@xanots/sdk 0.0.10 → 0.0.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (102) hide show
  1. package/CHANGELOG.md +33 -0
  2. package/README.md +48 -5
  3. package/dist/.build-fingerprint +1 -1
  4. package/dist/{agent-file-refresh-QNKN5RYD.js → agent-file-refresh-GQWAAOBV.js} +4 -4
  5. package/dist/bin.js +12 -11
  6. package/dist/{branch-commands-2BLOC2GR.js → branch-commands-5KMPAAZV.js} +7 -7
  7. package/dist/bundle.d.ts +218 -0
  8. package/dist/bundle.js +143 -0
  9. package/dist/{capture-4WVJY4DQ.js → capture-YLUVAITI.js} +2 -2
  10. package/dist/chunk-2VTJSI6X.js +192 -0
  11. package/dist/{chunk-5XZ744TS.js → chunk-2ZCUO2UG.js} +1 -1
  12. package/dist/{chunk-OYMR5AMJ.js → chunk-3LQGF2WS.js} +2 -2
  13. package/dist/{chunk-WP4OZZV4.js → chunk-3VFCKHOB.js} +2 -2
  14. package/dist/{chunk-XHEXOES3.js → chunk-5YDINUAP.js} +1 -1
  15. package/dist/{chunk-LU7TRWMC.js → chunk-6VNRMKFJ.js} +2 -2
  16. package/dist/{chunk-CTD5ZCV6.js → chunk-7WRJPKGK.js} +2 -2
  17. package/dist/{chunk-3INK4Y4E.js → chunk-AE3PDSDS.js} +1 -1
  18. package/dist/{chunk-5YCQ2QHH.js → chunk-AG5GCZDD.js} +2 -2
  19. package/dist/{chunk-DBFU47BJ.js → chunk-AOFFKSJC.js} +2 -2
  20. package/dist/{chunk-TCFIPDB3.js → chunk-AVGDL6RB.js} +1 -1
  21. package/dist/{chunk-4BXJGVZ3.js → chunk-DCMANKMX.js} +2 -69
  22. package/dist/{chunk-WHOJWOSV.js → chunk-EETVJZAZ.js} +1 -1
  23. package/dist/chunk-EHP3WPEG.js +21 -0
  24. package/dist/{chunk-W24FJHPD.js → chunk-ELK7UALJ.js} +3 -3
  25. package/dist/{chunk-VNQM3V2C.js → chunk-EXENFOWE.js} +2 -2
  26. package/dist/{chunk-P6TAVLOX.js → chunk-GSP2BY4F.js} +17 -10
  27. package/dist/{chunk-AIZKXUNP.js → chunk-IMLYGQK6.js} +2 -2
  28. package/dist/{chunk-LBYWGMOA.js → chunk-N74KDCBD.js} +176 -42
  29. package/dist/{chunk-3IGNIP6R.js → chunk-NDP7OUPS.js} +1 -1
  30. package/dist/chunk-OHX6MIUZ.js +184 -0
  31. package/dist/{chunk-EQW3YT5U.js → chunk-P6PVBQL6.js} +2 -2
  32. package/dist/{chunk-I7DQDJAM.js → chunk-PLE5QQOZ.js} +55 -56
  33. package/dist/chunk-PR7OXHGZ.js +70 -0
  34. package/dist/{chunk-VKSOTZK3.js → chunk-QYSQ3UDO.js} +160 -8
  35. package/dist/{chunk-ZQ2PKR6R.js → chunk-RQ3FXV4K.js} +2 -2
  36. package/dist/{chunk-Q77KNEUL.js → chunk-RQNMTDXD.js} +1703 -2
  37. package/dist/{chunk-QKM4U5UK.js → chunk-TJS2AF5Y.js} +2 -2
  38. package/dist/{chunk-DIA7CT7J.js → chunk-V5Y7D4LH.js} +11 -2
  39. package/dist/{chunk-KA6G2L7U.js → chunk-VK26K7AY.js} +3 -3
  40. package/dist/{chunk-YYFXVYPX.js → chunk-VPAWRBK5.js} +12 -16
  41. package/dist/{chunk-5R73LFWK.js → chunk-VRNZ2NVV.js} +7 -7
  42. package/dist/{chunk-ACCBOMCB.js → chunk-XT3XQ4PF.js} +32 -27
  43. package/dist/{chunk-7JDT4PBU.js → chunk-XWFRNJMQ.js} +5 -179
  44. package/dist/{chunk-7ZYW652H.js → chunk-YHS6VVLJ.js} +2 -2
  45. package/dist/{chunk-75Z74TA7.js → chunk-YX22LKQE.js} +2 -2
  46. package/dist/{chunk-F6CYJ7TN.js → chunk-Z2ZIE5CO.js} +2 -2
  47. package/dist/cli.d.ts +13 -6
  48. package/dist/cli.js +11 -10
  49. package/dist/codegen-command-Y2SPMAUW.js +47 -0
  50. package/dist/codegen.d.ts +5 -4
  51. package/dist/codegen.js +2 -2
  52. package/dist/{completion-WF46272M.js → completion-HJU5QEFB.js} +2 -2
  53. package/dist/{deploy-command-QTIVA22A.js → deploy-command-XHS5PKPV.js} +20 -19
  54. package/dist/{ephemeral-command-U4AQ3TXX.js → ephemeral-command-2NKPEXUU.js} +8 -8
  55. package/dist/index.d.ts +88 -102
  56. package/dist/index.js +13 -12
  57. package/dist/init-command-23FFNUFT.js +32 -0
  58. package/dist/internal.d.ts +10 -16
  59. package/dist/internal.js +76 -54
  60. package/dist/io-UBDMMDH6.js +12 -0
  61. package/dist/{live-diff-IXKBVG4K.js → live-diff-HCOTN5WC.js} +3 -3
  62. package/dist/{lock-GFXD6G2E.js → lock-HQ4KARU2.js} +3 -2
  63. package/dist/{lock-commands-DQ7CUMIV.js → lock-commands-WCRC56ME.js} +12 -11
  64. package/dist/{login-command-Z6CHTA57.js → login-command-P7LXD5TE.js} +6 -6
  65. package/dist/{loop-D5NPL4VH.js → loop-IC5ISSYB.js} +3 -3
  66. package/dist/{marketplace-command-P4IPLJ6J.js → marketplace-command-T6JCHW7J.js} +4 -4
  67. package/dist/{meta-client-K2J4XH64.js → meta-client-LKRKR3L2.js} +4 -4
  68. package/dist/node.d.ts +6 -5
  69. package/dist/node.js +18 -17
  70. package/dist/{preflight-command-GZ2GE5RN.js → preflight-command-TZWPHBXY.js} +17 -16
  71. package/dist/{profile-command-LJSBDV2L.js → profile-command-WBNSMQSI.js} +3 -3
  72. package/dist/{release-command-YUBTNHVX.js → release-command-WEFYRTCI.js} +27 -26
  73. package/dist/response-D6xGLEIn.d.ts +839 -0
  74. package/dist/{routes-manifest-PWZHDOI5.js → routes-manifest-5ZFKUQWA.js} +2 -2
  75. package/dist/{runtime-V4C3AC3A.js → runtime-LSLIDALK.js} +1 -1
  76. package/dist/scaffold.d.ts +16 -8
  77. package/dist/scaffold.js +7 -11
  78. package/dist/{static-host-3WMV7IZO.js → static-host-4JDQCHUW.js} +1 -1
  79. package/dist/{status-command-AL47VG7H.js → status-command-VARULAR5.js} +4 -4
  80. package/dist/{store-BG1UPZ3Z.d.ts → store-DAnUIi1T.d.ts} +95 -87
  81. package/dist/{test-command-YAZLKLGQ.js → test-command-YCAR4O35.js} +7 -7
  82. package/dist/{upgrade-command-FB5QJ363.js → upgrade-command-GYEIMJBG.js} +16 -16
  83. package/dist/{workspace-2COHDBM3.js → workspace-33KHFLX3.js} +2 -2
  84. package/dist/{workspace-command-43P42FBP.js → workspace-command-2ZTGT26W.js} +28 -27
  85. package/dist/{workspace-export-DURY5WYL.js → workspace-export-MLYTYZS5.js} +3 -3
  86. package/dist/{response-CVAE2kMj.d.ts → xdo-ODuJklk6.d.ts} +28 -860
  87. package/guides/authoring.md +11 -2
  88. package/guides/typed-frontend.md +5 -5
  89. package/llms/filters.md +11 -10
  90. package/llms/kinds-core.md +1 -1
  91. package/llms/statements-data.md +6 -3
  92. package/llms/values.md +1 -1
  93. package/llms-full.txt +53 -42
  94. package/llms.txt +34 -27
  95. package/manifest.json +6 -2
  96. package/package.json +7 -2
  97. package/dist/chunk-ANUDXFEX.js +0 -881
  98. package/dist/chunk-JGCWTCA7.js +0 -95
  99. package/dist/chunk-YBC3IKMF.js +0 -845
  100. package/dist/codegen-command-GB3H2KQ7.js +0 -46
  101. package/dist/init-command-MAXULNAD.js +0 -33
  102. package/dist/io-M7XZEMK7.js +0 -11
@@ -1,60 +1,40 @@
1
- import {
2
- ENGINE_HISTORY_LIMIT,
3
- clearLocalDboRefs,
4
- configuredDeadReturnBlocks,
5
- filledContext,
6
- hasNoListBounds,
7
- hasUnreadableInput,
8
- isBlankAgentSettings,
9
- isBlankGroupStatement,
10
- isDeadResultItem,
11
- isDefaultEnvelopeMember,
12
- isEmptyCustomize,
13
- isEmptyOutput,
14
- liveArrayMapContext,
15
- normalize,
16
- retiredInputSuccessor,
17
- retiredInputs
18
- } from "./chunk-3INK4Y4E.js";
19
1
  import {
20
2
  resolveEphemeralName
21
- } from "./chunk-ZQ2PKR6R.js";
3
+ } from "./chunk-RQ3FXV4K.js";
22
4
  import {
23
5
  getAccessToken
24
- } from "./chunk-QKM4U5UK.js";
6
+ } from "./chunk-TJS2AF5Y.js";
25
7
  import {
26
8
  exportWorkspaceBundle
27
- } from "./chunk-7ZYW652H.js";
9
+ } from "./chunk-YHS6VVLJ.js";
28
10
  import {
29
11
  projectShellFiles,
30
12
  resolveFrontendPreset,
31
13
  resolveThemeChoice,
32
14
  sanitizeAppName
33
- } from "./chunk-YYFXVYPX.js";
15
+ } from "./chunk-VPAWRBK5.js";
34
16
  import {
35
17
  XANO_DIR,
36
18
  resolveAiPresets,
37
19
  scaffoldProject
38
- } from "./chunk-KA6G2L7U.js";
20
+ } from "./chunk-VK26K7AY.js";
39
21
  import {
40
22
  TEST_EXPECT_TYPES
41
- } from "./chunk-75Z74TA7.js";
23
+ } from "./chunk-YX22LKQE.js";
42
24
  import {
43
25
  raw
44
- } from "./chunk-LU7TRWMC.js";
26
+ } from "./chunk-6VNRMKFJ.js";
45
27
  import {
46
28
  codegenLanding,
47
29
  describeOrigin,
48
30
  renderCodegenMarker,
49
31
  renderCodegenReadme
50
- } from "./chunk-ANUDXFEX.js";
32
+ } from "./chunk-RQNMTDXD.js";
51
33
  import {
52
34
  FIELD_METHODS,
53
- STATEMENT_SURFACES,
54
35
  SUPERSEDED_STATEMENTS,
55
- sPathOf,
56
36
  supersededBy
57
- } from "./chunk-4BXJGVZ3.js";
37
+ } from "./chunk-PR7OXHGZ.js";
58
38
  import {
59
39
  DEFAULT_PREFERENCES,
60
40
  DEFAULT_SETTINGS,
@@ -70,14 +50,40 @@ import {
70
50
  searchConstrainsRows,
71
51
  tableTrigger,
72
52
  workspaceTrigger
73
- } from "./chunk-P6TAVLOX.js";
53
+ } from "./chunk-GSP2BY4F.js";
54
+ import {
55
+ linkedTableOf,
56
+ tableRefOf
57
+ } from "./chunk-EHP3WPEG.js";
58
+ import {
59
+ ENGINE_HISTORY_LIMIT,
60
+ clearLocalDboRefs,
61
+ configuredDeadReturnBlocks,
62
+ filledContext,
63
+ hasNoListBounds,
64
+ hasUnreadableInput,
65
+ isBlankAgentSettings,
66
+ isBlankGroupStatement,
67
+ isDeadResultItem,
68
+ isDefaultEnvelopeMember,
69
+ isEmptyCustomize,
70
+ isEmptyOutput,
71
+ liveArrayMapContext,
72
+ normalize,
73
+ retiredInputSuccessor,
74
+ retiredInputs
75
+ } from "./chunk-AE3PDSDS.js";
76
+ import {
77
+ STATEMENT_SURFACES,
78
+ sPathOf
79
+ } from "./chunk-DCMANKMX.js";
74
80
  import {
75
81
  loadDefault,
76
82
  readVersion
77
- } from "./chunk-ACCBOMCB.js";
83
+ } from "./chunk-XT3XQ4PF.js";
78
84
  import {
79
85
  UsageError
80
- } from "./chunk-F6CYJ7TN.js";
86
+ } from "./chunk-Z2ZIE5CO.js";
81
87
  import {
82
88
  blank,
83
89
  detail,
@@ -118,11 +124,14 @@ import {
118
124
  sys,
119
125
  toolset,
120
126
  withFilters
121
- } from "./chunk-LBYWGMOA.js";
127
+ } from "./chunk-N74KDCBD.js";
122
128
  import {
123
129
  parsePathParams,
124
130
  unboundPathParams
125
- } from "./chunk-WHOJWOSV.js";
131
+ } from "./chunk-EETVJZAZ.js";
132
+ import {
133
+ REFERENCEABLE_KIND_PAYLOAD_KEYS
134
+ } from "./chunk-XWFRNJMQ.js";
126
135
  import {
127
136
  COLUMN_CONTEXT,
128
137
  INPUT_CONTEXT,
@@ -130,10 +139,7 @@ import {
130
139
  encodeField,
131
140
  encodeMockMap,
132
141
  encodeStatement
133
- } from "./chunk-5XZ744TS.js";
134
- import {
135
- REFERENCEABLE_KIND_PAYLOAD_KEYS
136
- } from "./chunk-7JDT4PBU.js";
142
+ } from "./chunk-2ZCUO2UG.js";
137
143
 
138
144
  // src/emit/codegen-command.ts
139
145
  import { existsSync, readFileSync, writeFileSync } from "fs";
@@ -1030,6 +1036,7 @@ function parseMember(cur) {
1030
1036
  let built = lifted.built;
1031
1037
  const symbols = [...lifted.symbols];
1032
1038
  const filterExprs = [];
1039
+ let absorbNowCoercion = built.tag === "const:epochms" && built.value === "now";
1033
1040
  while (cur.eat("|")) {
1034
1041
  const name = cur.take(/[A-Za-z0-9_]/);
1035
1042
  if (name === "" || !FILTER_NAMES.includes(name)) return null;
@@ -1053,9 +1060,15 @@ function parseMember(cur) {
1053
1060
  } catch {
1054
1061
  return null;
1055
1062
  }
1063
+ if (absorbNowCoercion && name === "to_epochms" && argBuilt.length === 0) {
1064
+ absorbNowCoercion = false;
1065
+ continue;
1066
+ }
1067
+ absorbNowCoercion = false;
1056
1068
  built = withFilters(built, filterValue);
1057
1069
  filterExprs.push(call(`fl.${name}`, ...argExprs));
1058
1070
  }
1071
+ if (filterExprs.length === 0) return { expr, built, symbols };
1059
1072
  return {
1060
1073
  expr: call("withFilters", expr, ...filterExprs),
1061
1074
  built,
@@ -1681,20 +1694,6 @@ function recoverOptions(stored, includeDescription, elide = true) {
1681
1694
  function storedChildren(stored) {
1682
1695
  return stored.children ?? [];
1683
1696
  }
1684
- function dbLinkTableGuid(stored) {
1685
- const suffix = "_mvpschema";
1686
- if (typeof stored.type !== "string" || !stored.type.endsWith(suffix)) return null;
1687
- const guid = stored.type.slice(0, -suffix.length);
1688
- return guid === "" ? null : guid;
1689
- }
1690
- function tableRefGuid(stored) {
1691
- if (stored.type !== "int" && stored.type !== "uuid") return null;
1692
- const last = stored.methods?.[stored.methods.length - 1];
1693
- const arg = last?.name === "@" ? last.arg?.[0] : void 0;
1694
- if (typeof arg !== "string" || !arg.startsWith("dbo=")) return null;
1695
- const guid = arg.slice("dbo=".length);
1696
- return guid === "" ? null : guid;
1697
- }
1698
1697
  function unbindLocalCustomizeRefs(stored) {
1699
1698
  const customize = stored.customize;
1700
1699
  if (customize === null || typeof customize !== "object") return { field: stored, unbound: [] };
@@ -1782,7 +1781,7 @@ function decodeField(ctx, refs, stored, surface, resolve2 = {}) {
1782
1781
  return null;
1783
1782
  };
1784
1783
  const catalog = surface === "input" ? input : f;
1785
- const dbLinkGuid = dbLinkTableGuid(stored);
1784
+ const dbLinkGuid = linkedTableOf(stored);
1786
1785
  if (dbLinkGuid !== null && surface === "input") {
1787
1786
  const rest = { ...opts };
1788
1787
  delete rest.merge;
@@ -1797,7 +1796,7 @@ function decodeField(ctx, refs, stored, surface, resolve2 = {}) {
1797
1796
  );
1798
1797
  if (decoded) return decoded;
1799
1798
  }
1800
- const refGuid = tableRefGuid(stored);
1799
+ const refGuid = tableRefOf(stored);
1801
1800
  if (refGuid !== null) {
1802
1801
  const withoutRef = { ...opts, methods: opts.methods.slice(0, -1) };
1803
1802
  if (withoutRef.methods.length === 0) delete withoutRef.methods;
@@ -6754,7 +6753,7 @@ async function fetchBundle(args, source) {
6754
6753
  if (source.kind === "ephemeral") {
6755
6754
  const auth3 = await getAccessToken(args);
6756
6755
  const name = resolveEphemeralName(auth3, source.name);
6757
- const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-U4AQ3TXX.js");
6756
+ const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-2NKPEXUU.js");
6758
6757
  const summary = await resolveLive(auth3, auth3.workspaceId, name);
6759
6758
  step(`Reading ephemeral "${name}"`);
6760
6759
  return {
@@ -7016,4 +7015,4 @@ export {
7016
7015
  verifyCrashEntry,
7017
7016
  blameGeneratedFile
7018
7017
  };
7019
- //# sourceMappingURL=chunk-I7DQDJAM.js.map
7018
+ //# sourceMappingURL=chunk-PLE5QQOZ.js.map
@@ -0,0 +1,70 @@
1
+ // src/fields/generated/field-methods.generated.ts
2
+ var FIELD_METHODS = {
3
+ "decimal": {
4
+ "max": "int",
5
+ "min": "int"
6
+ },
7
+ "email": {
8
+ "lower": "bool",
9
+ "trim": "bool"
10
+ },
11
+ "int": {
12
+ "max": "int",
13
+ "min": "int"
14
+ },
15
+ "password": {
16
+ "max": "int",
17
+ "min": "int",
18
+ "minAlpha": "int",
19
+ "minDigit": "int",
20
+ "minLowerAlpha": "int",
21
+ "minSymbol": "int",
22
+ "minUpperAlpha": "int",
23
+ "salt": "text"
24
+ },
25
+ "tableRef": {
26
+ "max": "int",
27
+ "min": "int"
28
+ },
29
+ "text": {
30
+ "alphaOk": "bool",
31
+ "digitOk": "bool",
32
+ "lower": "bool",
33
+ "max": "int",
34
+ "min": "int",
35
+ "ok": "text",
36
+ "pattern": "text",
37
+ "startsWith": "text",
38
+ "trim": "bool",
39
+ "upper": "bool"
40
+ },
41
+ "vector": {
42
+ "max": "int",
43
+ "min": "int"
44
+ }
45
+ };
46
+
47
+ // src/statements/superseded.ts
48
+ var SUPERSEDED_STATEMENTS = /* @__PURE__ */ new Map([
49
+ // Four crypto families, each phased forward with breaking changes between
50
+ // versions. The engine still registers a class for every one of them.
51
+ ["mvp:crypto_jwe_decode", "mvp:crypto_jwe_decode2"],
52
+ ["mvp:crypto_jwe_encode", "mvp:crypto_jwe_encode3"],
53
+ ["mvp:crypto_jwe_encode2", "mvp:crypto_jwe_encode3"],
54
+ ["mvp:crypto_jws_decode", "mvp:crypto_jws_decode2"],
55
+ ["mvp:crypto_jws_encode", "mvp:crypto_jws_encode2"],
56
+ // Retired outright — an old third-party log connector with no successor.
57
+ ["mvp:connect_ncscale_send_log", ""]
58
+ ]);
59
+ function supersededBy(storedName, surfaceOf) {
60
+ const successor = SUPERSEDED_STATEMENTS.get(storedName);
61
+ if (successor === void 0 || successor === "") return null;
62
+ return surfaceOf(successor) ?? successor;
63
+ }
64
+
65
+ export {
66
+ FIELD_METHODS,
67
+ SUPERSEDED_STATEMENTS,
68
+ supersededBy
69
+ };
70
+ //# sourceMappingURL=chunk-PR7OXHGZ.js.map
@@ -10,9 +10,10 @@ import {
10
10
  isQueryExpressionFilter,
11
11
  isSeedFileSource,
12
12
  middlewareEntryGuid,
13
+ reversedRegexOperands,
13
14
  stackReferencesAuth,
14
15
  tableColumns
15
- } from "./chunk-LBYWGMOA.js";
16
+ } from "./chunk-N74KDCBD.js";
16
17
  import {
17
18
  CANONICAL_PAYLOAD_KEYS,
18
19
  REFERENCEABLE_KINDS,
@@ -25,7 +26,7 @@ import {
25
26
  mintCanonical,
26
27
  recordObserved,
27
28
  resolveRef
28
- } from "./chunk-7JDT4PBU.js";
29
+ } from "./chunk-XWFRNJMQ.js";
29
30
 
30
31
  // src/workspace/seed-coerce.ts
31
32
  function coerceScalarValue(label, column, type, value, values) {
@@ -295,6 +296,91 @@ function checkInternalColumnReads(statements, owner, tablesByGuid, bag) {
295
296
  );
296
297
  }
297
298
  }
299
+ var DB_GET_BY_ID = "mvp:dbo_get";
300
+ var ROW_BINDING_STATEMENTS = /* @__PURE__ */ new Set([DB_GET, DB_GET_BY_ID]);
301
+ var INT_COLUMN_TYPES = /* @__PURE__ */ new Set(["int"]);
302
+ function isZeroDefault(value) {
303
+ return value === 0 || value === "0";
304
+ }
305
+ function checkGetByIdZero(record, statements, owner, tablesByGuid, bag) {
306
+ const zeroDefaultInputs = /* @__PURE__ */ new Set();
307
+ if (Array.isArray(record.input)) {
308
+ for (const entry of record.input) {
309
+ const declared = entry;
310
+ if (typeof declared?.name === "string" && isZeroDefault(declared.default)) {
311
+ zeroDefaultInputs.add(declared.name);
312
+ }
313
+ }
314
+ }
315
+ const bindings = /* @__PURE__ */ new Map();
316
+ for (const statement of statements) {
317
+ if (!ROW_BINDING_STATEMENTS.has(statement.name)) continue;
318
+ const as = statement.as;
319
+ if (typeof as !== "string" || as === "") continue;
320
+ const guid = statementTableGuid(statement);
321
+ const def = guid === void 0 ? void 0 : tablesByGuid.get(guid);
322
+ if (def) bindings.set(as, def);
323
+ }
324
+ const tested = /* @__PURE__ */ new Set();
325
+ for (const statement of statements) {
326
+ walkNodes(statement, (node) => {
327
+ if (typeof node.operand === "string") tested.add(node.operand);
328
+ });
329
+ }
330
+ const reported = /* @__PURE__ */ new Set();
331
+ for (const statement of statements) {
332
+ if (statement.name !== DB_GET_BY_ID || !Array.isArray(statement.input)) continue;
333
+ for (const entry of statement.input) {
334
+ const cell = entry;
335
+ if (cell?.name !== "id") continue;
336
+ if (Array.isArray(cell.filters) && cell.filters.length > 0) continue;
337
+ const source = zeroIdSource(cell, zeroDefaultInputs, bindings);
338
+ if (!source) continue;
339
+ if (source.reference !== void 0 && tested.has(source.reference)) continue;
340
+ if (reported.has(source.key)) continue;
341
+ reported.add(source.key);
342
+ bag.warn(
343
+ "db.get-by-id-zero",
344
+ `${owner}: the \`id\` of \`s.db.get_by_id\` ${source.because}, and the engine validates that key as \`>= 1\` \u2014 a \`0\` does not miss, it fails the whole request with HTTP 400 \`Value is less than the minimum value of 1\` naming a \`param\` the caller never sent. Inside a \`foreach\` that 400 ends the request, so one unset key loses every other row's work. Read a nullable foreign key with the field-match form, which binds \`null\` on \`0\` instead: \`s.db.get({ table, fieldName: "id", fieldValue: ${source.operand}, as })\`.`
345
+ );
346
+ }
347
+ }
348
+ }
349
+ function zeroIdSource(cell, zeroDefaultInputs, bindings) {
350
+ const value = typeof cell.value === "string" ? cell.value : "";
351
+ if ((cell.tag === "const:int" || cell.tag === "const:decimal") && Number(value) === 0) {
352
+ return {
353
+ key: "literal:0",
354
+ because: "is the literal `c.int(0)`",
355
+ operand: "c.int(0)"
356
+ };
357
+ }
358
+ if (cell.tag === "input" && zeroDefaultInputs.has(inputBase(value))) {
359
+ return {
360
+ key: `input:${value}`,
361
+ reference: value,
362
+ because: `is \`inp("${value}")\`, whose declared input default is \`0\` \u2014 an omitted input stands the sentinel up with nobody having written it`,
363
+ operand: `inp("${value}")`
364
+ };
365
+ }
366
+ if (cell.tag === "var") {
367
+ const dot = value.indexOf(".");
368
+ if (dot > 0) {
369
+ const def = bindings.get(value.slice(0, dot));
370
+ const column = value.slice(dot + 1);
371
+ const col = def && tableColumns(def).find((candidate) => candidate.name === column);
372
+ if (col && INT_COLUMN_TYPES.has(col.type) && isZeroDefault(col.default)) {
373
+ return {
374
+ key: `var:${value}`,
375
+ reference: value,
376
+ because: `is \`ref("${value}")\`, and "${column}" on table "${def.name}" is declared \`default: 0\` \u2014 every row that never set the link carries the sentinel`,
377
+ operand: `ref("${value}")`
378
+ };
379
+ }
380
+ }
381
+ }
382
+ return null;
383
+ }
298
384
  function collectInputRefs(node, out) {
299
385
  walkNodes(node, (record) => {
300
386
  if (record.tag !== "input") return;
@@ -435,6 +521,7 @@ function checkStacks(tables, sections, bag) {
435
521
  }
436
522
  }
437
523
  checkInternalColumnReads(statements, owner, tablesByGuid, bag);
524
+ checkGetByIdZero(obj, statements, owner, tablesByGuid, bag);
438
525
  }
439
526
  }
440
527
  }
@@ -493,6 +580,28 @@ function checkInterpolatedValues(sections, bag) {
493
580
  }
494
581
  }
495
582
  }
583
+ function checkRegexOperandOrder(sections, bag) {
584
+ for (const [payloadKey, arr] of Object.entries(sections)) {
585
+ for (const obj of arr ?? []) {
586
+ if (!obj || typeof obj !== "object") continue;
587
+ const name = obj.name;
588
+ const seen = /* @__PURE__ */ new Set();
589
+ walkNodes(obj, (record) => {
590
+ if (typeof record.tag !== "string" || typeof record.value !== "string") return;
591
+ if (!Array.isArray(record.filters)) return;
592
+ const reversed = reversedRegexOperands(record);
593
+ if (!reversed) return;
594
+ seen.add(`\`${reversed.filter}\` (pattern ${JSON.stringify(reversed.subject)})`);
595
+ });
596
+ if (seen.size === 0) continue;
597
+ const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
598
+ bag.warn(
599
+ "value.regex-operands-reversed",
600
+ `${owner} pipes a regex filter's SUBJECT and passes its PATTERN as the argument: ${[...seen].join("; ")}. The regex family is pattern-piped \u2014 the piped value is the PATTERN and the argument is the text tested against it, the reverse of every other filter \u2014 so this answers false for every input with HTTP 200 and no error, and a precondition built on it lets through the values it exists to refuse. Swap the operands: \`withFilters(c.regex(\u2026), fl.regex_test(subject))\`.`
601
+ );
602
+ }
603
+ }
604
+ }
496
605
  function checkSeed(tables, bag) {
497
606
  for (const def of tables) {
498
607
  const source = def.seed;
@@ -506,6 +615,18 @@ function checkSeed(tables, bag) {
506
615
  }
507
616
  }
508
617
  }
618
+ var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["run"]);
619
+ function checkReservedColumnNames(tables, bag) {
620
+ for (const def of tables) {
621
+ for (const col of tableColumns(def)) {
622
+ if (!RESERVED_COLUMN_NAMES.has(col.name)) continue;
623
+ bag.warn(
624
+ "table.reserved-column-name",
625
+ `table "${def.name}": the column name \`${col.name}\` is reserved by the engine \u2014 it is the key a block statement stores its sub-stack under, and an insert's parameter map collides with it. The table deploys and reads back correctly, and then EVERY \`s.db.add\` into it fails with HTTP 400 naming \`${col.name}\` and complaining about the value \u2014 at every column type, and whether the statement supplies a value or leaves the default to stand in. Rename the column (\`${col.name}_id\`, \`${col.name}s\`); the match is exact and case sensitive, so nothing else is affected.`
626
+ );
627
+ }
628
+ }
629
+ }
509
630
  var GATING_ACTIONS = {
510
631
  realtime_server: ["connect"],
511
632
  channel: ["join"]
@@ -728,6 +849,34 @@ function checkNullMatchArgs(sections, bag) {
728
849
  }
729
850
  }
730
851
  }
852
+ var URL_ONLY_VERBS = /* @__PURE__ */ new Set(["GET", "DELETE", "HEAD"]);
853
+ function checkPathSegmentCandidates(sections, bag) {
854
+ for (const obj of sections["query"] ?? []) {
855
+ if (!obj || typeof obj !== "object") continue;
856
+ const query = obj;
857
+ const name = typeof query.name === "string" ? query.name : "";
858
+ const verb = typeof query.verb === "string" ? query.verb : "";
859
+ if (!URL_ONLY_VERBS.has(verb)) continue;
860
+ const statements = [];
861
+ collectStatements(obj, statements);
862
+ const addressing = /* @__PURE__ */ new Set();
863
+ for (const statement of statements) {
864
+ const matchArg = DB_MATCH_ARG[statement.name];
865
+ if (matchArg === void 0) continue;
866
+ const cell = statementInput(statement, matchArg);
867
+ if (cell?.tag !== "input") continue;
868
+ if (typeof cell?.value !== "string" || cell.value === "") continue;
869
+ if (name.includes(`{${cell.value}}`)) continue;
870
+ addressing.add(cell.value);
871
+ }
872
+ for (const param of addressing) {
873
+ bag.warn(
874
+ "query.path-segment-candidate",
875
+ `query "${name}" (${verb}) looks up one row by the \`${param}\` input, but the path declares no \`{${param}}\` segment \u2014 so the value arrives as \`?${param}=\u2026\` instead of addressing the resource. The endpoint works, but the route is not addressable the way a REST client expects, and \`getPath()\` types as static, so a caller cannot pass the value positionally. Put it in the path: \`name: "${name}/{${param}}"\` (the segment may sit anywhere \u2014 \`"${name}/{${param}}/edit"\` routes too), keeping the \`${param}\` input as it is; the segment binds to the input of the same name. Leave it as-is if \`${param}\` really is a query-string param rather than part of the address.`
876
+ );
877
+ }
878
+ }
879
+ }
731
880
  function checkSameNameSiblings(sections, bag) {
732
881
  const appNames = appNamesByGuid(sections["app"]);
733
882
  for (const [payloadKey, arr] of Object.entries(sections)) {
@@ -1262,7 +1411,7 @@ var Xano = class {
1262
1411
  }
1263
1412
  /**
1264
1413
  * Every def object handed to {@link register}, by identity, so the SAME one
1265
- * registered twice is caught at the call that did it (issue #54).
1414
+ * registered twice is caught at the call that did it.
1266
1415
  *
1267
1416
  * Identity, not structure. Two separately constructed defs sharing a name are
1268
1417
  * a genuine collision, and the guid check at export already diagnoses that
@@ -1299,7 +1448,7 @@ var Xano = class {
1299
1448
  * what `workspace("my-app")` set — so the natural chain
1300
1449
  * `workspace("my-app").registerWorkspace(workspaceConfig({ history }))` no
1301
1450
  * longer makes an author restate a name this registry has held since its
1302
- * first call (#228). An explicit `name` still wins, and a rename this way is
1451
+ * first call. An explicit `name` still wins, and a rename this way is
1303
1452
  * a rename of the workspace.
1304
1453
  */
1305
1454
  registerWorkspace(def) {
@@ -1427,7 +1576,7 @@ var Xano = class {
1427
1576
  * With `options.strict`, every build WARNING fails the export instead of
1428
1577
  * printing — the shapes that deploy clean and then lose data or return the
1429
1578
  * wrong rows. Nothing about the emitted bundle changes; it either exports or
1430
- * it does not (issue #15).
1579
+ * it does not.
1431
1580
  */
1432
1581
  export(options = {}) {
1433
1582
  const lockCtx = options.lock;
@@ -1457,6 +1606,7 @@ var Xano = class {
1457
1606
  checkStacks(this.tableDefs, sections, bag);
1458
1607
  checkExpressionOperands(sections, bag);
1459
1608
  checkInterpolatedValues(sections, bag);
1609
+ checkRegexOperandOrder(sections, bag);
1460
1610
  checkReferences(this.bundleType, sections, this.workspaceConfig.guid, bag);
1461
1611
  checkDecodeOnlyStatements(sections, bag);
1462
1612
  checkRunFamilyHosts(sections, bag);
@@ -1469,8 +1619,10 @@ var Xano = class {
1469
1619
  checkUnboundVarRefs(sections, bag);
1470
1620
  checkSafeRefMatchArgs(sections, bag);
1471
1621
  checkNullMatchArgs(sections, bag);
1622
+ checkPathSegmentCandidates(sections, bag);
1472
1623
  checkSameNameSiblings(sections, bag);
1473
1624
  checkSeed(this.tableDefs, bag);
1625
+ checkReservedColumnNames(this.tableDefs, bag);
1474
1626
  checkKnowledge(sections, bag, { resolved: options.knowledge !== void 0 });
1475
1627
  checkRealtimePublish(this.bundleType, sections, bag);
1476
1628
  bag.flush();
@@ -1534,7 +1686,7 @@ var Xano = class {
1534
1686
  }
1535
1687
  /**
1536
1688
  * Warn about an `auth()`-keyed middleware **directly attached** to a host where
1537
- * `auth()` may resolve to `null` (issue #81).
1689
+ * `auth()` may resolve to `null`.
1538
1690
  *
1539
1691
  * The footgun: a rate limiter keyed by `auth("id")` is the canonical middleware,
1540
1692
  * but attach it to a host with no authenticated caller and `auth()` silently
@@ -1549,7 +1701,7 @@ var Xano = class {
1549
1701
  * false positives on legitimate use. The warning names the host and reason so
1550
1702
  * the author can confirm intent, vary the key, or move to an authenticated host.
1551
1703
  *
1552
- * Scope: the host's EFFECTIVE chain, across all three tiers (issue #43). The
1704
+ * Scope: the host's EFFECTIVE chain, across all three tiers. The
1553
1705
  * guard used to see only a host's own `middleware.pre`/`post`, so an author who
1554
1706
  * DRY'd a per-user limiter up to `apiGroup({ middleware })` or to the workspace
1555
1707
  * tier silently reintroduced the shared bucket — the same collapse, attached
@@ -1706,4 +1858,4 @@ export {
1706
1858
  Xano,
1707
1859
  workspace
1708
1860
  };
1709
- //# sourceMappingURL=chunk-VKSOTZK3.js.map
1861
+ //# sourceMappingURL=chunk-QYSQ3UDO.js.map
@@ -27,7 +27,7 @@ async function resolveMetaTarget(auth, selector, deps = {}) {
27
27
  case "workspace":
28
28
  return { base: auth.instance, workspaceId: auth.workspaceId, label: `workspace ${auth.workspaceId}` };
29
29
  case "ephemeral": {
30
- const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-U4AQ3TXX.js")).resolveLive;
30
+ const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-2NKPEXUU.js")).resolveLive;
31
31
  return resolveEphemeral(auth, selector.name, { ...deps, resolveLive });
32
32
  }
33
33
  }
@@ -37,4 +37,4 @@ export {
37
37
  resolveEphemeralName,
38
38
  resolveMetaTarget
39
39
  };
40
- //# sourceMappingURL=chunk-ZQ2PKR6R.js.map
40
+ //# sourceMappingURL=chunk-RQ3FXV4K.js.map