void 0;
+  if (site === void 0 || typeof authored[site.field] !== "function") return authored;
+  return { ...authored, [site.field]: toLambdaValue(authored[site.field], site.surface, storedName === "mvp:lambda" ? "s.lambda" : storedName) };
+}
+function assertLambdaStatement(storedName, authored) {
+  const site = Object.hasOwn(LAMBDA_STATEMENTS, storedName) ? LAMBDA_STATEMENTS[storedName] : void 0;
+  if (site === void 0) return;
+  const code = authored[site.field];
+  if (!isInspectableBody(code) || code.value.trim() === "") return;
+  assertLambdaBody(code.value, site.surface, "s.lambda");
+}
+function isInspectableBody(code) {
+  return typeof code === "object" && code !== null && code.tag === "const" && typeof code.value === "string" && (code.filters?.length ?? 0) === 0;
+}
+function toLambdaValue(x, surface, source) {
+  if (typeof x !== "function") return x;
+  const { body, captureReads } = extractFunction(String(x), source);
+  return lambdaValue(body, { surface }, source, true, captureReads);
+}
+var PREFIX = "lam";
+function extractFunction(source, caller) {
+  const src = source.trim();
+  if (src.includes("[native code]")) {
+    throw new Error(
+      `${caller}: this function has no readable source (it is native, bound, or otherwise not authored here), so there is no body to send to the engine. Write the body inline as an arrow function, or use lam.raw(...) with the code as text.`
+    );
+  }
+  const fn2 = readFunction(src, caller);
+  const [ps, pe] = fn2.params;
+  const [bs, be] = fn2.body;
+  const params = decodeIdentifierEscapes(src.slice(ps, pe));
+  const captureReads = assertDestructuredParams(params, maskNonCode(params), maskNonCode(decodeIdentifierEscapes(src.slice(bs, be))), caller);
+  const text = src.slice(bs, be);
+  if (fn2.block) return { body: stripKeepNames(dedent(text.trim())), captureReads };
+  const lead = /[ \t]*$/.exec(src.slice(0, bs))?.[0] ?? "";
+  const ownLine = /(^|\n)[ \t]*$/.test(src.slice(0, bs));
+  const expr = ownLine ? dedent(`
+${lead}${text}`).slice(1).trimStart() : dedent(text);
+  const body = `return ${expr};`;
+  return { body: stripKeepNames(body), captureReads };
+}
+function readFunction(src, caller) {
+  const reader = new SourceReader(tokenize(src));
+  const refuse = (reason) => {
+    throw new Error(
+      `${caller}: could not read ${JSON.stringify(src.slice(0, 80))} as one arrow function or function expression (${reason}), so the body cannot be located with certainty. Write the function itself \u2014 \`({ $var }: \u2026) => \u2026\` or \`function ({ $var }: \u2026) { \u2026 }\` \u2014 and nothing else. A class method or an object shorthand method does not extract; write it as an arrow function.`
+    );
+  };
+  try {
+    const { fn: fn2, end } = reader.parseFunctionExpression(0);
+    let k = end;
+    while (reader.isP(k, ";")) k++;
+    if (k < reader.toks.length) reader.fail(`\`${reader.toks[k].text}\` after the function`, k);
+    return fn2;
+  } catch (e) {
+    if (e instanceof SourceShapeError) return refuse(`${e.message} at line ${lineOf(src, e.offset)}`);
+    throw e;
+  }
+}
+var KEEP_NAMES_CALL = new RegExp(String.raw`()(?<!${ID_CHAR}|[\\.])__name\s*\(`, "u");
+function stripKeepNames(body) {
+  let out2 = body;
+  for (; ; ) {
+    const mask = maskNonCode(out2);
+    const call = KEEP_NAMES_CALL.exec(mask);
+    if (call === null) break;
+    const start = call.index + (call[1] ?? "").length;
+    const open = mask.indexOf("(", start);
+    const close = closingParen(mask, start) - 1;
+    if (close <= open) break;
+    const args = out2.slice(open + 1, close);
+    const comma = splitTopLevel(maskNonCode(args))[0]?.length ?? args.length;
+    const first = args.slice(0, comma).trim();
+    const before = mask.slice(0, start);
+    const isStatement = /(^|[;{}])\s*$/.test(before) && isIdentifierName(first);
+    const trailing = isStatement ? /^\s*;?/.exec(out2.slice(close + 1))?.[0].length ?? 0 : 0;
+    out2 = out2.slice(0, start) + (isStatement ? "" : first) + out2.slice(close + 1 + trailing);
+  }
+  return out2.trim();
+}
+function dedent(body) {
+  if (body.includes("`")) return body;
+  const lines = body.split("\n");
+  const indents = lines.slice(1).filter((l) => l.trim() !== "").map((l) => /^[ \t]*/.exec(l)?.[0].length ?? 0);
+  const common = indents.length ? Math.min(...indents) : 0;
+  if (common === 0) return body;
+  return [lines[0], ...lines.slice(1).map((l) => l.slice(common))].join("\n");
+}
+function assertDestructuredParams(params, paramsMask, bodyMask, caller) {
+  const open = paramsMask.indexOf("(");
+  const close = open === -1 ? -1 : closingParen(paramsMask, open) - 1;
+  const [inner, innerMask] = open === -1 || close <= open ? [params, paramsMask] : [params.slice(open + 1, close), paramsMask.slice(open + 1, close)];
+  let at = 0;
+  const captureReads = [];
+  splitTopLevel(innerMask).forEach((partMask, index) => {
+    const part = inner.slice(at, at + partMask.length);
+    at += partMask.length + 1;
+    const lead = /^\s*/.exec(partMask)?.[0].length ?? 0;
+    if (partMask[lead] === "{" || partMask[lead] === "[") {
+      assertPlainPattern(part, partMask, lead, index, bodyMask, caller);
+      if (index === 1) {
+        const end = closingBracket(partMask, lead);
+        captureReads.push(...patternNames(partMask.slice(lead, end), part.slice(lead, end)).filter((n) => readsName(bodyMask, n)));
+      }
+      return;
+    }
+    const name = new RegExp(String.raw`^\s*(?:\.\.\.)?\s*(${IDENT})`, "u").exec(partMask)?.[1];
+    if (name === void 0) return;
+    if (!readsName(bodyMask, name)) return;
+    const fix = index === 0 ? `DESTRUCTURE the bindings instead: \`({ ${name.startsWith("$") ? name : "$this"} }) => \u2026\` rather than \`(${name}) => \u2026 ${name}.$this \u2026\`.` : index === 1 ? `The second parameter carries \`capture\` only: DESTRUCTURE the keys you captured (\`(_, { rate }) => \u2026 rate \u2026\`), or declare \`${name}\` inside the body (\`const ${name} = \u2026\`).` : `Nothing arrives there: a lambda receives its bindings and its capture only. Declare \`${name}\` inside the body (\`const ${name} = \u2026\`), or bring a value in through \`capture\`.`;
+    throw new Error(
+      `${caller}: the body reads \`${name}\`, but a lambda's parameters are not real \u2014 only the BODY is sent, and the engine injects the bindings as free identifiers. ${fix} As written, \`${name}\` is undefined at runtime and the engine returns that failure as text in the value slot.`
+    );
+  });
+  return captureReads;
+}
+function readsName(bodyMask, name) {
+  return new RegExp(`(?<!${ID_CHAR}|\\.)${name.replace(/\$/g, "\\$")}(?!${ID_CHAR})`, "u").test(bodyMask);
+}
+function assertPlainPattern(part, partMask, lead, index, bodyMask, caller) {
+  const end = closingBracket(partMask, lead);
+  const pattern = part.slice(lead, end);
+  const patternMask = partMask.slice(lead, end);
+  const notReal = `a lambda's parameters are not real \u2014 only the BODY is sent, and the engine injects each ` + (index === 0 ? "binding" : "capture key") + ` under its OWN name`;
+  if (index >= 2) {
+    const read = patternNames(patternMask, pattern).find((n) => readsName(bodyMask, n));
+    if (read === void 0) return;
+    throw new Error(
+      `${caller}: the body reads \`${read}\`, but ${notReal}, and nothing arrives in a third parameter. Declare \`${read}\` inside the body (\`const ${read} = \u2026\`), or bring a value in through \`capture\`.`
+    );
+  }
+  const plain = `({ $this }) => $this.price`;
+  const fix = index === 0 ? `Destructure the bindings by their own names, with no renaming, nesting, default or rest \u2014 \`${plain}\`, \`({ $var }) => $var.subtotal\` \u2014 and read deeper values in the body.` : `Destructure the capture keys by their own names \u2014 \`(_, { rate }) => rate\` \u2014 and pick the name in \`capture\` itself (\`capture: { r: rate }\`, read as \`(_, { r }) => r\`).`;
+  if (patternMask.startsWith("[")) {
+    throw new Error(
+      `${caller}: the ${index === 0 ? "first" : "second"} parameter is an array pattern \`${pattern}\`, but ${notReal}, so nothing it names exists at runtime. ${fix}`
+    );
+  }
+  let at = 1;
+  for (const propMask of splitTopLevel(patternMask.slice(1, -1))) {
+    const prop = pattern.slice(at, at + propMask.length).trim();
+    at += propMask.length + 1;
+    if (propMask.trim() === "" || isIdentifierName(propMask.trim()) || isQuotedShorthand(prop)) continue;
+    const what = /^\s*\.\.\./.test(propMask) ? "a rest element" : hasTopLevel(propMask, ":") ? "a renamed or nested property" : hasTopLevel(propMask, "=") ? "a default (it never applies)" : "a computed or quoted key";
+    const alias = hasTopLevel(propMask, ":") ? patternNames(`{${propMask}}`, `{${prop}}`)[0] : void 0;
+    throw new Error(
+      `${caller}: \`${prop}\` in the parameter pattern \`${pattern}\` is ${what}, but ${notReal}` + (alias === void 0 ? `, so the pattern does nothing at runtime.` : isFreeIdentifier(alias) ? `, so \`${alias}\` is never defined: the body throws, and the engine returns that failure as text in the value slot with HTTP 200.` : `, so \`${alias}\` reads the global of that name instead \u2014 a wrong value with HTTP 200.`) + ` ${fix}`
+    );
+  }
+}
+function closingBracket(mask, from) {
+  let depth = 0;
+  for (let i = from; i < mask.length; i++) {
+    const ch = mask[i];
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if ((ch === ")" || ch === "]" || ch === "}") && --depth === 0) return i + 1;
+  }
+  return mask.length;
+}
+function hasTopLevel(mask, ch) {
+  let depth = 0;
+  for (let i = 0; i < mask.length; i++) {
+    const c2 = mask[i];
+    if (c2 === "(" || c2 === "[" || c2 === "{") depth++;
+    else if (c2 === ")" || c2 === "]" || c2 === "}") depth--;
+    else if (depth === 0 && c2 === ch && !(ch === "=" && /[=>]/.test(mask[i + 1] ?? ""))) return true;
+  }
+  return false;
+}
+function patternNames(mask, text) {
+  const m = mask.trim();
+  const offset = mask.indexOf(m);
+  const t = text.slice(offset, offset + m.length);
+  if (m.startsWith("{") || m.startsWith("[")) {
+    const end = closingBracket(m, 0);
+    const names = [];
+    let at = 1;
+    for (const elMask of splitTopLevel(m.slice(1, end - 1))) {
+      const el = t.slice(at, at + elMask.length);
+      at += elMask.length + 1;
+      let cut = elMask.length;
+      let depth = 0;
+      let colon = -1;
+      for (let i = 0; i < elMask.length; i++) {
+        const c2 = elMask[i];
+        if (c2 === "(" || c2 === "[" || c2 === "{") depth++;
+        else if (c2 === ")" || c2 === "]" || c2 === "}") depth--;
+        else if (depth === 0 && c2 === ":" && colon === -1 && m.startsWith("{")) colon = i;
+        else if (depth === 0 && c2 === "=" && !/[=>]/.test(elMask[i + 1] ?? "")) {
+          cut = i;
+          break;
+        }
+      }
+      const from = colon === -1 ? 0 : colon + 1;
+      const target = elMask.slice(from, cut).replace(/^(\s*)\.\.\./, "$1   ");
+      names.push(...patternNames(target, el.slice(from, cut)));
+    }
+    return names;
+  }
+  const id = new RegExp(`^${IDENT}`, "u").exec(m)?.[0];
+  return id === void 0 ? [] : [id];
+}
+function splitTopLevel(text) {
+  const parts = [];
+  let depth = 0;
+  let start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if (ch === "," && depth === 0) {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    }
+  }
+  parts.push(text.slice(start));
+  return parts;
+}
+function closingParen(mask, from) {
+  const open = mask.indexOf("(", from);
+  if (open === -1) return from;
+  let depth = 0;
+  for (let i = open; i < mask.length; i++) {
+    if (mask[i] === "(") depth++;
+    else if (mask[i] === ")" && --depth === 0) return i + 1;
+  }
+  return from;
+}
+function declaredLocals(mask, pattern = new RegExp(String.raw`\$${ID_CHAR}*`, "gu")) {
+  const declared = /* @__PURE__ */ new Set();
+  const add = (text) => {
+    for (const m of (text ?? "").matchAll(pattern)) declared.add(m[0]);
+  };
+  for (const m of mask.matchAll(/\b(?:const|let|var)\s+([^;\n]+)/g)) {
+    for (const declarator of (m[1] ?? "").split(",")) add(declarator.split("=")[0]);
+  }
+  for (const m of mask.matchAll(new RegExp(String.raw`\b(?:function|class)\s+(${IDENT})`, "gu"))) add(m[1]);
+  for (const m of mask.matchAll(/\bcatch\s*\(([^)]*)\)/g)) add(m[1]);
+  for (const m of mask.matchAll(new RegExp(String.raw`(\([^()]*\)|${IDENT})\s*=>`, "gu"))) add(m[1]);
+  for (const m of mask.matchAll(/\bfunction\b[^(]*\(([^)]*)\)/g)) add(m[1]);
+  return declared;
+}
+function dollarTokens(mask) {
+  return tokens(mask, new RegExp(String.raw`(^|\.\.\.|[^\p{ID_Continue}$.])(\$${ID_CHAR}+)`, "gu"));
+}
+function tokens(mask, pattern, skipKeys = false) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const m of mask.matchAll(pattern)) {
+    const name = m[2] ?? "";
+    if (name === "" || seen.has(name)) continue;
+    if (skipKeys) {
+      const before = mask.slice(0, m.index + (m[1] ?? "").length).trimEnd().slice(-1);
+      const after = mask.slice(m.index + m[0].length).trimStart().slice(0, 1);
+      if (after === ":" && (before === "{" || before === ",")) continue;
+    }
+    seen.add(name);
+    out2.push(name);
+  }
+  return out2;
+}
+var BUNDLER_HELPERS = {
+  __name: "a named inner function",
+  __publicField: "a class field",
+  __privateGet: "a #private field",
+  __privateSet: "a #private field",
+  __privateAdd: "a #private field",
+  __privateMethod: "a #private method",
+  __decorateClass: "a decorator",
+  __decorateParam: "a parameter decorator",
+  __async: "async/await",
+  __generator: "a generator",
+  __await: "await",
+  __forAwait: "for await",
+  __yieldStar: "yield*",
+  __spreadValues: "an object spread",
+  __spreadProps: "an object spread",
+  __objRest: "a rest destructuring",
+  __restKey: "a rest destructuring",
+  __pow: "the `**` operator",
+  __using: "`using`",
+  __callDispose: "`using`",
+  __toESM: "an import",
+  __toCommonJS: "an export",
+  __require: "a require",
+  __awaiter: "async/await",
+  __assign: "an object spread",
+  __rest: "a rest destructuring",
+  __decorate: "a decorator",
+  __extends: "a class",
+  __spreadArray: "an array spread"
+};
+var HELPER_LOOKALIKES = /* @__PURE__ */ new Set(["__proto__", "__dirname", "__filename"]);
+function suggestion(token, surface) {
+  const ACCUMULATOR_GUESSES = ["$acc", "$accumulator", "$carry", "$memo", "$total", "$prev", "$previous"];
+  if (ACCUMULATOR_GUESSES.includes(token) && LAMBDA_BINDINGS[surface].includes("$result")) {
+    return `\`$result\` is the accumulator at this surface`;
+  }
+  if (ACCUMULATOR_GUESSES.includes(token)) {
+    return `\`$result\` is the accumulator, and only \`reduce\` binds it`;
+  }
+  const elsewhere = Object.keys(LAMBDA_BINDINGS).filter(
+    (s) => LAMBDA_BINDINGS[s].includes(token)
+  );
+  if (elsewhere.length) return `\`${token}\` is bound at ${elsewhere.join(", ")}, but not here`;
+  if (token === "$parent" || token === "$this") {
+    return `the value a filter is applied to is \`$this\` in \`fl.lambda\`, and \`$parent\` in the array-iterating filters`;
+  }
+  return void 0;
+}
+function assertLambdaBody(body, surface, source = `${PREFIX}.fn`) {
+  try {
+    assertBody(body, surface, source);
+  } catch (err) {
+    if (collector === null) throw err;
+    collector(err instanceof Error ? err.message : String(err));
+  }
+}
+var collector = null;
+function collectLambdaBodyProblems(onProblem, fn2) {
+  const previous = collector;
+  collector = onProblem;
+  try {
+    return fn2();
+  } finally {
+    collector = previous;
+  }
+}
+var SYNTAX_CHECK = /* @__PURE__ */ Symbol.for("xanosdk.lambda.syntax-check");
+var FREE_READS = /* @__PURE__ */ Symbol.for("xanosdk.lambda.free-reads");
+function installLambdaFreeReads(reader) {
+  globalThis[FREE_READS] = reader;
+}
+function installLambdaSyntaxCheck(check) {
+  globalThis[SYNTAX_CHECK] = check;
+}
+function lambdaSyntaxError(body) {
+  const check = globalThis[SYNTAX_CHECK];
+  return typeof check === "function" ? check(body) : void 0;
+}
+function assertBody(body, surface, source) {
+  if (body.trim() === "") {
+    throw new Error(
+      `${source}: the lambda body is empty. A lambda must return a value \u2014 the engine refuses a statement with no code.`
+    );
+  }
+  const mask = maskNonCode(decodeIdentifierEscapes(body));
+  const legal = LAMBDA_BINDINGS[surface];
+  const scoped = globalThis[FREE_READS];
+  const candidates = typeof scoped === "function" ? scoped(mask).filter((n) => n.startsWith("$")) : (() => {
+    const locals = declaredLocals(mask);
+    return dollarTokens(mask).filter((n) => !locals.has(n));
+  })();
+  for (const token of candidates) {
+    if (legal.includes(token)) continue;
+    const hint = suggestion(token, surface);
+    throw new Error(
+      `${source}: \`${token}\` is not a binding in a \`${surface}\` lambda body${hint ? ` \u2014 ${hint}` : ""}. It reads as undefined at runtime and raises NOTHING: the body runs, \`typeof\` reports "undefined", the value comes back null with HTTP 200, and a defensive \`typeof x !== "undefined"\` guard takes the wrong branch. Author time is the only place this is catchable. Bound here: ${legal.join(", ")} (plus the ${LAMBDA_GLOBALS.join(" / ")} globals). A stack variable is reached as \`$var.name\`, never as \`$name\`.`
+    );
+  }
+  assertNoBundlerHelpers(mask, source);
+  const moduleSyntax = /(^|[;{}\n])\s*(import|export)\b(?![\s]*[.(])/.exec(mask);
+  if (moduleSyntax) {
+    const kw = moduleSyntax[2];
+    throw new Error(
+      `${source}: a top-level \`${kw}\` is a syntax error in a lambda body \u2014 the body is a function body, not a module, so it must \`return\` its value and cannot declare module syntax. Reach a dependency through the PRELOADED globals, which need no specifier: ${LAMBDA_MODULE_GLOBALS.join(", ")} (plus ${LAMBDA_GLOBALS.join(" / ")}, fetch, Buffer, TextEncoder). A dynamic \`import("...")\` or \`require("...")\` with a literal specifier is NOT portable: on an instance that bundles the body before running it, every literal specifier is resolved ahead of time and none of them exist, so the call comes back as the text \`Could not resolve "..."\` with HTTP 200.`
+    );
+  }
+  const syntax = lambdaSyntaxError(body);
+  if (syntax !== void 0) {
+    throw new Error(
+      `${source}: the lambda body does not parse \u2014 ${syntax.message} (body line ${syntax.line}, column ${syntax.column}: \`${syntax.lineText.trim()}\`). A body that does not parse cannot run.`
+    );
+  }
+}
+var KNOWN_NAMES = /* @__PURE__ */ new Set([
+  // keywords and literals
+  "await",
+  "async",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "let",
+  "new",
+  "null",
+  "of",
+  "return",
+  "static",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "undefined",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield",
+  "get",
+  "set",
+  "arguments",
+  "NaN",
+  "Infinity",
+  "as",
+  // ECMAScript globals
+  "globalThis",
+  "Object",
+  "Array",
+  "String",
+  "Number",
+  "Boolean",
+  "Symbol",
+  "BigInt",
+  "Math",
+  "JSON",
+  "Date",
+  "RegExp",
+  "Error",
+  "TypeError",
+  "RangeError",
+  "SyntaxError",
+  "ReferenceError",
+  "EvalError",
+  "URIError",
+  "AggregateError",
+  "Promise",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "WeakRef",
+  "FinalizationRegistry",
+  "Proxy",
+  "Reflect",
+  "ArrayBuffer",
+  "SharedArrayBuffer",
+  "DataView",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float32Array",
+  "Float64Array",
+  "BigInt64Array",
+  "BigUint64Array",
+  "Intl",
+  "Atomics",
+  "Iterator",
+  "Function",
+  "parseInt",
+  "parseFloat",
+  "isNaN",
+  "isFinite",
+  "encodeURI",
+  "encodeURIComponent",
+  "decodeURI",
+  "decodeURIComponent",
+  "escape",
+  "unescape",
+  "eval",
+  // web / runtime globals a body's host provides (live-probed; see LAMBDA_MODULE_GLOBALS)
+  "fetch",
+  "Request",
+  "Response",
+  "Headers",
+  "URL",
+  "URLSearchParams",
+  "TextEncoder",
+  "TextDecoder",
+  "Buffer",
+  "atob",
+  "btoa",
+  "setTimeout",
+  "clearTimeout",
+  "setInterval",
+  "clearInterval",
+  "queueMicrotask",
+  "structuredClone",
+  "AbortController",
+  "AbortSignal",
+  "Blob",
+  "File",
+  "FormData",
+  "ReadableStream",
+  "WritableStream",
+  "TransformStream",
+  "performance",
+  "Deno",
+  "process",
+  "require",
+  "self",
+  "navigator",
+  "EventSource",
+  "WebSocket",
+  "Event",
+  "EventTarget",
+  "CompressionStream",
+  "DecompressionStream",
+  "reportError",
+  "promisify",
+  "dns",
+  "http",
+  "https",
+  "net",
+  "url",
+  "zeebe",
+  "azure",
+  "rjsf",
+  ...LAMBDA_GLOBALS,
+  ...LAMBDA_MODULE_GLOBALS
+]);
+function isFreeIdentifier(name) {
+  if (KNOWN_NAMES.has(name)) return false;
+  return !(name in globalThis);
+}
+function closureDeclarations(mask) {
+  const declared = /* @__PURE__ */ new Set();
+  const bind = (target) => {
+    const t = target.replace(/^\s*\.\.\./, "");
+    for (const name of patternNames(t, t)) declared.add(name);
+  };
+  for (const m of mask.matchAll(new RegExp(String.raw`(?<!${ID_CHAR}|\.)(?:const|let|var)(?!${ID_CHAR})`, "gu"))) {
+    const from = m.index + m[0].length;
+    for (const declarator of splitTopLevel(mask.slice(from, listEnd(mask, from)))) {
+      bind(declarator.slice(0, topLevelIndex(declarator, DECLARATOR_END)));
+    }
+  }
+  for (const m of mask.matchAll(new RegExp(String.raw`\b(?:function\*?|class)\s*\*?\s*(${IDENT})`, "gu"))) {
+    if (m[1] !== void 0) declared.add(m[1]);
+  }
+  for (let i = mask.indexOf("("); i !== -1; i = mask.indexOf("(", i + 1)) {
+    const word = new RegExp(String.raw`(${IDENT})\s*$`, "u").exec(mask.slice(Math.max(0, i - 64), i))?.[1];
+    if (word !== void 0 && /^(if|while|for|switch|with)$/.test(word)) continue;
+    const close = closingParen(mask, i);
+    if (close === i) continue;
+    if (!/^\s*(?:\{|=>)/.test(mask.slice(close))) continue;
+    for (const param of splitTopLevel(mask.slice(i + 1, close - 1))) {
+      bind(param.slice(0, topLevelIndex(param, PARAM_DEFAULT)));
+    }
+  }
+  for (const m of mask.matchAll(new RegExp(String.raw`(?<!${ID_CHAR}|\.)(${IDENT})\s*=>`, "gu"))) {
+    if (m[1] !== void 0) declared.add(m[1]);
+  }
+  return declared;
+}
+function listEnd(mask, from) {
+  let depth = 0;
+  for (let i = from; i < mask.length; i++) {
+    const ch = mask[i];
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (--depth < 0) return i;
+    } else if (ch === ";" && depth === 0) return i;
+  }
+  return mask.length;
+}
+function topLevelIndex(text, at) {
+  let depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if (depth === 0) {
+      at.lastIndex = i;
+      if (at.test(text)) return i;
+    }
+  }
+  return text.length;
+}
+var PARAM_DEFAULT = /(?<![=!<>+\-*/%&|^?])=(?![=>])/uy;
+var DECLARATOR_END = new RegExp(String.raw`${PARAM_DEFAULT.source}|(?<![\p{ID_Continue}$])(?:of|in)(?![\p{ID_Continue}$])`, "uy");
+var CLOSURE_CANDIDATE = new RegExp(
+  // A `.` before a name is a member access — unless it ends a spread `...`.
+  String.raw`(^|\.\.\.|[^\p{ID_Continue}$\u200C\u200D.#])([\p{ID_Start}_][\p{ID_Continue}\u200C\u200D]*)(?!${ID_CHAR})`,
+  "gu"
+);
+function assertNoClosure(code, source) {
+  const mask = maskNonCode(decodeIdentifierEscapes(code));
+  const declared = closureDeclarations(mask);
+  const scoped = globalThis[FREE_READS];
+  const free = typeof scoped === "function" ? new Set(scoped(mask)) : void 0;
+  for (const m of mask.matchAll(CLOSURE_CANDIDATE)) {
+    const name = m[2];
+    if (name.startsWith("__") || !isFreeIdentifier(name)) continue;
+    if (free !== void 0 ? !free.has(name) : declared.has(name)) continue;
+    const start = m.index + (m[1] ?? "").length;
+    const before = mask.slice(0, start).trimEnd();
+    const after = mask.slice(start + name.length).trimStart();
+    if (/\btypeof$/.test(before)) continue;
+    if (after.startsWith(":") && !after.startsWith("::") && /[{,;]$|^$/.test(before)) continue;
+    if (/^:\s*(?:(?:for|while|do|switch)\b|\{)/.test(after) && !/[-+*/%&|^!~?<>=,.([]$/.test(before)) continue;
+    if (/\b(break|continue)$/.test(before)) continue;
+    if (after.startsWith("(") && !before.endsWith(")") && mask.slice(closingParen(mask, start)).trimStart().startsWith("{")) {
+      continue;
+    }
+    if (/^=(?![=>])/.test(after) && /[{};]$|^$/.test(before)) continue;
+    if (isClassMemberName(mask, start, name.length)) continue;
+    throw new Error(
+      `${source}: the lambda body reads \`${name}\`, which it does not declare \u2014 it comes from the scope the function was WRITTEN in, and only the body's text reaches the engine. There \`${name}\` is not defined: the body throws, and the engine returns that failure as TEXT in the value slot with HTTP 200 \u2014 a wrong value, not an error. Inline the value as a literal, pass it through the stack (\`$var.${name}\` after a \`s.set_var\`, or an input as \`$input.${name}\`), or carry it in with \`lam.fn(body, { capture: { ${name} } })\`.`
+    );
+  }
+}
+function isClassMemberName(mask, start, length) {
+  let depth = 0;
+  let open = -1;
+  for (let i = start - 1; i >= 0; i--) {
+    const ch = mask[i];
+    if (ch === ")" || ch === "]" || ch === "}") depth++;
+    else if (ch === "(" || ch === "[" || ch === "{") {
+      if (depth === 0) {
+        open = i;
+        break;
+      }
+      depth--;
+    }
+  }
+  if (open === -1 || mask[open] !== "{") return false;
+  const header = new RegExp(String.raw`(?<!${ID_CHAR}|\.)class(?:\s+${IDENT})?(?:\s+extends(?!${ID_CHAR})[^{};]*)?\s*$`, "u");
+  if (!header.test(mask.slice(Math.max(0, open - 256), open))) return false;
+  const lead = mask.slice(open + 1, start);
+  const before = lead.trimEnd();
+  const memberStart = before === "" || /[{};]$/.test(before) || new RegExp(String.raw`(?<!${ID_CHAR}|\.)(?:static|accessor|async|get|set)$`, "u").test(before) || // A line break ends a field whose initializer does not continue past it.
+  /\n\s*$/.test(lead) && !/[-+*/%&|^!~?:<>=,.([]$/.test(before);
+  if (!memberStart) return false;
+  const after = mask.slice(start + length);
+  return /^\s*(?:=(?![=>])|;|\}|\(|$)/.test(after) || /^[ \t]*\n/.test(after) || new RegExp(String.raw`^\s+${IDENT}`, "u").test(after);
+}
+function assertNoBundlerHelpers(mask, source) {
+  const declared = declaredLocals(mask, new RegExp(String.raw`__${ID_CHAR}*`, "gu"));
+  for (const token of tokens(mask, new RegExp(String.raw`(^|\.\.\.|[^\p{ID_Continue}$\u200C\u200D.])(__\p{ID_Start}${ID_CHAR}*)`, "gu"), true)) {
+    if (declared.has(token) || HELPER_LOOKALIKES.has(token)) continue;
+    const wrote = Object.hasOwn(BUNDLER_HELPERS, token) ? BUNDLER_HELPERS[token] : void 0;
+    throw new Error(
+      `${source}: \`${token}\` is a bundler helper, not something this body can call \u2014 the body was TRANSPILED before it could be read back${wrote ? `, because it writes ${wrote}` : ""}. An inline body is recovered from the live function with \`toString()\`, and a \`.ts\` loader (tsx/esbuild, which is how a TypeScript entry is evaluated) returns rewritten source. The helper is defined at MODULE scope and only the body travels, so \`${token}\` is undefined at runtime: the body throws, and the engine returns that failure as TEXT in the value slot with HTTP 200 \u2014 a wrong value, not an error. Move the body to its own module and load it with \`lam.file(...)\`, or write it as text with \`lam.raw(...)\`; neither is transpiled.`
+    );
+  }
+}
+var UNREPRESENTABLE_CLASSES = [
+  {
+    ctor: Date,
+    name: "Date",
+    fix: "capture the epoch number (`d.getTime()`) or the ISO string and rebuild it in the body (`new Date(d)`)"
+  },
+  {
+    ctor: Map,
+    name: "Map",
+    fix: "capture a plain object (`Object.fromEntries(m)`) \u2014 or the entries array, and rebuild with `new Map(entries)` in the body"
+  },
+  {
+    ctor: Set,
+    name: "Set",
+    fix: "capture an array (`[...s]`) \u2014 and rebuild with `new Set(arr)` in the body if you need set semantics"
+  },
+  {
+    ctor: RegExp,
+    name: "RegExp",
+    fix: "capture the source and flags as strings and rebuild with `new RegExp(src, flags)` in the body"
+  }
+];
+function assertJsonCapture(name, value, source) {
+  if (value === void 0) {
+    throw new Error(
+      `${source}: capture \`${name}\` is undefined, which cannot cross into the engine \u2014 the body is sent as TEXT and runs in a different process. Capture JSON data (string, number, boolean, null, object, array).`
+    );
+  }
+  assertJsonValue(name, value, source, /* @__PURE__ */ new Map());
+}
+function assertJsonValue(path, value, source, ancestors) {
+  const refuse = (what, becomes, fix = "Capture the plain JSON form and rebuild it in the body.") => {
+    throw new Error(
+      `${source}: capture \`${path}\` is ${what}, which cannot cross into the engine \u2014 the body is sent as TEXT, and JSON-encoding it yields ${becomes}. The body would read a different value than the one TypeScript gave it, and the engine returns what it computes from that with HTTP 200 \u2014 a wrong value rather than an error. ${fix}`
+    );
+  };
+  const type = typeof value;
+  if (type === "function" || type === "symbol" || type === "bigint") {
+    refuse(`${article(type)} ${type}`, type === "bigint" ? "an error" : "nothing", "Capture JSON data; for behaviour, inline it in the body.");
+  }
+  if (type === "number" && !Number.isFinite(value)) {
+    refuse(`\`${String(value)}\``, "`null`", "Capture it as a string (`String(n)`) and rebuild with `Number(s)` in the body.");
+  }
+  if (value === null || type !== "object") return;
+  const object = value;
+  for (const entry of UNREPRESENTABLE_CLASSES) {
+    if (!(object instanceof entry.ctor)) continue;
+    refuse(
+      `${article(entry.name)} ${entry.name}`,
+      entry.name === "Date" ? "a string" : "`{}`",
+      `Instead, ${entry.fix}.`
+    );
+  }
+  if (ArrayBuffer.isView(object) || object instanceof ArrayBuffer) {
+    refuse(`a binary buffer (\`${object.constructor.name}\`)`, "an index-keyed object or `{}`", "Capture a plain array (`Array.from(bytes)`) and rebuild it in the body.");
+  }
+  const cycleAt = ancestors.get(object);
+  if (cycleAt !== void 0) {
+    throw new Error(
+      `${source}: capture \`${path}\` is \`${cycleAt}\` itself \u2014 a cycle, which JSON cannot encode. Capture an acyclic copy and rebuild the link in the body.`
+    );
+  }
+  ancestors.set(object, path);
+  if (Array.isArray(object)) {
+    for (let i = 0; i < object.length; i++) {
+      if (!(i in object)) refuse(`a sparse array (no element at [${i}])`, "`null` in every hole", "Fill the holes explicitly.");
+      if (object[i] === void 0) refuse(`an array holding \`undefined\` at [${i}]`, "`null` there", "Use `null` explicitly, or leave the element out.");
+      assertJsonValue(`${path}[${i}]`, object[i], source, ancestors);
+    }
+    ancestors.delete(object);
+    return;
+  }
+  const proto = Object.getPrototypeOf(object);
+  if (proto !== Object.prototype && proto !== null) {
+    const name = object.constructor?.name;
+    refuse(
+      `an instance of \`${typeof name === "string" && name !== "" ? name : "a class"}\``,
+      "`{}` or whatever its `toJSON` returns",
+      "Capture a plain object of its JSON data and rebuild the instance in the body."
+    );
+  }
+  for (const [key, item] of Object.entries(object)) {
+    if (key === "toJSON" && typeof item === "function") refuse("an object with a `toJSON` method", "what `toJSON` returns", "Capture that value itself.");
+    if (item === void 0) continue;
+    assertJsonValue(`${path}.${key}`, item, source, ancestors);
+  }
+  ancestors.delete(object);
+}
+function capturePrelude(capture, source) {
+  if (capture === void 0) return "";
+  const lines = [];
+  for (const [name, value] of Object.entries(capture)) {
+    if (!new RegExp(`^${IDENT}$`, "u").test(name)) {
+      throw new Error(`${source}: capture key ${JSON.stringify(name)} is not a valid JavaScript identifier.`);
+    }
+    assertJsonCapture(name, value, source);
+    lines.push(`const ${name} = ${JSON.stringify(value)};`);
+  }
+  return lines.length ? lines.join("\n") + "\n" : "";
+}
+function assertCaptureNotRenamed(body, capture, source) {
+  if (capture === void 0) return;
+  const keys = Object.keys(capture);
+  if (keys.length === 0) return;
+  const mask = maskNonCode(decodeIdentifierEscapes(body));
+  const declared = declaredLocals(mask, new RegExp(IDENT, "gu"));
+  for (const token of tokens(mask, new RegExp(String.raw`(^|\.\.\.|[^\p{ID_Continue}$\u200C\u200D.])(${IDENT}[0-9])(?!${ID_CHAR})`, "gu"), true)) {
+    if (declared.has(token)) continue;
+    const key = keys.find((k) => new RegExp(`^${k.replace(/\$/g, "\\$")}[0-9]+$`).test(token));
+    if (key === void 0) continue;
+    throw new Error(
+      `${source}: capture key \`${key}\` collides with a module-scope binding of the same name, so the body was rewritten to read \`${token}\` \u2014 which the capture prelude does not declare. An inline body is recovered from the live function with \`toString()\`, and a \`.ts\` loader (tsx/esbuild) renames one of two same-named bindings; the prelude is written afterwards, under the ORIGINAL name. As it stands \`${token}\` is undefined at runtime: the body throws, and the engine returns that failure as TEXT in the value slot with HTTP 200 \u2014 a wrong value, not an error. Give the capture a key that nothing at module scope shares \u2014 it does not have to keep the name of what it carries (\`capture: { <newName>: ${key} }\`, destructured as \`(_, { <newName> }) => \u2026\`) \u2014 or move the body to its own module with \`lam.file(...)\`.`
+    );
+  }
+}
+function assertCaptureSupplied(reads, capture, source) {
+  const missing = reads.find((name) => capture === void 0 || !Object.hasOwn(capture, name));
+  if (missing === void 0) return;
+  const how = capture === void 0 ? `there is no \`capture\` here${source.startsWith(`${PREFIX}.`) ? "" : " (an inline body takes none)"}` : `\`capture\` has no \`${missing}\` key`;
+  const file = /^lam\.file\((.*)\)$/s.exec(source)?.[1];
+  const remedy = file === void 0 ? `lam.fn(body, { capture: { ${missing} } })` : `lam.file(${JSON.stringify(file)}, { capture: { ${missing} } })`;
+  throw new Error(
+    `${source}: the body reads \`${missing}\` from its second parameter, but ${how}, so nothing declares it at runtime \u2014 the body reads any global of that name instead, or throws. Supply it with \`${remedy}\`, or declare it inside the body.`
+  );
+}
+function lambdaValue(body, opts, source, fromFunction = false, captureReads = []) {
+  const code = capturePrelude(opts?.capture, source) + body;
+  assertCaptureSupplied(captureReads, opts?.capture, source);
+  assertCaptureNotRenamed(body, opts?.capture, source);
+  if (fromFunction) assertNoClosure(code, source);
+  if (opts?.surface !== void 0) {
+    if (!Object.hasOwn(LAMBDA_BINDINGS, opts.surface)) {
+      throw new Error(
+        `${source}: surface ${JSON.stringify(opts.surface)} is not a lambda surface \u2014 use one of ${Object.keys(LAMBDA_BINDINGS).map((k) => JSON.stringify(k)).join(", ")}.`
+      );
+    }
+    assertLambdaBody(code, opts.surface, source);
+  }
+  return c.text(code);
+}
+function fn(body, opts) {
+  const extracted = extractFunction(String(body), `${PREFIX}.fn`);
+  return lambdaValue(extracted.body, opts, `${PREFIX}.fn`, true, extracted.captureReads);
+}
+function raw(code, opts) {
+  return lambdaValue(code, opts, `${PREFIX}.raw`);
+}
+function fileOnNodeEntryOnly() {
+  throw new Error(
+    `${PREFIX}.file: this entry has no filesystem. It ships on the Node entry only \u2014 \`import { lam } from "@xano/sdk/node"\` (that \`lam\` carries \`fn\` and \`raw\` too). In a browser bundle, use \`${PREFIX}.raw(code, { surface })\` with the body as text.`
+  );
+}
+var lam = Object.assign({ fn, raw }, { file: fileOnNodeEntryOnly });
+
+export {
+  TAGS,
+  IDENT,
+  decodeIdentifier,
+  decodeIdentifierEscapes,
+  LAMBDA_BINDINGS,
+  LAMBDA_GLOBALS,
+  LAMBDA_MODULE_GLOBALS,
+  LAMBDA_CODE_FILTERS,
+  LAMBDA_STATEMENTS,
+  coerceLambdaFields,
+  assertLambdaStatement,
+  toLambdaValue,
+  extractFunction,
+  readFunction,
+  assertLambdaBody,
+  collectLambdaBodyProblems,
+  installLambdaFreeReads,
+  installLambdaSyntaxCheck,
+  lambdaSyntaxError,
+  lambdaValue,
+  lam,
+  isTaggedValue,
+  objTaggedList,
+  toPlainValue,
+  barePatternRefusal,
+  reversedOperandRefusal,
+  reversedRegexOperands,
+  lossyIntegerProblem,
+  c,
+  ref,
+  inp,
+  col,
+  auth,
+  resp,
+  caught,
+  isToolsetPath,
+  toolset,
+  env,
+  setting,
+  sys,
+  out,
+  filter,
+  withFilters
+};
+//# sourceMappingURL=chunk-OXA6PSZT.js.map