@xanots/sdk 0.0.1

package/dist/chunk-3DUAGYGP.js

@@ -0,0 +1,1550 @@
+import {
+  DECODE_ONLY_STATEMENTS,
+  DiagnosticBag,
+  FILTER_NAMES,
+  SCALAR_FAMILY,
+  assertMockKeysResolved,
+  buildBundle,
+  encodeObject,
+  getKind,
+  isQueryExpressionFilter,
+  isSeedFileSource,
+  middlewareEntryGuid,
+  stackReferencesAuth,
+  tableColumns
+} from "./chunk-EMCAWMHC.js";
+import {
+  CANONICAL_PAYLOAD_KEYS,
+  REFERENCEABLE_KINDS,
+  WORKSPACE_KEY,
+  deriveGuid,
+  guidSeedHint,
+  lockKey,
+  mintCanonical,
+  recordObserved,
+  resolveRef
+} from "./chunk-4HT3BNZ7.js";
+
+// src/workspace/seed-coerce.ts
+function coerceScalarValue(label, column, type, value, values) {
+  if (value === null) return null;
+  switch (SCALAR_FAMILY[type]) {
+    case "int":
+    case "decimal": {
+      if (typeof value === "number" && Number.isFinite(value)) return value;
+      if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) {
+        return Number(value);
+      }
+      throw located(label, column, type, value, "a number");
+    }
+    case "epochms": {
+      if (typeof value === "number" && Number.isFinite(value)) return value;
+      if (value instanceof Date) return value.getTime();
+      if (typeof value === "string") {
+        const ms = Date.parse(value);
+        if (Number.isFinite(ms)) return ms;
+      }
+      throw located(label, column, type, value, "an epoch-ms number, a Date, or a date string");
+    }
+    case "bool": {
+      if (typeof value === "boolean") return value;
+      if (value === "true" || value === 1) return true;
+      if (value === "false" || value === 0) return false;
+      throw located(label, column, type, value, "a boolean");
+    }
+    case "text": {
+      if (typeof value === "string") return value;
+      throw located(label, column, type, value, "a string");
+    }
+    case "enum": {
+      if (!values || values.length === 0) return value;
+      if (values.includes(value)) return value;
+      const allowed = values.map((v) => JSON.stringify(v)).join(", ");
+      throw new Error(
+        `${label}, column "${column}" (enum): ${JSON.stringify(value)} is not one of its declared values (${allowed}). Fix the seed value or add it to the column's enum.`
+      );
+    }
+    default:
+      assertJsonCarryable(label, column, type, value);
+      return value;
+  }
+}
+function assertJsonCarryable(label, column, type, value) {
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (node, path) => {
+    if (typeof node === "number") {
+      if (Number.isFinite(node)) return;
+      throw jsonRefusal(
+        label,
+        column,
+        type,
+        path,
+        `${node} is not a finite number`,
+        "JSON has no NaN or Infinity, so it would ship as `null` and the column would import empty"
+      );
+    }
+    if (typeof node === "bigint") {
+      throw jsonRefusal(
+        label,
+        column,
+        type,
+        path,
+        "a BigInt",
+        "JSON cannot carry one \u2014 convert it to a number or a string first"
+      );
+    }
+    if (typeof node === "function" || typeof node === "symbol") {
+      throw jsonRefusal(
+        label,
+        column,
+        type,
+        path,
+        `a ${typeof node}`,
+        "JSON drops it, so the key would vanish from the imported row"
+      );
+    }
+    if (node === null || typeof node !== "object") return;
+    if (seen.has(node)) {
+      throw jsonRefusal(
+        label,
+        column,
+        type,
+        path,
+        "a circular reference",
+        "JSON cannot carry one \u2014 the archive would fail to serialize"
+      );
+    }
+    seen.add(node);
+    if (Array.isArray(node)) {
+      node.forEach((el, i) => walk(el, `${path}[${i}]`));
+    } else {
+      for (const [key, member] of Object.entries(node)) walk(member, `${path}.${key}`);
+    }
+    seen.delete(node);
+  };
+  walk(value, `"${column}"`);
+}
+function jsonRefusal(label, column, type, path, got, why) {
+  return new Error(
+    `${label}, column "${column}" (${type}): ${path} is ${got}. ${why}. Seed rows are carried to the engine as JSON \u2014 fix the value or the column type.`
+  );
+}
+function coerceColumnValue(label, col, value) {
+  if (value === null) return null;
+  if (col.array) {
+    if (!Array.isArray(value)) throw located(label, col.name, `${col.type}[]`, value, "an array");
+    return value.map(
+      (el, j) => coerceScalarValue(label, `${col.name}[${j}]`, col.type, el, col.values)
+    );
+  }
+  return coerceScalarValue(label, col.name, col.type, value, col.values);
+}
+function located(label, column, type, value, expected) {
+  const got = value instanceof Date ? "Date" : Array.isArray(value) ? "array" : typeof value;
+  return new Error(
+    `${label}, column "${column}" (${type}): expected ${expected}, got ${got} (${JSON.stringify(value)}). Fix the seed value or the column type.`
+  );
+}
+function coerceSeedRowValues(tableName, columns, rows) {
+  const colByName = new Map(columns.map((c) => [c.name, c]));
+  return rows.map((row, i) => {
+    const label = `table "${tableName}", seed row ${i}`;
+    if (row === null || typeof row !== "object" || Array.isArray(row)) {
+      throw new Error(`${label}: expected a row object, got ${Array.isArray(row) ? "array" : typeof row}.`);
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(row)) {
+      if (value === void 0) continue;
+      const col = colByName.get(key);
+      if (col === void 0) {
+        const known = columns.map((c) => c.name).join(", ");
+        throw new Error(
+          `${label}: unknown column "${key}" (not in table schema). Known columns: ${known}.`
+        );
+      }
+      out[key] = coerceColumnValue(label, col, value);
+    }
+    return out;
+  });
+}
+function assertSeedIds(tableName, columns, rows) {
+  const idType = columns.find((c) => c.name === "id")?.type;
+  if (idType !== "int" && idType !== "uuid") return false;
+  const withId = rows.filter((r) => r.id !== void 0).length;
+  if (withId === rows.length) return false;
+  if (withId !== 0) {
+    const fill = idType === "int" ? "auto-numbered 1..N" : "assigned a generated uuid";
+    throw new Error(
+      `table "${tableName}": ${withId} of ${rows.length} seed rows set \`id\` and the rest omit it. The engine preserves seed ids and won't auto-fill a missing one, so a mix collides on the primary key. Provide \`id\` for every seed row, or none (they'll be ${fill}).`
+    );
+  }
+  return true;
+}
+
+// src/workspace/guards.ts
+var BULK_UPDATE = "mvp:dbo_bulkupdate";
+var DB_GET = "mvp:dbo_getby";
+var SYSTEM_COLUMNS = /* @__PURE__ */ new Set(["id", "created_at"]);
+function walkNodes(root, visit) {
+  const stack = [root];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (Array.isArray(node)) {
+      for (let i = node.length - 1; i >= 0; i--) stack.push(node[i]);
+      continue;
+    }
+    if (!node || typeof node !== "object") continue;
+    const record = node;
+    visit(record);
+    const values = Object.values(record);
+    for (let i = values.length - 1; i >= 0; i--) stack.push(values[i]);
+  }
+}
+function collectStatements(node, out) {
+  walkNodes(node, (record) => {
+    if (typeof record.name === "string" && record.name.startsWith("mvp:")) {
+      out.push(record);
+    }
+  });
+}
+function statementInput(statement, name) {
+  if (!Array.isArray(statement.input)) return void 0;
+  return statement.input.find(
+    (entry) => entry?.name === name
+  );
+}
+function statementTableGuid(statement) {
+  const id = statement.context?.dbo?.id;
+  return typeof id === "string" ? id : void 0;
+}
+function checkBulkUpdate(statement, owner, tablesByGuid, bag) {
+  const guid = statementTableGuid(statement);
+  const def = guid === void 0 ? void 0 : tablesByGuid.get(guid);
+  if (!def) return;
+  const items = statementInput(statement, "items");
+  if (typeof items?.tag !== "string" || !items.tag.startsWith("const")) return;
+  if (typeof items.value !== "string") return;
+  let parsed;
+  try {
+    parsed = JSON.parse(items.value);
+  } catch {
+    return;
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) return;
+  const supplied = /* @__PURE__ */ new Set();
+  for (const item of parsed) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return;
+    for (const key of Object.keys(item)) supplied.add(key);
+  }
+  if (supplied.size === 0) return;
+  const cleared = tableColumns(def).map((col) => col.name).filter((name) => !SYSTEM_COLUMNS.has(name) && !supplied.has(name));
+  if (cleared.length === 0) return;
+  bag.warn(
+    "db.bulk-update-partial-item",
+    `${owner}: \`s.db.bulk.update\` on table "${def.name}" is a full-row REPLACE, and these items omit ${cleared.map((n) => `"${n}"`).join(", ")} \u2014 each omitted column is written to its zero value ("" / 0 / null), not left alone, with an HTTP 200 and no error. Use \`s.db.bulk.patch\` to write only the keys an item carries, or supply every column you mean to preserve. (Only a static \`items\` array is checked; a \`ref\` cannot be.)`
+  );
+}
+function outputColumns(statement) {
+  const output = statement.output;
+  if (!output || output.customize !== true || !Array.isArray(output.items)) return void 0;
+  const names = /* @__PURE__ */ new Set();
+  for (const item of output.items) {
+    const name = item?.name;
+    if (typeof name === "string") names.add(name);
+  }
+  return names;
+}
+function collectVarRefs(node, out) {
+  walkNodes(node, (record) => {
+    if (record.tag !== "var") return;
+    if (typeof record.value === "string") out.push(record.value);
+    if (typeof record.operand === "string") out.push(record.operand);
+  });
+}
+function checkInternalColumnReads(statements, owner, tablesByGuid, bag) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const statement of statements) {
+    if (statement.name !== DB_GET) continue;
+    const as = statement.as;
+    if (typeof as !== "string" || as === "") continue;
+    const guid = statementTableGuid(statement);
+    const def = guid === void 0 ? void 0 : tablesByGuid.get(guid);
+    if (!def) continue;
+    bindings.set(as, { def, output: outputColumns(statement) });
+  }
+  if (bindings.size === 0) return;
+  const refs = [];
+  for (const statement of statements) collectVarRefs(statement, refs);
+  const reported = /* @__PURE__ */ new Set();
+  for (const path of refs) {
+    const dot = path.indexOf(".");
+    if (dot <= 0) continue;
+    const root = path.slice(0, dot);
+    const column = path.slice(dot + 1);
+    const binding = bindings.get(root);
+    if (!binding || binding.output?.has(column)) continue;
+    const col = tableColumns(binding.def).find((c) => c.name === column);
+    if (!col || col.access !== "internal") continue;
+    if (reported.has(path)) continue;
+    reported.add(path);
+    bag.warn(
+      "db.internal-column-read",
+      `${owner}: reads \`ref("${path}")\`, but "${column}" on table "${binding.def.name}" is \`access: "internal"\` and a \`db.get\` does not return it \u2014 the row has no "${column}" key, so this fails at runtime with \`Unable to locate var: ${path}\`. Name the column in \`output\` on that \`db.get\` (\`output\` overrides column visibility), e.g. \`output: ["id", "${column}"]\`.`
+    );
+  }
+}
+function collectInputRefs(node, out) {
+  walkNodes(node, (record) => {
+    if (record.tag !== "input") return;
+    if (typeof record.value === "string") out.push(record.value);
+    if (typeof record.operand === "string") out.push(record.operand);
+  });
+}
+function declaredInputNames(record) {
+  const names = /* @__PURE__ */ new Set();
+  if (!Array.isArray(record.input)) return names;
+  for (const entry of record.input) {
+    const name = entry?.name;
+    if (typeof name === "string" && name !== "") names.add(name);
+  }
+  return names;
+}
+function inputBase(reference) {
+  const cut = reference.search(/[.[]/);
+  return cut === -1 ? reference : reference.slice(0, cut);
+}
+function boundChannelInputs(payloadKey, record, channelInputs) {
+  if (payloadKey === "message") {
+    const guid = record.channel?.id;
+    return (typeof guid === "string" ? channelInputs.get(guid) : void 0) ?? /* @__PURE__ */ new Set();
+  }
+  if (payloadKey === "trigger") {
+    const objType = record.obj_type;
+    if (objType !== "channel" && objType !== "workspace_realtime_channel") return /* @__PURE__ */ new Set();
+    const objId = record.obj_id;
+    return (typeof objId === "string" ? channelInputs.get(objId) : void 0) ?? /* @__PURE__ */ new Set();
+  }
+  return /* @__PURE__ */ new Set();
+}
+function checkInputScope(sections, bag) {
+  const channelInputs = /* @__PURE__ */ new Map();
+  for (const channel of sections.channel ?? []) {
+    if (!channel || typeof channel !== "object") continue;
+    const record = channel;
+    if (typeof record.guid === "string") {
+      channelInputs.set(record.guid, declaredInputNames(record));
+    }
+  }
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    if (payloadKey === "middleware") continue;
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const record = obj;
+      if (!Array.isArray(record.run)) continue;
+      const declared = declaredInputNames(record);
+      for (const name2 of boundChannelInputs(payloadKey, record, channelInputs)) {
+        declared.add(name2);
+      }
+      const references = [];
+      collectInputRefs(record.run, references);
+      collectInputRefs(record.result, references);
+      const missing = [...new Set(references.map(inputBase))].filter(
+        // A bare `inp("")` is the whole input object, not a named one.
+        (name2) => name2 !== "" && !declared.has(name2)
+      );
+      if (missing.length === 0) continue;
+      const name = typeof record.name === "string" ? record.name : "?";
+      const declaredList = declared.size === 0 ? "it declares no inputs at all" : `it declares ${[...declared].map((n) => `\`${n}\``).join(", ")}`;
+      bag.warn(
+        "stack.inp-undeclared",
+        `${payloadKey} "${name}" reads ${missing.map((r) => `\`inp("${r}")\``).join(", ")}, which ${missing.length === 1 ? "is not a declared input" : "are not declared inputs"} here \u2014 ${declaredList}. This deploys clean and fails at runtime with \`Unable to locate input: ${missing[0]}\`. If the value comes from earlier in the stack rather than the request, read it with \`ref("<var>.${missing[0]}")\`; if it really is a request input, declare it in this def's \`input\`.`
+      );
+    }
+  }
+}
+function checkMiddleware(sections, bag) {
+  for (const mw of sections.middleware ?? []) {
+    if (!mw || typeof mw !== "object") continue;
+    const record = mw;
+    const name = typeof record.name === "string" ? record.name : "?";
+    if (Array.isArray(record.input) && record.input.length > 0) {
+      bag.warn(
+        "middleware.input-never-bound",
+        `middleware "${name}" declares \`input\`, which the host request never binds \u2014 \`inp()\` inside a middleware fails at runtime with \`Unable to locate input\`, and a declared default does not stand in. Read the request body with \`s.util.get_all_input\` instead; it yields a \`{ type, vars }\` envelope. The field is kept because the engine stores it and existing workspaces carry one.`
+      );
+    }
+    const refs = [];
+    collectInputRefs(record.run, refs);
+    const unique = [...new Set(refs)];
+    if (unique.length > 0) {
+      bag.warn(
+        "middleware.inp-unresolvable",
+        `middleware "${name}" reads ${unique.map((r) => `\`inp("${r}")\``).join(", ")}, which cannot resolve \u2014 a middleware has no bound inputs, so this fails at runtime with \`Unable to locate input: ${unique[0]}\`. Use \`s.util.get_all_input\` and read the \`{ type, vars }\` envelope it binds.`
+      );
+    }
+  }
+}
+function checkApiGroupCors(sections, bag) {
+  for (const app of sections.app ?? []) {
+    if (!app || typeof app !== "object") continue;
+    const record = app;
+    const cors = record.cors;
+    if (!cors || cors.mode !== "custom") continue;
+    const name = typeof record.name === "string" ? record.name : "?";
+    const origins = Array.isArray(cors.allowOrigins) ? cors.allowOrigins : [];
+    if (origins.length === 0) {
+      bag.warn(
+        "api-group.cors-no-origins",
+        `apiGroup "${name}": \`cors.mode: "custom"\` with an empty \`allowOrigins\` matches no request, so responses carry NO \`access-control-*\` headers and every browser call fails on a missing \`access-control-allow-origin\`. List the origins (\`allowOrigins: ["https://app.example.com"]\`), or drop to \`mode: "default"\` for the permissive policy.`
+      );
+    } else if (origins.includes("*")) {
+      bag.warn(
+        "api-group.cors-wildcard-origin",
+        `apiGroup "${name}": \`allowOrigins\` contains \`"*"\`, which is compared as a LITERAL origin under \`mode: "custom"\` \u2014 no browser sends \`Origin: *\`, so it matches nothing and those responses carry no \`access-control-*\` headers at all. Name each origin, or use \`mode: "default"\`, which is the any-origin policy.`
+      );
+    }
+    const methods = cors.allowMethods ?? {};
+    if (!Object.values(methods).some((v) => v === true)) {
+      bag.warn(
+        "api-group.cors-no-methods",
+        `apiGroup "${name}": \`cors.mode: "custom"\` enables no \`allowMethods\`, so no \`access-control-allow-methods\` is sent and a preflight has nothing to approve. Enable every verb the group's queries use \u2014 the map also gates the REAL response, so a request whose method is off gets no CORS headers even after a passing preflight.`
+      );
+    }
+  }
+}
+function checkStacks(tables, sections, bag) {
+  checkMiddleware(sections, bag);
+  checkInputScope(sections, bag);
+  checkApiGroupCors(sections, bag);
+  if (tables.length === 0) return;
+  const tablesByGuid = /* @__PURE__ */ new Map();
+  for (const def of tables) tablesByGuid.set(resolveRef("dbo", def), def);
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      if (statements.length === 0) continue;
+      for (const statement of statements) {
+        if (statement.name === BULK_UPDATE) {
+          checkBulkUpdate(statement, owner, tablesByGuid, bag);
+        }
+      }
+      checkInternalColumnReads(statements, owner, tablesByGuid, bag);
+    }
+  }
+}
+var EMPTY_OPERANDS = /* @__PURE__ */ new Set(["", "[]", "{}"]);
+var MEMBERSHIP_OPS = /* @__PURE__ */ new Set(["in"]);
+function checkIgnoreEmptyOperand(node, owner, bag) {
+  const right = node.right;
+  if (!right || right.ignore_empty !== true) return;
+  if (typeof right.tag !== "string" || !right.tag.startsWith("const")) return;
+  if (typeof right.operand !== "string" || !EMPTY_OPERANDS.has(right.operand)) return;
+  const op = typeof node.op === "string" ? node.op : "?";
+  const left = node.left?.operand;
+  const subject = typeof left === "string" && left !== "" ? `\`${left}\` ` : "";
+  const consequence = MEMBERSHIP_OPS.has(op) ? `this clause selects EVERY row instead of none, the opposite of what \`${op} []\` reads as. On a permission filter that is the whole table handed to a caller entitled to none of it.` : `this clause is dropped from the query and constrains nothing.`;
+  bag.warn(
+    "expression.ignore-empty-static-empty",
+    `${owner}: comparison ${subject}\`${op}\` sets \`ignoreEmpty\` on an operand that is EMPTY in the bundle. \`ignoreEmpty\` REMOVES the predicate when its operand resolves empty rather than matching zero rows, so ${consequence} Drop \`ignoreEmpty\` to keep the empty-list reading (\`in []\` matches nothing), or pass the list you meant.`
+  );
+}
+function checkExpressionOperands(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      walkNodes(obj, (record) => {
+        const statement = record.statement;
+        if (statement && typeof statement === "object" && "op" in statement) {
+          checkIgnoreEmptyOperand(statement, owner, bag);
+        }
+      });
+    }
+  }
+}
+function checkSeed(tables, bag) {
+  for (const def of tables) {
+    const source = def.seed;
+    if (source === void 0 || typeof source === "function" || isSeedFileSource(source)) continue;
+    if (!Array.isArray(source) || source.length === 0) continue;
+    try {
+      const coerced = coerceSeedRowValues(def.name, tableColumns(def), source);
+      assertSeedIds(def.name, tableColumns(def), coerced);
+    } catch (cause) {
+      bag.error("seed.invalid", cause.message);
+    }
+  }
+}
+var GATING_ACTIONS = {
+  realtime_server: ["connect"],
+  channel: ["join"]
+};
+function checkRealtimeGates(sections, bag) {
+  for (const obj of sections.trigger ?? []) {
+    if (!obj || typeof obj !== "object") continue;
+    const t = obj;
+    if (!Array.isArray(t.result) || t.result.length > 0) continue;
+    const objType = typeof t.obj_type === "string" ? t.obj_type : "";
+    const gating = GATING_ACTIONS[objType];
+    if (!gating) continue;
+    const actions = t.meta?.[objType]?.action;
+    const declared = gating.filter((a) => actions?.[a] === true);
+    if (declared.length === 0) continue;
+    const name = typeof t.name === "string" ? t.name : "?";
+    bag.warn(
+      "realtime.gate-denies-everyone",
+      `trigger "${name}" gates \`${declared.join("`/`")}\` but declares no \`response\`, so it returns nothing on every run \u2014 and an empty return is a DENY, which refuses every client. A crash denies too, so there is no shape of this trigger that admits anyone. Add \`response: () => obj({ allowed: c.bool(true) })\` (any truthy value admits; an \`allowed: false\` with a \`reason\` reaches the client). If refusing everyone is the intent, say so explicitly with \`response: () => c.bool(false)\`.`
+    );
+  }
+}
+function checkRealtimeDeliver(bundleType, sections, bag) {
+  if (bundleType !== "workspace") return;
+  const channels = /* @__PURE__ */ new Map();
+  for (const obj of sections.channel ?? []) {
+    if (!obj || typeof obj !== "object") continue;
+    const ch = obj;
+    if (typeof ch.guid !== "string" || ch.guid === "") continue;
+    channels.set(ch.guid, {
+      name: typeof ch.name === "string" ? ch.name : "?",
+      perRecipient: ch.delivery?.per_recipient === true
+    });
+  }
+  const delivered = /* @__PURE__ */ new Set();
+  for (const obj of sections.trigger ?? []) {
+    if (!obj || typeof obj !== "object") continue;
+    const t = obj;
+    if (t.obj_type !== "channel" || t.active === false) continue;
+    const actions = t.meta?.channel?.action;
+    if (actions?.deliver !== true) continue;
+    if (typeof t.obj_id !== "string" || t.obj_id === "") continue;
+    const channel = channels.get(t.obj_id);
+    if (!channel) continue;
+    delivered.add(t.obj_id);
+    if (channel.perRecipient) continue;
+    const name = typeof t.name === "string" ? t.name : "?";
+    bag.warn(
+      "realtime.deliver-without-per-recipient",
+      `trigger "${name}" gates \`deliver\` on channel "${channel.name}", but that channel does not set \`delivery: { perRecipient: true }\` \u2014 the engine runs the per-recipient path only when BOTH halves are present, so this trigger never runs and every subscriber receives the UNREDACTED payload. Nothing errors and nothing is logged. Add \`delivery: { perRecipient: true }\` to the channel, noting that it costs one stack per recipient per message. If the redaction is no longer wanted, remove the trigger rather than leaving it as a gate that does not gate.`
+    );
+  }
+  for (const [guid, channel] of channels) {
+    if (!channel.perRecipient || delivered.has(guid)) continue;
+    bag.warn(
+      "realtime.per-recipient-without-deliver",
+      `channel "${channel.name}" sets \`delivery: { perRecipient: true }\` but no active \`deliver\` trigger is bound to it, so the flag is a no-op \u2014 the engine falls back to a plain broadcast rather than dropping anyone. Remove it, or add a \`realtimeChannelTrigger({ channel, actions: { deliver: true } })\` to redact per recipient.`
+    );
+  }
+}
+var IMPLICIT_VAR_BASES = /* @__PURE__ */ new Set(["input"]);
+function collectBindings(statements) {
+  const bound = /* @__PURE__ */ new Set();
+  for (const statement of statements) {
+    if (typeof statement.as === "string" && statement.as !== "") bound.add(statement.as);
+    const context = statement.context;
+    if (typeof context?.as === "string" && context.as !== "") bound.add(context.as);
+    if (typeof context?.name === "string" && context.name !== "") bound.add(context.name);
+  }
+  return bound;
+}
+function editDistance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const current = [i];
+    for (let j = 1; j <= b.length; j++) {
+      current[j] = Math.min(
+        previous[j] + 1,
+        current[j - 1] + 1,
+        previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    previous = current;
+  }
+  return previous[b.length];
+}
+function didYouMean(name, bound) {
+  let best;
+  let bestDistance = Infinity;
+  for (const candidate of bound) {
+    const distance = editDistance(name, candidate);
+    if (distance < bestDistance) {
+      best = candidate;
+      bestDistance = distance;
+    }
+  }
+  return best !== void 0 && bestDistance <= Math.max(1, Math.round(name.length / 3)) ? best : void 0;
+}
+function checkUnboundVarRefs(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      if (statements.length === 0) continue;
+      const bound = collectBindings(statements);
+      const refs = [];
+      collectVarRefs(obj, refs);
+      const reported = /* @__PURE__ */ new Set();
+      for (const path of refs) {
+        const dot = path.indexOf(".");
+        const base = dot === -1 ? path : path.slice(0, dot);
+        if (base === "" || base.startsWith("$") || IMPLICIT_VAR_BASES.has(base)) continue;
+        if (bound.has(base)) continue;
+        if (reported.has(base)) continue;
+        reported.add(base);
+        const suggestion = didYouMean(base, bound);
+        bag.warn(
+          "stack.unbound-var",
+          `${owner}: \`ref("${path}")\` names a variable that nothing in this stack binds with \`as\`. At runtime this raises \`Unable to locate var: ${base}\` \u2014 an HTTP 500 on the deployed environment.${suggestion ? ` Did you mean "${suggestion}"?` : ""} Bind it first (\`as: "${base}"\` on the statement that produces it). Do NOT reach for \`ref(\u2026, { safe: true })\` here: that is for drilling into a value that may be null, and against a name that binds nothing it just turns the 500 into a silent \`null\`.`
+        );
+      }
+    }
+  }
+}
+var DB_MATCH_ARG = {
+  "mvp:dbo_getby": "field_value",
+  "mvp:dbo_delby": "field_value",
+  "mvp:dbo_hasby": "field_value",
+  "mvp:dbo_editby": "field_value",
+  "mvp:dbo_patch": "field_value",
+  "mvp:dbo_addoreditby": "field_value",
+  "mvp:dbo_get": "id"
+};
+function isNullSafeDrill(cell) {
+  const value = cell;
+  if (value?.tag !== "var" || !Array.isArray(value.filters)) return false;
+  return value.filters.some((entry) => {
+    const filter = entry;
+    if (filter?.name !== "get") return false;
+    const fallback = Array.isArray(filter.arg) ? filter.arg[1] : void 0;
+    if (fallback === void 0) return true;
+    return fallback.tag === "const:null";
+  });
+}
+function checkSafeRefMatchArgs(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      for (const statement of statements) {
+        const matchArg = DB_MATCH_ARG[statement.name];
+        if (matchArg === void 0 || !Array.isArray(statement.input)) continue;
+        for (const entry of statement.input) {
+          const cell = entry;
+          if (cell?.name !== matchArg) continue;
+          if (!isNullSafeDrill(cell)) continue;
+          const base = typeof cell.value === "string" ? cell.value : "the base";
+          const arg = matchArg === "id" ? "`id`" : "`fieldValue`";
+          bag.warn(
+            "db.safe-ref-match-arg",
+            `${owner}: a \`ref(\u2026, { safe: true })\` is the ${arg} of \`${statement.name}\`. That opt-in exists to produce \`null\` when \`${base}\` is null, and \`null\` is never a legal match value \u2014 the engine rejects the request with HTTP 400 \`Missing param: ${matchArg}\` before any later statement runs, so a following precondition never gets to answer and the caller sees an internal-sounding 400 instead of your 404. \`{ safe: true }\` is for an EXPRESSION operand (a precondition/condition, an \`obj()\` member), not a db match argument. Guard existence first \u2014 \`s.precondition({ expr: expr(ref("${base}"), "!=", c.null()), error_type: "notfound", \u2026 })\` \u2014 then drill WITHOUT \`safe\`, since the base is known non-null by then.`
+          );
+        }
+      }
+    }
+  }
+}
+function checkNullMatchArgs(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      for (const statement of statements) {
+        const matchArg = DB_MATCH_ARG[statement.name];
+        if (matchArg === void 0 || !Array.isArray(statement.input)) continue;
+        for (const entry of statement.input) {
+          const cell = entry;
+          if (cell?.name !== matchArg) continue;
+          if (cell.tag !== "const:null") continue;
+          if (Array.isArray(cell.filters) && cell.filters.length > 0) continue;
+          const arg = matchArg === "id" ? "`id`" : "`fieldValue`";
+          bag.warn(
+            "db.null-match-arg",
+            `${owner}: \`c.null()\` is the ${arg} of \`${statement.name}\`. \`null\` is never a legal match value \u2014 the engine rejects the request with HTTP 400 \`Missing param: ${matchArg}\` on the FIRST call, and the caller sees an input error naming an argument they never sent. \`null\` belongs in an EXPRESSION operand (a precondition/condition, an \`obj()\` member), not in a lookup's match slot. Modelling an optional link? Store the sentinel instead \u2014 \`f.tableRef(users, { required: true, default: 0 })\` \u2014 and match on \`c.int(0)\`, which finds no row and binds \`null\`, the answer the null was after.`
+          );
+        }
+      }
+    }
+  }
+}
+function checkSameNameSiblings(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    const guidsByName = /* @__PURE__ */ new Map();
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const { name, guid } = obj;
+      if (typeof name !== "string" || name === "" || typeof guid !== "string") continue;
+      const guids = guidsByName.get(name) ?? /* @__PURE__ */ new Set();
+      guids.add(guid);
+      guidsByName.set(name, guids);
+    }
+    for (const [name, guids] of guidsByName) {
+      if (guids.size < 2) continue;
+      const advice = payloadKey === "query" ? `Give them distinct names (\`${name}\` and \`${name}/create\` for a GET/POST pair \u2014 the verb still carries the semantics). An explicit \`guid\` clears the export-time collision but not this one.` : `${payloadKey} identity is composed from more than the name here, but the lock key is not \u2014 name them uniquely across the workspace.`;
+      bag.warn(
+        "lock.same-name-siblings",
+        `${guids.size} ${payloadKey} objects share the name "${name}" while carrying different guids. This bundle exports, but a lock entry is keyed \`${payloadKey}:${name}\` and holds ONE guid, so \`xanots export --lock\` REFUSES the pair \u2014 and a committed \`xano.lock\` is the recommended workflow. ${advice} Fixing it now costs a rename; at the first locked export it costs the lock.`
+      );
+    }
+  }
+}
+var REALTIME_PUBLISH = "mvp:realtime_publish";
+function constantCell(cell) {
+  const c = cell;
+  if (typeof c?.tag !== "string" || !c.tag.startsWith("const")) return void 0;
+  if (Array.isArray(c.filters) && c.filters.length > 0) return void 0;
+  return typeof c.value === "string" && c.value !== "" ? c.value : void 0;
+}
+function channelPathMatches(template, path) {
+  const pattern = template.split(/\{[^{}]*\}/).map((literal) => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+");
+  return new RegExp(`^${pattern}$`).test(path);
+}
+function checkRealtimePublish(bundleType, sections, bag) {
+  if (bundleType !== "workspace") return;
+  const objName = (obj) => {
+    const name = obj?.name;
+    return typeof name === "string" ? name : void 0;
+  };
+  const servers = (sections.realtime_server ?? []).map(objName).filter((n) => n !== void 0);
+  const channels = (sections.channel ?? []).map(objName).filter((n) => n !== void 0);
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const owner = `${payloadKey} "${objName(obj) ?? "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      for (const statement of statements) {
+        if (statement.name !== REALTIME_PUBLISH) continue;
+        const context = statement.context ?? {};
+        const server = constantCell(context.realtime_server);
+        if (server !== void 0 && !servers.includes(server)) {
+          bag.warn(
+            "realtime.publish-unknown-server",
+            `${owner}: \`s.realtime.publish\` targets realtime server "${server}", which this workspace does not register. The engine resolves the server by NAME and FAILS SOFT \u2014 a miss is swallowed with nothing returned to the stack \u2014 so this publish goes nowhere and reports nothing. Pass the \`realtimeServer()\` handle rather than a bare name so a rename cannot break it.${servers.length > 0 ? ` Registered: ${servers.map((n) => `"${n}"`).join(", ")}.` : ""}`
+          );
+        }
+        const channel = constantCell(context.channel);
+        if (channel !== void 0 && !channels.some((path) => channelPathMatches(path, channel))) {
+          bag.warn(
+            "realtime.publish-unknown-channel",
+            `${owner}: \`s.realtime.publish\` targets channel path "${channel}", which matches no \`realtimeChannel()\` on this workspace, so no client can be subscribed to it \u2014 and the publish is swallowed silently rather than failing. Build the path with \`channel.getChannel({ \u2026 })\` instead of writing it out.${channels.length > 0 ? ` Registered: ${channels.map((n) => `"${n}"`).join(", ")}.` : ""}`
+          );
+        }
+      }
+    }
+  }
+}
+var TRIGGER_BINDINGS = {
+  database: "table",
+  realtime_server: "realtimeServer",
+  channel: "channel",
+  toolset: "mcpServer` / `agent"
+};
+function checkTriggerBindings(sections, bag) {
+  for (const obj of sections.trigger ?? []) {
+    if (!obj || typeof obj !== "object") continue;
+    const t = obj;
+    const objType = typeof t.obj_type === "string" ? t.obj_type : "";
+    const arg = TRIGGER_BINDINGS[objType];
+    if (!arg) continue;
+    if (t.obj_id !== 0 && t.obj_id !== "" && t.obj_id !== void 0 && t.obj_id !== null) continue;
+    const name = typeof t.name === "string" ? t.name : "?";
+    bag.warn(
+      "trigger.unbound",
+      `trigger "${name}" is an \`${objType}\` trigger but names no object to fire on, so it deploys bound to nothing and never runs. Bind it with \`${arg}\` \u2014 pass the def handle (or its name) and it resolves to the target's guid at export, surviving a \`--reset\` deploy. A raw numeric \`objId\` is the escape hatch, and is rarely what you want: ids are assigned at import and are not knowable from a def.`
+    );
+  }
+}
+function checkDecodeOnlyStatements(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const objName = obj.name;
+      const owner = `${payloadKey} "${typeof objName === "string" ? objName : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      const found = new Set(
+        statements.map((s) => s.name).filter((name) => DECODE_ONLY_STATEMENTS.has(name))
+      );
+      for (const name of found) {
+        bag.error(
+          "statement.decode-only",
+          `${owner} contains \`${name}\`, which is ${DECODE_ONLY_STATEMENTS.get(name)}. It reached this bundle from a pulled workspace \u2014 XanoTS has no factory for it \u2014 and the generated source carries it as a \`raw({ name: "${name}", \u2026 })\` call. Replace that call with the statement it stands in for.`
+        );
+      }
+    }
+  }
+}
+var GUID_RE = /^[0-9a-f]{32}$/;
+var VALUE_KEYS = /* @__PURE__ */ new Set([
+  "input",
+  "value",
+  // The same tagged value under the name a COMPARISON gives it
+  // (`statement.left.operand` / `statement.right.operand`). Missing here made
+  // any workspace that compares against a hash, a checksum, an API key or a hex
+  // token fail its export outright — `md5("hello world")` asserted in a
+  // precondition read as a pointer at an object that was never registered
+  // (issue #132). `normalize` already pairs the two keys for the same reason.
+  "operand",
+  "default",
+  "filters",
+  "search",
+  "docs",
+  "description",
+  "mocks",
+  // A saved unit test's subtree: its `input[]` and its assertions' `vars[]` are
+  // author values like any other, and its `id` is the test's OWN identity, not
+  // a pointer at another object — the same case as `guid` below. Without this a
+  // pulled test's 32-hex id read as a reference to an object nothing registers,
+  // which is a hard export error.
+  "test",
+  "tag",
+  "settings_registry",
+  // An object's own identity, not a pointer at another object.
+  "guid"
+]);
+var EXTERNAL_REF_KEYS = /* @__PURE__ */ new Set(["run_version"]);
+var EMBEDDED_REF_RE = /^(?:dbo=([0-9a-f]{32})|([0-9a-f]{32})_mvpschema)$/;
+function refGuid(value, allowBare) {
+  const embedded = EMBEDDED_REF_RE.exec(value);
+  if (embedded) return embedded[1] ?? embedded[2];
+  return allowBare && GUID_RE.test(value) ? value : null;
+}
+function collectDanglingRefs(node, path, owner, known, out, embeddedOnly = false) {
+  const stack = [{ node, path, embeddedOnly }];
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if ("text" in frame) {
+      const guid = refGuid(frame.text, frame.allowBare);
+      if (guid && !known.has(guid)) out.push({ owner, path: frame.path, guid });
+      continue;
+    }
+    const current = frame.node;
+    if (Array.isArray(current)) {
+      for (let i = current.length - 1; i >= 0; i--) {
+        const item = current[i];
+        const itemPath = `${frame.path}[${i}]`;
+        stack.push(
+          typeof item === "string" ? { text: item, path: itemPath, allowBare: false } : { node: item, path: itemPath, embeddedOnly: frame.embeddedOnly }
+        );
+      }
+      continue;
+    }
+    if (!current || typeof current !== "object") continue;
+    const entries = Object.entries(current);
+    for (let i = entries.length - 1; i >= 0; i--) {
+      const [key, value] = entries[i];
+      if (EXTERNAL_REF_KEYS.has(key)) continue;
+      const inValue = frame.embeddedOnly || VALUE_KEYS.has(key);
+      const valuePath = `${frame.path}.${key}`;
+      stack.push(
+        typeof value === "string" ? { text: value, path: valuePath, allowBare: !inValue } : { node: value, path: valuePath, embeddedOnly: inValue }
+      );
+    }
+  }
+}
+function checkReferences(bundleType, sections, workspaceGuid, bag) {
+  if (bundleType !== "workspace") return;
+  const known = /* @__PURE__ */ new Set();
+  if (typeof workspaceGuid === "string") known.add(workspaceGuid);
+  for (const arr of Object.values(sections)) {
+    for (const obj of arr ?? []) {
+      const guid = obj?.guid;
+      if (typeof guid === "string") known.add(guid);
+    }
+  }
+  const dangling = [];
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      collectDanglingRefs(obj, "$", owner, known, dangling);
+    }
+  }
+  const byGuid = /* @__PURE__ */ new Map();
+  for (const ref of dangling) {
+    const bucket = byGuid.get(ref.guid);
+    if (bucket) bucket.push(ref);
+    else byGuid.set(ref.guid, [ref]);
+  }
+  for (const [guid, refs] of byGuid) {
+    const owners = [...new Set(refs.map((r) => r.owner))];
+    const from = owners.length === 1 ? owners[0] : `${owners.slice(0, 3).join(", ")}${owners.length > 3 ? `, +${owners.length - 3} more` : ""}`;
+    const seed = guidSeedHint(guid);
+    const target = seed ? `${seed.slice(0, seed.indexOf(":"))} "${seed.slice(seed.indexOf(":") + 1)}" (guid ${guid})` : `an object with guid ${guid}`;
+    bag.error(
+      "reference.unresolved",
+      `${from} references ${target}, which is not registered on this workspace. A reference is resolved to a guid from the target's NAME with no registry lookup, so a mistyped name produces a valid-looking guid that only fails at deploy \u2014 "Invalid <kind> reference. Try importing: ${guid}" \u2014 after the import has begun. Check the name for a typo and register the target; pass the def handle rather than a bare name so a rename cannot silently break the reference. Reference found at ${refs[0].path}.`
+    );
+  }
+}
+var LOOP_CONTROL_STATEMENTS = /* @__PURE__ */ new Map([
+  ["mvp:foreach_break", "s.foreach_break()"],
+  ["mvp:foreach_continue", "s.foreach_continue()"],
+  ["mvp:foreach_remove", "s.foreach_remove()"]
+]);
+var LOOP_STATEMENTS = /* @__PURE__ */ new Set(["mvp:for", "mvp:foreach", "mvp:while"]);
+var REQUEST_ONLY_TIME_FILTERS = new Set(
+  FILTER_NAMES.filter((n) => n.startsWith("epochms_") && !isQueryExpressionFilter(n))
+);
+function operandFilterNames(operand, out) {
+  if (!operand || typeof operand !== "object") return;
+  const filters = operand.filters;
+  if (!Array.isArray(filters)) return;
+  for (const f of filters) {
+    if (f && typeof f === "object" && typeof f.name === "string") {
+      out.push(f.name);
+    }
+  }
+}
+function checkSearchOperandFilters(sections, bag) {
+  if (REQUEST_ONLY_TIME_FILTERS.size === 0) return;
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      walkNodes(obj, (record) => {
+        const context = record.context;
+        if (!context || typeof context.search !== "object" || context.search === null) return;
+        const found = [];
+        walkNodes(context.search, (node) => {
+          const statement = node.statement;
+          if (!statement || typeof statement !== "object") return;
+          operandFilterNames(statement.left, found);
+          operandFilterNames(statement.right, found);
+        });
+        const offending = [...new Set(found)].filter((n) => REQUEST_ONLY_TIME_FILTERS.has(n));
+        for (const filter of offending) {
+          bag.warn(
+            "search.request-only-filter",
+            `${owner} pipes a search operand through \`${filter}\`, which evaluates only in the request. A \`where\` is compiled into SQL, where that filter has no form \u2014 the endpoint deploys clean and then fails the request with a bare fatal naming nothing. Either use the SQL-side spelling (\`epochms_add_day\`, \`epochms_sub_month\`, and the rest of that family) or compute the value in an earlier \`s.set_var\` and reference it with \`ref()\` in the \`where\`.`
+          );
+        }
+      });
+    }
+  }
+}
+function checkSwitchFallthrough(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      walkNodes(obj, (node) => {
+        if (node.name !== "mvp:switch") return;
+        const context = node.context;
+        const cases = context?.elif?.run;
+        if (!Array.isArray(cases)) return;
+        const hasDefault = Array.isArray(context?.else?.run) && context.else.run.length > 0;
+        cases.forEach((entry, i) => {
+          if (!entry || typeof entry !== "object") return;
+          const record = entry;
+          if (record.disabled === true) return;
+          const caseContext = record.context;
+          if (caseContext?.break === true) return;
+          const fallsInto = i < cases.length - 1 || hasDefault;
+          if (!fallsInto) return;
+          const target = i < cases.length - 1 ? `case ${i + 2} of ${cases.length}` : "the `default` block";
+          bag.warn(
+            "switch.missing-break",
+            `${owner} has a \`s.switch\` whose case ${i + 1} omits \`break: true\`, so a match there FALLS THROUGH and also runs ${target}. The engine's default is fallthrough, not stop \u2014 every statement in the later bodies runs as well, which duplicates whatever they write. Add \`break: true\` to that case. If the cascade IS deliberate there is no suppression: this stays a warning and never blocks a plain export, but \`--strict\` fails on it, so a strict build wants the cases restructured (or a \`s.conditional\` chain) rather than the fallthrough.`
+          );
+        });
+      });
+    }
+  }
+}
+function checkLoopControl(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      walkLoopDepth(obj, 0, owner, bag);
+    }
+  }
+}
+function walkLoopDepth(root, rootDepth, owner, bag) {
+  const stack = [{ node: root, depth: rootDepth }];
+  while (stack.length > 0) {
+    const { node, depth } = stack.pop();
+    if (Array.isArray(node)) {
+      for (let i = node.length - 1; i >= 0; i--) stack.push({ node: node[i], depth });
+      continue;
+    }
+    if (!node || typeof node !== "object") continue;
+    const record = node;
+    const statement = typeof record.name === "string" ? record.name : void 0;
+    const disabled = record.disabled === true;
+    if (!disabled && statement !== void 0 && LOOP_CONTROL_STATEMENTS.has(statement) && depth === 0) {
+      const spelling = LOOP_CONTROL_STATEMENTS.get(statement);
+      bag.error(
+        "stack.loop-control-outside-loop",
+        `${owner} runs \`${spelling}\` outside any loop. Loop control is only defined inside the body of \`s.foreach\`, \`s.for\` or \`s.while\` \u2014 the engine receives a break with no loop to break out of, which is undefined behaviour rather than a no-op, and nothing reports it at deploy. Move it into a loop body, or delete it. (A conditional or group INSIDE a loop is still inside the loop; this fires only when no loop encloses it at all.)`
+      );
+    }
+    if (statement !== void 0 && LOOP_STATEMENTS.has(statement)) {
+      const context = record.context;
+      const body = context?.run;
+      stack.push({ node: body, depth: depth + 1 });
+      if (context && typeof context === "object") {
+        const inner = Object.entries(context);
+        for (let i = inner.length - 1; i >= 0; i--) {
+          const [key, value] = inner[i];
+          if (key === "run") continue;
+          stack.push({ node: value, depth });
+        }
+      }
+      const own = Object.entries(record);
+      for (let i = own.length - 1; i >= 0; i--) {
+        const [key, value] = own[i];
+        if (key === "context") continue;
+        stack.push({ node: value, depth });
+      }
+      continue;
+    }
+    const values = Object.values(record);
+    for (let i = values.length - 1; i >= 0; i--) stack.push({ node: values[i], depth });
+  }
+}
+function checkMicroserviceSecrets(sections, bag) {
+  const rows = sections.microservice;
+  if (!Array.isArray(rows)) return;
+  for (const row of rows) {
+    if (!row || typeof row !== "object") continue;
+    const record = row;
+    const name = typeof record.name === "string" ? record.name : "(unnamed)";
+    const carried = [];
+    const auth = record["registry_auth"];
+    if (typeof auth?.["dockerconfigjson"] === "string" && auth["dockerconfigjson"] !== "") {
+      carried.push("`registryAuth.dockerconfigjson`");
+    }
+    const chart = record["chart"];
+    if (typeof chart?.["values"] === "string" && chart["values"] !== "") {
+      carried.push("`chart.values`");
+    }
+    if (carried.length === 0) continue;
+    bag.notice(
+      "microservice.secret-in-bundle",
+      `microservice "${name}" writes ${carried.join(" and ")} into this bundle verbatim \u2014 the engine stores the value as given, so there is no deploy-time indirection and a \`process.env\` read here resolves at export, not on the tenant. Treat the bundle (and any tree pulled from it) as secret material: keep it out of git, or rotate the credential after it lands there. Workspace env vars are the surface that IS mapped \u2014 \`workspaceConfig({ env })\` sets them on the tenant and \`env("NAME")\` reads one back in a stack, without the value appearing in a stack literal.`
+    );
+  }
+}
+function checkMicroserviceBlocks(sections, bag) {
+  const rows = sections.microservice;
+  if (!Array.isArray(rows) || rows.length === 0) return;
+  bag.notice(
+    "microservice.early-surface",
+    `this workspace declares ${rows.length === 1 ? "a microservice" : `${rows.length} microservices`} \u2014 an EARLY platform surface whose stored shape is expected to change. What deploys today is a \`builtin\` microservice's \`deployment\`/\`ingresses\` and a \`helm\` one's \`chart\`; \`configs\`/\`volumes\` are refused at export because the engine rejects an import carrying them. Pin \`@xanots/sdk\` for reproducible builds and re-read the microservice section on upgrade.`
+  );
+  for (const row of rows) {
+    if (!row || typeof row !== "object") continue;
+    const record = row;
+    const name = typeof record.name === "string" ? record.name : "(unnamed)";
+    const populated = ["configs", "volumes"].filter((key) => {
+      const value = record[key];
+      return Array.isArray(value) && value.length > 0;
+    });
+    if (populated.length === 0) continue;
+    const fields = populated.map((key) => `\`${key}\``).join(" and ");
+    const workaround = populated.map(
+      (key) => key === "configs" ? "a value the workload reads goes in a container's `env` (`deployment.containers[].env`)" : "storage goes in a container's own `volumes` (`emptyDir`, `persistent`, or `config`)"
+    ).join("; ");
+    bag.error(
+      "microservice.unsupported-block",
+      `microservice "${name}" declares ${fields}, which the engine refuses on import \u2014 the workspace fatals mid-deploy, after provisioning has begun. Refused here instead, where nothing has been created yet. Workaround: ${workaround}. Both fields are typed and \`@deprecated\` because a pulled workspace can still carry them; neither can be deployed by this SDK today.`
+    );
+  }
+}
+var RUN_FAMILY = {
+  "mvp:workspace_run_function": "s.function.call",
+  "mvp:workspace_run_tool": "s.tool.call",
+  "mvp:workspace_run_middleware": "s.middleware.call",
+  "mvp:workspace_run_endpoint": "s.api.call",
+  "mvp:workspace_run_task": "s.task.call",
+  "mvp:workspace_run_trigger": "s.trigger.call",
+  "mvp:workspace_run_workflow_test": "s.workflow_test.call",
+  "mvp:workspace_run_addon": "s.addon.call"
+};
+var RUNS_OUTSIDE_A_WORKFLOW_TEST = /* @__PURE__ */ new Set([
+  "mvp:workspace_run_function",
+  "mvp:workspace_run_tool",
+  "mvp:workspace_run_middleware",
+  "mvp:workspace_run_addon"
+]);
+function checkRunFamilyHosts(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    if (payloadKey === "workflow_test") continue;
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const objName = obj.name;
+      const owner = `${payloadKey} "${typeof objName === "string" ? objName : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      const found = new Set(
+        statements.map((s) => s.name).filter((name) => name in RUN_FAMILY && !RUNS_OUTSIDE_A_WORKFLOW_TEST.has(name))
+      );
+      for (const name of found) {
+        const factory = RUN_FAMILY[name];
+        bag.error(
+          "statement.run-family-host",
+          `${owner} contains \`${factory}\`, which only runs inside a workflow test. Outside one the engine resolves this step against a registry holding only functions, tools and middleware, so it deploys clean, passes from the builder (whose runner loads the whole workspace), and then fails the first real request with \`ERROR_FATAL: \u2026 does not exist\`. Move it into a \`workflowTest({ \u2026 })\`, where the whole family is available. From an ordinary stack use \`s.function.run\`, \`s.function.call\`, \`s.tool.call\` or \`s.middleware.call\`.`
+        );
+      }
+    }
+  }
+}
+
+// src/workspace/xano.ts
+var XANO_BRAND = /* @__PURE__ */ Symbol.for("xanots.Xano");
+var Xano = class {
+  /** @internal cross-realm identity brand — see {@link Xano.isXano}. */
+  [XANO_BRAND] = true;
+  /** Encoded objects keyed by `packageExport` payload key. */
+  sections = /* @__PURE__ */ new Map();
+  /** Table defs, encoded lazily at {@link export} so each can inherit the workspace `use_xdo`. */
+  tableDefs = [];
+  workspaceConfig = {};
+  bundleType = "workspace";
+  /** True for any `Xano` registry, even one created by a different module instance. */
+  static isXano(value) {
+    return typeof value === "object" && value !== null && value[XANO_BRAND] === true;
+  }
+  /** Encode one def and stamp its deterministic guid (the engine's sync/reference anchor). */
+  encodeOne(kind, def) {
+    const encoded = kind.encode(def);
+    assertMockKeysResolved(encoded, kind.name);
+    if (REFERENCEABLE_KINDS.has(kind.name) && encoded && typeof encoded === "object") {
+      const obj = encoded;
+      const explicit = def.guid;
+      if (obj.guid === void 0 && typeof obj.name === "string") {
+        obj.guid = explicit ?? kind.guidOf?.(def) ?? deriveGuid(kind.payloadKey, obj.name);
+      }
+    }
+    return encoded;
+  }
+  /** Register one or more authoring defs of a given kind. */
+  register(kindName, defOrDefs) {
+    const kind = getKind(kindName);
+    const defs = Array.isArray(defOrDefs) ? defOrDefs : [defOrDefs];
+    for (const def of defs) this.assertNotAlreadyRegistered(kind.name, def);
+    if (kind.name === "table") {
+      for (const def of defs) this.tableDefs.push(def);
+      return this;
+    }
+    const bucket = this.sections.get(kind.payloadKey) ?? [];
+    for (const def of defs) bucket.push(this.encodeOne(kind, def));
+    this.sections.set(kind.payloadKey, bucket);
+    return this;
+  }
+  /**
+   * Every def object handed to {@link register}, by identity, so the SAME one
+   * registered twice is caught at the call that did it (issue #54).
+   *
+   * Identity, not structure. Two separately constructed defs sharing a name are
+   * a genuine collision, and the guid check at export already diagnoses that
+   * correctly — it explains that identity derives from `(type, name)` and names
+   * both objects. This guard must not shadow it.
+   */
+  registered = /* @__PURE__ */ new Set();
+  /**
+   * Refuse the same def object twice.
+   *
+   * The failure this front-runs: a helper registers a def on your behalf and
+   * you then register it again yourself — `registerAuth(ws).registerTables([userTable])`
+   * is the reported shape. Nothing objected at the second call; it surfaced much
+   * later at `emitBundle` as `Duplicate object guid (efb55…) shared by "dbo/user"
+   * and "dbo/user"`, a message that names a guid and the same label twice and
+   * points at neither line.
+   */
+  assertNotAlreadyRegistered(kindName, def) {
+    if (def === null || typeof def !== "object") return;
+    if (!this.registered.has(def)) {
+      this.registered.add(def);
+      return;
+    }
+    const name = def.name;
+    const label = typeof name === "string" ? `"${name}"` : "it";
+    throw new Error(
+      `register: the same ${kindName} def ${label} was registered twice on this workspace. The second registration is always a mistake \u2014 the bundle would carry the object twice under one guid, which fails the import. A helper that registers on your behalf is the usual cause (\`registerAuth(ws)\` registers its own tables, so a following \`registerTables([userTable])\` is the duplicate): drop the manual call. Two DIFFERENT defs that share a name are a separate problem, and export reports that one by guid.`
+    );
+  }
+  /**
+   * Register the workspace settings object (singleton).
+   *
+   * A config with no `name` inherits the one already on the registry — which is
+   * what `workspace("my-app")` set — so the natural chain
+   * `workspace("my-app").registerWorkspace(workspaceConfig({ history }))` no
+   * longer makes an author restate a name this registry has held since its
+   * first call (#228). An explicit `name` still wins, and a rename this way is
+   * a rename of the workspace.
+   */
+  registerWorkspace(def) {
+    const authored = def ?? {};
+    const inherited = this.workspaceConfig.name;
+    const withName = authored.name === void 0 && typeof inherited === "string" ? { ...authored, name: inherited } : authored;
+    this.workspaceConfig = encodeObject("workspace", withName);
+    return this;
+  }
+  /** Set the bundle `type` (defaults to "workspace"). */
+  setBundleType(type) {
+    this.bundleType = type;
+    return this;
+  }
+  /**
+   * The registered table defs (with their authored `seed`), for the Node deploy
+   * path to build `content/` seed entries. Deliberately NOT reached from
+   * `export()` — seed values are resolved only in the deploy pipeline, so they
+   * never enter the browser-safe bundle. See {@link import("./seed.js")}.
+   */
+  tables() {
+    return [...this.tableDefs];
+  }
+  registerFunctions(defs) {
+    return this.register("function", defs);
+  }
+  registerTriggers(defs) {
+    return this.register("trigger", defs);
+  }
+  registerTools(defs) {
+    return this.register("tool", defs);
+  }
+  registerMcpServers(defs) {
+    return this.register("mcp_server", defs);
+  }
+  registerAgents(defs) {
+    return this.register("agent", defs);
+  }
+  registerTables(defs) {
+    return this.register("table", defs);
+  }
+  registerQueries(defs) {
+    return this.register("query", defs);
+  }
+  registerApiGroups(defs) {
+    return this.register("api_group", defs);
+  }
+  registerTasks(defs) {
+    return this.register("task", defs);
+  }
+  registerMiddleware(defs) {
+    return this.register("middleware", defs);
+  }
+  registerAddons(defs) {
+    return this.register("addon", defs);
+  }
+  registerMicroservices(defs) {
+    return this.register("microservice", defs);
+  }
+  registerRealtimeServers(defs) {
+    return this.register("realtime_server", defs);
+  }
+  registerRealtimeChannels(defs) {
+    return this.register("channel", defs);
+  }
+  registerRealtimeMessages(defs) {
+    return this.register("message", defs);
+  }
+  registerWorkflowTests(defs) {
+    return this.register("workflow_test", defs);
+  }
+  /**
+   * Assemble the signed aggregate `packageExport` bundle.
+   *
+   * With `options.lock` (a {@link LockExportContext}), the export participates
+   * in identity locking: empty api-group/toolset canonicals are filled from the
+   * lock — minted fresh on first sight — and every identity the bundle emits is
+   * reported back through `ctx.observed` (MUTATING the passed context), which
+   * the caller merges into the lock file. All lock work happens before the
+   * bundle is signed. Without options the output is byte-identical to before.
+   *
+   * With `options.strict`, every build WARNING fails the export instead of
+   * printing — the shapes that deploy clean and then lose data or return the
+   * wrong rows. Nothing about the emitted bundle changes; it either exports or
+   * it does not (issue #15).
+   */
+  export(options = {}) {
+    const lockCtx = options.lock;
+    const sections = {};
+    for (const [key, arr] of this.sections) {
+      sections[key] = arr;
+    }
+    if (this.tableDefs.length > 0) {
+      const tableKind = getKind("table");
+      const wsUseXdo = this.workspaceConfig.use_xdo === true;
+      sections[tableKind.payloadKey] = this.tableDefs.map((def) => {
+        const encoded = this.encodeOne(
+          tableKind,
+          def.useXdo === void 0 ? { ...def, useXdo: wsUseXdo } : def
+        );
+        return { ...encoded, import: { mode: "standard" } };
+      });
+    }
+    const bag = new DiagnosticBag(options.strict === true);
+    this.validateQueryAuth(sections, bag);
+    this.validateMiddlewareAuth(sections, bag);
+    checkMicroserviceSecrets(sections, bag);
+    checkMicroserviceBlocks(sections, bag);
+    checkStacks(this.tableDefs, sections, bag);
+    checkExpressionOperands(sections, bag);
+    checkReferences(this.bundleType, sections, this.workspaceConfig.guid, bag);
+    checkDecodeOnlyStatements(sections, bag);
+    checkRunFamilyHosts(sections, bag);
+    checkLoopControl(sections, bag);
+    checkSwitchFallthrough(sections, bag);
+    checkSearchOperandFilters(sections, bag);
+    checkRealtimeGates(sections, bag);
+    checkRealtimeDeliver(this.bundleType, sections, bag);
+    checkTriggerBindings(sections, bag);
+    checkUnboundVarRefs(sections, bag);
+    checkSafeRefMatchArgs(sections, bag);
+    checkNullMatchArgs(sections, bag);
+    checkSameNameSiblings(sections, bag);
+    checkSeed(this.tableDefs, bag);
+    checkRealtimePublish(this.bundleType, sections, bag);
+    bag.flush();
+    if (lockCtx) this.applyLock(lockCtx, sections);
+    if (this.workspaceConfig.guid === void 0) {
+      const wsName = typeof this.workspaceConfig.name === "string" ? this.workspaceConfig.name : "workspace";
+      this.workspaceConfig.guid = deriveGuid("workspace", wsName);
+    }
+    return buildBundle({
+      type: this.bundleType,
+      workspace: this.workspaceConfig,
+      sections,
+      lock: lockCtx?.lock
+    });
+  }
+  /**
+   * Cross-check every query's resolved `auth` against the registered auth tables.
+   *
+   * `resolveAuth` (in `encodeQuery`) turns a table ref into a guid with no
+   * registry visibility, so a bare-name typo produces a valid-looking guid that
+   * only fails at deploy with an opaque engine error. Here we have the registry,
+   * so we catch it at export and name the offending query.
+   *
+   * A registered table that is not `table({ auth: true })` only WARNS: the
+   * engine reads that flag nowhere at request time (it compares the token's
+   * `dbo` to the endpoint's by name, and mints tokens for any table by name), so
+   * refusing the combination blocked a real workspace's round trip. A numeric
+   * `auth` (raw `dbo.id` escape hatch) references a table by id xanots never
+   * sees, so it's left as-is; `false` is a public endpoint. A table that pins an
+   * explicit `guid` referenced by bare name lands in the "not registered" branch
+   * (its name-derived guid diverges from the pinned one) — pass the def instead.
+   */
+  validateQueryAuth(sections, bag) {
+    const queries = sections["query"];
+    if (!Array.isArray(queries) || queries.length === 0) return;
+    const tableNameByGuid = /* @__PURE__ */ new Map();
+    const authGuids = /* @__PURE__ */ new Set();
+    for (const def of this.tableDefs) {
+      const guid = resolveRef("dbo", def);
+      tableNameByGuid.set(guid, def.name);
+      if (def.auth === true) authGuids.add(guid);
+    }
+    for (const q of queries) {
+      if (!q || typeof q !== "object") continue;
+      const auth = q.auth;
+      if (typeof auth !== "string" || authGuids.has(auth)) continue;
+      const name = String(q.name ?? "?");
+      const known = tableNameByGuid.get(auth);
+      if (known) {
+        bag.warn(
+          "query.auth-table-unflagged",
+          `query "${name}" requires auth against table "${known}", which is not marked \`table({ auth: true })\`. The engine allows it \u2014 a token minted for that table is accepted \u2014 but the editor will not offer the table as an auth source. Mark it if that is what you meant.`
+        );
+        continue;
+      }
+      bag.error(
+        "query.auth-table-unregistered",
+        `query "${name}": \`auth\` references a table that isn't registered on this workspace. Check for a typo, or register the auth table; if it pins an explicit \`guid\`, pass the table def rather than its name.`
+      );
+    }
+  }
+  /**
+   * Warn about an `auth()`-keyed middleware **directly attached** to a host where
+   * `auth()` may resolve to `null` (issue #81).
+   *
+   * The footgun: a rate limiter keyed by `auth("id")` is the canonical middleware,
+   * but attach it to a host with no authenticated caller and `auth()` silently
+   * resolves to `null` — every caller collapses into one shared bucket, with no
+   * signal at author, export, or runtime. This surfaces it at export, where the
+   * middleware registry is known (an attachment entry only carries the target's
+   * guid; we resolve it back to the encoded `run` to inspect for `auth()`).
+   *
+   * It **warns, never throws** — a bare `auth()` reference is not proof of a
+   * collapse (an IP-disambiguated key or a personalize-if-logged-in middleware
+   * uses `auth()` where `null` is fine), so blocking the export would produce
+   * false positives on legitimate use. The warning names the host and reason so
+   * the author can confirm intent, vary the key, or move to an authenticated host.
+   *
+   * Scope: the host's EFFECTIVE chain, across all three tiers (issue #43). The
+   * guard used to see only a host's own `middleware.pre`/`post`, so an author who
+   * DRY'd a per-user limiter up to `apiGroup({ middleware })` or to the workspace
+   * tier silently reintroduced the shared bucket — the same collapse, attached
+   * one level up, with the warning switched off. Since the limiter is more
+   * naturally written once at the group than repeated on every endpoint, the
+   * tier that most needed the warning was the one that never got it.
+   *
+   * The cascade is the engine's own: a phase whose `_customize` flag is set is
+   * answered by that tier (including `clear()`, which customizes with an empty
+   * list and therefore stops inheritance); an un-customized phase falls through
+   * to the API group, then to the workspace's `{objType}_{phase}` map. A query
+   * that clears a phase is NOT warned about a group middleware it does not run.
+   *
+   * An authenticated `query` (its own `auth` table set) resolves an identity, so
+   * it is skipped at every tier.
+   */
+  validateMiddlewareAuth(sections, bag) {
+    const middlewares = sections["middleware"];
+    if (!Array.isArray(middlewares) || middlewares.length === 0) return;
+    const byGuid = /* @__PURE__ */ new Map();
+    for (const mw of middlewares) {
+      if (!mw || typeof mw !== "object") continue;
+      const guid = mw.guid;
+      if (typeof guid === "string") byGuid.set(guid, mw);
+    }
+    const authCache = /* @__PURE__ */ new Map();
+    const referencesAuth = (guid) => {
+      let hit = authCache.get(guid);
+      if (hit === void 0) {
+        const run = byGuid.get(guid)?.run;
+        hit = stackReferencesAuth(Array.isArray(run) ? run : void 0);
+        authCache.set(guid, hit);
+      }
+      return hit;
+    };
+    const hostKinds = [
+      { key: "query", label: "query", reason: "this endpoint has no auth table" },
+      { key: "task", label: "task", reason: "a task is scheduled/background and never has a request identity" },
+      { key: "function", label: "function", reason: "auth() is null unless an authenticated caller invokes it" },
+      { key: "tool", label: "tool", reason: "auth() is null unless an authenticated caller invokes it" }
+    ];
+    const groupByGuid = /* @__PURE__ */ new Map();
+    for (const group of sections["app"] ?? []) {
+      if (!group || typeof group !== "object") continue;
+      const guid = group.guid;
+      if (typeof guid === "string") groupByGuid.set(guid, group);
+    }
+    const workspaceTier = this.workspaceConfig.middleware ?? {};
+    const list = (x) => Array.isArray(x) ? x : [];
+    const customizes = (block, phase) => !!block && typeof block === "object" && block[`${phase}_customize`] === true;
+    for (const { key, label, reason } of hostKinds) {
+      const hosts = sections[key];
+      if (!Array.isArray(hosts)) continue;
+      for (const host of hosts) {
+        if (!host || typeof host !== "object") continue;
+        if (label === "query" && host.auth) continue;
+        const block = host.middleware;
+        const hostName = String(host.name ?? "?");
+        const groupId = label === "query" ? host.app?.id : void 0;
+        const group = typeof groupId === "string" ? groupByGuid.get(groupId) : void 0;
+        for (const phase of ["pre", "post"]) {
+          let entries;
+          let tier;
+          if (customizes(block, phase)) {
+            entries = list(block[phase]);
+            tier = "";
+          } else if (group && customizes(group.middleware, phase)) {
+            entries = list(group.middleware[phase]);
+            tier = ` (inherited from apiGroup "${String(group.name ?? "?")}")`;
+          } else {
+            entries = list(workspaceTier[`${label}_${phase}`]);
+            tier = " (inherited from the workspace tier)";
+          }
+          for (const entry of entries) {
+            if (entry?.disabled === true) continue;
+            const guid = middlewareEntryGuid(entry);
+            if (!guid || !referencesAuth(guid)) continue;
+            const mwName = String(byGuid.get(guid)?.name ?? guid);
+            bag.warn(
+              "middleware.auth-null-host",
+              `middleware "${mwName}" references auth() and is attached to ${label} "${hostName}"${tier}, where ${reason}. A null auth() collapses all callers into one shared key \u2014 attach it to an authenticated host, vary the key, or remove auth().`
+            );
+          }
+        }
+      }
+    }
+  }
+  /**
+   * Lock participation (see {@link export}): canonical fill + identity report.
+   * Runs after all sections are assembled and before signing.
+   */
+  applyLock(ctx, sections) {
+    const usedCanonicals = /* @__PURE__ */ new Set();
+    for (const entry of Object.values(ctx.lock.objects)) {
+      if (entry.canonical) usedCanonicals.add(entry.canonical);
+    }
+    for (const arr of Object.values(sections)) {
+      for (const obj of arr ?? []) {
+        const canonical = obj.canonical;
+        if (typeof canonical === "string" && canonical !== "") usedCanonicals.add(canonical);
+      }
+    }
+    const mintUnique = () => {
+      let token = mintCanonical();
+      while (usedCanonicals.has(token)) token = mintCanonical();
+      usedCanonicals.add(token);
+      return token;
+    };
+    const canonicalByGuid = (guid) => {
+      if (typeof guid !== "string") return void 0;
+      for (const entry of Object.values(ctx.lock.objects)) {
+        if (entry.guid === guid && entry.canonical !== void 0) return entry.canonical;
+      }
+      return void 0;
+    };
+    for (const key of CANONICAL_PAYLOAD_KEYS) {
+      for (const obj of sections[key] ?? []) {
+        if (!obj || typeof obj !== "object") continue;
+        const o = obj;
+        if (typeof o.name !== "string" || o.canonical !== "") continue;
+        o.canonical = ctx.lock.objects[lockKey(key, o.name)]?.canonical ?? canonicalByGuid(o.guid) ?? mintUnique();
+      }
+    }
+    const ws = this.workspaceConfig;
+    if (ws.canonical === "") {
+      ws.canonical = ctx.lock.objects[WORKSPACE_KEY]?.canonical ?? "";
+    }
+    if (typeof ws.canonical === "string" && ws.canonical !== "") {
+      recordObserved(ctx, WORKSPACE_KEY, { canonical: ws.canonical });
+    }
+    for (const [payloadKey, arr] of Object.entries(sections)) {
+      for (const obj of arr ?? []) {
+        if (!obj || typeof obj !== "object") continue;
+        const o = obj;
+        if (typeof o.name !== "string" || typeof o.guid !== "string") continue;
+        const identity = { guid: o.guid };
+        if (typeof o.canonical === "string" && o.canonical !== "") {
+          identity.canonical = o.canonical;
+        }
+        recordObserved(ctx, lockKey(payloadKey, o.name), identity);
+      }
+    }
+  }
+};
+function workspace(name) {
+  return new Xano().registerWorkspace({ name });
+}
+
+export {
+  coerceSeedRowValues,
+  assertSeedIds,
+  Xano,
+  workspace
+};
+//# sourceMappingURL=chunk-3DUAGYGP.js.map