@xano/sdk 1.0.4 → 1.0.6

package/dist/{chunk-KTGRGWZW.js → chunk-EADVVTDK.js}

@@ -1,28 +1,28 @@
 import {
   retryCommand,
   withheldNote
-} from "./chunk-FMOEVAGT.js";
+} from "./chunk-6X3MY2JP.js";
 import {
   contextFlags
-} from "./chunk-SEUCZZCP.js";
+} from "./chunk-N5I37JFB.js";
 import {
   READ_AFTERMATH,
   SENT_AFTERMATH,
   closeSentence
-} from "./chunk-MN2PB6WB.js";
+} from "./chunk-YR2I5HGE.js";
 import {
   UsageError,
   detail,
   pastePath,
   warn
-} from "./chunk-SBR2WZXG.js";
+} from "./chunk-D7BUMOKU.js";
 import {
   shellQuote
 } from "./chunk-5ZSO4T2G.js";
 
 // src/emit/static-teardown.ts
 async function readStaticTeardown(auth, target, recorded) {
-  const { listServingStaticHosts } = await import("./static-host-WM24RG25.js");
+  const { listServingStaticHosts } = await import("./static-host-ONEHA4LI.js");
   try {
     const serving = await listServingStaticHosts({ ...target, accessToken: auth.access_token });
     const urls = serving.map((s) => s.url);
@@ -130,7 +130,7 @@ function survivingRemedy(args, command) {
 async function assertStaticHostExists(args, auth, target) {
   const host = namedStaticHost(args);
   if (host === void 0) return;
-  const { listStaticHostNames, StaticHostNotFoundError } = await import("./static-host-WM24RG25.js");
+  const { listStaticHostNames, StaticHostNotFoundError } = await import("./static-host-ONEHA4LI.js");
   let names;
   try {
     names = await listStaticHostNames({ ...target, accessToken: auth.access_token });
@@ -215,4 +215,4 @@ export {
   EXIT_STATIC_FAILED,
   unknownStaticOutcome
 };
-//# sourceMappingURL=chunk-KTGRGWZW.js.map
+//# sourceMappingURL=chunk-EADVVTDK.js.map

package/dist/{chunk-FJWZ5OVV.js → chunk-ENMBEXOP.js}

@@ -1,13 +1,13 @@
 import {
   ensureExportGitignored
-} from "./chunk-Y2ZLKBM6.js";
+} from "./chunk-UD2Z7K6W.js";
 import {
   andList
 } from "./chunk-622HUCZT.js";
 import {
   UsageError,
   warn
-} from "./chunk-SBR2WZXG.js";
+} from "./chunk-D7BUMOKU.js";
 
 // src/emit/output-target.ts
 import { accessSync, chmodSync, constants, mkdirSync, statSync, writeFileSync } from "fs";
@@ -125,4 +125,4 @@ export {
   secretsPhrase,
   assertWritableTarget
 };
-//# sourceMappingURL=chunk-FJWZ5OVV.js.map
+//# sourceMappingURL=chunk-ENMBEXOP.js.map

package/dist/{chunk-OPHB5ORL.js → chunk-EQFYOOO6.js}

@@ -2,12 +2,14 @@ import {
   decodeMarkerWith,
   iconLibraryOf,
   reactPreset
-} from "./chunk-UCQ2VUTG.js";
+} from "./chunk-M6ZFSTIZ.js";
 import {
+  blockVersion,
   composeBlock,
   gitattributesSpec,
+  htmlDialect,
   upsertBlock
-} from "./chunk-DGWHAVRG.js";
+} from "./chunk-3EDSPMXN.js";
 import {
   colorTokens,
   defaultThemeChoice,
@@ -56,32 +58,36 @@ function renderPackageJson({ appName, sdkVersion }, preset, choice = defaultThem
       // Scaffolds written before the default flipped still pass `--lock`, and
       // it stays accepted for exactly that reason.
       "xano:export": `npm run xano:routes && ${check} && xanosdk export ./xano/index.ts --out workspace.json`,
-      // Runs `build` rather than `check` directly: `--static ./frontend/dist`
-      // needs that directory to EXIST, and only `vite build` writes it. Pointing
-      // the flag at a directory the script never produced meant a fresh clone
-      // running the one documented command had no `dist` to ship.
-      // `build` already prefixes the same typecheck, so this is one check, not
-      // two.
-      "xano:deploy": `npm run build && xanosdk deploy ./xano/index.ts --static ./frontend/dist`,
-      // The tight loop: redeploy the backend to an engine on this machine.
+      // The default deploy, and the tight loop: redeploy the backend to the
+      // Xano Engine on this machine. It needs no Xano account, so a fresh
+      // scaffold runs it before anyone signs in.
       //
       // No `--static` and no `npm run build`, and both omissions are the point
       // rather than an economy: there is no frontend to ship here. The dev
       // server is still serving it, and the deploy points that server at the
       // engine on its way past, so the loop is backend-only by design.
-      // (`--static` does work on a local engine, for a built frontend the
+      // (`--static` does work on a Xano Engine, for a built frontend the
       // engine itself should serve; this loop has none.)
       //
-      // The flag is bare deliberately. The engine's download URL is passed by
-      // hand once and cached for every run after; baking one into a scaffolded
-      // project would ship a coordinate that is not this project's to carry.
+      // No `--local`: the Xano Engine is where a bare deploy goes, and the
+      // project's pinned version is what it runs. Baking an engine version or
+      // URL into a scaffolded project would ship a coordinate that is not this
+      // project's to carry.
       //
       // `--keep-data`, because the engine is the developer's own backend and
       // this loop runs once per code change: each run merges into what the last
       // one left, so rows entered through the app survive the edit. The first
       // run, and the first after the engine restarts, replaces and seeds.
       // `--reset` on the command line still gives a clean slate.
-      "xano:deploy:local-engine": `npm run xano:routes && ${check} && xanosdk deploy ./xano/index.ts --local-engine --keep-data`,
+      "xano:deploy": `npm run xano:routes && ${check} && xanosdk deploy ./xano/index.ts --keep-data`,
+      // The cloud deploy: backend and built frontend to an ephemeral.
+      // Runs `build` rather than `check` directly: `--static ./frontend/dist`
+      // needs that directory to EXIST, and only `vite build` writes it. Pointing
+      // the flag at a directory the script never produced meant a fresh clone
+      // running the documented command had no `dist` to ship.
+      // `build` already prefixes the same typecheck, so this is one check, not
+      // two.
+      "xano:deploy:ephemeral": `npm run build && xanosdk deploy ./xano/index.ts --ephemeral --static ./frontend/dist`,
       // The frontend-only loop: rebuild and republish to the environment this
       // project last deployed to, without recompiling or re-importing the
       // backend. `build` runs first because publish ships only what is on disk.
@@ -190,9 +196,9 @@ function renderViteConfig(preset) {
   const header = root === null ? `// Vite's root is the project root. The framework resolves its own file
 // locations from the plugin config below \u2014 this file is the ONLY place that
 // config lives \u2014 and routes the build through its adapter, which writes
-// frontend/dist, the directory \`npm run xano:deploy\` ships as the frontend.` : `// Vite's root is the ${root}/ folder, so index.html and the app live there
+// frontend/dist, the directory \`npm run xano:deploy:ephemeral\` ships as the frontend.` : `// Vite's root is the ${root}/ folder, so index.html and the app live there
 // while the Xano SDK backend sits in xano/ as a peer. The build lands in
-// ${root}/dist, which \`npm run xano:deploy\` ships as the static frontend.`;
+// ${root}/dist, which \`npm run xano:deploy:ephemeral\` ships as the static frontend.`;
   const rootBlock = root === null ? "" : `  root: ${JSON.stringify(root)},
   // Vite resolves \`.env\` files against \`root\`, which is ${root}/ here \u2014 but
   // \`.env.example\` sits at the project root, so that is where anyone will
@@ -401,69 +407,119 @@ ${version === void 0 ? "" : `        with:
 }
 function renderEnvExample() {
   return `# Point the frontend at a deployed Xano backend. Leave unset to run the UI
-# with no backend. When you \`npm run xano:deploy\`, the backend URL is injected
-# as window.XANO_HOST at runtime instead \u2014 no rebuild needed.
+# with no backend. \`npm run xano:deploy\` writes the Xano Engine's URL to
+# .env.local for you. After \`npm run xano:deploy:ephemeral\`, the backend URL is
+# injected as window.XANO_HOST at runtime instead \u2014 no rebuild needed.
 VITE_XANO_HOST=https://your-instance.xano.io
 `;
 }
-function renderReadme({ appName, install }, preset, choice = defaultThemeChoice()) {
+var XANO_BADGE = "[![Built on Xano](https://img.shields.io/badge/built_on-Xano-0055FF)](https://xano.com)";
+var README_PATH = "README.md";
+var README_BUILT_WITH_BLOCK = {
+  dialect: htmlDialect("xanosdk-built-with"),
+  pkg: "xanosdk-built-with",
+  file: README_PATH
+};
+var README_BUILT_WITH_BODY = `## Built with
+
+- [Xano](https://xano.com) hosts everything under [\`xano/\`](xano/): the database, APIs,
+  auth, background tasks, realtime, file storage and AI agents. It runs on your machine as
+  the Xano Engine and in the cloud from the same command. [Docs](https://docs.xano.com) \xB7
+  [Community](https://community.xano.com)
+- [Xano SDK](https://github.com/xano-sdk/sdk) is the TypeScript the backend is authored in.
+  The [guides](https://github.com/xano-sdk/sdk/blob/main/guides/README.md) cover signing in
+  and deploying, releasing to production, the typed frontend, and every CLI command.`;
+function renderReadmeBuiltWith(sdkVersion) {
+  return composeBlock(README_BUILT_WITH_BLOCK, [README_BUILT_WITH_BODY], sdkVersion);
+}
+function readmeBuiltWithVersion(text) {
+  return blockVersion(text, README_BUILT_WITH_BLOCK);
+}
+function refreshReadmeBuiltWith(existing, sdkVersion) {
+  return upsertBlock(existing, README_BUILT_WITH_BLOCK, renderReadmeBuiltWith(sdkVersion)).text;
+}
+function renderReadmeDescriptionSlot(appName) {
+  return `_Describe ${appName} here: what it does and who it is for._`;
+}
+function renderReadme({ appName, install, sdkVersion }, preset, choice = defaultThemeChoice()) {
   return `# ${appName}
 
-A [Xano SDK](https://www.npmjs.com/package/@xano/sdk) project: a Xano
-backend authored in TypeScript under [\`xano/\`](xano/), and a ${preset.label}
-frontend under [\`frontend/\`](frontend/) that derives its request paths and
-types from the backend defs \u2014 so the two can't drift.
+${XANO_BADGE}
+
+${renderReadmeDescriptionSlot(appName)}
+
+The backend under [\`xano/\`](xano/) is TypeScript, authored with the
+[Xano SDK](https://github.com/xano-sdk/sdk) and running on [Xano](https://xano.com). It runs
+on your machine as the **Xano Engine** and ships to Xano's cloud with the same command. The
+${preset.label} frontend under [\`frontend/\`](frontend/) takes its request paths and types
+from the backend defs rather than hand-typing them.
 
 ## Quick start
 
 \`\`\`bash
 ${install?.manager ?? "npm"} install${install?.ignoreWorkspace === true ? " --ignore-workspace" : ""}
-npm run dev          # run the frontend (no backend needed yet)
+npm run xano:deploy   # run the backend on the Xano Engine, on this machine
+npm run dev           # run the frontend, already pointed at it
 \`\`\`
 
-Then author your backend in [\`xano/index.ts\`](xano/index.ts) \u2014 start with the
-walkthrough in [\`xano/EXAMPLE.md\`](xano/EXAMPLE.md).
-
-## Deploy
+No Xano account needed. Then author your backend in [\`xano/index.ts\`](xano/index.ts),
+starting with the walkthrough in [\`xano/EXAMPLE.md\`](xano/EXAMPLE.md), and rerun
+\`npm run xano:deploy\` after each change.
+
+## Run it on your machine
+
+The Xano Engine is Xano running on your machine. \`npm run xano:deploy\` typechecks the
+backend and deploys it to the engine: no sign-in, and no network round-trip.
+It prints the backend URL, a link that opens Xano's visual builder on the engine, and
+points \`npm run dev\` at it through \`.env.local\` (restart the dev server if it was already
+running).
+
+- **It works on a fresh machine with nothing set.** The first run downloads the latest
+  engine once per machine and pins its version in \`package.json\`. Commit that change, so
+  everyone on the project runs the same engine.
+- **It keeps your table rows across redeploys** (\`--keep-data\`). The first run seeds and
+  later runs merge your changes in without re-seeding. Rows survive only in tables and columns that keep
+  their names (a rename drops the old one with its rows), and only while the engine runs. An
+  engine update or restart starts it empty and the next run seeds again.
+  \`npm run xano:deploy -- --reset\` gives a clean, re-seeded slate.
+- **Updates are yours to take.** When a newer engine ships, a deploy offers it and never
+  applies it without a yes. \`npx xanosdk local update\` moves the pin on purpose,
+  and \`npx xanosdk local cache clear\` reclaims the disk space. To try another engine
+  without moving the pin, export \`XANOSDK_ENGINE_OVERRIDE\` with a version (\`v0.1.5\`)
+  or an engine archive path.
+- **The rest of the CLI follows.** After a local deploy, \`npm run xano:test\`,
+  \`npx xanosdk tables\` and \`npx xanosdk status\` reach the engine with no flag.
+  \`npx xanosdk local stop <name>\` shuts it down.
+
+## Deploy to Xano's cloud
 
 \`\`\`bash
-npx xanosdk login        # once, to authenticate against your Xano account
-npm run xano:deploy     # build the frontend, then ship it with the backend
+npx xanosdk login               # once, to authenticate against your Xano account
+npm run xano:deploy:ephemeral   # build the frontend, then ship it with the backend
 \`\`\`
 
-- \`npm run xano:deploy:local-engine\` redeploys just the backend to a local engine,
-  for a tight loop with no network round-trip. Keep \`npm run dev\` running \u2014 the
-  deploy points it at the engine. It works on a fresh machine with nothing set: the
-  first run downloads the latest engine once per machine and pins its version in
-  \`package.json\` (commit that change, so everyone on the project runs the same
-  engine). When a newer engine ships, a deploy offers it and never applies it without
-  a yes; \`npx xanosdk local-engine update\` moves the pin on purpose, and
-  \`npx xanosdk local-engine cache clear\` reclaims the disk space. To try another engine
-  without moving the pin, export \`XANOSDK_LOCAL_ENGINE_OVERRIDE\` with a version
-  (\`v0.1.5\`) or an engine archive path. It keeps the engine's
-  table rows across redeploys (\`--keep-data\`): the first run seeds, later runs merge
-  your changes in without re-seeding. Rows survive only in tables and columns that
-  keep their names \u2014 a rename drops the old one with its rows \u2014 and only while the
-  engine runs; an engine update or restart starts it empty and the next run seeds
-  again. \`npm run xano:deploy:local-engine -- --reset\` gives a clean, re-seeded slate.
+That deploys the backend and the built frontend to a live **ephemeral** environment on
+Xano and prints its URL. Run it again to refresh the same environment; if it expired, a
+fresh one is created and the new URL is called out. \`npx xanosdk status\` says who you
+are signed in as, which workspace you are bound to, and which environment this project
+last deployed to \u2014 its URL, and when it expires \u2014 so you never have to remember the
+environment's name. Your **workspace** is reached through a release (\`deploy --ephemeral --test\`,
+\`release create\`, \`promote\`); see the
+[deploying guide](https://github.com/xano-sdk/sdk/blob/main/guides/deploying.md).
+
+The other scripts:
+
 - \`npm run xano:deploy:frontend\` rebuilds the frontend and republishes it to the
   environment this project last deployed to \u2014 no backend compile or import, so it
-  is the quick loop for UI-only changes. \`publish\` does not reach a local engine, so after
-  a local-engine deploy run it as \`npm run xano:deploy:frontend -- --to ephemeral\`, or
-  have the engine serve a build with \`--static ./frontend/dist\` on the local deploy.
-  \`npx xanosdk publish ./frontend/dist --to workspace\` puts the same build in front of
-  your real workspace instead.
-- \`npm run xano:export\` compiles the backend to \`workspace.json\` (don't commit it).
-- \`npm run xano:deploy\` deploys the backend and the built frontend to a live
-  **ephemeral** environment and prints its URL. Run it again to refresh the same
-  environment; if it expired, a fresh one is created and the new URL is called out.
-- \`npx xanosdk status\` says who you are signed in as, which workspace you are bound to, and
-  which environment this project last deployed to \u2014 its URL, and when it expires. You
-  never have to remember the environment's name.
+  is the quick loop for UI-only changes. After \`npm run xano:deploy\` the engine serves
+  it; \`npm run xano:deploy:frontend -- --to ephemeral\` sends it to an ephemeral instead,
+  and \`npx xanosdk publish ./frontend/dist --to workspace\` puts the same build in front
+  of your real workspace.
 - \`npm run xano:test\` runs the tests the DEPLOYED environment carries \u2014 the \`tests\`
   on a query/function/middleware and any \`workflowTest()\`. It compiles nothing, so
   deploy first. A failing suite exits 5, distinct from a crash. \`npx xanosdk deploy
   ./xano/index.ts --test\` does both in one step.
+- \`npm run xano:export\` compiles the backend to \`workspace.json\` (don't commit it).
 
 ## \`xano.lock\` \u2014 commit it
 
@@ -495,8 +551,9 @@ export again. Every \`lock\` subcommand finds \`xano/xano.lock\` from the projec
 ## The one contract
 
 [\`frontend/src/lib/api.ts\`](frontend/src/lib/api.ts) takes request paths from
-\`xano/routes.gen.ts\` (\`routePath("GET notes/{id}", { id })\`) and request/response
-types from the query defs (\`import type\` + \`InferInput\` / \`InferResponse\`).
+\`xano/routes.gen.ts\` (\`routePath("GET notes/{id}", { id })\`), request types from the
+same file (\`RouteInputs["POST create_note"]\`, \`MessageInputs[...]\` for realtime), and
+response types from the query defs (\`import type\` + \`InferResponse\`).
 Never hand-type a URL or a request body \u2014 change a def and the frontend follows.
 
 \`npm run xano:routes\` writes \`xano/routes.gen.ts\` from the defs; \`dev\`, \`build\`
@@ -537,6 +594,8 @@ Xano SDK is composable with other \`@xano-sdk/*\` packages:
 
 None of these ship with the scaffold. Install one only when you need it \u2014 an
 add-on you never register is weight in \`package.json\` for nothing.
+
+${renderReadmeBuiltWith(sdkVersion)}
 `;
 }
 function renderXanoIndex({ appName }) {
@@ -659,7 +718,7 @@ xano/
    \`workflowTest({ name, stack })\` when the behavior spans several objects.
    They live beside the code they cover and ship with it. See "Testing" below.
 6. **Compile** with \`npm run xano:export\`, and **deploy** with
-   \`npm run xano:deploy\` (after \`npx xanosdk login\`). The first of either writes
+   \`npm run xano:deploy\` (it runs on the Xano Engine; no account needed). The first of either writes
    \`xano/xano.lock\` \u2014 **commit it**. It pins every object's identity, so a later
    rename renames the object instead of deleting and recreating it. See
    "\`xano.lock\` \u2014 commit it" in the project README.
@@ -707,8 +766,11 @@ URL or a request body:
   groups share is keyed \`"<group>:<VERB> <name>"\`). Run
   \`npm run xano:routes\` after adding or renaming an endpoint (\`dev\`, \`build\` and
   \`typecheck\` also run it) and commit the file.
-- **Shapes** come from the defs with \`import type\` \u2014 \`InferInput\`/\`InferResponse\`
-  erase to nothing.
+- **Request types** come from the same file: \`RouteInputs["POST create_note"]\`
+  (\`ChannelInputs\`/\`MessageInputs\` for realtime). For runtime validation,
+  \`npx xanosdk marketplace install zod\` adds zod schemas under the same keys.
+- **Response types** come from the defs with \`import type\` \u2014 \`InferResponse\`
+  erases to nothing.
 - Never import a def as a value in the frontend. Its \`s.*\`/\`c.*\` stack calls run
   at module load, so one import for its \`getPath()\` pulls the backend graph it
   references and the SDK runtime into the bundle.
@@ -720,8 +782,8 @@ function describeOrigin(o) {
       return `workspace ${o.origin}`;
     case "ephemeral":
       return `ephemeral "${o.origin}"`;
-    case "local-engine":
-      return `local engine "${o.origin}"`;
+    case "local":
+      return `Xano Engine "${o.origin}"`;
     case "tenant":
       return `tenant "${o.origin}"`;
     case "release":
@@ -749,7 +811,7 @@ function renderCodegenMarker({ sdkVersion }, origin, generatedAt, report, files)
   };
   return JSON.stringify(files === void 0 ? head : decodeMarkerWith(head, files), null, 2) + "\n";
 }
-function renderCodegenReadme({ appName }, origin, envNames, preset) {
+function renderCodegenReadme({ appName, sdkVersion }, origin, envNames, preset) {
   const secrets = envNames.length === 0 ? "" : `
 ## Fill in the backend env values
 
@@ -776,16 +838,23 @@ cleartext, which is why it is gitignored too.
 `;
   return `# ${appName}
 
-A [Xano SDK](https://www.npmjs.com/package/@xano/sdk) project pulled from
-${describeCommittedOrigin(origin)}. The Xano backend lives in [\`xano/\`](xano/) as readable
-TypeScript; the ${preset.label} frontend under [\`frontend/\`](frontend/) is a starter \u2014
-the pull carries a backend, not a UI.
+${XANO_BADGE}
+
+${renderReadmeDescriptionSlot(appName)}
 
-## Deploy it
+The backend under [\`xano/\`](xano/) is TypeScript pulled from ${describeCommittedOrigin(origin)}
+with the [Xano SDK](https://github.com/xano-sdk/sdk), and runs on [Xano](https://xano.com). The
+${preset.label} frontend under [\`frontend/\`](frontend/) is a starter \u2014 the pull carries a
+backend, not a UI.
+
+## Run it
 
 \`\`\`bash
-npx xanosdk login        # once, to authenticate against your Xano account
-npm run xano:deploy     # typecheck, build the frontend, ship both
+npm run xano:deploy                # on the Xano Engine, on this machine (no account needed)
+npm run dev                        # the starter frontend, pointed at it
+
+npx xanosdk login                  # once, to authenticate against your Xano account
+npm run xano:deploy:ephemeral      # typecheck, build the frontend, ship both to an ephemeral
 \`\`\`
 
 ## Read this before deploying
@@ -793,10 +862,11 @@ npm run xano:deploy     # typecheck, build the frontend, ship both
 - **\`xano/\` is your source now** \u2014 edit it and commit it. \`npx xanosdk pull\` (or re-running
   \`npx xanosdk init --from\`) refreshes it from a backend: it lists what will change and asks
   first, keeps files you added, and overwrites the files it decodes \u2014 commit first.
-- **\`npx xanosdk deploy\` is a full replace** of an **ephemeral** environment or a local engine
-  (\`npm run xano:deploy\`), unless \`--keep-data\` merges into the one an earlier deploy
-  filled. A real workspace is reached with \`npx xanosdk promote <release>\` or
-  \`npx xanosdk deploy --to workspace\`, which merge and leave table rows alone.
+- **\`npx xanosdk deploy\` is a full replace** of a Xano Engine or an **ephemeral** environment
+  (\`npm run xano:deploy:ephemeral\`), unless \`--keep-data\` merges into the one an earlier deploy
+  filled (\`npm run xano:deploy\` passes it). A real workspace is reached with
+  \`npx xanosdk promote <release>\` or \`npx xanosdk deploy --to workspace\`, which merge
+  and leave table rows alone.
 - **This is schema only.** Table rows are not carried, and neither are payload sections
   this SDK models no kind for. A deploy recreates the structure, not the data.
 
@@ -809,11 +879,13 @@ ${secrets}
 npm run dev            # run the starter frontend
 npm run typecheck      # the whole project, both halves
 npm run xano:export    # compile the backend to workspace.json (don't commit it)
-npm run xano:routes    # regenerate xano/routes.gen.ts, the frontend's paths
+npm run xano:routes    # regenerate xano/routes.gen.ts: the frontend's paths and request types
 \`\`\`
 
 [\`frontend/src/lib/api.ts\`](frontend/src/lib/api.ts) shows the one contract: paths
-from \`routePath()\` in \`xano/routes.gen.ts\`, types from the query defs in \`xano/\`.
+and request types from \`xano/routes.gen.ts\`, response types from the query defs in \`xano/\`.
+
+${renderReadmeBuiltWith(sdkVersion)}
 `;
 }
 function renderReadmeThemingSection(choice) {
@@ -877,7 +949,7 @@ function initLanding({ appName }) {
         { text: ")." }
       ],
       [{ text: "Wire it into the UI from " }, { code: "frontend/src/lib/api.ts" }, { text: "." }],
-      [{ text: "Ship it: " }, { code: "npm run xano:deploy" }, { text: "." }]
+      [{ text: "Run it on the Xano Engine: " }, { code: "npm run xano:deploy" }, { text: "." }]
     ],
     cta: UI_DOCS_CTA
   };
@@ -904,9 +976,9 @@ function codegenLanding({ appName }, origin) {
         { text: "." }
       ],
       [
-        { text: "Ship it: " },
+        { text: "Run it on the Xano Engine: " },
         { code: "npm run xano:deploy" },
-        { text: " (a full replace of an ephemeral env)." }
+        { text: " (a full replace of the Xano Engine)." }
       ]
     ],
     cta: UI_DOCS_CTA
@@ -1063,9 +1135,9 @@ export function cn(...inputs: ClassValue[]) {
 ${extra}`;
 }
 function renderApiTs() {
-  return `// The one contract: endpoint paths come from the generated route manifest, and
-// request/response *types* from your xanosdk query defs. Never hand-type a URL
-// or a request body: change a def and everything here follows.
+  return `// The one contract: endpoint paths and request types come from the generated
+// route manifest, and response *types* from your xanosdk query defs. Never
+// hand-type a URL or a request body: change a def and everything here follows.
 //
 // Keep the backend out of the browser bundle:
 //   \u2022 Paths and verbs: \`routePath()\` / \`ROUTES\` from xano/routes.gen.ts, plain data
@@ -1073,16 +1145,20 @@ function renderApiTs() {
 //     regenerate it). Never import a def as a VALUE for its getPath()/verb:
 //     its s.*/c.* factory calls run at module load, so one import pulls in the
 //     backend graph it references and the SDK runtime that builds it.
-//   \u2022 Shapes: \`import type\` only. InferInput/InferResponse erase to nothing.
+//   \u2022 Request types: \`RouteInputs["<VERB> <name>"]\` from the same file
+//     (\`ChannelInputs\` / \`MessageInputs\` for realtime), types only. For
+//     runtime validation, \`npx xanosdk marketplace install zod\` adds zod
+//     schemas under the same keys.
+//   \u2022 Response types: \`import type\` the def. InferResponse erases to nothing.
 //
 // Nothing here imports the manifest yet \u2014 an add-on's endpoints may already be
 // in it. Wire an endpoint (one in xano/, or an add-on's) like:
 //
-//   import type { InferInput, InferResponse } from "@xano/sdk";
+//   import type { InferResponse } from "@xano/sdk";
 //   import type { createNoteQuery } from "../../../xano/api/create-note.js";
-//   import { ROUTES, routePath } from "../../../xano/routes.gen.js";
+//   import { ROUTES, routePath, type RouteInputs } from "../../../xano/routes.gen.js";
 //
-//   export type CreateNoteBody = InferInput<typeof createNoteQuery>;
+//   export type CreateNoteBody = RouteInputs["POST create_note"];
 //   export type Note = InferResponse<typeof createNoteQuery>;
 //
 //   export async function createNote(body: CreateNoteBody): Promise<Note> {
@@ -1328,7 +1404,7 @@ export {};
 }
 function renderLayoutTs() {
   return `// There is no server. The backend is Xano, reached through $lib/api.ts,
-// and \`npm run xano:deploy\` ships this app to a static host with no runtime.
+// and \`npm run xano:deploy:ephemeral\` ships this app to a static host with no runtime.
 //
 // prerender: true \u2014 every route is rendered to its own HTML file AT BUILD TIME
 // and served as a real document. That is what makes each page load as itself
@@ -1788,7 +1864,7 @@ becomes its own HTML document at build time, so a page loads as itself rather
 than as a shell that fills in afterwards, and an unmatched path returns a real
 404 from [\`+error.svelte\`](frontend/src/routes/+error.svelte).
 
-> **There is no server.** \`npm run xano:deploy\` ships this app to a static host
+> **There is no server.** \`npm run xano:deploy:ephemeral\` ships this app to a static host
 > with no runtime of its own; Xano is the backend, reached through
 > [\`frontend/src/lib/api.ts\`](frontend/src/lib/api.ts). So \`+page.server.ts\`,
 > form actions, and server \`load\` have nothing to run on \u2014 and **nothing warns
@@ -1969,6 +2045,9 @@ export {
   checkWorkflowPath,
   renderCheckWorkflow,
   renderEnvExample,
+  README_PATH,
+  readmeBuiltWithVersion,
+  refreshReadmeBuiltWith,
   renderReadme,
   renderXanoIndex,
   renderXanoExampleMd,
@@ -1987,4 +2066,4 @@ export {
   allFrontendPresets,
   resolveFrameworkFlag
 };
-//# sourceMappingURL=chunk-OPHB5ORL.js.map
+//# sourceMappingURL=chunk-EQFYOOO6.js.map

package/dist/{chunk-WOGJB2F6.js → chunk-FNLTFOUD.js}

@@ -25,11 +25,11 @@ import {
   isDeadResultItem,
   isEmptyCustomize,
   normalize
-} from "./chunk-3HOGFGKG.js";
+} from "./chunk-D3KEPRRN.js";
 import {
   f,
   input
-} from "./chunk-37FBPMNE.js";
+} from "./chunk-S56YBYMN.js";
 import {
   TAGS,
   auth,
@@ -59,7 +59,7 @@ import {
   defaultNullable,
   encodeField,
   parseMethod
-} from "./chunk-4DJTQ6W4.js";
+} from "./chunk-JIKGT7DO.js";
 
 // src/codegen/report.ts
 var AUDIENCE_ORDER = [
@@ -505,11 +505,6 @@ var DecodeContext = class {
    * for `generate --out`. Only the caller knows the directory.
    */
   secretsFile = WORKSPACE_SECRETS_FILE;
-  /**
-   * Whether the caller writes that sidecar at all. `--no-secrets` does not, and
-   * the report has to say so rather than promise a file and a restored gate.
-   */
-  writesSecrets = true;
   /** The barrel's `workspace("…")` name when the payload carries no workspace object. */
   fallbackWorkspaceName = "workspace";
   /** The import block of the file currently being generated. */
@@ -2026,4 +2021,4 @@ export {
   decodeTableSchema,
   decodeResponse
 };
-//# sourceMappingURL=chunk-WOGJB2F6.js.map
+//# sourceMappingURL=chunk-FNLTFOUD.js.map

package/dist/{chunk-II747OWE.js → chunk-FQ53GTII.js}

@@ -7,7 +7,7 @@ import {
   parsePathParams,
   queryKind,
   warnUnboundReturn
-} from "./chunk-5W7DOMIU.js";
+} from "./chunk-VJFMUJWZ.js";
 import {
   workspaceKind
 } from "./chunk-6JAEMMZ7.js";
@@ -16,7 +16,7 @@ import {
   encodeMcpOauth,
   refuseUnknown,
   standaloneDefKind
-} from "./chunk-5YL5OC2G.js";
+} from "./chunk-5QMJOE2K.js";
 import {
   resolveAuthRef
 } from "./chunk-45ZUMF4E.js";
@@ -68,7 +68,7 @@ import {
   registerSpec,
   resolveEnumValue,
   throwError
-} from "./chunk-OPG4DYX2.js";
+} from "./chunk-T4LJ5UR2.js";
 import {
   assertCanonical,
   assertStoredName,
@@ -83,7 +83,7 @@ import {
   encodeExpression,
   encodeRuntimeCondition,
   tableKind
-} from "./chunk-4PQHO74B.js";
+} from "./chunk-SLGJIWCY.js";
 import {
   brandDef
 } from "./chunk-ERVIASGL.js";
@@ -99,15 +99,15 @@ import {
 } from "./chunk-WTPZRR4I.js";
 import {
   emitDiagnostic
-} from "./chunk-GPI3OWRE.js";
+} from "./chunk-YHB34BN6.js";
 import {
   lockKey
-} from "./chunk-OOGXZL7Z.js";
+} from "./chunk-5KJBWIDZ.js";
 import {
   HOSTED_FILE_SCHEME,
   isHostedFile,
   pendingHostedSrc
-} from "./chunk-XNCP4KYO.js";
+} from "./chunk-VQPDATQT.js";
 import {
   ANNOTATION_KEYS,
   OPTION_KEYS,
@@ -121,10 +121,10 @@ import {
 import {
   impliedInputs,
   isTriggerObjType
-} from "./chunk-7GX445AE.js";
+} from "./chunk-4XHAT7C5.js";
 import {
   encodeInput
-} from "./chunk-37FBPMNE.js";
+} from "./chunk-S56YBYMN.js";
 import {
   barePatternRefusal,
   c,
@@ -3058,4 +3058,4 @@ export {
   serializeBundle,
   emitBundle
 };
-//# sourceMappingURL=chunk-II747OWE.js.map
+//# sourceMappingURL=chunk-FQ53GTII.js.map