@xanots/sdk 0.0.11 → 0.0.12

package/dist/{chunk-QK7ZQJLP.js → chunk-N74KDCBD.js}

@@ -2,7 +2,7 @@ import {
   assertPathParamInputs,
   fillPathParams,
   parsePathParams
-} from "./chunk-WHOJWOSV.js";
+} from "./chunk-EETVJZAZ.js";
 import {
   appNamesByGuid,
   deriveGuid,
@@ -12,7 +12,7 @@ import {
   lockNameForObject,
   queryGroupComponent,
   resolveRef
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 import {
   COLUMN_CONTEXT,
   INPUT_CONTEXT,
@@ -22,7 +22,7 @@ import {
   encodeStatement,
   rawResponseItems,
   registerStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-2ZCUO2UG.js";
 import {
   sha1Bytes
 } from "./chunk-OHX6MIUZ.js";
@@ -139,7 +139,7 @@ var DiagnosticBag = class {
    * a guard. But the audience for this SDK is largely an agent that never reads
    * stderr, and CI has no way to notice a message nobody fails on. `strict`
    * gives a pipeline one switch that turns "printed something" into "did not
-   * ship" (issue #15).
+   * ship".
    *
    * Scope: the diagnostics an EXPORT collects. A guard that runs while a
    * statement is being built ({@link emitDiagnostic}) has already had its say by
@@ -374,7 +374,7 @@ var c = {
    * A `number` that is not an integer, or is past `Number.MAX_SAFE_INTEGER`,
    * **throws**: by the time such a literal reaches here its precision is already
    * gone, so encoding it would write a value the caller did not type. The throw
-   * names the string form. (issue #153)
+   * names the string form.
    */
   int(n) {
     return val(intLiteral(n), "const:int");
@@ -422,7 +422,7 @@ var c = {
    * null** the engine writes into a `db.*` statement's `@meta` slot —
    * `c.null("const:obj")` → `{tag:"const:obj", value:"null"}`, 16 of them across
    * eight ordinary queries in the survey corpus, which had no spelling and came
-   * back as `rawValue` (issue #151).
+   * back as `rawValue`.
    *
    * ⚠ Not the same bytes as `c.obj(null)`, which is the BLANK object
    * (`value: ""`). Both evaluate to null — the engine JSON-decodes the stored
@@ -438,7 +438,7 @@ var c = {
    * (`fl.regex_test`/`regex_match`/`regex_replace`/…). Xano runs PHP `preg_*`, so
    * the pattern MUST be delimiter-wrapped — a bare `c.text("^…$")` is an invalid
    * PCRE and the filter then matches *nothing* for every input, so a precondition
-   * built on it silently rejects all values (issue #128). This wraps the raw
+   * built on it silently rejects all values. This wraps the raw
    * pattern in `/…/`, escapes any interior `/`, and appends `flags`, so the result
    * is always valid; `withFilters` rejects a bare `c.text` pattern and points here.
    *
@@ -466,8 +466,13 @@ var c = {
    * `text("now") |to_epoch_ms` chain; both evaluate to the same epoch-ms number
    * on a live engine, and both persist verbatim, but the native tag is what the
    * editor writes and needs no filter to get there. Chain math onto it as usual:
-   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`. (issues #120,
-   * #145)
+   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`.
+   *
+   * Inside an `obj()` the tag is flattened into an expression string, where the
+   * identifier `now` alone is the STRING "now" — so `obj()` writes the
+   * `now|to_epochms` coercion that restores this tag's meaning. A `c.now()` used
+   * as a FILTER ARGUMENT there is refused: the coercion cannot be written in
+   * that position. Hoist it with `s.set_var` and `ref()` it.
    */
   now() {
     return val("now", "const:epochms");
@@ -478,7 +483,6 @@ var c = {
    * compile error and throws at runtime — it would serialize as internal
    * representation the engine can't decode. For a computed/multi-key object
    * response use a record of values (`response: { key: value }`), not `c.obj`.
-   * See issue #42.
    *
    * Called with no argument it is the **empty object**, `{}` — the same default
    * the editor gives a new object variable, and the only empty form current
@@ -495,7 +499,7 @@ var c = {
    * same bytes instead of being quietly re-pointed at `{}`.
    *
    * A **populated** object is stored the way the editor stores one: an empty
-   * `{}` base carrying one `set` filter per key (issue #248). It is NOT a
+   * `{}` base carrying one `set` filter per key. It is NOT a
    * populated JSON string — that form fails the request at runtime, see
    * {@link objSetFilters}.
    *
@@ -516,7 +520,7 @@ var c = {
   /**
    * Array constant → JSON-string value with `tag:"const:array"`. Takes **plain
    * JSON literals only** — like {@link obj}, a nested tagged value is a compile
-   * error and throws at runtime. See issue #42.
+   * error and throws at runtime.
    */
   array(a) {
     assertPlainJson(a);
@@ -1350,7 +1354,7 @@ var f = {
    * bytes, and a map does not preserve it.
    *
    * Without this there is no way to author a structured JSON column at all
-   * (issue #135).
+   *.
    */
   json(options = {}) {
     return descriptor("json", { ...options });
@@ -1420,9 +1424,8 @@ var f = {
    *   instead: `f.tableRef("tweets", { type: "int" })`. Identity guids derive
    *   from `(type, name)`, so the name form resolves to the same guid.
    *
-   * Byte-verified whole-object against a persisted table readback
-   * (`test/fixtures/tables/ex_field_table_ref.json`, asserted in
-   * `test/conformance/kinds-corpus.test.ts`): the `@` method carries
+   * Byte-verified whole-object against a persisted table readback: the `@`
+   * method carries
    * `disabled:false`, sits last in `methods`, and its `dbo=` arg is the target
    * table's payload guid.
    *
@@ -1469,7 +1472,7 @@ var input = {
    * password on **both** signup and login, let the `f.password` *column* hash on write,
    * and pass the plaintext straight to `check_password`. See the auth recipe in the
    * README. Reach for `input.password` only when you specifically want bind-time hashing
-   * and are not also comparing it with `check_password` (issue #109).
+   * and are not also comparing it with `check_password`.
    */
   password: makeInput("password"),
   /**
@@ -1599,8 +1602,15 @@ var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function serializeValue(v2, path) {
   const record = objSetRecord(v2, path);
   if (record) return record;
+  const nowExpr = serializeEpochMs(v2);
+  if (nowExpr !== null) return nowExpr + serializeFilters(v2, path);
   return serializeAtom(v2, path) + serializeFilters(v2, path);
 }
+function serializeEpochMs(v2) {
+  if (v2.tag !== "const:epochms") return null;
+  if (v2.value !== "now") return null;
+  return "now|to_epochms";
+}
 function objSetRecord(v2, path) {
   if (v2.tag !== "const:obj") return null;
   if (v2.value === "") {
@@ -1717,12 +1727,16 @@ function serializeAtom(v2, path) {
     // renders `$env.STRIPE_KEY`.
     case "setting":
       return `$env.${v2.value}`;
-    // The engine's native current-time constant. Only ever holds `"now"` — the
-    // same narrowing the decoder makes — so anything else falls through to the
-    // rejection rather than being rendered as a `now` it is not.
+    // The engine's native current-time constant reaches this function ONLY as a
+    // filter argument — a member position is answered by `serializeEpochMs`
+    // above. There it is unwritable: the value needs a leading `|to_epochms` to
+    // evaluate as a time at all (see `serializeEpochMs`), and inside an argument
+    // a trailing `|` binds to the whole value rather than to the argument, which
+    // is the same wall a pre-filtered argument hits.
     case "const:epochms":
-      if (v2.value === "now") return "now";
-      break;
+      throw new Error(
+        `obj(): \`${path}\` is \`c.now()\` used as a FILTER ARGUMENT. In an expression the current-time constant has to carry a \`|to_epochms\` coercion, and a \`|\` inside an argument binds to the whole value instead \u2014 so this cannot be written without changing what it means. Compute it in a prior step (\`s.set_var("now", c.now())\`) and reference it with \`ref("now")\`.`
+      );
     // `c.array([…])` stores plain JSON, and the literal grammar spells the same
     // list — so it renders to the identical bytes a bare `[…]` member does. The
     // bare form always worked and this one used to throw, which made the empty
@@ -1801,7 +1815,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
   const hole = argNames.slice(0, last).findIndex((n) => named[n] === void 0);
   if (hole !== -1) {
     throw new Error(
-      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too. (issue #221)`
+      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too.`
     );
   }
   assertArity(name, argNames, required, last + 1);
@@ -1810,7 +1824,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
 var assertArity = (name, argNames, required, got) => {
   if (got >= required) return;
   throw new Error(
-    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared. (issues #221, #246)`
+    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared.`
   );
 };
 var assertMaxArity = (name, argNames, got) => {
@@ -4237,4 +4251,4 @@ export {
   serializeBundle,
   emitBundle
 };
-//# sourceMappingURL=chunk-QK7ZQJLP.js.map
+//# sourceMappingURL=chunk-N74KDCBD.js.map

package/dist/{chunk-3IGNIP6R.js → chunk-NDP7OUPS.js}

@@ -86,4 +86,4 @@ export {
   fetchReadOrExplain,
   retryingFetch
 };
-//# sourceMappingURL=chunk-3IGNIP6R.js.map
+//# sourceMappingURL=chunk-NDP7OUPS.js.map

package/dist/{chunk-EQW3YT5U.js → chunk-P6PVBQL6.js}

@@ -1,7 +1,7 @@
 import {
   describeTransportFailure,
   httpFailure
-} from "./chunk-3IGNIP6R.js";
+} from "./chunk-NDP7OUPS.js";
 
 // src/deploy/branch.ts
 var BRANCH_TIMEOUT_MS = 3e4;
@@ -156,4 +156,4 @@ export {
   assertBranchAbsent,
   requireBranch
 };
-//# sourceMappingURL=chunk-EQW3YT5U.js.map
+//# sourceMappingURL=chunk-P6PVBQL6.js.map

package/dist/{chunk-HYBN4H3F.js → chunk-PLE5QQOZ.js}

@@ -1,40 +1,40 @@
 import {
   resolveEphemeralName
-} from "./chunk-ZQ2PKR6R.js";
+} from "./chunk-RQ3FXV4K.js";
 import {
   getAccessToken
-} from "./chunk-QKM4U5UK.js";
+} from "./chunk-TJS2AF5Y.js";
 import {
   exportWorkspaceBundle
-} from "./chunk-7ZYW652H.js";
+} from "./chunk-YHS6VVLJ.js";
 import {
   projectShellFiles,
   resolveFrontendPreset,
   resolveThemeChoice,
   sanitizeAppName
-} from "./chunk-4IF54NU5.js";
+} from "./chunk-VPAWRBK5.js";
 import {
   XANO_DIR,
   resolveAiPresets,
   scaffoldProject
-} from "./chunk-KA6G2L7U.js";
+} from "./chunk-VK26K7AY.js";
 import {
   TEST_EXPECT_TYPES
-} from "./chunk-G4EJMQLD.js";
+} from "./chunk-YX22LKQE.js";
 import {
   raw
-} from "./chunk-LU7TRWMC.js";
+} from "./chunk-6VNRMKFJ.js";
 import {
   codegenLanding,
   describeOrigin,
   renderCodegenMarker,
   renderCodegenReadme
-} from "./chunk-ANUDXFEX.js";
+} from "./chunk-RQNMTDXD.js";
 import {
   FIELD_METHODS,
   SUPERSEDED_STATEMENTS,
   supersededBy
-} from "./chunk-BSK7ELHU.js";
+} from "./chunk-PR7OXHGZ.js";
 import {
   DEFAULT_PREFERENCES,
   DEFAULT_SETTINGS,
@@ -50,7 +50,7 @@ import {
   searchConstrainsRows,
   tableTrigger,
   workspaceTrigger
-} from "./chunk-UOZMSF4C.js";
+} from "./chunk-GSP2BY4F.js";
 import {
   linkedTableOf,
   tableRefOf
@@ -72,18 +72,18 @@ import {
   normalize,
   retiredInputSuccessor,
   retiredInputs
-} from "./chunk-3INK4Y4E.js";
+} from "./chunk-AE3PDSDS.js";
 import {
   STATEMENT_SURFACES,
   sPathOf
-} from "./chunk-BC2C5GVI.js";
+} from "./chunk-DCMANKMX.js";
 import {
   loadDefault,
   readVersion
-} from "./chunk-RCT7UX7B.js";
+} from "./chunk-XT3XQ4PF.js";
 import {
   UsageError
-} from "./chunk-F6CYJ7TN.js";
+} from "./chunk-Z2ZIE5CO.js";
 import {
   blank,
   detail,
@@ -124,14 +124,14 @@ import {
   sys,
   toolset,
   withFilters
-} from "./chunk-QK7ZQJLP.js";
+} from "./chunk-N74KDCBD.js";
 import {
   parsePathParams,
   unboundPathParams
-} from "./chunk-WHOJWOSV.js";
+} from "./chunk-EETVJZAZ.js";
 import {
   REFERENCEABLE_KIND_PAYLOAD_KEYS
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 import {
   COLUMN_CONTEXT,
   INPUT_CONTEXT,
@@ -139,7 +139,7 @@ import {
   encodeField,
   encodeMockMap,
   encodeStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-2ZCUO2UG.js";
 
 // src/emit/codegen-command.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
@@ -1036,6 +1036,7 @@ function parseMember(cur) {
   let built = lifted.built;
   const symbols = [...lifted.symbols];
   const filterExprs = [];
+  let absorbNowCoercion = built.tag === "const:epochms" && built.value === "now";
   while (cur.eat("|")) {
     const name = cur.take(/[A-Za-z0-9_]/);
     if (name === "" || !FILTER_NAMES.includes(name)) return null;
@@ -1059,9 +1060,15 @@ function parseMember(cur) {
     } catch {
       return null;
     }
+    if (absorbNowCoercion && name === "to_epochms" && argBuilt.length === 0) {
+      absorbNowCoercion = false;
+      continue;
+    }
+    absorbNowCoercion = false;
     built = withFilters(built, filterValue);
     filterExprs.push(call(`fl.${name}`, ...argExprs));
   }
+  if (filterExprs.length === 0) return { expr, built, symbols };
   return {
     expr: call("withFilters", expr, ...filterExprs),
     built,
@@ -6746,7 +6753,7 @@ async function fetchBundle(args, source) {
   if (source.kind === "ephemeral") {
     const auth3 = await getAccessToken(args);
     const name = resolveEphemeralName(auth3, source.name);
-    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-U4AQ3TXX.js");
+    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-2NKPEXUU.js");
     const summary = await resolveLive(auth3, auth3.workspaceId, name);
     step(`Reading ephemeral "${name}"`);
     return {
@@ -7008,4 +7015,4 @@ export {
   verifyCrashEntry,
   blameGeneratedFile
 };
-//# sourceMappingURL=chunk-HYBN4H3F.js.map
+//# sourceMappingURL=chunk-PLE5QQOZ.js.map

package/dist/{chunk-BSK7ELHU.js → chunk-PR7OXHGZ.js}

@@ -67,4 +67,4 @@ export {
   SUPERSEDED_STATEMENTS,
   supersededBy
 };
-//# sourceMappingURL=chunk-BSK7ELHU.js.map
+//# sourceMappingURL=chunk-PR7OXHGZ.js.map

package/dist/{chunk-OWGCOGKK.js → chunk-QYSQ3UDO.js}

@@ -13,7 +13,7 @@ import {
   reversedRegexOperands,
   stackReferencesAuth,
   tableColumns
-} from "./chunk-QK7ZQJLP.js";
+} from "./chunk-N74KDCBD.js";
 import {
   CANONICAL_PAYLOAD_KEYS,
   REFERENCEABLE_KINDS,
@@ -26,7 +26,7 @@ import {
   mintCanonical,
   recordObserved,
   resolveRef
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 
 // src/workspace/seed-coerce.ts
 function coerceScalarValue(label, column, type, value, values) {
@@ -1411,7 +1411,7 @@ var Xano = class {
   }
   /**
    * Every def object handed to {@link register}, by identity, so the SAME one
-   * registered twice is caught at the call that did it (issue #54).
+   * registered twice is caught at the call that did it.
    *
    * Identity, not structure. Two separately constructed defs sharing a name are
    * a genuine collision, and the guid check at export already diagnoses that
@@ -1448,7 +1448,7 @@ var Xano = class {
    * what `workspace("my-app")` set — so the natural chain
    * `workspace("my-app").registerWorkspace(workspaceConfig({ history }))` no
    * longer makes an author restate a name this registry has held since its
-   * first call (#228). An explicit `name` still wins, and a rename this way is
+   * first call. An explicit `name` still wins, and a rename this way is
    * a rename of the workspace.
    */
   registerWorkspace(def) {
@@ -1576,7 +1576,7 @@ var Xano = class {
    * With `options.strict`, every build WARNING fails the export instead of
    * printing — the shapes that deploy clean and then lose data or return the
    * wrong rows. Nothing about the emitted bundle changes; it either exports or
-   * it does not (issue #15).
+   * it does not.
    */
   export(options = {}) {
     const lockCtx = options.lock;
@@ -1686,7 +1686,7 @@ var Xano = class {
   }
   /**
    * Warn about an `auth()`-keyed middleware **directly attached** to a host where
-   * `auth()` may resolve to `null` (issue #81).
+   * `auth()` may resolve to `null`.
    *
    * The footgun: a rate limiter keyed by `auth("id")` is the canonical middleware,
    * but attach it to a host with no authenticated caller and `auth()` silently
@@ -1701,7 +1701,7 @@ var Xano = class {
    * false positives on legitimate use. The warning names the host and reason so
    * the author can confirm intent, vary the key, or move to an authenticated host.
    *
-   * Scope: the host's EFFECTIVE chain, across all three tiers (issue #43). The
+   * Scope: the host's EFFECTIVE chain, across all three tiers. The
    * guard used to see only a host's own `middleware.pre`/`post`, so an author who
    * DRY'd a per-user limiter up to `apiGroup({ middleware })` or to the workspace
    * tier silently reintroduced the shared bucket — the same collapse, attached
@@ -1858,4 +1858,4 @@ export {
   Xano,
   workspace
 };
-//# sourceMappingURL=chunk-OWGCOGKK.js.map
+//# sourceMappingURL=chunk-QYSQ3UDO.js.map

package/dist/{chunk-ZQ2PKR6R.js → chunk-RQ3FXV4K.js}

@@ -27,7 +27,7 @@ async function resolveMetaTarget(auth, selector, deps = {}) {
     case "workspace":
       return { base: auth.instance, workspaceId: auth.workspaceId, label: `workspace ${auth.workspaceId}` };
     case "ephemeral": {
-      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-U4AQ3TXX.js")).resolveLive;
+      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-2NKPEXUU.js")).resolveLive;
       return resolveEphemeral(auth, selector.name, { ...deps, resolveLive });
     }
   }
@@ -37,4 +37,4 @@ export {
   resolveEphemeralName,
   resolveMetaTarget
 };
-//# sourceMappingURL=chunk-ZQ2PKR6R.js.map
+//# sourceMappingURL=chunk-RQ3FXV4K.js.map