@xanots/sdk 0.0.5 → 0.0.7

package/dist/{chunk-OARSPAIE.js → chunk-5PDOAR77.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-ZOYMZZ3S.js";
 import {
   getAccessToken
-} from "./chunk-SG4UBJ47.js";
+} from "./chunk-3QW5NFZJ.js";
 import {
   exportWorkspaceBundle
 } from "./chunk-QTNO2WD6.js";
@@ -27,15 +27,15 @@ import {
   resolveFrontendPreset,
   resolveThemeChoice,
   sanitizeAppName
-} from "./chunk-KXCPZUUM.js";
+} from "./chunk-DBHE35JM.js";
 import {
   XANO_DIR,
   resolveAiPresets,
   scaffoldProject
-} from "./chunk-7SISR3CS.js";
+} from "./chunk-4PE4ZAB7.js";
 import {
   TEST_EXPECT_TYPES
-} from "./chunk-PXXLBXOP.js";
+} from "./chunk-JAVB27HL.js";
 import {
   raw
 } from "./chunk-LU7TRWMC.js";
@@ -44,7 +44,7 @@ import {
   describeOrigin,
   renderCodegenMarker,
   renderCodegenReadme
-} from "./chunk-QUUB7HYK.js";
+} from "./chunk-P5C2YKAM.js";
 import {
   FIELD_METHODS,
   STATEMENT_SURFACES,
@@ -67,14 +67,14 @@ import {
   searchConstrainsRows,
   tableTrigger,
   workspaceTrigger
-} from "./chunk-CYJ7R3AD.js";
+} from "./chunk-2V3JUXTF.js";
 import {
   loadDefault,
   readVersion
-} from "./chunk-MS3BRZAZ.js";
+} from "./chunk-CL2H2WYE.js";
 import {
   UsageError
-} from "./chunk-IVP6TS26.js";
+} from "./chunk-JQLR64UC.js";
 import {
   blank,
   detail,
@@ -115,7 +115,7 @@ import {
   sys,
   toolset,
   withFilters
-} from "./chunk-YUPQOLFX.js";
+} from "./chunk-NJGNUVXR.js";
 import {
   parsePathParams,
   unboundPathParams
@@ -130,7 +130,7 @@ import {
 } from "./chunk-5XZ744TS.js";
 import {
   REFERENCEABLE_KIND_PAYLOAD_KEYS
-} from "./chunk-YUBJLB6G.js";
+} from "./chunk-7JDT4PBU.js";
 
 // src/emit/codegen-command.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
@@ -2732,10 +2732,7 @@ function callDecoder(shape) {
         shape.path
       );
     }
-    const target = unbound ? lit(null) : shape.external ? obj2([
-      ["name", lit("")],
-      ["guid", lit(guid)]
-    ]) : resolveReference(a.ctx, a.refs, guid, { ...a.resolve, unresolved: "object-ref" });
+    const target = unbound ? lit(null) : resolveReference(a.ctx, a.refs, guid, { ...a.resolve, unresolved: "object-ref" });
     const entries = [[shape.arg, target]];
     const runtime = {
       [shape.arg]: unbound ? null : { name: "", guid }
@@ -2845,11 +2842,7 @@ var CALL_DECODERS = /* @__PURE__ */ new Map([
     "mvp:workspace_run_middleware",
     callDecoder({ path: "middleware.call", arg: "middleware", idPath: "id" })
   ],
-  ["mvp:workspace_run_addon", callDecoder({ path: "addon.call", arg: "addon", idPath: "id" })],
-  [
-    "mvp:action",
-    callDecoder({ path: "action.call", arg: "action", idPath: "run_version.id", external: true })
-  ]
+  ["mvp:workspace_run_addon", callDecoder({ path: "addon.call", arg: "addon", idPath: "id" })]
 ]);
 
 // src/codegen/specials/db.ts
@@ -4032,26 +4025,52 @@ function callInput2(a) {
   }
   return { expr: obj2(cells), runtime };
 }
+function registryInput(a) {
+  const list = a.stored.settings_registry;
+  return callInput2({ ...a, stored: { ...a.stored, input: Array.isArray(list) ? list : [] } });
+}
+function withCallBindings(a, entries, runtime) {
+  for (const [key2, read] of [
+    ["input", callInput2],
+    ["registry", registryInput]
+  ]) {
+    const decoded = read(a);
+    if (!decoded) return false;
+    if (Object.keys(decoded.runtime).length > 0) {
+      entries.push([key2, decoded.expr]);
+      runtime[key2] = decoded.runtime;
+    }
+  }
+  return true;
+}
+var actionCall = (a) => {
+  const context = a.stored.context ?? {};
+  const id2 = getPath2(context, "run_version.id");
+  if (typeof id2 !== "string" || id2 === "")
+    return declineHere("action.call: context.run_version.id is blank");
+  const entries = [["actionId", lit(id2)]];
+  const runtime = { actionId: id2 };
+  withAs(a, entries, runtime);
+  if (!withCallBindings(a, entries, runtime)) return null;
+  return prove(a.ctx, a.stored, "action.call", [runtime], [obj2(entries)]);
+};
 var actionPackageCall = (a) => {
   const context = a.stored.context ?? {};
-  if (getPath2(context, "action.trace_id") !== "" || getPath2(context, "package_version.id") !== "")
-    return declineHere("action.package.call: statement carries a marketplace identity");
-  const slug = getPath2(context, "package.slug");
-  if (typeof slug !== "string")
-    return declineHere("action.package.call: context.package.slug is not a string");
-  const entries = [["action", lit("")]];
-  const runtime = { action: "" };
-  if (slug !== "") {
-    entries.push(["package", lit(slug)]);
-    runtime.package = slug;
-  }
-  const input2 = callInput2(a);
-  if (!input2) return null;
-  if (Object.keys(input2.runtime).length > 0) {
-    entries.push(["input", input2.expr]);
-    runtime.input = input2.runtime;
+  const parts = {
+    traceId: getPath2(context, "action.trace_id"),
+    versionId: getPath2(context, "package_version.id"),
+    slug: getPath2(context, "package.slug")
+  };
+  const entries = [];
+  const runtime = {};
+  for (const [arg, value] of Object.entries(parts)) {
+    if (typeof value !== "string" || value === "")
+      return declineHere(`action.package.call: context identity part \`${arg}\` is blank`);
+    entries.push([arg, lit(value)]);
+    runtime[arg] = value;
   }
   withAs(a, entries, runtime);
+  if (!withCallBindings(a, entries, runtime)) return null;
   return prove(a.ctx, a.stored, "action.package.call", [runtime], [obj2(entries)]);
 };
 var workflowTestCall = (a) => {
@@ -4165,6 +4184,7 @@ var MISC_DECODERS = /* @__PURE__ */ new Map([
   ["mvp:realtime_publish", realtimePublish],
   ["mvp:create_auth", createAuthToken],
   ["mvp:guid", createGuid],
+  ["mvp:action", actionCall],
   ["mvp:action_package", actionPackageCall],
   ["mvp:workspace_run_workflow_test", workflowTestCall]
 ]);
@@ -6731,7 +6751,7 @@ async function fetchBundle(args, source) {
   if (source.kind === "sandbox") {
     const auth3 = await getAccessToken(args);
     step("Reading the sandbox workspace");
-    const { fetchSandboxBundle } = await import("./sandbox-export-command-R6QMEK3D.js");
+    const { fetchSandboxBundle } = await import("./sandbox-export-command-MO6DEZ7Z.js");
     return {
       bundle: await fetchSandboxBundle(auth3),
       origin: { source: "sandbox", origin: auth3.instance }
@@ -6745,7 +6765,7 @@ async function fetchBundle(args, source) {
       );
     }
     const auth3 = await getAccessToken(args);
-    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-46SL27GJ.js");
+    const { resolveLive, fetchEphemeralBundle } = await import("./ephemeral-command-SD2KLX4P.js");
     const summary = await resolveLive(auth3, auth3.workspaceId, name);
     step(`Reading ephemeral "${name}"`);
     return {
@@ -7014,4 +7034,4 @@ export {
   verifyCrashEntry,
   blameGeneratedFile
 };
-//# sourceMappingURL=chunk-OARSPAIE.js.map
+//# sourceMappingURL=chunk-5PDOAR77.js.map

package/dist/{chunk-5WGEURVI.js → chunk-6AAT2AYQ.js}

@@ -7,12 +7,20 @@ import {
 // src/deploy/import.ts
 var IMPORT_TIMEOUT_MS = 12e4;
 var PROBE_TIMEOUT_MS = 15e3;
+function plannedBranch(parsed) {
+  const summary = parsed.summary !== null && typeof parsed.summary === "object" && !Array.isArray(parsed.summary) ? parsed.summary : {};
+  for (const candidate of [parsed.branch, parsed.branch_label, summary.branch, summary.branch_label]) {
+    if (typeof candidate === "string" && candidate !== "") return candidate;
+  }
+  return void 0;
+}
 function query(opts) {
   const params = new URLSearchParams();
   if (opts.mode !== void 0) params.set("mode", opts.mode);
   if (opts.prune !== void 0) params.set("delete", String(opts.prune));
   if (opts.records !== void 0) params.set("records", String(opts.records));
   if (opts.truncate !== void 0) params.set("truncate", String(opts.truncate));
+  if (opts.branch !== void 0) params.set("branch", opts.branch);
   const qs = params.toString();
   return qs === "" ? "" : `?${qs}`;
 }
@@ -66,6 +74,16 @@ async function assertMergeSupported(auth, opts) {
 ${text}`
   );
 }
+function assertBranchTargetHonored(plan, requested, baseUrl) {
+  if (plan.branch === requested) return;
+  const observed = plan.branch === void 0 ? `it did not say which branch the plan targets` : `it planned against "${plan.branch}"`;
+  throw new Error(
+    `Refusing to release to branch "${requested}": ${observed}.
+  instance: ${baseUrl}
+An instance that predates branch support IGNORES the branch parameter, imports into whichever branch is LIVE, and still answers 200 \u2014 so a release that looked staged would have overwritten production. That is not recoverable, so it is not attempted on an instance that has not confirmed the target.
+Update the instance, or drop \`--branch\` to release to the live branch deliberately.`
+  );
+}
 function body(archive) {
   const form = new FormData();
   form.append("file", new Blob([archive], { type: "application/gzip" }), "workspace.gz");
@@ -145,12 +163,14 @@ ${text}`);
     hasRecords: parsed.has_records === true,
     hasEnv: parsed.has_env === true,
     operations,
+    branch: plannedBranch(parsed),
     raw: text
   };
 }
 
 export {
+  assertBranchTargetHonored,
   importWorkspaceArchive,
   planWorkspaceImport
 };
-//# sourceMappingURL=chunk-5WGEURVI.js.map
+//# sourceMappingURL=chunk-6AAT2AYQ.js.map

package/dist/{chunk-QA5ICJ4M.js → chunk-7BUTRVKA.js}

@@ -1,9 +1,9 @@
 import {
   compileBundle
-} from "./chunk-MS3BRZAZ.js";
+} from "./chunk-CL2H2WYE.js";
 import {
   missingArgument
-} from "./chunk-IVP6TS26.js";
+} from "./chunk-JQLR64UC.js";
 
 // src/emit/bundle-input.ts
 import { existsSync, readFileSync } from "fs";
@@ -34,4 +34,4 @@ export {
   assertBundleInput,
   loadBundleText
 };
-//# sourceMappingURL=chunk-QA5ICJ4M.js.map
+//# sourceMappingURL=chunk-7BUTRVKA.js.map

package/dist/{chunk-YUBJLB6G.js → chunk-7JDT4PBU.js}

@@ -269,6 +269,39 @@ function realtimeMessageSeedName(server, channelPath, name) {
     seedPart("message", "name", name)
   ].join(SEED_SEP);
 }
+function querySeedName(group, verb, name) {
+  return [
+    group === "" ? "" : seedPart("query", "apiGroup", group),
+    seedPart("query", "verb", verb),
+    seedPart("query", "name", name)
+  ].join(SEED_SEP);
+}
+function deriveQueryGuid(group, verb, name) {
+  const seed = `query:${querySeedName(group, verb, name)}`;
+  const guid = getLockedGuid(seed) ?? getLockedGuid(`query:${name}`) ?? rawDeriveGuid(seed);
+  SEEN_SEEDS.set(guid, seed);
+  return guid;
+}
+function queryGroupComponent(ref) {
+  if (ref.apiGroupId !== void 0) return `#${ref.apiGroupId}`;
+  const group = ref.apiGroup;
+  if (group === void 0) return "";
+  return typeof group === "string" ? group : group.name;
+}
+function resolveQueryRef(target) {
+  if (typeof target !== "string" && target.guid) {
+    if (target.name) SEEN_SEEDS.set(target.guid, `query:${target.name}`);
+    return target.guid;
+  }
+  const handle = typeof target === "string" ? void 0 : target;
+  if (handle?.verb !== void 0 && handle.name) {
+    return deriveQueryGuid(queryGroupComponent(handle), handle.verb, handle.name);
+  }
+  const label = typeof target === "string" ? `"${target}"` : `"${handle?.name ?? "?"}"`;
+  throw new Error(
+    `Cannot resolve query reference ${label}: a query's identity is composed from its api group, verb, and name, so a bare name cannot identify one. Pass the query() def handle (it carries all three), or a { name, guid } pair to address an object by explicit identity.`
+  );
+}
 function rawDeriveGuid(seed) {
   return md5Hex(seed);
 }
@@ -321,6 +354,30 @@ function resolvePayloadKey(kindOrPayloadKey) {
 function lockKey(payloadKey, name) {
   return `${payloadKey}:${name}`;
 }
+function lockNameForObject(payloadKey, obj, appNameByGuid) {
+  if (payloadKey !== "query") return obj.name;
+  const verb = typeof obj.verb === "string" ? obj.verb : "";
+  const appId = obj.app?.id;
+  let group = "";
+  if (typeof appId === "string" && appId !== "") {
+    group = appNameByGuid.get(appId) ?? appId;
+  } else if (typeof appId === "number" && appId !== 0) {
+    group = `#${appId}`;
+  }
+  return [group, verb, obj.name].join("|");
+}
+function appNamesByGuid(appSection) {
+  const map = /* @__PURE__ */ new Map();
+  if (!Array.isArray(appSection)) return map;
+  for (const row of appSection) {
+    if (!row || typeof row !== "object") continue;
+    const { name, guid } = row;
+    if (typeof name === "string" && typeof guid === "string" && guid !== "") {
+      map.set(guid, name);
+    }
+  }
+  return map;
+}
 function emptyLock() {
   return { version: LOCK_VERSION, objects: {} };
 }
@@ -447,11 +504,14 @@ function validateLockObjects(raw, path) {
       guidOwners.set(guid, key);
     }
     if (typeof canonical === "string") {
-      const owner = canonicalOwners.get(canonical);
+      const scope = isWorkspaceKey ? WORKSPACE_KEY : key.slice(0, key.indexOf(":"));
+      let owners = canonicalOwners.get(scope);
+      if (owners === void 0) canonicalOwners.set(scope, owners = /* @__PURE__ */ new Map());
+      const owner = owners.get(canonical);
       if (owner !== void 0) {
         fail(path, `entries "${owner}" and "${key}" share the same canonical (${canonical}).`);
       }
-      canonicalOwners.set(canonical, key);
+      owners.set(canonical, key);
     }
     const entry = {};
     if (typeof guid === "string") entry.guid = guid;
@@ -505,7 +565,7 @@ function recordObserved(ctx, key, identity) {
   const prior = ctx.observed[key];
   if (prior?.guid !== void 0 && identity.guid !== void 0 && prior.guid !== identity.guid) {
     throw new Error(
-      `Two exported objects collapse onto lock key "${key}" with different guids (${prior.guid} vs ${identity.guid}) \u2014 two same-kind objects sharing a name: a query verb pair pinning explicit guids, or a kind whose identity is composed from more than the name (a realtime channel is unique per server, a message per channel). The lock keys identity by (type, name) and cannot track both; rename one of the objects.`
+      `Two exported objects collapse onto lock key "${key}" with different guids (${prior.guid} vs ${identity.guid}) \u2014 two same-kind objects sharing a name behind explicit guids, or a realtime kind whose identity is composed from more than the name (a channel is unique per server, a message per channel). The lock cannot track both under one key; rename one of the objects.`
     );
   }
   const entry = ctx.lock.objects[key];
@@ -570,6 +630,7 @@ function adoptFromBundle(lock, bundle, bundlePath) {
       objects[key] = after;
     }
   };
+  const appNames = appNamesByGuid(sections["app"]);
   for (const payloadKey of LOCK_PAYLOAD_KEYS) {
     const arr = sections[payloadKey];
     if (!Array.isArray(arr)) continue;
@@ -578,18 +639,19 @@ function adoptFromBundle(lock, bundle, bundlePath) {
       if (!obj || typeof obj !== "object") continue;
       const o = obj;
       if (typeof o.name !== "string" || typeof o.guid !== "string" || o.guid === "") continue;
-      if (namesSeen.has(o.name)) {
+      const lockName = lockNameForObject(payloadKey, o, appNames);
+      if (namesSeen.has(lockName)) {
         throw new Error(
-          `${bundlePath} contains two "${payloadKey}" objects named "${o.name}" (a query verb pair, most likely). The lock keys by (type, name) and cannot represent both \u2014 adoption aborted. Rename one of them engine-side so names are unique, then re-export and re-adopt.`
+          `${bundlePath} contains two "${payloadKey}" objects with the identity "${lockName}" \u2014 the lock keys identity per kind and cannot represent both. Adoption aborted; rename one of them engine-side, then re-export and re-adopt.`
         );
       }
-      namesSeen.add(o.name);
+      namesSeen.add(lockName);
       const incoming = { guid: o.guid };
       if (typeof o.canonical === "string" && o.canonical !== "") {
         incoming.canonical = o.canonical;
         canonicalsSeen = true;
       }
-      applyEntry(lockKey(payloadKey, o.name), incoming);
+      applyEntry(lockKey(payloadKey, lockName), incoming);
     }
   }
   const ws = sections["workspace"];
@@ -660,6 +722,9 @@ export {
   REFERENCEABLE_KINDS,
   realtimeChannelSeedName,
   realtimeMessageSeedName,
+  deriveQueryGuid,
+  queryGroupComponent,
+  resolveQueryRef,
   deriveGuid,
   guidSeedHint,
   resolveRef,
@@ -669,6 +734,8 @@ export {
   CANONICAL_PAYLOAD_KEYS,
   resolvePayloadKey,
   lockKey,
+  lockNameForObject,
+  appNamesByGuid,
   emptyLock,
   parseLock,
   validateLockModel,
@@ -680,4 +747,4 @@ export {
   adoptFromBundle,
   mergeObserved
 };
-//# sourceMappingURL=chunk-YUBJLB6G.js.map
+//# sourceMappingURL=chunk-7JDT4PBU.js.map

package/dist/{chunk-LLWK6H77.js → chunk-BKDJN76G.js}

@@ -122,6 +122,34 @@ function oauthErrorCode(err) {
   }
   return void 0;
 }
+function oauthErrorResponse(err) {
+  const cause = err?.cause;
+  return typeof Response !== "undefined" && cause instanceof Response ? cause : void 0;
+}
+var OAUTH_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_request",
+  "invalid_client",
+  "invalid_grant",
+  "unauthorized_client",
+  "unsupported_grant_type",
+  "invalid_scope"
+]);
+async function resolveOAuthErrorCode(err) {
+  const rfc = oauthErrorCode(err);
+  if (rfc !== void 0) return rfc;
+  const res = oauthErrorResponse(err);
+  if (res === void 0 || res.bodyUsed) return void 0;
+  try {
+    const body = await res.clone().json();
+    if (!body || typeof body !== "object") return void 0;
+    const fields = body;
+    for (const candidate of [fields.error, fields.message, fields.code]) {
+      if (typeof candidate === "string" && OAUTH_ERROR_CODES.has(candidate)) return candidate;
+    }
+  } catch {
+  }
+  return void 0;
+}
 var OpenIdProvider = class {
   constructor(opts) {
     this.opts = opts;
@@ -470,6 +498,8 @@ export {
   DEFAULT_PORT,
   decodeAudience,
   oauthErrorCode,
+  oauthErrorResponse,
+  resolveOAuthErrorCode,
   OpenIdProvider,
   globalAuthFilePath,
   localAuthFilePath,
@@ -483,4 +513,4 @@ export {
   resolveScope,
   assertHttpsOrigin
 };
-//# sourceMappingURL=chunk-LLWK6H77.js.map
+//# sourceMappingURL=chunk-BKDJN76G.js.map