@xano/xanoscript-language-server 12.16.5 → 12.17.0

package/lexer/db.js

@@ -73,6 +73,12 @@ export const PatchToken = createTokenByName("patch", {
   categories: [Identifier],
 });
 
+// increment
+export const IncrementToken = createTokenByName("increment", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
 // schema
 export const SchemaToken = createTokenByName("schema", {
   longer_alt: Identifier,
@@ -151,6 +157,7 @@ export const DbTokens = [
   UpdateToken,
   HasToken,
   PatchToken,
+  IncrementToken,
   SchemaToken,
   TransactionToken,
   TruncateToken,
@@ -186,6 +193,7 @@ export function mapTokenToType(token) {
     case UpdateToken.name:
     case HasToken.name:
     case PatchToken.name:
+    case IncrementToken.name:
     case TransactionToken.name:
     case TruncateToken.name:
     case DirectQueryToken.name:

package/lexer/mcp.js

@@ -0,0 +1,109 @@
+import { Identifier } from "./identifier.js";
+import { createTokenByName } from "./utils.js";
+
+// MCP 2026-07-28 authoring keywords: the `prompt` and `resource` object kinds,
+// the tool/prompt/resource metadata keys, and the `mcp.elicit` / `mcp.progress`
+// statements. Grounded against cloud-client's schema DSL
+// (`script/kind/schema/core/{prompt,resource,tool,mcp_server}.yaml` and
+// `script/kind/schema/statement/mcp.{elicit,progress}.yaml`).
+//
+// Ordering note: a keyword with `longer_alt: Identifier` loses to an EARLIER
+// shorter token, so `prompts` must precede `prompt`, and `resource` is lexed
+// after `resources` (MicroserviceTokens, reused by the mcp_server parser).
+
+// "prompts"
+export const PromptsToken = createTokenByName("prompts", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "prompt"
+export const PromptToken = createTokenByName("prompt", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "resource"
+export const ResourceToken = createTokenByName("resource", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "title"
+export const TitleToken = createTokenByName("title", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "annotations"
+export const AnnotationsToken = createTokenByName("annotations", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "icons"
+export const IconsToken = createTokenByName("icons", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "uri"
+export const UriToken = createTokenByName("uri", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "mime_type"
+export const MimeTypeToken = createTokenByName("mime_type", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "elicit" (mcp.elicit)
+export const ElicitToken = createTokenByName("elicit", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "progress" (mcp.progress)
+export const ProgressToken = createTokenByName("progress", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+export const McpObjectTokens = [
+  PromptsToken,
+  PromptToken,
+  ResourceToken,
+  TitleToken,
+  AnnotationsToken,
+  IconsToken,
+  UriToken,
+  MimeTypeToken,
+  ElicitToken,
+  ProgressToken,
+];
+
+/**
+ * Maps a token name to a type
+ * @param {string} token the token name
+ */
+export function mapTokenToType(token) {
+  switch (token) {
+    case PromptToken.name:
+    case ResourceToken.name:
+    case PromptsToken.name:
+      return "keyword";
+    case TitleToken.name:
+    case AnnotationsToken.name:
+    case IconsToken.name:
+    case UriToken.name:
+    case MimeTypeToken.name:
+      return "variable";
+    case ElicitToken.name:
+    case ProgressToken.name:
+      return "function";
+    default:
+      return null;
+  }
+}

package/lexer/tokens.js

@@ -84,6 +84,10 @@ import {
   mapTokenToType as mapLiteralTokenToType,
 } from "./literal.js";
 import { mapTokenToType as mapMathTokenToType, MathTokens } from "./math.js";
+import {
+  mapTokenToType as mapMcpObjectTokenToType,
+  McpObjectTokens,
+} from "./mcp.js";
 import {
   mapTokenToType as mapMcpServerTokenToType,
   McpServerTokens,
@@ -468,6 +472,9 @@ export const allTokens = uniq([
   ChannelServerToken,
   ...AgentTokens, // Must come before ToolTokens because of ToolsToken
   ...ToolTokens,
+  // MCP authoring keywords (prompt/resource kinds, tool metadata, mcp.*);
+  // after MicroserviceTokens so `resources` wins over `resource`.
+  ...McpObjectTokens,
   ...AddonTokens,
   ...ActionTokens,
   ...BranchTokens,
@@ -503,6 +510,7 @@ const tokenMappers = [
   mapFunctionTokenToType,
   mapLiteralTokenToType,
   mapMathTokenToType,
+  mapMcpObjectTokenToType,
   mapMcpServerTokenToType,
   mapMcpServerTriggerTokenToType,
   mapMessageTokenToType,

package/onCompletion/onCompletion.js

@@ -95,7 +95,7 @@ function getWorkspaceCompletions(prefix) {
 
   // db.* table name context
   if (
-    /\b(get|add|edit|delete|query|patch|has|truncate|add_or_edit|schema)\s+("?[^"\s{]*$)/.test(
+    /\b(get|add|edit|delete|query|patch|increment|has|truncate|add_or_edit|schema)\s+("?[^"\s{]*$)/.test(
       prefix
     )
   ) {

package/onDefinition/onDefinition.js

@@ -11,6 +11,7 @@ const DB_OPERATION_TOKENS = new Set([
   "delete",
   "query",
   "patch",
+  "increment",
   "has",
   "truncate",
   "add_or_edit",

package/onHover/functions.md

@@ -473,6 +473,45 @@ Calls an internal Xano AI tool, it allows you to invoke internal tools within yo
 - `tool.call` takes the name of the tool as an argument.
 - `input`: The input parameters for the tool.
 
+# mcp.elicit
+
+```xs
+mcp.elicit {
+  key = "confirm"
+  message = "Delete order " ~ $input.order_id ~ "?"
+  input {
+    bool proceed
+    text reason?
+  }
+} as $answer
+```
+
+Asks the MCP client for input while a tool, prompt or resource runs. `$answer` is `{action, content}`, where `action` is `accept`, `decline` or `cancel`, and `content` holds the `input` fields on `accept`.
+
+- `key`: required. Identifies the answer across retries; use a distinct key per elicit.
+- `message`: required. The question shown to the user.
+- `input`: optional. The form fields, same grammar as a tool's `input` block.
+
+**Input is only collected from `2026-07-28` clients with form elicitation.** Every other client, and a run outside MCP, gets `{action: "cancel"}`, so always handle the `cancel` branch.
+
+The client retries the WHOLE request with each answer, so every statement before the elicit runs again on each round trip. Put writes (`db.add`, `db.edit`, a non-GET `api.request`, `util.send_email`, `function.run`) after the last `mcp.elicit`.
+
+# mcp.progress
+
+```xs
+mcp.progress {
+  progress = $index
+  total = $count
+  message = "Processing " ~ $index ~ " of " ~ $count
+}
+```
+
+Sends an MCP `notifications/progress` update to the client while a tool, prompt or resource runs. It does nothing outside an MCP request, or when the client sent no progress token.
+
+- `progress`: required. Must increase on every call; a value that does not is dropped.
+- `total`: optional. The expected final value.
+- `message`: optional. A short status line.
+
 # api.lambda
 
 ```xs
@@ -928,6 +967,20 @@ db.patch user {
 
 Updates specific fields of an existing record in a database table (e.g., `user`) identified by a field (e.g., `email`) and its value (e.g., `$input.email`). The `data` block specifies the fields to update, and the modified record is stored in `$updated_user`.
 
+# db.increment
+
+```xs
+db.increment post {
+  where = $db.post.id == $input.id
+  field_name = "view_count"
+  value = 1
+  return = {type: "list"}
+  output = ["id", "view_count"]
+} as $updated
+```
+
+Atomically adds `value` to the numeric column `field_name` (e.g., `view_count`) on every record of a database table (e.g., `post`) matching the `where` clause. A negative `value` (e.g., `-1`, or `$input.qty|multiply:-1`) decrements. `return` selects `list` (default, the updated records) or `count` (the number of updated records), `output` limits the returned columns, and the result is stored in `$updated`.
+
 # db.get
 
 ```xs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xano/xanoscript-language-server",
-  "version": "12.16.5",
+  "version": "12.17.0",
   "description": "Language Server Protocol implementation for XanoScript",
   "type": "module",
   "main": "server.js",

package/parser/base_parser.js

@@ -306,6 +306,8 @@ export class XanoBaseParser extends CstParser {
     this.warnings = [];
     this.informations = [];
     this.hints = [];
+    // write-before-elicit lint state (parser/functions/mcp/elicitLint.js)
+    this.__mcpElicitLint = { mutations: [], checked: 0 };
     this.__symbolTable = {
       input: {},
       var: {},

package/parser/clauses/inputClause.js

@@ -6,7 +6,9 @@ import { InputToken, NewlineToken } from "../../lexer/tokens.js";
  * @param {import('../base_parser.js').XanoBaseParser} $
  */
 export function inputClause($) {
-  return () => {
+  // `fields` collects the top-level fields (not nested object schema fields),
+  // keyed by name: { typeToken, nameToken, iterable }
+  return (fields = {}) => {
     $.sectionStack.push("inputClause");
 
     let hasStatement = false;
@@ -24,11 +26,18 @@ export function inputClause($) {
         $.SUBRULE($.optionalCommentBlockFn);
 
         $.OR([
-          { ALT: () => $.SUBRULE($.objectColumnDefinition) },
-          { ALT: () => $.SUBRULE($.enumColumnDefinition) },
           {
             ALT: () =>
-              $.SUBRULE($.columnDefinition, { ARGS: [{ include_file: true }] }),
+              $.SUBRULE($.objectColumnDefinition, { ARGS: [fields] }),
+          },
+          {
+            ALT: () => $.SUBRULE($.enumColumnDefinition, { ARGS: [fields] }),
+          },
+          {
+            ALT: () =>
+              $.SUBRULE($.columnDefinition, {
+                ARGS: [{ include_file: true }, fields],
+              }),
           },
           {
             ALT: () => $.SUBRULE($.dbLinkColumnDefinition),

package/parser/clauses/mcpMetadataClauses.js

@@ -0,0 +1,252 @@
+import { EqualToken } from "../../lexer/control.js";
+import {
+  SingleQuotedStringLiteral,
+  StringLiteral,
+} from "../../lexer/literal.js";
+import { AnnotationsToken, IconsToken, TitleToken } from "../../lexer/mcp.js";
+import { MultiLineStringToken } from "../../lexer/multiline.js";
+
+// Shared MCP metadata blocks for `tool`, `prompt` and `resource` (MCP spec
+// 2026-07-28). The rules mirror cloud-client's decode checks so the editor
+// reports what a push would refuse:
+//   - `helper/mvp/mcpserver/ToolMetadata.php` (icons, tool annotations)
+//   - `helper/script/transform/Resource.php` (resource annotations)
+
+export const ICON_MIME_TYPES = ["image/png", "image/jpeg", "image/webp"];
+export const ICON_URL_MAX_LENGTH = 2048;
+export const ICON_DATA_MAX_BYTES = 65536;
+export const RESOURCE_AUDIENCES = ["user", "assistant"];
+
+const ICON_SCHEMA = {
+  src: "[string]",
+  // validated below: cloud-client compares it lowercased and allows ""
+  "mime_type?": "[string]",
+  "sizes?": ["[string]"],
+  "theme?": ["light", "dark"],
+};
+
+const ISO_8601 =
+  /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+
+/**
+ * The value of a token that `[string]` accepts ("...", '...' or a """ block),
+ * or null for anything else (an expression, a variable).
+ * @param {import('chevrotain').IToken} [token]
+ * @returns {string|null}
+ */
+function stringValue(token) {
+  switch (token?.tokenType) {
+    case StringLiteral:
+    case SingleQuotedStringLiteral:
+      return token.image.slice(1, -1);
+    case MultiLineStringToken:
+      return token.image.slice(3, -3).trim();
+    default:
+      return null;
+  }
+}
+
+/**
+ * Why an icon `src` is refused, or null. Same rules as ToolMetadata::srcProblem:
+ * `https:` or a base64 `data:` URI of png/jpeg/webp. SVG and every other scheme
+ * (`http:`, `javascript:`, `file:`, ...) are refused.
+ * @param {string} src
+ * @returns {string|null}
+ */
+export function iconSrcProblem(src) {
+  const lower = src.toLowerCase();
+
+  if (lower.startsWith("https://")) {
+    if (src.length > ICON_URL_MAX_LENGTH) {
+      return `icon src is longer than ${ICON_URL_MAX_LENGTH} characters`;
+    }
+    let host = "";
+    try {
+      host = new URL(src).hostname;
+    } catch {
+      host = "";
+    }
+    if (!host || /\s/.test(src)) {
+      return "icon src is not a valid https URL";
+    }
+    return null;
+  }
+
+  if (lower.startsWith("data:")) {
+    const match = src.match(/^data:([a-z0-9.+/-]+);base64,([A-Za-z0-9+/]*={0,2})$/i);
+    if (!match) {
+      return "icon data: src must be base64 image data";
+    }
+    const mime = match[1].toLowerCase();
+    if (!ICON_MIME_TYPES.includes(mime)) {
+      return `icon data: src must be ${ICON_MIME_TYPES.join(", ")} — got "${mime}"`;
+    }
+    const payload = match[2];
+    if (payload.length === 0) {
+      return "icon data: src must be base64 image data";
+    }
+    const padding = payload.endsWith("==") ? 2 : payload.endsWith("=") ? 1 : 0;
+    if ((payload.length * 3) / 4 - padding > ICON_DATA_MAX_BYTES) {
+      return `icon data: src is larger than ${ICON_DATA_MAX_BYTES} bytes`;
+    }
+    return null;
+  }
+
+  const scheme = src.includes(":") ? src.split(":")[0] + ":" : src.slice(0, 20);
+  return `icon src must be https: or a data: image — got "${scheme}"`;
+}
+
+/**
+ * title = "Human readable name"
+ * @param {import('../base_parser.js').XanoBaseParser} $
+ */
+export function mcpTitleClause($) {
+  return () => {
+    $.sectionStack.push("mcpTitleClause");
+    $.CONSUME(TitleToken); // "title"
+    $.CONSUME(EqualToken); // "="
+    const value = $.CONSUME(StringLiteral); // "..."
+    if (value.image === `""`) {
+      $.addMissingError(value, "title cannot be empty");
+    }
+    $.sectionStack.pop();
+  };
+}
+
+/**
+ * icons = [{ src: "https://...", mime_type: "image/png", sizes: ["48x48"], theme: "light" }]
+ * @param {import('../base_parser.js').XanoBaseParser} $
+ */
+export function mcpIconsClause($) {
+  return () => {
+    $.sectionStack.push("mcpIconsClause");
+    const parent = $.CONSUME(IconsToken); // "icons"
+    $.CONSUME(EqualToken); // "="
+
+    const captured = {};
+    $.SUBRULE($.schemaParseArrayFn, { ARGS: [parent, [ICON_SCHEMA], captured] });
+
+    $.ACTION(() => {
+      for (const icon of captured.value || []) {
+        const srcToken = icon.src?.value;
+        const src = stringValue(srcToken);
+        if (src !== null) {
+          const problem = iconSrcProblem(src);
+          if (problem) {
+            $.addInvalidValueError(srcToken, problem);
+          }
+        }
+
+        const mimeToken = icon.mime_type?.value;
+        const mime = stringValue(mimeToken);
+        if (mime !== null) {
+          if (mime !== "" && !ICON_MIME_TYPES.includes(mime.toLowerCase())) {
+            $.addInvalidValueError(
+              mimeToken,
+              `icon mime_type must be one of ${ICON_MIME_TYPES.join(", ")} — got "${mime}"`,
+            );
+          }
+        }
+
+        for (const size of icon.sizes?.value || []) {
+          const sizeToken = size?.value;
+          const value = stringValue(sizeToken);
+          if (value === null) continue;
+          if (!/^(\d{1,5}x\d{1,5}|any)$/.test(value)) {
+            $.addInvalidValueError(
+              sizeToken,
+              `icon size must be WxH or "any" — got "${value}"`,
+            );
+          }
+        }
+      }
+    });
+    $.sectionStack.pop();
+  };
+}
+
+/**
+ * annotations = { read_only_hint: true, destructive_hint: false, ... } (tool)
+ * @param {import('../base_parser.js').XanoBaseParser} $
+ */
+export function mcpToolAnnotationsClause($) {
+  return () => {
+    $.sectionStack.push("mcpToolAnnotationsClause");
+    const parent = $.CONSUME(AnnotationsToken); // "annotations"
+    $.CONSUME(EqualToken); // "="
+    $.SUBRULE($.schemaParseObjectFn, {
+      ARGS: [
+        parent,
+        {
+          "read_only_hint?": "[boolean]",
+          "destructive_hint?": "[boolean]",
+          "idempotent_hint?": "[boolean]",
+          "open_world_hint?": "[boolean]",
+        },
+      ],
+    });
+    $.sectionStack.pop();
+  };
+}
+
+/**
+ * annotations = { audience: ["user"], priority: 0.5, last_modified: "2025-01-12T15:00:58Z" } (resource)
+ * @param {import('../base_parser.js').XanoBaseParser} $
+ */
+export function mcpResourceAnnotationsClause($) {
+  return () => {
+    $.sectionStack.push("mcpResourceAnnotationsClause");
+    const parent = $.CONSUME(AnnotationsToken); // "annotations"
+    $.CONSUME(EqualToken); // "="
+
+    const captured = {};
+    $.SUBRULE($.schemaParseObjectFn, {
+      ARGS: [
+        parent,
+        {
+          "audience?": ["[string]"],
+          "priority?": "[number]",
+          "last_modified?": "[string]",
+        },
+        captured,
+      ],
+    });
+
+    $.ACTION(() => {
+      for (const role of captured.audience?.value || []) {
+        const roleToken = role?.value;
+        const value = stringValue(roleToken);
+        if (value === null) continue;
+        if (!RESOURCE_AUDIENCES.includes(value)) {
+          $.addInvalidValueError(
+            roleToken,
+            `resource annotation audience must be user or assistant — got "${value}"`,
+          );
+        }
+      }
+
+      const priorityToken = captured.priority?.value;
+      if (priorityToken) {
+        const priority = Number(priorityToken.image);
+        if (Number.isFinite(priority) && (priority < 0 || priority > 1)) {
+          $.addInvalidValueError(
+            priorityToken,
+            `resource annotation priority must be from 0 to 1 — got ${priorityToken.image}`,
+          );
+        }
+      }
+
+      const modifiedToken = captured.last_modified?.value;
+      const value = stringValue(modifiedToken);
+      if (value !== null) {
+        if (!ISO_8601.test(value) || Number.isNaN(Date.parse(value))) {
+          $.addInvalidValueError(
+            modifiedToken,
+            `resource annotation last_modified must be an ISO 8601 date, e.g. "2025-01-12T15:00:58Z"`,
+          );
+        }
+      }
+    });
+    $.sectionStack.pop();
+  };
+}

package/parser/clauses/nakedStackFn.js

@@ -2,6 +2,7 @@ import { ExclamationToken } from "../../lexer/cast.js";
 import { CommentToken } from "../../lexer/comment.js";
 import { LCurly, RCurly } from "../../lexer/control.js";
 import { NewlineToken } from "../../lexer/tokens.js";
+import { recordStatement } from "../functions/mcp/elicitLint.js";
 
 export const DEFAULT_OPTIONS = {
   allowCallStatements: false,
@@ -26,6 +27,10 @@ export function nakedStackFn($) {
         {
           ALT: () => {
             $.OPTION(() => $.CONSUME(ExclamationToken)); // optional "!" to continue on error
+            let startIdx;
+            $.ACTION(() => {
+              startIdx = $.exportLexerState() + 1;
+            });
             $.OR1([
               { ALT: () => $.SUBRULE($.aiFn) },
               { ALT: () => $.SUBRULE($.dbFn) },
@@ -37,6 +42,7 @@ export function nakedStackFn($) {
               { ALT: () => $.SUBRULE($.textFn) },
               { ALT: () => $.SUBRULE($.utilFn) },
               { ALT: () => $.SUBRULE($.realtimeFn) },
+              { ALT: () => $.SUBRULE($.mcpFn) },
               { ALT: () => $.SUBRULE($.preconditionFn) },
               { ALT: () => $.SUBRULE($.zipFn) },
               { ALT: () => $.SUBRULE($.objectFn) },
@@ -67,6 +73,8 @@ export function nakedStackFn($) {
               },
               { ALT: () => $.SUBRULE($.workflowExpectFn) },
             ]);
+            // write-before-elicit lint (see functions/mcp/elicitLint.js)
+            $.ACTION(() => recordStatement($, startIdx));
           },
         },
       ]);

package/parser/clauses/register.js

@@ -8,6 +8,12 @@ import { flexibleStringClause } from "./flexibleStringClause.js";
 import { historyClause } from "./historyClause.js";
 import { indexClause } from "./indexClause.js";
 import { inputClause } from "./inputClause.js";
+import {
+  mcpIconsClause,
+  mcpResourceAnnotationsClause,
+  mcpTitleClause,
+  mcpToolAnnotationsClause,
+} from "./mcpMetadataClauses.js";
 import { mcpServerClause } from "./mcpServerClause.js";
 import { middlewareClause } from "./middlewareClause.js";
 import { nakedStackFn } from "./nakedStackFn.js";
@@ -40,6 +46,16 @@ export const register = ($) => {
   $.inputClause = $.RULE("inputClause", inputClause($));
   $.outputClause = $.RULE("outputClause", outputClause($));
   $.mcpServerClause = $.RULE("mcpServerClause", mcpServerClause($));
+  $.mcpTitleClause = $.RULE("mcpTitleClause", mcpTitleClause($));
+  $.mcpIconsClause = $.RULE("mcpIconsClause", mcpIconsClause($));
+  $.mcpToolAnnotationsClause = $.RULE(
+    "mcpToolAnnotationsClause",
+    mcpToolAnnotationsClause($)
+  );
+  $.mcpResourceAnnotationsClause = $.RULE(
+    "mcpResourceAnnotationsClause",
+    mcpResourceAnnotationsClause($)
+  );
   $.realtimeServerClause = $.RULE(
     "realtimeServerClause",
     realtimeServerClause($)

package/parser/definitions/columnDefinition.js

@@ -142,6 +142,7 @@ export function columnDefinition($) {
     schema[getVarName(nameToken)] = {
       typeToken: inputTypeToken,
       nameToken: nameToken,
+      iterable,
     };
 
     // add the variable to the registry

package/parser/definitions/enumColumnDefinition.js

@@ -36,6 +36,7 @@ export function enumColumnDefinition($) {
     schema[getVarName(name)] = {
       typeToken: parent,
       nameToken: name,
+      iterable,
     };
 
     // ? (is it an optional field)

package/parser/definitions/objectColumnDefinition.js

@@ -41,6 +41,7 @@ export function objectColumnDefinition($) {
     schema[getVarName(name)] = {
       typeToken: parent,
       nameToken: name,
+      iterable,
     };
 
     // ? (is it an optional field)