@xano/sdk 1.0.2 → 1.0.3

package/dist/{chunk-EDCCKH7Y.js → chunk-OPG4DYX2.js}

@@ -2,16 +2,16 @@ import {
   assertInputValue,
   assertOneOf as assertOneOf2,
   leanInput
-} from "./chunk-XVBGLISP.js";
+} from "./chunk-ICK36EGF.js";
 import {
   FILTER_NAMES,
   fl
-} from "./chunk-GGZILEUD.js";
+} from "./chunk-BEXZ4XRV.js";
 import {
   assertCanonical,
   buildMiddlewareBlock,
   encodeContainerHistory
-} from "./chunk-5WGGTU5K.js";
+} from "./chunk-ETAZIGNT.js";
 import {
   safeNames
 } from "./chunk-GSGDWJB5.js";
@@ -37,7 +37,7 @@ import {
   tableColumns,
   tableIndexes,
   unusableColumns
-} from "./chunk-G5IW3EYW.js";
+} from "./chunk-4PQHO74B.js";
 import {
   brandDef
 } from "./chunk-ERVIASGL.js";
@@ -45,7 +45,7 @@ import {
   assertDefShape,
   encodeTags,
   registerKind
-} from "./chunk-4POWHT2K.js";
+} from "./chunk-VTMTIBKP.js";
 import {
   findNonJson,
   nonJsonMessage
@@ -61,20 +61,20 @@ import {
 import {
   nearestKey
 } from "./chunk-WTPZRR4I.js";
+import {
+  DiagnosticError
+} from "./chunk-GPI3OWRE.js";
 import {
   orNames,
   suggest,
   suggestAll
 } from "./chunk-UTI5G6OJ.js";
-import {
-  DiagnosticError
-} from "./chunk-2Y4X2VLM.js";
 import {
   appNamesByGuid,
   identityNamesByGuid,
   lockNameForObject,
   sdkKindName
-} from "./chunk-6MR5TI5V.js";
+} from "./chunk-OOGXZL7Z.js";
 import {
   annotate,
   encodeStatement,
@@ -83,7 +83,7 @@ import {
   registerStatement,
   statementLabel,
   statementMark
-} from "./chunk-YU4HSQW7.js";
+} from "./chunk-A2AOUBJS.js";
 import {
   LAMBDA_CODE_FILTERS,
   assertLambdaStatement,
@@ -99,7 +99,7 @@ import {
   sys,
   toPlainValue,
   withFilters
-} from "./chunk-HYAI62TU.js";
+} from "./chunk-UVF45BVU.js";
 import {
   maskNonCode
 } from "./chunk-VAX3UZOY.js";
@@ -107,10 +107,10 @@ import {
   guidSeedHint,
   refSpelling,
   resolveRef
-} from "./chunk-NZOWWHU5.js";
+} from "./chunk-LL6ED5IB.js";
 import {
   isListColumn
-} from "./chunk-TTEIYD5P.js";
+} from "./chunk-4DJTQ6W4.js";
 import {
   argsOrEmpty,
   assertArg,
@@ -122,7 +122,7 @@ import {
   describeEntry,
   isRecordArg,
   isTaggedArg
-} from "./chunk-CIMQZRRE.js";
+} from "./chunk-4MIV244X.js";
 import {
   withArticle
 } from "./chunk-36JUQZVQ.js";
@@ -224,7 +224,15 @@ function encodeOne(spec, path, envelopeOffset) {
     throw new Error("addon: `children` cannot reference an ancestor addon spec (cycle detected).");
   }
   const { offset, as } = splitAs(spec.as);
-  const finalOffset = envelopeOffset !== void 0 ? withEnvelopeOffset(offset, envelopeOffset) : offset;
+  if (spec.envelope !== void 0 && typeof spec.envelope !== "boolean") {
+    throw new Error(`addon "${spec.as}": \`envelope\` must be true or false \u2014 got ${JSON.stringify(spec.envelope)}.`);
+  }
+  if (spec.envelope === true && envelopeOffset === void 0) {
+    throw new Error(
+      `addon "${spec.as}": \`envelope: true\` grafts onto a db.query's paging envelope, and this attachment has none \u2014 only a top-level addon on a list query with paging (and metadata) on does. Drop \`envelope\`.`
+    );
+  }
+  const finalOffset = envelopeOffset !== void 0 && spec.envelope !== true ? withEnvelopeOffset(offset, envelopeOffset) : offset;
   const stored = {
     // An unbound attachment stores a blank id — the same "no target" the engine
     // writes, and the same spelling `table: null` / `fn: null` already use.
@@ -676,8 +684,8 @@ var EVAL_ITEM = {
 var EVAL_KEYS = ["name", "as", "filters"];
 var PAGING_KEYS = ["page", "per_page", "offset", "totals", "metadata", "enabled", "search", "sort"];
 var BIND_ITEM = {
-  test: (v) => isRecordArg(v) && "table" in v,
-  want: "a join ({ table, as?, join?, where? })"
+  test: (v) => isRecordArg(v) && ("table" in v || "expand" in v),
+  want: "a join ({ table, as?, join?, where? }) or a list expansion ({ expand, as, join?, where? })"
 };
 var WHERE_ITEM = {
   test: (v) => isRecordArg(v) || isTaggedArg(v),
@@ -757,6 +765,7 @@ function assertNoAddonShadow(table, addons) {
   if (typeof table === "string" || !("schema" in table)) return;
   const cols = new Set(tableColumns(table).map((col) => col.name));
   for (const spec of addons) {
+    if (spec.envelope === true) continue;
     const as = spec.as;
     const dot = as.lastIndexOf(".");
     const alias = dot === -1 ? as : as.slice(dot + 1);
@@ -791,7 +800,7 @@ function dboStatement(name, table, as, input, opts = {}, tableAlias, enforceHidd
   };
 }
 var BULK_BY_CONDITION = '`s.db.query({ table, where, as: "rows" })` then `s.foreach` over `rows` with `s.db.patch` per id (or `s.db.increment({ table, where, \u2026 })` to add to a numeric column) to change the rows matching a condition';
-var BULK_WRITE_KEYS = ["disabled", "description", "mock", "asFilters", "tableAlias", "table", "items", "as"];
+var BULK_WRITE_KEYS = ["disabled", "description", "mock", "asFilters", "uncheckedAs", "tableAlias", "table", "items", "as"];
 function assertBulkWriteKeys(label, args, extra = []) {
   if (args.where !== void 0) {
     throw new Error(
@@ -807,7 +816,7 @@ function assertNoWhere(label, args, alternative) {
     `Statement "${label}": \`where\` is not an argument of ${label} \u2014 it matches one row by \`fieldName\`/\`fieldValue\` (the id by default). ` + (a.fieldValue !== void 0 ? `Drop \`where\` to match on \`fieldValue\` alone, or use ${alternative}.` : `Use ${alternative}, or pass \`fieldValue\`.`)
   );
 }
-var DB_GET_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, lock: 1, output: 1, addon: 1, as: 1 });
+var DB_GET_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, lock: 1, output: 1, addon: 1, as: 1 });
 function dbGet(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.get", args, '`s.db.query({ table, where, returnType: "single" })` for the first row matching a condition');
@@ -830,7 +839,7 @@ function dbGet(args) {
     args.tableAlias
   ), args);
 }
-var DB_DEL_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, as: 1 });
+var DB_DEL_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, as: 1 });
 function dbDel(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.del", args, "`s.db.bulk.delete({ table, where })` to delete the rows matching a condition");
@@ -846,7 +855,7 @@ function dbDel(args) {
     args.tableAlias
   ), args);
 }
-var DB_HAS_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, as: 1 });
+var DB_HAS_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, as: 1 });
 function dbHas(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.has", args, '`s.db.query({ table, where, returnType: "exists" })` to test a condition');
@@ -862,7 +871,7 @@ function dbHas(args) {
     args.tableAlias
   ), args);
 }
-var DB_PATCH_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, output: 1, addon: 1, as: 1 });
+var DB_PATCH_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, output: 1, addon: 1, as: 1 });
 function dbPatch(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.patch", args, BULK_BY_CONDITION);
@@ -883,7 +892,7 @@ function dbPatch(args) {
     args.tableAlias
   ), args);
 }
-var DB_TRUNCATE_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, reset: 1, as: 1 });
+var DB_TRUNCATE_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, reset: 1, as: 1 });
 function dbTruncate(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.truncate"`, args, DB_TRUNCATE_KEYS);
@@ -1003,7 +1012,7 @@ function nestedFields(cell, statement, path) {
     return isNestedCell(child) ? { name, value: c.text(""), children: nestedFields(child, statement, `${path}.${name}`) } : { name, value: child };
   });
 }
-var DB_ADD_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, data: 1, row: 1, output: 1, addon: 1, as: 1 });
+var DB_ADD_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, data: 1, row: 1, output: 1, addon: 1, as: 1 });
 function dbAdd(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.add"`, args, DB_ADD_KEYS);
@@ -1019,7 +1028,7 @@ function dbAdd(args) {
     args.enforceHiddenFields
   ), args);
 }
-var DB_EDIT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, row: 1, output: 1, addon: 1, as: 1 });
+var DB_EDIT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, row: 1, output: 1, addon: 1, as: 1 });
 function dbEdit(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.edit", args, BULK_BY_CONDITION);
@@ -1041,7 +1050,7 @@ function dbEdit(args) {
     args.enforceHiddenFields
   ), args);
 }
-var DB_ADD_OR_EDIT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, row: 1, as: 1 });
+var DB_ADD_OR_EDIT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, enforceHiddenFields: 1, table: 1, fieldName: 1, fieldValue: 1, data: 1, row: 1, as: 1 });
 function dbAddOrEdit(args) {
   args = argsOrEmpty(args);
   assertNoWhere("s.db.add_or_edit", args, '`s.db.query({ table, where, returnType: "single" })` first to find the row');
@@ -1064,7 +1073,7 @@ function dbAddOrEdit(args) {
     input
   }, args);
 }
-var DB_SCHEMA_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, path: 1, as: 1 });
+var DB_SCHEMA_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, path: 1, as: 1 });
 function dbSchema(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.schema"`, args, DB_SCHEMA_KEYS);
@@ -1085,7 +1094,7 @@ function assertSqlEnums(statement, args) {
   assertOneOf(statement, "responseType", args.responseType, DB_RESPONSE_TYPES);
   assertOneOf(statement, "parser", args.parser, DB_SQL_PARSERS);
 }
-var DB_DIRECT_QUERY_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, sql: 1, responseType: 1, args: 1, parser: 1, as: 1 });
+var DB_DIRECT_QUERY_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, sql: 1, responseType: 1, args: 1, parser: 1, as: 1 });
 function dbDirectQuery(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.direct_query"`, args, DB_DIRECT_QUERY_KEYS);
@@ -1225,7 +1234,7 @@ function assertBulkDeleteScope(search, allRows) {
     'Statement "s.db.bulk.delete": this deletes EVERY row in the table \u2014 a filter that constrains nothing matches all rows, so this is a truncate with a row count. (An omitted `where`, an empty `where: []`, and an empty `and()`/`or()` group all encode to the same thing, which is how a dynamically built clause list reaches it.) Pass the filter you meant (`where: expr(col("status"), "=", c.text("expired"))`), or say the wipe is deliberate with `allRows: true`.'
   );
 }
-var DB_BULK_DELETE_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, where: 1, allRows: 1, as: 1 });
+var DB_BULK_DELETE_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, where: 1, allRows: 1, as: 1 });
 function dbBulkDelete(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.bulk.delete"`, args, DB_BULK_DELETE_KEYS);
@@ -1283,7 +1292,7 @@ function incrementAmount(value) {
     throw new Error(`Statement "s.db.increment": \`value\` ${lossyIntegerProblem(value)}`);
   return coerceScalar(value);
 }
-var DB_INCREMENT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, tableAlias: 1, table: 1, where: 1, fieldName: 1, value: 1, returnType: 1, output: 1, addon: 1, as: 1 });
+var DB_INCREMENT_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, tableAlias: 1, table: 1, where: 1, fieldName: 1, value: 1, returnType: 1, output: 1, addon: 1, as: 1 });
 function dbIncrement(args) {
   args = argsOrEmpty(args);
   assertKnownKeys(`Statement "s.db.increment"`, args, DB_INCREMENT_KEYS);
@@ -1373,6 +1382,7 @@ function encodeBind(binds) {
   if (!binds?.length) return void 0;
   const seen = /* @__PURE__ */ new Set();
   return binds.map((b) => {
+    if (b.expand !== void 0) return encodeExpandBind(b, seen);
     if (b.table === null && b.as === void 0) {
       throw new Error(
         "db.query bind: a join with `table: null` must name its `as` alias \u2014 an unbound join has no table name to derive one from. (`table: null` represents a join whose table was deleted; fix the pulled workspace rather than authoring it.)"
@@ -1397,6 +1407,28 @@ function encodeBind(binds) {
     return entry2;
   });
 }
+function encodeExpandBind(b, seen) {
+  const where = `db.query bind { expand: ${JSON.stringify(b.expand)} }`;
+  if (b.table !== void 0) {
+    throw new Error(`${where}: \`expand\` and \`table\` are exclusive \u2014 a bind either joins a table or expands a list column.`);
+  }
+  if (typeof b.expand !== "string" || !/^[^.]+\.[^.]/.test(b.expand)) {
+    throw new Error(
+      `${where}: \`expand\` is \`<alias>.<column>\` \u2014 the query's \`tableAlias\` (or a joined table's \`as\`), then a list column of it, e.g. "blog.categories".`
+    );
+  }
+  if (typeof b.as !== "string" || b.as === "") {
+    throw new Error(`${where}: an expansion needs an \`as\` alias to address its elements by \u2014 the engine refuses one without.`);
+  }
+  if (seen.has(b.as)) {
+    throw new Error(`db.query bind: duplicate join alias "${b.as}" \u2014 every join and expansion needs its own \`as\`.`);
+  }
+  seen.add(b.as);
+  const entry2 = { dbo: { as: b.as, id: b.expand }, join: b.join ?? "inner" };
+  const search = encodeSearch(b.where, void 0, `Statement "s.db.query": bind "${b.as}"`);
+  if (search !== void 0) entry2.search = search;
+  return entry2;
+}
 function collectColOperands(search, out) {
   if (search === null || typeof search !== "object") return;
   if (Array.isArray(search)) {
@@ -1510,6 +1542,7 @@ var DB_QUERY_KEYS = Object.keys({
   description: 1,
   mock: 1,
   asFilters: 1,
+  uncheckedAs: 1,
   tableAlias: 1,
   table: 1,
   returnType: 1,
@@ -1527,7 +1560,9 @@ var DB_QUERY_KEYS = Object.keys({
   addon: 1,
   as: 1
 });
-var DB_BIND_KEYS = Object.keys({ table: 1, as: 1, join: 1, where: 1 });
+var DB_BIND_KEYS = Object.keys(
+  { table: 1, expand: 1, as: 1, join: 1, where: 1 }
+);
 function dbQuery(args) {
   args = argsOrEmpty(args);
   if (args.return !== void 0) {
@@ -1630,7 +1665,7 @@ var EXTERNAL_SQL_NAME = {
   postgres: "mvp:dbo_external_postgres_query",
   snowflake: "mvp:dbo_external_snowflake_query"
 };
-var DB_EXTERNAL_QUERY_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, engine: 1, sql: 1, connectionString: 1, responseType: 1, args: 1, parser: 1, as: 1 });
+var DB_EXTERNAL_QUERY_KEYS = Object.keys({ disabled: 1, description: 1, mock: 1, asFilters: 1, uncheckedAs: 1, engine: 1, sql: 1, connectionString: 1, responseType: 1, args: 1, parser: 1, as: 1 });
 function dbExternalQuery(args) {
   args = argsOrEmpty(args);
   const statement = `s.db.external.${String(args.engine)}.direct_query`;
@@ -1764,7 +1799,7 @@ function inputEntry(name, v, full) {
 function specLabel(spec) {
   return spec.factory ?? readableStatementName(spec.name);
 }
-var SPEC_ENVELOPE_KEYS = ["disabled", "description", "mock", "asFilters", "output"];
+var SPEC_ENVELOPE_KEYS = ["disabled", "description", "mock", "asFilters", "uncheckedAs", "output"];
 function encodeFromSpec(spec, authored) {
   authored ??= {};
   const label = specLabel(spec);
@@ -1860,7 +1895,8 @@ function encodeFromSpec(spec, authored) {
     disabled: authored.disabled,
     description: authored.description,
     asFilters,
-    mock: authored.mock
+    mock: authored.mock,
+    uncheckedAs: authored.uncheckedAs
   });
   if (env?.settingsRegistry) stmt.settings_registry = [];
   if (spec.output) {
@@ -5445,6 +5481,10 @@ function sdkSubject(payloadKey, obj) {
   return `${sdkKindName(payloadKey, obj)} "${verb}${name}"`;
 }
 var RAW_REQUEST_HOSTS = /* @__PURE__ */ new Set(["query", "tool", "prompt"]);
+function callableInputNames(record, section, tableColumns2) {
+  const inputs = declaredInputNames(record, tableColumns2);
+  return inputs !== null && inputs.size === 0 && RAW_REQUEST_HOSTS.has(section) ? null : inputs;
+}
 function checkOmittedCallInputs(sections, bag) {
   const tableColumns2 = tableColumnsOf(sections);
   const declared = /* @__PURE__ */ new Map();
@@ -5576,10 +5616,10 @@ function checkUnitTests(sections, bag) {
 function checkAddonAliases(owner, attached, subject, bag) {
   const seen = /* @__PURE__ */ new Set();
   for (const spec of attached) {
-    const as = spec?.as;
-    if (typeof as !== "string" || as === "") continue;
+    const { as, id } = spec ?? {};
+    if (typeof as !== "string" || as === "" || id === 0 || id === "" || id === void 0 || id === null) continue;
     if (seen.has(as)) {
-      bag.error(
+      bag.warn(
         "db.addon-duplicate-alias",
         `${owner}: two attached addons graft as "${as}" \u2014 the later overwrites the earlier on every row. Give each its own \`as\`.`,
         subject
@@ -5658,7 +5698,7 @@ function checkAddonAttachments(sections, bag) {
               const base = inputBase(e.value);
               if (columns.includes(base)) continue;
               const near = nearestKey(base, columns);
-              bag.error(
+              bag.warn(
                 "db.addon-unknown-column",
                 `${owner}: the attached ${label} binds \`out("${e.value}")\`, but the rows it reads have no \`${base}\` column \u2014 the binding is null on every row, so the addon grafts nothing.` + (near !== void 0 ? ` Did you mean \`out("${near}")\`?` : ` The columns are ${proseList(columns.map((c2) => `\`${c2}\``), "and")}.`),
                 obj
@@ -6488,7 +6528,8 @@ function checkRouteShadowing(sections, bag) {
     routes.push({
       name: query.name,
       verb,
-      segments: query.name.split("/").map((segment) => compileSegment(segment, narrowed))
+      segments: query.name.split("/").map((segment) => compileSegment(segment, narrowed)),
+      record: obj
     });
     byGroupVerb.set(key, routes);
   }
@@ -6507,10 +6548,9 @@ function checkRouteShadowing(sections, bag) {
         if (witness.length !== a.segments.length) continue;
         const path = `/${witness.join("/")}`;
         const disjoint = disjointRouteExample(a.name, b.name);
-        bag.error(
-          "query.route-shadowed",
-          `queries "${a.name}" and "${b.name}" (${a.verb}, same api group) can both match \`${a.verb} ${path}\`. Xano serves the FIRST route that matches in creation order \u2014 a literal route gets no precedence over a \`{param}\` one \u2014 so one of them silently answers the other's requests. Creation order is \`registerQueries\` order only on a fresh deploy; a release or \`deploy --keep-data\` keeps an existing route first, so reordering does not fix it. Make the paths disjoint: move the param route under its own segment${disjoint === void 0 ? "" : ` (\`"${disjoint}"\`)`}, rename the literal, or \u2014 when the param is numeric \u2014 declare it \`input.int({ required: true })\`: only a REQUIRED int or decimal segment is narrowed to digits; an optional one matches any text.`
-        );
+        const message = () => `queries "${a.name}" and "${b.name}" (${a.verb}, same api group) can both match \`${a.verb} ${path}\`. Xano serves the FIRST route that matches in creation order \u2014 a literal route gets no precedence over a \`{param}\` one \u2014 so one of them silently answers the other's requests. Creation order is \`registerQueries\` order only on a fresh deploy; a release or \`deploy --keep-data\` keeps an existing route first, so reordering does not fix it. Make the paths disjoint: move the param route under its own segment${disjoint === void 0 ? "" : ` (\`"${disjoint}"\`)`}, rename the literal, or \u2014 when the param is numeric \u2014 declare it \`input.int({ required: true })\`: only a REQUIRED int or decimal segment is narrowed to digits; an optional one matches any text.`;
+        if (bag.isAccepted("query.route-shadowed", message, a.record)) continue;
+        bag.warn("query.route-shadowed", message(), b.record);
       }
     }
   }
@@ -7132,11 +7172,11 @@ function checkLoopControl(sections, bag) {
       if (!obj || typeof obj !== "object") continue;
       const name = obj.name;
       const owner = `${sdkKindName(payloadKey, obj)} "${typeof name === "string" ? name : "?"}"`;
-      walkLoopDepth(obj, 0, owner, bag);
+      walkLoopDepth(obj, 0, owner, bag, obj);
     }
   }
 }
-function walkLoopDepth(root, rootDepth, owner, bag) {
+function walkLoopDepth(root, rootDepth, owner, bag, subject) {
   const stack = [{ node: root, depth: rootDepth }];
   while (stack.length > 0) {
     const { node, depth } = stack.pop();
@@ -7150,9 +7190,10 @@ function walkLoopDepth(root, rootDepth, owner, bag) {
     const disabled = record.disabled === true;
     if (!disabled && statement !== void 0 && LOOP_CONTROL_STATEMENTS.has(statement) && depth === 0) {
       const spelling = LOOP_CONTROL_STATEMENTS.get(statement);
-      bag.error(
+      bag.warn(
         "stack.loop-control-outside-loop",
-        `${owner} runs \`${spelling}\` outside any loop. Loop control is only defined inside the body of \`s.foreach\`, \`s.for\` or \`s.while\` \u2014 with no loop to ${LOOP_CONTROL_EFFECT.get(statement) ?? "act on"}, what it does is undefined rather than a no-op, and nothing reports it at deploy or at request time. Move it into a loop body, or delete it. (A conditional or group INSIDE a loop is still inside the loop; this fires only when no loop encloses it at all.)`
+        `${owner} runs \`${spelling}\` outside any loop. Loop control is only defined inside the body of \`s.foreach\`, \`s.for\` or \`s.while\` \u2014 with no loop to ${LOOP_CONTROL_EFFECT.get(statement) ?? "act on"}, what it does is undefined rather than a no-op, and nothing reports it at deploy or at request time. Move it into a loop body, or delete it. (A conditional or group INSIDE a loop is still inside the loop; this fires only when no loop encloses it at all.)`,
+        subject
       );
     }
     if (statement !== void 0 && LOOP_STATEMENTS.has(statement)) {
@@ -8103,6 +8144,7 @@ export {
   checkCacheTtl,
   checkUnusableColumnNames,
   checkReservedInputNames,
+  callableInputNames,
   checkOmittedCallInputs,
   checkUnknownCallInputs,
   checkUnitTests,
@@ -8153,4 +8195,4 @@ export {
   checkToolOutputSchema,
   checkAgentArgPlaceholders
 };
-//# sourceMappingURL=chunk-EDCCKH7Y.js.map
+//# sourceMappingURL=chunk-OPG4DYX2.js.map

package/dist/{chunk-VUVPZYMM.js → chunk-PWIXETG7.js}

@@ -1,6 +1,6 @@
 import {
   backendDirIn
-} from "./chunk-DMD5I36N.js";
+} from "./chunk-ERJNHEFV.js";
 import {
   shellWord
 } from "./chunk-FWD7AL6N.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-EUUUMY7J.js";
 import {
   pointerRootFor
-} from "./chunk-Z6LUIVLY.js";
+} from "./chunk-FPBGAT5D.js";
 import {
   UsageError,
   setTypedCwd
-} from "./chunk-JZEWT7NY.js";
+} from "./chunk-SBR2WZXG.js";
 
 // src/emit/xanosdk-project.ts
 import { existsSync, realpathSync, statSync } from "fs";
@@ -154,4 +154,4 @@ export {
   RELATIVE_PATH_ARGS,
   enterProjectRoot
 };
-//# sourceMappingURL=chunk-VUVPZYMM.js.map
+//# sourceMappingURL=chunk-PWIXETG7.js.map

package/dist/{chunk-GQ4PMMCQ.js → chunk-QEZL5MPJ.js}

@@ -1,10 +1,10 @@
 import {
   envExampleNames
-} from "./chunk-2DH7VTO5.js";
+} from "./chunk-7KLAMYMS.js";
 import {
   WORKSPACE_ENV_EXAMPLE_BASENAME,
   renderWorkspaceEnvExample
-} from "./chunk-VTLE2QDY.js";
+} from "./chunk-IRQCV3OT.js";
 import {
   atomicWrite
 } from "./chunk-LLNZGEFK.js";
@@ -54,4 +54,4 @@ export {
   refreshEnvExample,
   bundleEnvNames
 };
-//# sourceMappingURL=chunk-GQ4PMMCQ.js.map
+//# sourceMappingURL=chunk-QEZL5MPJ.js.map

package/dist/{chunk-OJLJA3XM.js → chunk-QV3GXQRE.js}

@@ -9,7 +9,7 @@ import {
   serverMessage,
   statusLabel,
   transportTarget
-} from "./chunk-PYT3DC4G.js";
+} from "./chunk-MN2PB6WB.js";
 import {
   withArticle
 } from "./chunk-36JUQZVQ.js";
@@ -110,4 +110,4 @@ export {
   assertBranchReadSupported,
   exportWorkspaceBundle
 };
-//# sourceMappingURL=chunk-OJLJA3XM.js.map
+//# sourceMappingURL=chunk-QV3GXQRE.js.map

package/dist/{chunk-TLQE7ZN3.js → chunk-RX3EMQGN.js}

@@ -1,7 +1,7 @@
 import {
   LOCK_PAYLOAD_KEYS,
   lockKey
-} from "./chunk-6MR5TI5V.js";
+} from "./chunk-OOGXZL7Z.js";
 
 // src/lock/landed.ts
 function destinationKey(instance, dest) {
@@ -153,4 +153,4 @@ export {
   withoutLanding,
   landedOn
 };
-//# sourceMappingURL=chunk-TLQE7ZN3.js.map
+//# sourceMappingURL=chunk-RX3EMQGN.js.map

package/dist/{chunk-JZEWT7NY.js → chunk-SBR2WZXG.js}

@@ -1,9 +1,9 @@
+import {
+  setDiagnosticSink
+} from "./chunk-GPI3OWRE.js";
 import {
   suggest
 } from "./chunk-UTI5G6OJ.js";
-import {
-  setDiagnosticSink
-} from "./chunk-2Y4X2VLM.js";
 import {
   shellQuote
 } from "./chunk-5ZSO4T2G.js";
@@ -3033,4 +3033,4 @@ export {
   movedVerb,
   installCliDiagnosticSink
 };
-//# sourceMappingURL=chunk-JZEWT7NY.js.map
+//# sourceMappingURL=chunk-SBR2WZXG.js.map

package/dist/{chunk-MOELGXVV.js → chunk-SEATQLFB.js}

@@ -1,20 +1,20 @@
 import {
   readDeployed
-} from "./chunk-5KDJCQEU.js";
+} from "./chunk-HSEQYBDO.js";
 import {
   isProjectDir
-} from "./chunk-VUVPZYMM.js";
+} from "./chunk-PWIXETG7.js";
 import {
   LookupFailedError,
   SourceError,
   resolveSource
-} from "./chunk-2YH2I6RA.js";
+} from "./chunk-46TUUNM3.js";
 import {
   NotSignedInError
-} from "./chunk-5RA4BBJL.js";
+} from "./chunk-CJPLBFFY.js";
 import {
   otherCredentialRefusal
-} from "./chunk-C3YIYEWR.js";
+} from "./chunk-YTPGQV5C.js";
 import {
   getEngineRecord
 } from "./chunk-WL2DSNJV.js";
@@ -23,12 +23,12 @@ import {
   parseSlot,
   refusedKind,
   slotValueMissing
-} from "./chunk-GUKT7QYA.js";
+} from "./chunk-UDE5C2XN.js";
 import {
   getEnvironment,
   readEphemeralState,
   unreadableEphemeralState
-} from "./chunk-EJ3JCML2.js";
+} from "./chunk-UKUIUS3E.js";
 import {
   ENV_CREDENTIAL_VARS,
   ORIGIN_READ_ONLY_BY_REFRESH,
@@ -36,10 +36,10 @@ import {
   credentialFileFlagFor,
   recordedByEnvCredential,
   typedCredentialFlags
-} from "./chunk-RJOGX6LA.js";
+} from "./chunk-SEUCZZCP.js";
 import {
   backendDirIn
-} from "./chunk-DMD5I36N.js";
+} from "./chunk-ERJNHEFV.js";
 import {
   globalAuthFilePath,
   localAuthFilePath,
@@ -47,13 +47,13 @@ import {
   profileAddCommand,
   readCredentialFile,
   recordedCredentialPath
-} from "./chunk-GME75QO6.js";
+} from "./chunk-I2BGYNHD.js";
 import {
   UsageError,
   displayPath,
   pastePath,
   sourceSpellings
-} from "./chunk-JZEWT7NY.js";
+} from "./chunk-SBR2WZXG.js";
 import {
   shellQuote
 } from "./chunk-5ZSO4T2G.js";
@@ -86,7 +86,7 @@ async function selectBackend(slot, raw, ctx) {
   }
   const decided = decide({ cwd, pointer, state, scope, engineRecorded: getEngineRecord(cwd, env) !== void 0 }, slot);
   if ("refusal" in decided) {
-    const { reachableFirst } = await import("./env-target-5QFU2TR5.js");
+    const { reachableFirst } = await import("./env-target-KUWQYHZ7.js");
     throw await reachableFirst(decided.refusal, scope);
   }
   refuseUnservable(slot, decided.kind);
@@ -368,4 +368,4 @@ export {
   NothingTrackedError,
   nestedBackendEntries
 };
-//# sourceMappingURL=chunk-MOELGXVV.js.map
+//# sourceMappingURL=chunk-SEATQLFB.js.map

package/dist/{chunk-RJOGX6LA.js → chunk-SEUCZZCP.js}

@@ -3,7 +3,7 @@ import {
   recordedCredentialFile,
   recordedCredentialPath,
   resolveAuthFilePath
-} from "./chunk-GME75QO6.js";
+} from "./chunk-I2BGYNHD.js";
 import {
   readEnvVar
 } from "./chunk-X2NL4KUO.js";
@@ -73,4 +73,4 @@ export {
   ENV_CREDENTIAL_VARS,
   recordedByEnvCredential
 };
-//# sourceMappingURL=chunk-RJOGX6LA.js.map
+//# sourceMappingURL=chunk-SEUCZZCP.js.map

package/dist/{chunk-IG5QQQSA.js → chunk-TTVAHCWP.js}

@@ -1,7 +1,7 @@
 import {
   parsePathParams,
   pathSegment
-} from "./chunk-IWGNIWQX.js";
+} from "./chunk-5W7DOMIU.js";
 
 // src/emit/routes-manifest.ts
 var RouteManifestError = class extends Error {
@@ -444,4 +444,4 @@ export {
   unresolvedCanonicalMessage,
   renderPlannedManifest
 };
-//# sourceMappingURL=chunk-IG5QQQSA.js.map
+//# sourceMappingURL=chunk-TTVAHCWP.js.map

package/dist/{chunk-GUKT7QYA.js → chunk-UDE5C2XN.js}

@@ -7,7 +7,7 @@ import {
   isKindShaped,
   parseSource,
   sourceSpellings
-} from "./chunk-JZEWT7NY.js";
+} from "./chunk-SBR2WZXG.js";
 
 // src/emit/backend-slot.ts
 function commandPath(command, subcommand) {
@@ -124,4 +124,4 @@ export {
   refusedKind,
   parseSlot
 };
-//# sourceMappingURL=chunk-GUKT7QYA.js.map
+//# sourceMappingURL=chunk-UDE5C2XN.js.map

package/dist/{chunk-AKNCFVKZ.js → chunk-UDZX2ZL4.js}

@@ -33,4 +33,4 @@ export {
   rawResponse,
   rawResponseItems
 };
-//# sourceMappingURL=chunk-AKNCFVKZ.js.map
+//# sourceMappingURL=chunk-UDZX2ZL4.js.map