@xanots/sdk 0.0.11 → 0.0.13

package/dist/{chunk-OWGCOGKK.js → chunk-MEFMTICH.js}

@@ -13,7 +13,7 @@ import {
   reversedRegexOperands,
   stackReferencesAuth,
   tableColumns
-} from "./chunk-QK7ZQJLP.js";
+} from "./chunk-N74KDCBD.js";
 import {
   CANONICAL_PAYLOAD_KEYS,
   REFERENCEABLE_KINDS,
@@ -26,7 +26,7 @@ import {
   mintCanonical,
   recordObserved,
   resolveRef
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 
 // src/workspace/seed-coerce.ts
 function coerceScalarValue(label, column, type, value, values) {
@@ -777,6 +777,79 @@ function checkUnboundVarRefs(sections, bag) {
     }
   }
 }
+function checkPasswordInputHashing(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const record = obj;
+      if (!Array.isArray(record.input)) continue;
+      const passwordInputs = /* @__PURE__ */ new Set();
+      for (const entry of record.input) {
+        const declared = entry;
+        if (typeof declared?.name === "string" && declared.type === "password") {
+          passwordInputs.add(declared.name);
+        }
+      }
+      if (passwordInputs.size === 0) continue;
+      const name = record.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const statements = [];
+      collectStatements(obj, statements);
+      const reported = /* @__PURE__ */ new Set();
+      for (const statement of statements) {
+        if (statement.name !== "mvp:check_pass") continue;
+        const cell = statementInput(statement, "text_password");
+        if (cell?.tag !== "input" || typeof cell.value !== "string") continue;
+        const declaredName = inputBase(cell.value);
+        if (!passwordInputs.has(declaredName)) continue;
+        if (reported.has(declaredName)) continue;
+        reported.add(declaredName);
+        bag.warn(
+          "stack.password-input-double-hash",
+          `${owner}: \`s.security.check_password\` reads \`inp("${cell.value}")\`, and the input \`${declaredName}\` is declared \`input.password()\`. That hashes the submission on bind, and the stored \`f.password()\` column hashed on write, so \`check_password\` compares two DIFFERENT hashes and a correct password always fails \u2014 the endpoint answers false on a row it found, which reads as a wrong credential. Declare it \`input.text()\` and pass the plaintext: \`check_password\` does the comparison hash itself.`
+        );
+      }
+    }
+  }
+}
+function checkToThrowScope(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      const all = [];
+      collectStatements(obj, all);
+      const toThrows = all.filter((st) => st.name === "mvp:test_expect_to_throw");
+      if (toThrows.length === 0) continue;
+      const boundAnywhere = collectBindings(all);
+      for (const toThrow of toThrows) {
+        const body = toThrow.context?.run;
+        if (!Array.isArray(body) || body.length === 0) continue;
+        const inside = [];
+        collectStatements(body, inside);
+        const boundInside = collectBindings(inside);
+        const refs = [];
+        collectVarRefs(body, refs);
+        const reported = /* @__PURE__ */ new Set();
+        for (const path of refs) {
+          const dot = path.indexOf(".");
+          const base = dot === -1 ? path : path.slice(0, dot);
+          if (base === "" || base.startsWith("$")) continue;
+          if (RESERVED_VAR_NAMESPACES[base]) continue;
+          if (boundInside.has(base)) continue;
+          if (!boundAnywhere.has(base)) continue;
+          if (reported.has(base)) continue;
+          reported.add(base);
+          bag.warn(
+            "stack.to-throw-isolated-var",
+            `${owner}: \`ref("${path}")\` inside an \`s.expect.to_throw\` body names \`${base}\`, which is bound OUTSIDE the body. \`to_throw\` runs its \`body\` in an ISOLATED var stack, so \`${base}\` is not visible in there: the body raises \`Missing var entry: ${base}\` before reaching the statement under test, and the test reports \`to_throw failed - expected "\u2026" not found in error "Missing var entry: ${base}"\` \u2014 which reads as the guard not firing. Bind what the body needs INSIDE the body, or pass the value as a literal.`
+          );
+        }
+      }
+    }
+  }
+}
 var DB_MATCH_ARG = {
   "mvp:dbo_getby": "field_value",
   "mvp:dbo_delby": "field_value",
@@ -1411,7 +1484,7 @@ var Xano = class {
   }
   /**
    * Every def object handed to {@link register}, by identity, so the SAME one
-   * registered twice is caught at the call that did it (issue #54).
+   * registered twice is caught at the call that did it.
    *
    * Identity, not structure. Two separately constructed defs sharing a name are
    * a genuine collision, and the guid check at export already diagnoses that
@@ -1448,7 +1521,7 @@ var Xano = class {
    * what `workspace("my-app")` set — so the natural chain
    * `workspace("my-app").registerWorkspace(workspaceConfig({ history }))` no
    * longer makes an author restate a name this registry has held since its
-   * first call (#228). An explicit `name` still wins, and a rename this way is
+   * first call. An explicit `name` still wins, and a rename this way is
    * a rename of the workspace.
    */
   registerWorkspace(def) {
@@ -1576,7 +1649,7 @@ var Xano = class {
    * With `options.strict`, every build WARNING fails the export instead of
    * printing — the shapes that deploy clean and then lose data or return the
    * wrong rows. Nothing about the emitted bundle changes; it either exports or
-   * it does not (issue #15).
+   * it does not.
    */
   export(options = {}) {
     const lockCtx = options.lock;
@@ -1617,6 +1690,8 @@ var Xano = class {
     checkRealtimeDeliver(this.bundleType, sections, bag);
     checkTriggerBindings(sections, bag);
     checkUnboundVarRefs(sections, bag);
+    checkToThrowScope(sections, bag);
+    checkPasswordInputHashing(sections, bag);
     checkSafeRefMatchArgs(sections, bag);
     checkNullMatchArgs(sections, bag);
     checkPathSegmentCandidates(sections, bag);
@@ -1686,7 +1761,7 @@ var Xano = class {
   }
   /**
    * Warn about an `auth()`-keyed middleware **directly attached** to a host where
-   * `auth()` may resolve to `null` (issue #81).
+   * `auth()` may resolve to `null`.
    *
    * The footgun: a rate limiter keyed by `auth("id")` is the canonical middleware,
    * but attach it to a host with no authenticated caller and `auth()` silently
@@ -1701,7 +1776,7 @@ var Xano = class {
    * false positives on legitimate use. The warning names the host and reason so
    * the author can confirm intent, vary the key, or move to an authenticated host.
    *
-   * Scope: the host's EFFECTIVE chain, across all three tiers (issue #43). The
+   * Scope: the host's EFFECTIVE chain, across all three tiers. The
    * guard used to see only a host's own `middleware.pre`/`post`, so an author who
    * DRY'd a per-user limiter up to `apiGroup({ middleware })` or to the workspace
    * tier silently reintroduced the shared bucket — the same collapse, attached
@@ -1858,4 +1933,4 @@ export {
   Xano,
   workspace
 };
-//# sourceMappingURL=chunk-OWGCOGKK.js.map
+//# sourceMappingURL=chunk-MEFMTICH.js.map

package/dist/{chunk-QK7ZQJLP.js → chunk-N74KDCBD.js}

@@ -2,7 +2,7 @@ import {
   assertPathParamInputs,
   fillPathParams,
   parsePathParams
-} from "./chunk-WHOJWOSV.js";
+} from "./chunk-EETVJZAZ.js";
 import {
   appNamesByGuid,
   deriveGuid,
@@ -12,7 +12,7 @@ import {
   lockNameForObject,
   queryGroupComponent,
   resolveRef
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 import {
   COLUMN_CONTEXT,
   INPUT_CONTEXT,
@@ -22,7 +22,7 @@ import {
   encodeStatement,
   rawResponseItems,
   registerStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-2ZCUO2UG.js";
 import {
   sha1Bytes
 } from "./chunk-OHX6MIUZ.js";
@@ -139,7 +139,7 @@ var DiagnosticBag = class {
    * a guard. But the audience for this SDK is largely an agent that never reads
    * stderr, and CI has no way to notice a message nobody fails on. `strict`
    * gives a pipeline one switch that turns "printed something" into "did not
-   * ship" (issue #15).
+   * ship".
    *
    * Scope: the diagnostics an EXPORT collects. A guard that runs while a
    * statement is being built ({@link emitDiagnostic}) has already had its say by
@@ -374,7 +374,7 @@ var c = {
    * A `number` that is not an integer, or is past `Number.MAX_SAFE_INTEGER`,
    * **throws**: by the time such a literal reaches here its precision is already
    * gone, so encoding it would write a value the caller did not type. The throw
-   * names the string form. (issue #153)
+   * names the string form.
    */
   int(n) {
     return val(intLiteral(n), "const:int");
@@ -422,7 +422,7 @@ var c = {
    * null** the engine writes into a `db.*` statement's `@meta` slot —
    * `c.null("const:obj")` → `{tag:"const:obj", value:"null"}`, 16 of them across
    * eight ordinary queries in the survey corpus, which had no spelling and came
-   * back as `rawValue` (issue #151).
+   * back as `rawValue`.
    *
    * ⚠ Not the same bytes as `c.obj(null)`, which is the BLANK object
    * (`value: ""`). Both evaluate to null — the engine JSON-decodes the stored
@@ -438,7 +438,7 @@ var c = {
    * (`fl.regex_test`/`regex_match`/`regex_replace`/…). Xano runs PHP `preg_*`, so
    * the pattern MUST be delimiter-wrapped — a bare `c.text("^…$")` is an invalid
    * PCRE and the filter then matches *nothing* for every input, so a precondition
-   * built on it silently rejects all values (issue #128). This wraps the raw
+   * built on it silently rejects all values. This wraps the raw
    * pattern in `/…/`, escapes any interior `/`, and appends `flags`, so the result
    * is always valid; `withFilters` rejects a bare `c.text` pattern and points here.
    *
@@ -466,8 +466,13 @@ var c = {
    * `text("now") |to_epoch_ms` chain; both evaluate to the same epoch-ms number
    * on a live engine, and both persist verbatim, but the native tag is what the
    * editor writes and needs no filter to get there. Chain math onto it as usual:
-   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`. (issues #120,
-   * #145)
+   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`.
+   *
+   * Inside an `obj()` the tag is flattened into an expression string, where the
+   * identifier `now` alone is the STRING "now" — so `obj()` writes the
+   * `now|to_epochms` coercion that restores this tag's meaning. A `c.now()` used
+   * as a FILTER ARGUMENT there is refused: the coercion cannot be written in
+   * that position. Hoist it with `s.set_var` and `ref()` it.
    */
   now() {
     return val("now", "const:epochms");
@@ -478,7 +483,6 @@ var c = {
    * compile error and throws at runtime — it would serialize as internal
    * representation the engine can't decode. For a computed/multi-key object
    * response use a record of values (`response: { key: value }`), not `c.obj`.
-   * See issue #42.
    *
    * Called with no argument it is the **empty object**, `{}` — the same default
    * the editor gives a new object variable, and the only empty form current
@@ -495,7 +499,7 @@ var c = {
    * same bytes instead of being quietly re-pointed at `{}`.
    *
    * A **populated** object is stored the way the editor stores one: an empty
-   * `{}` base carrying one `set` filter per key (issue #248). It is NOT a
+   * `{}` base carrying one `set` filter per key. It is NOT a
    * populated JSON string — that form fails the request at runtime, see
    * {@link objSetFilters}.
    *
@@ -516,7 +520,7 @@ var c = {
   /**
    * Array constant → JSON-string value with `tag:"const:array"`. Takes **plain
    * JSON literals only** — like {@link obj}, a nested tagged value is a compile
-   * error and throws at runtime. See issue #42.
+   * error and throws at runtime.
    */
   array(a) {
     assertPlainJson(a);
@@ -1350,7 +1354,7 @@ var f = {
    * bytes, and a map does not preserve it.
    *
    * Without this there is no way to author a structured JSON column at all
-   * (issue #135).
+   *.
    */
   json(options = {}) {
     return descriptor("json", { ...options });
@@ -1420,9 +1424,8 @@ var f = {
    *   instead: `f.tableRef("tweets", { type: "int" })`. Identity guids derive
    *   from `(type, name)`, so the name form resolves to the same guid.
    *
-   * Byte-verified whole-object against a persisted table readback
-   * (`test/fixtures/tables/ex_field_table_ref.json`, asserted in
-   * `test/conformance/kinds-corpus.test.ts`): the `@` method carries
+   * Byte-verified whole-object against a persisted table readback: the `@`
+   * method carries
    * `disabled:false`, sits last in `methods`, and its `dbo=` arg is the target
    * table's payload guid.
    *
@@ -1469,7 +1472,7 @@ var input = {
    * password on **both** signup and login, let the `f.password` *column* hash on write,
    * and pass the plaintext straight to `check_password`. See the auth recipe in the
    * README. Reach for `input.password` only when you specifically want bind-time hashing
-   * and are not also comparing it with `check_password` (issue #109).
+   * and are not also comparing it with `check_password`.
    */
   password: makeInput("password"),
   /**
@@ -1599,8 +1602,15 @@ var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function serializeValue(v2, path) {
   const record = objSetRecord(v2, path);
   if (record) return record;
+  const nowExpr = serializeEpochMs(v2);
+  if (nowExpr !== null) return nowExpr + serializeFilters(v2, path);
   return serializeAtom(v2, path) + serializeFilters(v2, path);
 }
+function serializeEpochMs(v2) {
+  if (v2.tag !== "const:epochms") return null;
+  if (v2.value !== "now") return null;
+  return "now|to_epochms";
+}
 function objSetRecord(v2, path) {
   if (v2.tag !== "const:obj") return null;
   if (v2.value === "") {
@@ -1717,12 +1727,16 @@ function serializeAtom(v2, path) {
     // renders `$env.STRIPE_KEY`.
     case "setting":
       return `$env.${v2.value}`;
-    // The engine's native current-time constant. Only ever holds `"now"` — the
-    // same narrowing the decoder makes — so anything else falls through to the
-    // rejection rather than being rendered as a `now` it is not.
+    // The engine's native current-time constant reaches this function ONLY as a
+    // filter argument — a member position is answered by `serializeEpochMs`
+    // above. There it is unwritable: the value needs a leading `|to_epochms` to
+    // evaluate as a time at all (see `serializeEpochMs`), and inside an argument
+    // a trailing `|` binds to the whole value rather than to the argument, which
+    // is the same wall a pre-filtered argument hits.
     case "const:epochms":
-      if (v2.value === "now") return "now";
-      break;
+      throw new Error(
+        `obj(): \`${path}\` is \`c.now()\` used as a FILTER ARGUMENT. In an expression the current-time constant has to carry a \`|to_epochms\` coercion, and a \`|\` inside an argument binds to the whole value instead \u2014 so this cannot be written without changing what it means. Compute it in a prior step (\`s.set_var("now", c.now())\`) and reference it with \`ref("now")\`.`
+      );
     // `c.array([…])` stores plain JSON, and the literal grammar spells the same
     // list — so it renders to the identical bytes a bare `[…]` member does. The
     // bare form always worked and this one used to throw, which made the empty
@@ -1801,7 +1815,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
   const hole = argNames.slice(0, last).findIndex((n) => named[n] === void 0);
   if (hole !== -1) {
     throw new Error(
-      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too. (issue #221)`
+      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too.`
     );
   }
   assertArity(name, argNames, required, last + 1);
@@ -1810,7 +1824,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
 var assertArity = (name, argNames, required, got) => {
   if (got >= required) return;
   throw new Error(
-    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared. (issues #221, #246)`
+    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared.`
   );
 };
 var assertMaxArity = (name, argNames, got) => {
@@ -4237,4 +4251,4 @@ export {
   serializeBundle,
   emitBundle
 };
-//# sourceMappingURL=chunk-QK7ZQJLP.js.map
+//# sourceMappingURL=chunk-N74KDCBD.js.map

package/dist/{chunk-3IGNIP6R.js → chunk-NDP7OUPS.js}

@@ -86,4 +86,4 @@ export {
   fetchReadOrExplain,
   retryingFetch
 };
-//# sourceMappingURL=chunk-3IGNIP6R.js.map
+//# sourceMappingURL=chunk-NDP7OUPS.js.map

package/dist/{chunk-4Q7ZOHH7.js → chunk-OONT4ZL4.js}

@@ -1,9 +1,9 @@
 import {
   compileBundle
-} from "./chunk-RCT7UX7B.js";
+} from "./chunk-RLI6XD4O.js";
 import {
   missingArgument
-} from "./chunk-F6CYJ7TN.js";
+} from "./chunk-Z2ZIE5CO.js";
 
 // src/emit/bundle-input.ts
 import { existsSync, readFileSync } from "fs";
@@ -34,4 +34,4 @@ export {
   assertBundleInput,
   loadBundleText
 };
-//# sourceMappingURL=chunk-4Q7ZOHH7.js.map
+//# sourceMappingURL=chunk-OONT4ZL4.js.map

package/dist/{chunk-EQW3YT5U.js → chunk-P6PVBQL6.js}

@@ -1,7 +1,7 @@
 import {
   describeTransportFailure,
   httpFailure
-} from "./chunk-3IGNIP6R.js";
+} from "./chunk-NDP7OUPS.js";
 
 // src/deploy/branch.ts
 var BRANCH_TIMEOUT_MS = 3e4;
@@ -156,4 +156,4 @@ export {
   assertBranchAbsent,
   requireBranch
 };
-//# sourceMappingURL=chunk-EQW3YT5U.js.map
+//# sourceMappingURL=chunk-P6PVBQL6.js.map

package/dist/{chunk-QYMAZRAU.js → chunk-PJNWOZMT.js}

@@ -6,7 +6,7 @@ import {
   realtimeChannelGuid,
   realtimeServerRefName,
   resolveRealtimeServerRef
-} from "./chunk-UOZMSF4C.js";
+} from "./chunk-BYQHCCYU.js";
 import {
   assertCanonical,
   assertOneOf,
@@ -25,17 +25,17 @@ import {
   resolveAuthRef,
   resolveMockKeys,
   warnLiveDatasource
-} from "./chunk-QK7ZQJLP.js";
+} from "./chunk-N74KDCBD.js";
 import {
   deriveGuid,
   getLockedCanonical,
   lockKey,
   realtimeMessageSeedName,
   resolveRef
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 import {
   encodeStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-2ZCUO2UG.js";
 
 // src/kinds/canonical.ts
 function resolveCanonicalToken(label, payloadKey, accessor, def, override) {
@@ -667,4 +667,4 @@ export {
   addonKind,
   addon
 };
-//# sourceMappingURL=chunk-QYMAZRAU.js.map
+//# sourceMappingURL=chunk-PJNWOZMT.js.map

package/dist/{chunk-BSK7ELHU.js → chunk-PR7OXHGZ.js}

@@ -67,4 +67,4 @@ export {
   SUPERSEDED_STATEMENTS,
   supersededBy
 };
-//# sourceMappingURL=chunk-BSK7ELHU.js.map
+//# sourceMappingURL=chunk-PR7OXHGZ.js.map

package/dist/{chunk-RCT7UX7B.js → chunk-RLI6XD4O.js}

@@ -1,10 +1,10 @@
 import {
   ENV_SPELLINGS
-} from "./chunk-CTD5ZCV6.js";
+} from "./chunk-7WRJPKGK.js";
 import {
   readLockFile,
   writeLockFile
-} from "./chunk-XEOX6AM7.js";
+} from "./chunk-3LQGF2WS.js";
 import {
   UsageError,
   extraArguments,
@@ -15,7 +15,7 @@ import {
   unknownFlag,
   unknownHelpTopic,
   unknownSubcommand
-} from "./chunk-F6CYJ7TN.js";
+} from "./chunk-Z2ZIE5CO.js";
 import {
   detail,
   info,
@@ -26,13 +26,13 @@ import {
   Xano,
   assertSeedIds,
   coerceSeedRowValues
-} from "./chunk-OWGCOGKK.js";
+} from "./chunk-MEFMTICH.js";
 import {
   getCommand,
   getSubcommand,
   isCommand,
   suggest
-} from "./chunk-DIA7CT7J.js";
+} from "./chunk-V5Y7D4LH.js";
 import {
   FILTER_NAMES,
   KNOWLEDGE_DIR,
@@ -46,7 +46,7 @@ import {
   pathSegment,
   serializeBundle,
   tableColumns
-} from "./chunk-QK7ZQJLP.js";
+} from "./chunk-N74KDCBD.js";
 import {
   WORKSPACE_KEY,
   createLockContext,
@@ -58,7 +58,7 @@ import {
   seedLockOverrides,
   serializeLock,
   validateLockModel
-} from "./chunk-VAF6A3YD.js";
+} from "./chunk-XWFRNJMQ.js";
 
 // src/emit/cli.ts
 import { pathToFileURL as pathToFileURL3, fileURLToPath as fileURLToPath3 } from "url";
@@ -441,6 +441,7 @@ function parseArgs(argv) {
   let backupBranch;
   let emit2;
   let json = false;
+  let noRefresh = false;
   let open = false;
   const positionals = [];
   const positionalAt = [];
@@ -670,6 +671,8 @@ function parseArgs(argv) {
     } else if (arg.startsWith("--backup-branch=")) {
       const value = arg.slice("--backup-branch=".length);
       backupBranch = value === "" ? true : value;
+    } else if (arg === "--no-refresh") {
+      noRefresh = true;
     } else if (arg === "--json") {
       json = true;
     } else if (arg === "--open") {
@@ -785,6 +788,7 @@ function parseArgs(argv) {
     backupBranch,
     emit: emit2,
     json,
+    noRefresh,
     open,
     unknownFlags
   };
@@ -1004,11 +1008,11 @@ async function run(argv) {
     return;
   }
   if (command === "init") {
-    const { runInitCommand } = await import("./init-command-NPVL32L6.js");
+    const { runInitCommand } = await import("./init-command-DNDONP3O.js");
     return runInitCommand(args);
   }
   if (command === "completion") {
-    const { isCompletionShell, runCompletionCommand, COMPLETION_SHELLS } = await import("./completion-WF46272M.js");
+    const { isCompletionShell, runCompletionCommand, COMPLETION_SHELLS } = await import("./completion-HJU5QEFB.js");
     const shell = args.positionals[0];
     if (shell === void 0 || !isCompletionShell(shell)) {
       throw new UsageError(
@@ -1019,15 +1023,15 @@ async function run(argv) {
     return runCompletionCommand(shell);
   }
   if (command === "upgrade") {
-    const { runUpgradeCommand } = await import("./upgrade-command-BN3EHAOI.js");
+    const { runUpgradeCommand } = await import("./upgrade-command-A75DOIUH.js");
     return runUpgradeCommand(args);
   }
   if (command === "lock") {
-    const { runLockCommand } = await import("./lock-commands-ZZKZ4LZJ.js");
+    const { runLockCommand } = await import("./lock-commands-6U7UIJGR.js");
     return runLockCommand(args);
   }
   if (command === "login") {
-    const { runLoginCommand } = await import("./login-command-Z6CHTA57.js");
+    const { runLoginCommand } = await import("./login-command-P7LXD5TE.js");
     return runLoginCommand(args);
   }
   if (command === "logout") {
@@ -1035,45 +1039,45 @@ async function run(argv) {
     return runLogoutCommand(args);
   }
   if (command === "deploy") {
-    const { runDeployCommand } = await import("./deploy-command-IP7V7GT4.js");
+    const { runDeployCommand } = await import("./deploy-command-CGVKRWUE.js");
     return runDeployCommand(args);
   }
   if (command === "ephemeral") {
-    const { runEphemeralCommand } = await import("./ephemeral-command-U4AQ3TXX.js");
+    const { runEphemeralCommand } = await import("./ephemeral-command-2NKPEXUU.js");
     return runEphemeralCommand(args);
   }
   if (command === "release") {
-    const { runReleaseCommand } = await import("./release-command-IMNTIVWK.js");
+    const { runReleaseCommand } = await import("./release-command-CMMYT6XK.js");
     return runReleaseCommand(args);
   }
   if (command === "test") {
-    const { runTestCommand } = await import("./test-command-YAZLKLGQ.js");
+    const { runTestCommand } = await import("./test-command-YCAR4O35.js");
     return runTestCommand(args);
   }
   if (command === "workspace") {
-    const { runWorkspaceCommand } = await import("./workspace-command-MNK7Y7MQ.js");
+    const { runWorkspaceCommand } = await import("./workspace-command-YELP47SJ.js");
     return runWorkspaceCommand(args);
   }
   if (command === "status") {
-    const { runStatusCommand } = await import("./status-command-AL47VG7H.js");
+    const { runStatusCommand } = await import("./status-command-VARULAR5.js");
     return runStatusCommand(args);
   }
   if (command === "whoami") {
-    const { runProfileCommand } = await import("./profile-command-LJSBDV2L.js");
+    const { runProfileCommand } = await import("./profile-command-WBNSMQSI.js");
     return runProfileCommand(args);
   }
   if (command === "profile") {
     if (args.subcommand !== "me") {
       throw unknownSubcommand("profile", args.subcommand);
     }
-    const { runProfileCommand } = await import("./profile-command-LJSBDV2L.js");
+    const { runProfileCommand } = await import("./profile-command-WBNSMQSI.js");
     return runProfileCommand(args);
   }
   if (command === "marketplace") {
     if (!["list", "search", "details", "install"].includes(args.subcommand ?? "")) {
       throw unknownSubcommand("marketplace", args.subcommand);
     }
-    const marketplace = await import("./marketplace-command-P4IPLJ6J.js");
+    const marketplace = await import("./marketplace-command-T6JCHW7J.js");
     if (args.subcommand === "list") return marketplace.runMarketplaceListCommand(args);
     if (args.subcommand === "search") return marketplace.runMarketplaceSearchCommand(args);
     if (args.subcommand === "details") return marketplace.runMarketplaceDetailsCommand(args);
@@ -1083,7 +1087,7 @@ async function run(argv) {
     throw unknownCommand("push");
   }
   if (command === "preflight") {
-    const { runPreflightCommand } = await import("./preflight-command-K346GPTY.js");
+    const { runPreflightCommand } = await import("./preflight-command-UYE7SUQV.js");
     return runPreflightCommand(args);
   }
   if (command !== "compile" && command !== "export" && command !== "paths" && command !== "routes") {
@@ -1113,9 +1117,10 @@ async function run(argv) {
     process.stdout.write(json + "\n");
   }
 }
-async function refreshAgentGuidance() {
+async function refreshAgentGuidance(args) {
+  if (args.noRefresh) return;
   try {
-    const { refreshAgentFiles } = await import("./agent-file-refresh-QNKN5RYD.js");
+    const { refreshAgentFiles } = await import("./agent-file-refresh-GQWAAOBV.js");
     const refreshed = refreshAgentFiles({
       projectDir: process.cwd(),
       sdkVersion: readVersion()
@@ -1231,7 +1236,7 @@ async function runPaths(args) {
       return;
     }
     if (unresolved.length === 0) {
-      const { renderRouteManifest } = await import("./routes-manifest-PWZHDOI5.js");
+      const { renderRouteManifest } = await import("./routes-manifest-MN6XBYRE.js");
       const source = renderRouteManifest(
         resolved.map((r) => ({ name: r.name, verb: r.verb, canonical: r.canonical })),
         describableServers.length > 0 ? { servers: describableServers, channels: channelRows } : void 0
@@ -1287,7 +1292,7 @@ async function compileBundle(args, opts = {}) {
       `--frozen-lock: no xano.lock found at ${lockPath}. Create one with \`xanots export ${file} --lock\` and commit it.`
     );
   }
-  await refreshAgentGuidance();
+  await refreshAgentGuidance(args);
   const def = await loadDefault(file);
   if (!Xano.isXano(def)) {
     throw new Error(`Module "${file}" must default-export a Xano registry for \`export\`.`);
@@ -1348,4 +1353,4 @@ export {
   exportBundleJson,
   compileBundle
 };
-//# sourceMappingURL=chunk-RCT7UX7B.js.map
+//# sourceMappingURL=chunk-RLI6XD4O.js.map

package/dist/{chunk-ZQ2PKR6R.js → chunk-RQ3FXV4K.js}

@@ -27,7 +27,7 @@ async function resolveMetaTarget(auth, selector, deps = {}) {
     case "workspace":
       return { base: auth.instance, workspaceId: auth.workspaceId, label: `workspace ${auth.workspaceId}` };
     case "ephemeral": {
-      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-U4AQ3TXX.js")).resolveLive;
+      const resolveLive = deps.resolveLive ?? (await import("./ephemeral-command-2NKPEXUU.js")).resolveLive;
       return resolveEphemeral(auth, selector.name, { ...deps, resolveLive });
     }
   }
@@ -37,4 +37,4 @@ export {
   resolveEphemeralName,
   resolveMetaTarget
 };
-//# sourceMappingURL=chunk-ZQ2PKR6R.js.map
+//# sourceMappingURL=chunk-RQ3FXV4K.js.map