@xano/xanoscript-language-server 12.20.0 → 12.21.0

package/README.md

@@ -1,24 +1,18 @@
-```
-██╗  ██╗███████╗    ██╗      █████╗ ███╗   ██╗ ██████╗ ██╗   ██╗ █████╗  ██████╗ ███████╗
-╚██╗██╔╝██╔════╝    ██║     ██╔══██╗████╗  ██║██╔════╝ ██║   ██║██╔══██╗██╔════╝ ██╔════╝
- ╚███╔╝ ███████╗    ██║     ███████║██╔██╗ ██║██║  ███╗██║   ██║███████║██║  ███╗█████╗
- ██╔██╗ ╚════██║    ██║     ██╔══██║██║╚██╗██║██║   ██║██║   ██║██╔══██║██║   ██║██╔══╝
-██╔╝ ██╗███████║    ███████╗██║  ██║██║ ╚████║╚██████╔╝╚██████╔╝██║  ██║╚██████╔╝███████╗
-╚═╝  ╚═╝╚══════╝    ╚══════╝╚═╝  ╚═╝╚═╝  ╚═══╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚══════╝
-
-███████╗███████╗██████╗ ██╗   ██╗███████╗██████╗
-██╔════╝██╔════╝██╔══██╗██║   ██║██╔════╝██╔══██╗
-███████╗█████╗  ██████╔╝██║   ██║█████╗  ██████╔╝
-╚════██║██╔══╝  ██╔══██╗╚██╗ ██╔╝██╔══╝  ██╔══██╗
-███████║███████╗██║  ██║ ╚████╔╝ ███████╗██║  ██║
-╚══════╝╚══════╝╚═╝  ╚═╝  ╚═══╝  ╚══════╝╚═╝  ╚═╝
-```
-
 # XanoScript Language Server
 
-A Language Server Protocol (LSP) implementation for [XanoScript](https://xano.com), built on [Chevrotain](https://chevrotain.io/).
+The [Language Server Protocol](https://microsoft.github.io/language-server-protocol/) implementation for XanoScript, the language that describes a [Xano](https://www.xano.com) backend: its APIs, functions, tables, tasks, agents, MCP servers and policies.
 
-Maintained by the [Xano](https://xano.com) team.
+Xano is one platform to build, run and govern AI-built software. This server brings the platform's rules into the editor, so you and your coding agent see the problems a push would refuse while you write the code.
+
+Built on [Chevrotain](https://chevrotain.io/) and maintained by the Xano team.
+
+## Features
+
+- **Diagnostics** - Errors and warnings as you type, including cross-file references, variable usage and workspace policy checks
+- **Completion** - Context-aware suggestions, triggered by `.`, `:`, `$` and `|`
+- **Hover** - Documentation for statements, filters, input variables and policy checks
+- **Go to definition** - Jump to a referenced function, task, query or table, or to where a variable is set
+- **Semantic highlighting** - Token-based highlighting for every XanoScript construct
 
 ## Installation
 
@@ -26,155 +20,100 @@ Maintained by the [Xano](https://xano.com) team.
 npm install @xano/xanoscript-language-server
 ```
 
-**Requirements:** Node.js 20+
+Requires Node.js 20 or later.
 
-## Features
+## Usage
+
+The package ships two entry points:
 
-The language server provides full LSP support including:
+| Entry point | Runtime | Transport |
+|---|---|---|
+| `server.js` | Node.js | stdio / IPC, via `vscode-languageserver/node` |
+| `language-server-worker.js` | Browser (Web Worker) | `postMessage`, via `vscode-languageserver/browser` |
 
-- **Code Completion** - Context-aware suggestions triggered by `.`, `:`, `$`, and `|`
-- **Syntax Highlighting** - Semantic token-based highlighting for XanoScript constructs
-- **Hover Information** - Documentation and type information on hover
-- **Diagnostics** - Real-time error detection and reporting
+Point any LSP client at `server.js` for `.xs` files. For example, with VS Code's `vscode-languageclient`:
 
-## Supported Object Types
+```js
+const serverModule = require.resolve("@xano/xanoscript-language-server/server.js");
 
-The parser supports the following XanoScript constructs:
+const client = new LanguageClient(
+  "xanoscript",
+  "XanoScript",
+  {
+    run: { module: serverModule, transport: TransportKind.ipc },
+    debug: { module: serverModule, transport: TransportKind.ipc },
+  },
+  { documentSelector: [{ scheme: "file", language: "xanoscript" }] }
+);
+```
+
+### Policy checks
+
+XanoScript `policy` files are checked against Xano's policy check catalogue. The server ships a snapshot of it (`parser/policy/catalogueSnapshot.js`), so what it reports is a warning: your instance may be newer than the snapshot. A host that can fetch the live catalogue can load it with `setPolicyCatalogue()` from `parser/policy/catalogue.js`.
+
+## Supported object types
 
 | Type | Description |
 |------|-------------|
-| `query` | API endpoints with HTTP verbs, input validation, and responses |
-| `function` | Reusable logic blocks with testing capabilities |
-| `task` | Scheduled operations with cron-like triggers |
+| `query` | API endpoints with HTTP verbs, input validation and responses |
 | `api_group` | Collections of related API endpoints |
+| `function` | Reusable logic blocks with tests |
+| `task` | Scheduled operations with cron-like triggers |
 | `table` | Database schema definitions with column types |
-| `table_trigger` | Database table trigger definitions |
-| `workflow_test` | Test definitions for workflows |
-| `addon` | Add-on definitions |
-| `agent` | AI agent definitions |
-| `agent_trigger` | Agent trigger handlers |
-| `branch` | Branch logic |
-| `mcp_server` | MCP server definitions |
-| `mcp_server_trigger` | MCP server trigger handlers |
+| `table_trigger` | Database table triggers |
+| `workflow_test` | Workflow test definitions |
 | `middleware` | Middleware definitions |
-| `realtime_channel` | Realtime v1 channel definitions |
-| `realtime_trigger` | Realtime v1 trigger handlers |
-| `realtime_server` | Realtime v2 server definitions (the container that owns channels) |
-| `channel` | Realtime v2 channel definitions (path templates) |
+| `addon` | Add-on definitions |
+| `branch` | Branch definitions |
+| `workspace` / `workspace_trigger` | Workspace definitions and triggers |
+| `error_trigger` | Error trigger handlers |
+| `agent` / `agent_trigger` | AI agent definitions and triggers |
+| `tool` | Tool definitions, including MCP tool metadata |
+| `mcp_server` / `mcp_server_trigger` | MCP server definitions and connection triggers |
+| `prompt` / `resource` | MCP prompts and resources |
+| `policy` | Workspace policies and their rules |
+| `microservice` | Container and Helm microservice deployments |
+| `realtime_channel` / `realtime_trigger` | Realtime v1 channels and triggers |
+| `realtime_server` / `realtime_server_trigger` | Realtime v2 servers and connection triggers |
+| `channel` / `channel_trigger` | Realtime v2 channels and join/leave triggers |
 | `message` | Realtime v2 channel message handlers |
-| `channel_trigger` | Realtime v2 channel triggers (join/leave lifecycle, deliver per-recipient) |
-| `realtime_server_trigger` | Realtime v2 connection lifecycle triggers (connect/disconnect) |
-| `tool` | Tool definitions |
-| `workspace` | Workspace definitions |
-| `workspace_trigger` | Workspace trigger handlers |
-
-## Built-in Function Domains
-
-XanoScript includes functions organized by domain:
-
-- **ai** - AI and machine learning operations
-- **api** - External API calls and HTTP requests
-- **array** - Array manipulation and iteration
-- **cloud** - Cloud service integrations
-- **controls** - Flow control (conditionals, loops, etc.)
-- **db** - Database queries and operations
-- **debug** - Debugging and logging utilities
-- **expect** - Testing assertions
-- **math** - Mathematical operations
-- **object** - Object manipulation
-- **redis** - Redis cache operations
-- **schema** - Schema operations
-- **security** - Authentication and security functions
-- **storage** - File storage operations
-- **stream** - Streaming data operations
-- **text** - String manipulation
-- **util** - General utilities
-- **var** - Variable operations
-- **zip** - Compression utilities
-
-## Project Structure
+| `run` | Run job and service definitions |
 
-```
-├── server.js              # LSP server entry point
-├── lexer/                 # Lexical analysis
-│   ├── lexer.js           # Chevrotain lexer implementation
-│   ├── tokens.js          # Main token registry
-│   └── [domain].js        # Domain-specific tokens (api, db, cloud, etc.)
-├── parser/                # Syntax parsing
-│   ├── base_parser.js     # Core XanoBaseParser
-│   ├── [type]_parser.js   # Object type parsers
-│   ├── attributes/        # Field attributes (description, disabled, sensitive)
-│   ├── clauses/           # Language blocks (stack, input, response, etc.)
-│   ├── definitions/       # Type and column definitions
-│   ├── functions/         # Built-in functions by domain
-│   └── generic/           # Reusable parsing components
-├── onCompletion/          # Code completion logic
-├── onDidChangeContent/    # Diagnostics and error reporting
-├── onHover/               # Hover documentation
-└── onSemanticCheck/       # Semantic token highlighting
-```
-
-## Development
-
-```sh
-# Install dependencies
-npm install
-
-# Run all tests (~1800 tests)
-npm test
+## Built-in function domains
 
-# Run specific test
-npm test -- -g "test name"
+`ai`, `api`, `array`, `cloud`, `controls`, `datadog`, `db`, `debug`, `expect`, `math`, `mcp`, `object`, `realtime`, `redis`, `schema`, `security`, `storage`, `stream`, `text`, `util`, `var`, `zip`
 
-# Lint code
-npm run lint
+## Project structure
 
-# Fix lint issues
-npm run lint:fix
-
-# Generate TextMate language definition
-npm run tm
+```
+├── server.js                  # Node LSP entry point
+├── language-server-worker.js  # Browser (Web Worker) entry point
+├── lexer/                     # Token definitions
+├── parser/                    # Grammar rules
+│   ├── base_parser.js         # Core XanoBaseParser
+│   ├── [type]_parser.js       # One parser per object type
+│   ├── attributes/            # Field attributes (description, disabled, sensitive)
+│   ├── clauses/               # Blocks (stack, input, response, ...)
+│   ├── definitions/           # Type and column definitions
+│   ├── functions/             # Built-in statements by domain
+│   ├── generic/               # Shared parsing components
+│   └── policy/                # Policy check catalogue
+├── onCompletion/              # Completion
+├── onDefinition/              # Go to definition
+├── onDidChangeContent/        # Diagnostics
+├── onHover/                   # Hover documentation
+├── onSemanticCheck/           # Semantic tokens
+└── workspace/                 # Cross-file index and validation
 ```
 
-## Adding New Features
-
-### New Object Type
-
-1. Create a new parser in `parser/` (e.g., `my_object_parser.js`)
-2. Follow existing parser patterns (see `query_parser.js`, `function_parser.js`)
-3. Register it in `server.js`
-
-### New Keyword/Function
-
-We have a hierarchy for the different statements XanoScript uses:
-
-1. **Parser** - Top level (Query parser, Function parser, etc.)
-2. **Clause** - Main blocks in a given object type (stack, response, input, etc.)
-3. **Functions** - Statements like `debug.log` or `db.query`
-4. **Attributes/Definitions** - Components used to define functions
-5. **Generic** - Shared language toolset
-
-To add a new function:
-
-1. Add token definition in appropriate `lexer/` file
-2. Create function implementation in `parser/functions/[domain]/`
-3. Register in parent clause or parser
-4. Add comprehensive tests in corresponding `.spec.js` file
-
-## Testing
-
-The language server is heavily tested and should remain that way. Tests should be:
-
-- Easy to copy, paste, and extend
-- Straightforward and easy to read
-- Avoid dynamic generation (no loops)
+## Contributing
 
-Test files use `.spec.js` naming convention and mirror the source structure.
+This repository receives one commit per release. Development happens elsewhere, so pull requests are turned off here. Found a bug? [Open an issue](https://github.com/xano-inc/xanoscript-language-server/issues/new?template=bug_report.yml). [CONTRIBUTING.md](CONTRIBUTING.md) says what makes a report quick to fix.
 
-## CI/CD
+## Security
 
-On commit, pre-commit hooks run linting via Husky. The CI pipeline runs all tests and linting checks. Configuration is in `.github/workflows/ci.yml`.
+To report a vulnerability, see [SECURITY.md](SECURITY.md). Please don't open a public issue.
 
 ## License
 
-MIT License - see [LICENSE](LICENSE) for details.
+[MIT](LICENSE)

package/embedded/README.md

@@ -81,7 +81,7 @@ This works in any context (not just `api.lambda`), making it flexible for future
 ## Client-Side vs Server-Side
 
 - **Server-side** (this folder): JavaScript implementation used by language server
-- **Client-side** (`src/tooling/js_embedding.ts`): TypeScript implementation used by VS Code extension
+- **Client-side**: the editor extension creates the virtual documents with the same extraction logic
 - Both implement the same extraction logic but in their respective environments
 
 ## Testing
@@ -89,7 +89,6 @@ This works in any context (not just `api.lambda`), making it flexible for future
 All modules are ES6 modules and can be tested independently:
 
 ```bash
-cd language-server
 node -e "import('./embedded/embeddedContent.js').then(m => console.log(m.extractEmbeddedJS('code = \"\"\"\\nconsole.log()\\n\"\"\"')))"
 ```
 

package/lexer/mcp.js

@@ -4,9 +4,8 @@ import { createTokenByName } from "./utils.js";
 // MCP 2026-07-28 authoring keywords: the `prompt` and `resource` object kinds,
 // the tool/prompt/resource metadata keys, and the `mcp.elicit` / `mcp.progress`
 // statements, plus the per-server `oauth` block and the `mcp.oauth.complete` /
-// `mcp.oauth.request` / `mcp.oauth.revoke` statements. Grounded against cloud-client's schema DSL
-// (`script/kind/schema/core/{prompt,resource,tool,mcp_server}.yaml` and
-// `script/kind/schema/statement/mcp.{elicit,progress}.yaml`).
+// `mcp.oauth.request` / `mcp.oauth.revoke` statements. Grounded against the Xano
+// backend's XanoScript schema.
 //
 // Ordering note: a keyword with `longer_alt: Identifier` loses to an EARLIER
 // shorter token, so `prompts` must precede `prompt`, and `resource` is lexed

package/lexer/realtime_server_trigger.js

@@ -14,7 +14,7 @@ export const RealtimeServerTriggerToken = createTokenByName(
 // longer_alt lists the trigger token so `realtime_server_trigger` wins over the
 // shorter `realtime_server` prefix, AND Identifier so a name that merely EXTENDS
 // the keyword (e.g. `realtime_server_0`, the default scaffold name) tokenizes as
-// one identifier instead of keyword + leftover `_0` (DEV-7582). longer_alt is not
+// one identifier instead of keyword + leftover `_0`. longer_alt is not
 // transitive, so Identifier must be listed here directly — matching the
 // [ServerDetailsToken, Identifier] precedent in channel.js.
 export const RealtimeServerToken = createTokenByName("realtime_server", {

package/onHover/functions.md

@@ -1985,10 +1985,13 @@ Removes characters (default is whitespace, or as specified by `value`) from both
 throw {
   name = "ValidationError"
   value = "Invalid user input provided"
+  status = 400
 }
 ```
 
-Throws an error and halts the script’s execution immediately. The `name` parameter specifies the error type (e.g., `"ValidationError"`), and `value` provides a custom error message to describe the issue.
+Throws an error and halts the script’s execution immediately. The `name` parameter specifies the error type (e.g., `"ValidationError"`), and `value` provides a custom error message to describe the issue. A `try_catch` can catch it.
+
+`status` (optional, a whole number from 100 to 599) is the HTTP status the request answers with when nothing catches the throw, including a throw inside a function run with `function.run`. Without it, an uncaught throw answers 200. A caught throw never changes the status.
 
 # try_catch
 

package/package.json

@@ -1,7 +1,14 @@
 {
   "name": "@xano/xanoscript-language-server",
-  "version": "12.20.0",
-  "description": "Language Server Protocol implementation for XanoScript",
+  "version": "12.21.0",
+  "description": "Language Server Protocol implementation for XanoScript, the language of Xano backends",
+  "keywords": [
+    "xano",
+    "xanoscript",
+    "language-server",
+    "lsp",
+    "chevrotain"
+  ],
   "type": "module",
   "main": "server.js",
   "files": [
@@ -31,14 +38,17 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/xano-labs/xs-language-server.git"
+    "url": "git+https://github.com/xano-inc/xanoscript-language-server.git"
   },
   "author": "Xano <support@xano.com>",
   "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
   "bugs": {
-    "url": "https://github.com/xano-labs/xs-language-server/issues"
+    "url": "https://github.com/xano-inc/xanoscript-language-server/issues"
   },
-  "homepage": "https://github.com/xano-labs/xs-language-server#readme",
+  "homepage": "https://github.com/xano-inc/xanoscript-language-server#readme",
   "scripts": {
     "test-one": "mocha",
     "test": "mocha \"**/*.spec.js\"",

package/parser/clauses/historyClause.js

@@ -5,8 +5,7 @@ import { HistoryToken } from "../../lexer/tokens.js";
 /**
  * Parses the history clause.
  *
- * `history` mirrors the backend serializer (cloud-client
- * helper/script/transform via `Transform::onSchemaRequestHistory`): the value is
+ * `history` mirrors the backend serializer: the value is
  * `false` (disabled), `"inherit"` (hand-authored sentinel), `"all"` (unbounded),
  * or ANY non-negative integer message limit — not a fixed set of magic numbers.
  * It is split across two OR branches because `schemaParseEnumFn` refuses an enum

package/parser/clauses/mcpMetadataClauses.js

@@ -7,10 +7,8 @@ import { AnnotationsToken, IconsToken, TitleToken } from "../../lexer/mcp.js";
 import { MultiLineStringToken } from "../../lexer/multiline.js";
 
 // Shared MCP metadata blocks for `tool`, `prompt` and `resource` (MCP spec
-// 2026-07-28). The rules mirror cloud-client's decode checks so the editor
-// reports what a push would refuse:
-//   - `helper/mvp/mcpserver/ToolMetadata.php` (icons, tool annotations)
-//   - `helper/script/transform/Resource.php` (resource annotations)
+// 2026-07-28). The rules mirror the Xano backend's decode checks (icons, tool annotations,
+// resource annotations) so the editor reports what a push would refuse.
 
 export const ICON_MIME_TYPES = ["image/png", "image/jpeg", "image/webp"];
 export const ICON_URL_MAX_LENGTH = 2048;
@@ -19,7 +17,7 @@ export const RESOURCE_AUDIENCES = ["user", "assistant"];
 
 const ICON_SCHEMA = {
   src: "[string]",
-  // validated below: cloud-client compares it lowercased and allows ""
+  // validated below: the backend compares it lowercased and allows ""
   "mime_type?": "[string]",
   "sizes?": ["[string]"],
   "theme?": ["light", "dark"],
@@ -47,7 +45,7 @@ function stringValue(token) {
 }
 
 /**
- * Why an icon `src` is refused, or null. Same rules as ToolMetadata::srcProblem:
+ * Why an icon `src` is refused, or null. Same rules as the platform:
  * `https:` or a base64 `data:` URI of png/jpeg/webp. SVG and every other scheme
  * (`http:`, `javascript:`, `file:`, ...) are refused.
  * @param {string} src

package/parser/definitions/dbLinkColumnDefinition.js

@@ -13,7 +13,7 @@ export function dbLinkColumnDefinition($) {
         parentToken,
         {
           table: "[string]",
-          "override?": { "[string]": { hidden: "[boolean]" } },
+          "override?": { "[string]": { "hidden?": "[boolean]", "required?": "[boolean]" } },
         },
       ],
     });

package/parser/functions/controls/throwFn.js

@@ -1,4 +1,25 @@
 import { ThrowToken } from "../../../lexer/control.js";
+import { IntegerLiteral } from "../../../lexer/literal.js";
+
+/**
+ * `status` is the HTTP status an UNCAUGHT throw answers with
+ * (mvp:throw_error, `status?: static:int`).
+ * It is a static integer from 100 to 599, never an expression, so a variable
+ * or an out-of-range number is caught in the editor rather than at run time.
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+function statusValue($) {
+  const token = $.CONSUME(IntegerLiteral, {
+    ERR_MSG: "status must be a whole number from 100 to 599",
+  });
+  const value = Number(token.image);
+  if (!Number.isInteger(value) || value < 100 || value > 599) {
+    $.addInvalidValueError(
+      token,
+      `Invalid status ${token.image}. Must be a whole number from 100 to 599`,
+    );
+  }
+}
 
 /**
  * represent $var.x or $x, the only format accepting an assigment
@@ -6,14 +27,19 @@ import { ThrowToken } from "../../../lexer/control.js";
  */
 export function throwFn($) {
   const requiredAttrs = ["value", "name"];
-  const optionalAttrs = ["description", "disabled"];
+  const optionalAttrs = ["description", "disabled", "status"];
 
   return () => {
     $.sectionStack.push("throw");
     const tokenFn = $.CONSUME(ThrowToken); // "throw"
     // value is a required field
     $.SUBRULE($.functionAttrReq, {
-      ARGS: [tokenFn, requiredAttrs, optionalAttrs],
+      ARGS: [
+        tokenFn,
+        requiredAttrs,
+        optionalAttrs,
+        { types: { status: statusValue } },
+      ],
     });
 
     $.sectionStack.pop();

package/parser/functions/mcp/mcpElicitFn.js

@@ -13,7 +13,7 @@ import { checkElicit } from "./elicitLint.js";
 //   }
 // } as $answer
 //
-// Asks the MCP client for input (cloud-client mvp:mcp_elicit). Input is only
+// Asks the MCP client for input. Input is only
 // collected from 2026-07-28 clients with form elicitation; every other client
 // (and a non-MCP run) resolves to {action: "cancel"}. The `input` block is the
 // same grammar as a tool's `input` block.

package/parser/functions/mcp/mcpOauthFn.js

@@ -5,7 +5,7 @@ import { CompleteToken, OauthToken, RevokeToken } from "../../../lexer/mcp.js";
 import { DotToken, NewlineToken } from "../../../lexer/tokens.js";
 import { getVarName } from "../../generic/utils.js";
 
-// The values cloud-client's mvp:mcp_oauth_complete accepts for `decision`.
+// The values `mcp.oauth.complete` accepts for `decision`.
 const DECISIONS = ["approve", "deny"];
 
 /**
@@ -35,9 +35,7 @@ function decisionValue($, identifier) {
   $.SUBRULE5($.expressionFn, { ARGS: [identifier, {}] });
 }
 
-// The `mcp.oauth.*` login hand-off statements (cloud-client
-// mvp:mcp_oauth_{complete,request,revoke}, kind schemas
-// statement/mcp.oauth.{complete,request,revoke}.yaml). Each takes an optional
+// The `mcp.oauth.*` login hand-off statements. Each takes an optional
 // `as $var` binding.
 
 /**

package/parser/functions/mcp/mcpProgressFn.js

@@ -6,8 +6,8 @@ import { ProgressToken } from "../../../lexer/mcp.js";
 //   message = "Working"  // optional
 // }
 //
-// Emits `notifications/progress` on the current MCP response stream
-// (cloud-client mvp:mcp_progress). A value that does not strictly increase is
+// Emits `notifications/progress` on the current MCP response stream.
+// A value that does not strictly increase is
 // dropped at run time. NO `as $var` binding.
 
 /**

package/parser/functions/realtime/realtimePublishFn.js

@@ -9,8 +9,8 @@ import { PublishToken } from "../../../lexer/realtime.js";
 //   auth_id = $auth.id        // optional
 // }
 //
-// Injects a server-authored event onto a realtime v2 channel (cloud-client
-// mvp:realtime_publish). `realtime_server` + `channel` + `data` are required;
+// Injects a server-authored event onto a realtime v2 channel.
+// `realtime_server` + `channel` + `data` are required;
 // `message`/`auth_table`/`auth_id` are optional. Flat attrs (the PHP transform
 // maps auth_table/auth_id into the nested context.auth.{dbo_id,row_id} shape).
 // Unlike realtime.get_session it has NO `as $var` binding.

package/parser/mcp_primitive_parser.js

@@ -11,7 +11,7 @@ import { getVarName } from "./generic/utils.js";
 
 // First-class MCP `prompt` and `resource` workspace objects (MCP 2026-07-28),
 // attached to an `mcp_server` through its `prompts` / `resources` blocks.
-// Grounded against cloud-client's `script/kind/schema/core/{prompt,resource}.yaml`.
+// Grounded against the Xano backend's XanoScript schema.
 //
 //   prompt code_review {                 resource regional_order {
 //     title = "Code review"                uri = "orders://{region}/{order_id}"
@@ -22,7 +22,7 @@ import { getVarName } from "./generic/utils.js";
 //   }                                      response = $order
 //                                        }
 
-/** The input field types a resource uri variable can be bound to (ResourceUri::VARIABLE_TYPES). */
+/** The input field types a resource uri variable can be bound to. */
 export const RESOURCE_URI_VARIABLE_TYPES = [
   "text",
   "int",
@@ -39,7 +39,7 @@ const MIME_TYPE =
 
 /**
  * Parse a resource uri: a literal URI, or an RFC 6570 LEVEL-1 template.
- * Mirrors cloud-client's `ResourceUri::parse`.
+ * Mirrors the backend's resource URI parser.
  * @param {string} uri
  * @returns {{ problem: string|null, variables: string[] }}
  */
@@ -103,7 +103,7 @@ export function parseResourceUri(uri) {
 
 /**
  * Why a resource's uri variables and its input block disagree, or null.
- * Mirrors cloud-client's `ResourceUri::inputProblem`.
+ * Mirrors the backend's check that URI variables match `input`.
  * @param {string[]} variables
  * @param {Object<string, {type: string, iterable: boolean}>} inputs
  * @returns {string|null}

package/parser/mcp_server_parser.js

@@ -98,8 +98,7 @@ export function mcpServerDeclaration($) {
           },
         },
         {
-          // Per-server OAuth (cloud-client mcp_server.yaml `oauth`; values are
-          // validated server-side by helper/mvp/mcpoauth/OauthConfig.php).
+          // Per-server OAuth (values are validated server-side).
           // An assignment block like a channel's `publish`. mcp_server ONLY:
           // deliberately absent from agent_parser.js. Mode-specific rules
           // (hosted needs login_url, external needs issuer, ...) stay

package/parser/message_parser.js

@@ -82,8 +82,8 @@ export function messageDeclaration($) {
           },
         },
         {
-          // backend Message.php `encode()` emits `docs = "..."` for a
-          // documented message; round-tripped by `decode()`. See DEV-7620.
+          // the backend emits `docs = "..."` for a
+          // documented message; round-tripped on push.
           GATE: () => !hasDocs,
           ALT: () => {
             hasDocs = true;
@@ -91,7 +91,7 @@ export function messageDeclaration($) {
           },
         },
         {
-          // backend Message.php `encode()` emits `active = false` for a
+          // the backend emits `active = false` for a
           // disabled message; mirrors the sibling `channel` declaration.
           GATE: () => !hasActive,
           ALT: () => {

package/parser/microservice_parser.js

@@ -25,8 +25,7 @@ import { Identifier, NewlineToken, TypeToken } from "../lexer/tokens.js";
 
 // Grammar for the top-level `microservice <name> { ... }` entity.
 //
-// Grounded against cloud-client's authoritative XanoScript schema DSL
-// (extensions/MVP/includes/xano/script/kind/schema/{core,component}/*.yaml):
+// Grounded against the Xano backend's XanoScript schema:
 //
 //   microservice <name> {
 //     description|guid|kind|tenant_deploy = "..."   # static:text (optional)

package/parser/parser.js

@@ -80,7 +80,7 @@ export function xanoscriptParser(text, scheme, preTokenized = null) {
       }
       for (const error of lexResult.errors) {
         // The platform names the first character it cannot read; the lexer skips a run of them.
-        // Quoted as PHP's escapeshellarg quotes it (Unexpected.php): a `'` is written `'\''`.
+        // Quoted as PHP's escapeshellarg quotes it: a `'` is written `'\''`.
         const first = String.fromCodePoint(text.codePointAt(error.offset)).replaceAll("'", "'\\''");
         parser.addInvalidValueError({
           image: text.slice(error.offset, error.offset + error.length),

package/parser/policy/catalogue.js

@@ -9,7 +9,7 @@
  * language server checks the policy's block shape only.
  *
  * A host fills it:
- *   - Studio sends its own live answer (`source: "live"`); a check-level problem is then an
+ *   - The Xano editor sends its own live answer (`source: "live"`); a check-level problem is then an
  *     error, because the instance refuses the same save.
  *   - The Node server and offline tools load the generated snapshot (`catalogueSnapshot.js`,
  *     `source: "snapshot"`); a check-level problem is then a warning, because the snapshot can
@@ -30,7 +30,7 @@ let version = 0;
 
 /**
  * Replace the catalogue.
- * @param {Object|Object[]|null} catalogue `{items, document}` as the platform serves it, Studio's
+ * @param {Object|Object[]|null} catalogue `{items, document}` as the platform serves it, the editor's
  *   `{checks, document}`, or a bare list of checks; null clears it
  * @param {{source?: "live"|"snapshot", generatedAt?: string|null}} [options]
  */

package/parser/policy/policyLiteral.js

@@ -45,7 +45,7 @@ export const isA = (token, type) => !!token && tokenMatcher(token, type);
 /** A catalogue entry's own property, never an inherited one (`constructor`, `toString`). */
 export const own = (object, key) => object && Object.hasOwn(object, key) ? object[key] : undefined;
 
-/** Native Parser::stripQuotes: double quotes use C escapes, single quotes only \\ and \'. */
+/** As the platform reads a string: double quotes use C escapes, single quotes only \\ and \'. */
 export function policyStringValue(image) {
   if (image.startsWith('"""') || image.startsWith("'''")) {
     return image.slice(3, -3).replace(/^\r?\n/, "").replace(/\r?\n[ ]*$/, "");

package/parser/policy/validatePolicyRule.js

@@ -6,8 +6,7 @@ import { policyLiteralValue } from "./policyLiteral.js";
  * Everything here is read from the catalogue the host loaded (see `catalogue.js`): the check
  * ids, each check's params with their types, closed value sets, nested fields, `required`,
  * `requires_one_of`, `minimum` and `non_empty`, and the scope fields that apply to it. Nothing
- * names a check. The findings are worded like the platform's refusals (`Registry::validateParams`,
- * `coerce`, `unknownCheck`) without their `rule[i] ("KEY.Rn"): params:` prefix, since a diagnostic
+ * names a check. The findings are worded like the platform's refusals without their `rule[i] ("KEY.Rn"): params:` prefix, since a diagnostic
  * already points at the place; they are a preview, and the platform's own answer on save decides.
  * Where the platform stops at the first refusal, this reports every problem, one per param.
  *
@@ -15,17 +14,17 @@ import { policyLiteralValue } from "./policyLiteral.js";
  * holds at most `STRING_MAX_LENGTH` characters, and a name longer than `NEAREST_MAX_LENGTH` bytes
  * gets no near miss.
  *
- * Check-specific rules the catalogue does not publish (`Check::validate`, `authoredRefusal`,
+ * Check-specific rules the catalogue does not publish (per-check validation,
  * renamed ids and params, statement wildcards) are left to the platform.
  *
  * Whether a value is a literal at all, and duplicate names, are the block's shape, not the
  * catalogue's: the parser reports those (policy_parser.js) and this skips such values.
  */
 
-/** `Registry::STRING_MAX_LENGTH`: the longest string a string or string[] param may hold, in characters. */
+/** The platform's limit on the longest string a string or string[] param may hold, in characters. */
 const STRING_MAX_LENGTH = 1024;
 
-/** `Registry::NEAREST_MAX_LENGTH`: the longest name, in bytes, a near miss is looked for. */
+/** The platform's limit on the longest name, in bytes, a near miss is looked for. */
 const NEAREST_MAX_LENGTH = 128;
 
 /** Edit distance, as PHP's `levenshtein` (insert, delete and replace all cost 1). */
@@ -49,7 +48,7 @@ function levenshtein(a, b) {
 }
 
 /**
- * The closest names to a misspelling, nearest first, at most two (`Registry::nearest`): within
+ * The closest names to a misspelling, nearest first, at most two, as the platform suggests them: within
  * three edits, or one containing the other. A name longer than `NEAREST_MAX_LENGTH` bytes gets
  * none, since edit distance costs the product of the two lengths per candidate.
  * @param {string} wanted
@@ -79,7 +78,7 @@ export function didYouMean(name, candidates) {
   return near.length ? `Did you mean ${near.map((n) => `"${n}"`).join(" or ")}? ` : "";
 }
 
-/** `Registry::provided`: set when not null/false, not an empty or blank string, not an empty list or object. */
+/** Whether a param counts as provided: set when not null/false, not an empty or blank string, not an empty list or object. */
 function provided(value) {
   if (value === null || value === undefined || value === false) return false;
   if (typeof value === "string") return value.trim() !== "";
@@ -89,7 +88,7 @@ function provided(value) {
 }
 
 /**
- * A param's value as the platform validates it (`Registry::validateParams`): one left out, or written
+ * A param's value as the platform validates it: one left out, or written
  * as `null` when its type is not `any`, is its default.
  */
 const inForce = (literal, schema, name) =>
@@ -107,7 +106,7 @@ export function unknownCheckMessage(id, ids) {
 }
 
 /**
- * `Registry::coerce`: whether a value has its param's declared type and values.
+ * Whether a value has its param's declared type and values.
  * @returns {{token: Object, message: string}|null}
  */
 function coerce(node, spec, checkId, name) {
@@ -124,7 +123,7 @@ function coerce(node, spec, checkId, name) {
       if (!whole || (minimum !== undefined && node.value < minimum)) {
         return fail(`be a whole number${minimum !== undefined ? ` of at least ${minimum}` : ""}`);
       }
-      // `Registry::INTEGER_MAX`: past 2^53 - 1 a whole number is no longer exact.
+      // The platform's integer limit: past 2^53 - 1 a whole number is no longer exact.
       if (Math.abs(node.value) > Number.MAX_SAFE_INTEGER) {
         return fail(`be a whole number no larger than ${Number.MAX_SAFE_INTEGER}`);
       }
@@ -188,7 +187,7 @@ function closedProperties(spec) {
 
 /**
  * Why a set scope field cannot change what a rule of this check selects, or null when it can,
- * read from the check's published `scope_fields` (the same reading as Studio's rule form).
+ * read from the check's published `scope_fields` (the same reading as the Xano editor's rule form).
  */
 function inapplicableScope(check, name, literal) {
   const field = (check.scope_fields ?? []).find((item) => item?.name === name);

package/parser/policy_parser.js

@@ -21,10 +21,10 @@ import { didYouMean, validatePolicyRule } from "./policy/validatePolicyRule.js";
 //     rule { <field> = <literal> } # repeating; `check` names a catalogue item, `params` its params
 //   }
 //
-// with the comment, named-rule and literal-value rules of cloud-client's Script.php. It knows no
+// with the comment, named-rule and literal-value rules the platform enforces. It knows no
 // field: which fields a policy and a rule may set, their types, value sets and defaults, the retired
 // fields and reserved blocks, the key pattern and when a rule is required all come from the
-// catalogue's `document` (helper/mvp/policy/Document.php), and every check from its `items`. With no
+// catalogue's `document`, and every check from its `items`. With no
 // catalogue loaded, only the shape is checked. See parser/policy/catalogue.js.
 
 /** The platform's refusal of a named rule, after its `rule[<i>]: ` prefix. */
@@ -287,7 +287,7 @@ function fieldProblem(name, node, spec) {
 }
 
 /**
- * A rule's params: an object of literal values (Script::literal; a name written twice is already
+ * A rule's params: an object of literal values (a name written twice is already
  * reported by the object grammar). The catalogue then says what the object may hold.
  */
 function checkParamsShape(node, report) {

package/parser/realtime_channel_parser.js

@@ -33,7 +33,7 @@ export function realtimeChannelDeclaration($) {
             anonymous_clients: "[boolean]",
             nested_channels: "[boolean]",
             // The CLI pull emits `message_history: history ?? 0` (an arbitrary
-            // integer — see cloud-client RealtimeChannel.php `onSettings`), so
+            // integer), so
             // accept any numeric value rather than a fixed enum. Kept typed
             // ("[number]") so a non-numeric value still surfaces a diagnostic.
             message_history: "[number]",