@xanots/sdk 0.0.9 → 0.0.10

package/CHANGELOG.md

@@ -11,6 +11,23 @@ listed here.
 
 ---
 
+## 0.0.9 — Eight reports from real use
+
+_2026-08-31_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.9)
+
+Eight reports, all from one round of real-world use, and every one of them a case that type-checks, exports under `--strict` and deploys clean before going wrong. The headline is a deploy that could not succeed at all: any seeded number below `1e-4` failed the import with a signature error that named nothing. The rest correct places where the docs described behavior the engine does not have — a search operator that silently matches nothing, a by-id read that rejects the sentinel the field docs prescribe, and a seeding question whose two possible answers demanded opposite designs.
+
+- Seed data holding a number below `1e-4` no longer fails the deploy
+- ⚠️ Every test JSON document puts its per-test array under `tests`
+- `like` and `ilike` match nothing for a bare term — reach for `includes`
+- `db.get_by_id` rejects the `0` optional-FK sentinel, and takes the whole request with it
+- A seeded `f.password()` column IS hashed, so demo credentials work as fixtures
+- Native email is discoverable, and the built-in provider needs no configuration
+- A relative entry path names the directory it resolved against
+- Three fields the docs called plain values take tagged ones
+
+---
+
 ## 0.0.8 — The auth() lookalike
 
 _2026-08-30_ · [release notes](https://github.com/xanots/sdk/releases/tag/v0.0.8)

package/README.md

@@ -119,17 +119,17 @@ The starter backend is empty but already compiles and deploys — grow it from t
 in `xano/EXAMPLE.md`. For the flags, the two presets, theming, and add-ons, see
 [The scaffolded project](https://github.com/xanots/sdk/blob/main/guides/scaffold.md).
 
-Prefer to see the theme before you commit to it? `xanots onboard` picks the framework, the
-palette, the typefaces and the add-ons in a browser, against a live preview, and hands the
-result back to `init` here in your terminal.
+Prefer to see the theme before you commit to it? `--web` picks the framework, the palette,
+the typefaces and the add-ons in a browser, against a live preview, and hands the result
+back to `init` here in your terminal.
 
 ```bash
-npx @xanots/sdk onboard my-app
+npx @xanots/sdk init my-app --web
 ```
 
 It is a nicer way to arrive at the flags above, not a second scaffolder — it prints the
 equivalent `init` command when it is done, so the project stays reproducible from a script.
-The configurator is downloaded on demand, so `onboard` needs the registry before it can
+The configurator is downloaded on demand, so `--web` needs the registry before it can
 start; `init` reaches out only to install the new project's dependencies, which
 `--no-install` skips.
 
@@ -263,7 +263,7 @@ statements, values, inputs, and middleware are all in the
 
 | Command | Where it goes |
 |---|---|
-| `xanots deploy` | A disposable **ephemeral** environment (default) — create-or-refreshed each run, auto-expiring, with its own URL. `--dest sandbox` targets your throwaway singleton instead. |
+| `xanots deploy` | A disposable **ephemeral** environment — create-or-refreshed each run, auto-expiring, with its own URL. There is no other destination and no flag to choose one. |
 | `xanots release` | Your **main Xano instance** workspace — the production target. **Merges** by default: objects are updated in place or added, and your table data is never touched unless you ask. |
 
 Every `deploy` is a **full replace** of the disposable environment — always fresh, no merge
@@ -277,10 +277,15 @@ change, and asks. `--yes` skips the prompt for CI but never skips the preview. S
 `xanots release ./xano/index.ts --dry-run` to see the plan without committing to it.
 
 > ⚠️ A deploy is a full replace of the target environment, **including its table records**,
-> before importing. The blast radius is your own disposable ephemeral or sandbox — but
+> before importing. The blast radius is your own disposable ephemeral — but
 > anything you only ever created by hand in it is gone. That is exactly why production has a
 > separate `release` path.
 
+`xanots status` answers where you stand in one read — who you are signed in as, which
+instance and workspace your credential is bound to, and the environment this project last
+deployed to, including whether it is still alive and when it expires. You never have to
+remember the environment's name; it is tracked with the project.
+
 Every flag, the `--prune` rules, the identity model, and headless CI runs are in
 [Signing in & deploying](https://github.com/xanots/sdk/blob/main/guides/deploying.md). Environment management is
 `xanots ephemeral <list|get|delete|export>`.
@@ -291,8 +296,9 @@ The tests you author — a `tests` entry on a query, function, or middleware, or
 `workflowTest()` — run against a deployed environment:
 
 ```bash
-npx xanots test run-all                    # the ephemeral you last deployed to
-npx xanots test run-all --dest workspace   # or your real workspace (this only reads)
+npx xanots test run-all                       # the ephemeral you last deployed to
+npx xanots test run-all --env ephemeral:pr-3  # or a named one
+npx xanots test run-all --env workspace       # or your real workspace (this only reads)
 ```
 
 `xanots test list` shows what is there without running it, and `xanots test run "<name>"`
@@ -344,7 +350,7 @@ Importing a def carries the SDK runtime with it. When that matters, emit a route
 instead — plain data plus one interpolator, importing nothing:
 
 ```bash
-xanots paths ./xano/index.ts --emit xano/routes.gen.ts
+xanots routes ./xano/index.ts --emit xano/routes.gen.ts
 ```
 
 Route names and their `{param}` keys are still checked at compile time, so a backend rename
@@ -356,21 +362,22 @@ rules, endpoint-name constraints, and the realtime helpers are in
 
 ## Already have a Xano workspace?
 
-`codegen` runs the loop the other way: it reads a workspace and writes it back out as
+`--from` runs the loop the other way: it reads a workspace and writes it back out as
 readable XanoTS source — real `s.db.query(...)`, `f.email()`, typed defs — not a JSON dump.
-And not a loose pile of files either: you get the same runnable project `xanots init`
-scaffolds, with the pulled workspace filling `xano/`. So a pull deploys:
+And not a loose pile of files either: it is the same runnable project `xanots init`
+scaffolds, with the pulled workspace filling `xano/` instead of the starter. So a pull
+deploys:
 
 ```bash
-xanots workspace codegen my-app   # your real workspace (the one your login is scoped to)
+xanots init my-app --from workspace   # your real workspace (the one your login is scoped to)
 cd my-app
 npm run build
-npm run xano:deploy               # → a live ephemeral URL
+npm run xano:deploy                   # → a live ephemeral URL
 ```
 
-The other three sources are the same command with a different origin — `xanots sandbox
-codegen`, `xanots ephemeral codegen`, and `xanots codegen ws.json` for a bundle already on
-disk (offline, no login).
+The other two sources are the same flag with a different value — `--from ephemeral:<name>`,
+and `--from ./ws.json` for a bundle already on disk (offline, no login). Everything else about the project is unchanged, so `--theme`, `--ai` and `--web`
+compose with a pull exactly as they do with a starter.
 
 Object identities are preserved, so cross-references stay intact, and a statement this SDK
 does not model yet round-trips verbatim rather than breaking the pull. Then it checks its own
@@ -379,7 +386,7 @@ from, so "it compiled" and "it means the same thing" are separate claims and you
 
 > ⚠️ **`xano/` is a scratch surface.** Regenerating rewrites it, it carries schema only — no
 > table rows — and deploying it is a *full replace* of the target. Pull from your real
-> workspace, edit, and `deploy` to a disposable ephemeral or sandbox. Workspace env var
+> workspace, edit, and `deploy` to a disposable ephemeral. Workspace env var
 > **values** ride inline in `xano/workspace.ts`, so treat a pulled tree as secret-bearing
 > before you commit it.
 
@@ -401,10 +408,10 @@ reference, the guides carry the shape of a project and the behavior that will bi
 | [Object kinds](https://github.com/xanots/sdk/blob/main/guides/object-kinds.md) | Every authorable kind, and splitting a workspace across microservices |
 | [Authoring reference](https://github.com/xanots/sdk/blob/main/guides/authoring.md) | Tables and fields, statements, values, inputs, middleware, seed data |
 | [CLI](https://github.com/xanots/sdk/blob/main/guides/cli.md) | Every command, shell completion, and what failures look like |
-| [Signing in & deploying](https://github.com/xanots/sdk/blob/main/guides/deploying.md) | Auth, ephemerals, `--static`, releasing to production, `xanots validate` |
+| [Signing in & deploying](https://github.com/xanots/sdk/blob/main/guides/deploying.md) | Auth, ephemerals, `--static`, releasing to production, `xanots preflight` |
 | [Environment & identity](https://github.com/xanots/sdk/blob/main/guides/environment.md) | Every environment variable, and how `xano.lock` pins identity |
 | [The typed frontend surface](https://github.com/xanots/sdk/blob/main/guides/typed-frontend.md) | Path resolution, input/response inference, bundle cost, the route manifest |
-| [Pulling an existing workspace](https://github.com/xanots/sdk/blob/main/guides/codegen.md) | What `xanots codegen` writes, how faithful it is, and how to read its report |
+| [Pulling an existing workspace](https://github.com/xanots/sdk/blob/main/guides/codegen.md) | What `xanots init --from` writes, how faithful it is, and how to read its report |
 | [Coverage & agent grounding](https://github.com/xanots/sdk/blob/main/guides/coverage.md) | What is covered, what is out of scope, and the files agents read |
 
 The package also ships two machine-readable descriptions of the same surface, generated from

package/dist/.build-fingerprint

@@ -1 +1 @@
-6be27443d5fbd10d871e0401f52565ed89d47edcc49810206bbf1efb9497f539
+d72e74909376b02042f7e65298a7158f3c3646928e959af4a14a7409667d070d

package/dist/{agent-file-refresh-4W37DGXS.js → agent-file-refresh-QNKN5RYD.js}

@@ -3,8 +3,8 @@ import {
   codingAgentDetected,
   isCI,
   refreshAgentFiles
-} from "./chunk-QIWBCS7N.js";
-import "./chunk-4PE4ZAB7.js";
+} from "./chunk-JGCWTCA7.js";
+import "./chunk-KA6G2L7U.js";
 import "./chunk-ZSYZTGJH.js";
 import "./chunk-Q77KNEUL.js";
 import "./chunk-EZG76F7R.js";
@@ -14,4 +14,4 @@ export {
   isCI,
   refreshAgentFiles
 };
-//# sourceMappingURL=agent-file-refresh-4W37DGXS.js.map
+//# sourceMappingURL=agent-file-refresh-QNKN5RYD.js.map

package/dist/bin.js

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import {
   maybeNotifyUpdate
-} from "./chunk-OW2QZEWL.js";
+} from "./chunk-5YCQ2QHH.js";
 import {
   readVersion,
   run
-} from "./chunk-K3YSQDXJ.js";
+} from "./chunk-ACCBOMCB.js";
+import "./chunk-CTD5ZCV6.js";
+import "./chunk-OYMR5AMJ.js";
 import {
   exitCodeOf,
   reportFailure
-} from "./chunk-JQLR64UC.js";
-import "./chunk-OYMR5AMJ.js";
+} from "./chunk-F6CYJ7TN.js";
 import "./chunk-GNPVYOPB.js";
 import {
   clearProgress,
   error
 } from "./chunk-EZG76F7R.js";
-import "./chunk-UDL46O35.js";
-import "./chunk-OKNSR7MT.js";
-import "./chunk-QONOJO45.js";
+import "./chunk-VKSOTZK3.js";
+import "./chunk-DIA7CT7J.js";
+import "./chunk-LBYWGMOA.js";
 import "./chunk-WHOJWOSV.js";
 import "./chunk-5XZ744TS.js";
 import "./chunk-7JDT4PBU.js";

package/dist/{branch-commands-PBQ36L4A.js → branch-commands-2BLOC2GR.js}

@@ -6,19 +6,20 @@ import {
 } from "./chunk-EQW3YT5U.js";
 import {
   confirm
-} from "./chunk-4PTSTDIG.js";
-import {
-  getAccessToken
-} from "./chunk-3QW5NFZJ.js";
-import "./chunk-BKDJN76G.js";
+} from "./chunk-AIZKXUNP.js";
 import {
   isMachineOutput,
   writeJson
 } from "./chunk-NUQCEOKA.js";
+import {
+  getAccessToken
+} from "./chunk-QKM4U5UK.js";
+import "./chunk-FE5I6S6N.js";
 import "./chunk-3IGNIP6R.js";
 import {
-  UsageError
-} from "./chunk-JQLR64UC.js";
+  UsageError,
+  assertNoForce
+} from "./chunk-F6CYJ7TN.js";
 import "./chunk-GNPVYOPB.js";
 import {
   blank,
@@ -28,7 +29,7 @@ import {
   success,
   warn
 } from "./chunk-EZG76F7R.js";
-import "./chunk-OKNSR7MT.js";
+import "./chunk-DIA7CT7J.js";
 
 // src/emit/branch-commands.ts
 var VERBS = ["list", "set-live", "delete"];
@@ -60,6 +61,7 @@ function renderList(branches, workspaceId) {
   detail("Branches scope logic. Tables and microservices are shared by every branch.");
 }
 async function runBranchCommand(args) {
+  assertNoForce(args.force, "workspace", "branch");
   const verb = assertVerb(args.positionals[0]);
   const auth = await getAccessToken(args);
   const workspaceId = auth.workspaceId;
@@ -87,7 +89,7 @@ async function runBranchCommand(args) {
     if (outgoing !== void 0) detail(`The runtime stops serving "${outgoing}" and starts serving "${label}".`);
     detail("Table data is unaffected \u2014 it is shared by every branch either way.");
     blank();
-    if (!args.yes && !args.force) {
+    if (!args.yes) {
       const ok = await confirm(`Make "${label}" the live branch?`, {
         flag: "--yes",
         helpFor: { command: "workspace", subcommand: "branch" }
@@ -114,7 +116,7 @@ Promote another branch first (\`xanots workspace branch set-live <other>\`), the
       { helpFor: { command: "workspace", subcommand: "branch" } }
     );
   }
-  if (!args.yes && !args.force) {
+  if (!args.yes) {
     const ok = await confirm(`Delete branch "${label}" from workspace #${workspaceId}?`, {
       flag: "--yes",
       helpFor: { command: "workspace", subcommand: "branch" }
@@ -131,4 +133,4 @@ Promote another branch first (\`xanots workspace branch set-live <other>\`), the
 export {
   runBranchCommand
 };
-//# sourceMappingURL=branch-commands-PBQ36L4A.js.map
+//# sourceMappingURL=branch-commands-2BLOC2GR.js.map

package/dist/{capture-7PO6SGB4.js → capture-4WVJY4DQ.js}

@@ -1,6 +1,6 @@
 import {
   fixtureDirForKind
-} from "./chunk-T4XPCJRF.js";
+} from "./chunk-TCFIPDB3.js";
 
 // src/validate/capture.ts
 import { mkdirSync, writeFileSync } from "fs";
@@ -29,4 +29,4 @@ function safeName(name) {
 export {
   captureFixtures
 };
-//# sourceMappingURL=capture-7PO6SGB4.js.map
+//# sourceMappingURL=capture-4WVJY4DQ.js.map

package/dist/{chunk-ZOYMZZ3S.js → chunk-3INK4Y4E.js}

@@ -976,4 +976,4 @@ export {
   filledContext,
   normalize
 };
-//# sourceMappingURL=chunk-ZOYMZZ3S.js.map
+//# sourceMappingURL=chunk-3INK4Y4E.js.map

package/dist/{chunk-NDZFBZHC.js → chunk-3UABJA4X.js}

@@ -164,4 +164,4 @@ export {
   readyRatio,
   printMicroserviceSection
 };
-//# sourceMappingURL=chunk-NDZFBZHC.js.map
+//# sourceMappingURL=chunk-3UABJA4X.js.map

package/dist/{chunk-7OXFMCTX.js → chunk-5R73LFWK.js}

@@ -6,7 +6,7 @@ import {
   realtimeChannelGuid,
   realtimeServerRefName,
   resolveRealtimeServerRef
-} from "./chunk-ZZLPTHT5.js";
+} from "./chunk-P6TAVLOX.js";
 import {
   assertCanonical,
   assertOneOf,
@@ -25,7 +25,7 @@ import {
   resolveAuthRef,
   resolveMockKeys,
   warnLiveDatasource
-} from "./chunk-QONOJO45.js";
+} from "./chunk-LBYWGMOA.js";
 import {
   encodeStatement
 } from "./chunk-5XZ744TS.js";
@@ -667,4 +667,4 @@ export {
   addonKind,
   addon
 };
-//# sourceMappingURL=chunk-7OXFMCTX.js.map
+//# sourceMappingURL=chunk-5R73LFWK.js.map

package/dist/{chunk-OW2QZEWL.js → chunk-5YCQ2QHH.js}

@@ -1,6 +1,6 @@
 import {
   readVersion
-} from "./chunk-K3YSQDXJ.js";
+} from "./chunk-ACCBOMCB.js";
 import {
   atomicWrite
 } from "./chunk-GNPVYOPB.js";
@@ -170,4 +170,4 @@ export {
   upgradeCommand,
   maybeNotifyUpdate
 };
-//# sourceMappingURL=chunk-OW2QZEWL.js.map
+//# sourceMappingURL=chunk-5YCQ2QHH.js.map

package/dist/{chunk-5YQOIFT4.js → chunk-75Z74TA7.js}

@@ -1,7 +1,7 @@
 import {
   c,
   resp
-} from "./chunk-QONOJO45.js";
+} from "./chunk-LBYWGMOA.js";
 
 // src/values/expect.ts
 var TEST_EXPECT_TYPES = [
@@ -90,4 +90,4 @@ export {
   TEST_EXPECT_TYPES,
   expect
 };
-//# sourceMappingURL=chunk-5YQOIFT4.js.map
+//# sourceMappingURL=chunk-75Z74TA7.js.map

package/dist/{chunk-QTNO2WD6.js → chunk-7ZYW652H.js}

@@ -53,4 +53,4 @@ function describeErrorBody(bytes, contentType) {
 export {
   exportWorkspaceBundle
 };
-//# sourceMappingURL=chunk-QTNO2WD6.js.map
+//# sourceMappingURL=chunk-7ZYW652H.js.map