@xanots/sdk 0.0.9 → 0.0.11

package/dist/{chunk-UDL46O35.js → chunk-OWGCOGKK.js}

@@ -10,9 +10,10 @@ import {
   isQueryExpressionFilter,
   isSeedFileSource,
   middlewareEntryGuid,
+  reversedRegexOperands,
   stackReferencesAuth,
   tableColumns
-} from "./chunk-QONOJO45.js";
+} from "./chunk-QK7ZQJLP.js";
 import {
   CANONICAL_PAYLOAD_KEYS,
   REFERENCEABLE_KINDS,
@@ -25,7 +26,7 @@ import {
   mintCanonical,
   recordObserved,
   resolveRef
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-VAF6A3YD.js";
 
 // src/workspace/seed-coerce.ts
 function coerceScalarValue(label, column, type, value, values) {
@@ -295,6 +296,91 @@ function checkInternalColumnReads(statements, owner, tablesByGuid, bag) {
     );
   }
 }
+var DB_GET_BY_ID = "mvp:dbo_get";
+var ROW_BINDING_STATEMENTS = /* @__PURE__ */ new Set([DB_GET, DB_GET_BY_ID]);
+var INT_COLUMN_TYPES = /* @__PURE__ */ new Set(["int"]);
+function isZeroDefault(value) {
+  return value === 0 || value === "0";
+}
+function checkGetByIdZero(record, statements, owner, tablesByGuid, bag) {
+  const zeroDefaultInputs = /* @__PURE__ */ new Set();
+  if (Array.isArray(record.input)) {
+    for (const entry of record.input) {
+      const declared = entry;
+      if (typeof declared?.name === "string" && isZeroDefault(declared.default)) {
+        zeroDefaultInputs.add(declared.name);
+      }
+    }
+  }
+  const bindings = /* @__PURE__ */ new Map();
+  for (const statement of statements) {
+    if (!ROW_BINDING_STATEMENTS.has(statement.name)) continue;
+    const as = statement.as;
+    if (typeof as !== "string" || as === "") continue;
+    const guid = statementTableGuid(statement);
+    const def = guid === void 0 ? void 0 : tablesByGuid.get(guid);
+    if (def) bindings.set(as, def);
+  }
+  const tested = /* @__PURE__ */ new Set();
+  for (const statement of statements) {
+    walkNodes(statement, (node) => {
+      if (typeof node.operand === "string") tested.add(node.operand);
+    });
+  }
+  const reported = /* @__PURE__ */ new Set();
+  for (const statement of statements) {
+    if (statement.name !== DB_GET_BY_ID || !Array.isArray(statement.input)) continue;
+    for (const entry of statement.input) {
+      const cell = entry;
+      if (cell?.name !== "id") continue;
+      if (Array.isArray(cell.filters) && cell.filters.length > 0) continue;
+      const source = zeroIdSource(cell, zeroDefaultInputs, bindings);
+      if (!source) continue;
+      if (source.reference !== void 0 && tested.has(source.reference)) continue;
+      if (reported.has(source.key)) continue;
+      reported.add(source.key);
+      bag.warn(
+        "db.get-by-id-zero",
+        `${owner}: the \`id\` of \`s.db.get_by_id\` ${source.because}, and the engine validates that key as \`>= 1\` \u2014 a \`0\` does not miss, it fails the whole request with HTTP 400 \`Value is less than the minimum value of 1\` naming a \`param\` the caller never sent. Inside a \`foreach\` that 400 ends the request, so one unset key loses every other row's work. Read a nullable foreign key with the field-match form, which binds \`null\` on \`0\` instead: \`s.db.get({ table, fieldName: "id", fieldValue: ${source.operand}, as })\`.`
+      );
+    }
+  }
+}
+function zeroIdSource(cell, zeroDefaultInputs, bindings) {
+  const value = typeof cell.value === "string" ? cell.value : "";
+  if ((cell.tag === "const:int" || cell.tag === "const:decimal") && Number(value) === 0) {
+    return {
+      key: "literal:0",
+      because: "is the literal `c.int(0)`",
+      operand: "c.int(0)"
+    };
+  }
+  if (cell.tag === "input" && zeroDefaultInputs.has(inputBase(value))) {
+    return {
+      key: `input:${value}`,
+      reference: value,
+      because: `is \`inp("${value}")\`, whose declared input default is \`0\` \u2014 an omitted input stands the sentinel up with nobody having written it`,
+      operand: `inp("${value}")`
+    };
+  }
+  if (cell.tag === "var") {
+    const dot = value.indexOf(".");
+    if (dot > 0) {
+      const def = bindings.get(value.slice(0, dot));
+      const column = value.slice(dot + 1);
+      const col = def && tableColumns(def).find((candidate) => candidate.name === column);
+      if (col && INT_COLUMN_TYPES.has(col.type) && isZeroDefault(col.default)) {
+        return {
+          key: `var:${value}`,
+          reference: value,
+          because: `is \`ref("${value}")\`, and "${column}" on table "${def.name}" is declared \`default: 0\` \u2014 every row that never set the link carries the sentinel`,
+          operand: `ref("${value}")`
+        };
+      }
+    }
+  }
+  return null;
+}
 function collectInputRefs(node, out) {
   walkNodes(node, (record) => {
     if (record.tag !== "input") return;
@@ -435,6 +521,7 @@ function checkStacks(tables, sections, bag) {
         }
       }
       checkInternalColumnReads(statements, owner, tablesByGuid, bag);
+      checkGetByIdZero(obj, statements, owner, tablesByGuid, bag);
     }
   }
 }
@@ -493,6 +580,28 @@ function checkInterpolatedValues(sections, bag) {
     }
   }
 }
+function checkRegexOperandOrder(sections, bag) {
+  for (const [payloadKey, arr] of Object.entries(sections)) {
+    for (const obj of arr ?? []) {
+      if (!obj || typeof obj !== "object") continue;
+      const name = obj.name;
+      const seen = /* @__PURE__ */ new Set();
+      walkNodes(obj, (record) => {
+        if (typeof record.tag !== "string" || typeof record.value !== "string") return;
+        if (!Array.isArray(record.filters)) return;
+        const reversed = reversedRegexOperands(record);
+        if (!reversed) return;
+        seen.add(`\`${reversed.filter}\` (pattern ${JSON.stringify(reversed.subject)})`);
+      });
+      if (seen.size === 0) continue;
+      const owner = `${payloadKey} "${typeof name === "string" ? name : "?"}"`;
+      bag.warn(
+        "value.regex-operands-reversed",
+        `${owner} pipes a regex filter's SUBJECT and passes its PATTERN as the argument: ${[...seen].join("; ")}. The regex family is pattern-piped \u2014 the piped value is the PATTERN and the argument is the text tested against it, the reverse of every other filter \u2014 so this answers false for every input with HTTP 200 and no error, and a precondition built on it lets through the values it exists to refuse. Swap the operands: \`withFilters(c.regex(\u2026), fl.regex_test(subject))\`.`
+      );
+    }
+  }
+}
 function checkSeed(tables, bag) {
   for (const def of tables) {
     const source = def.seed;
@@ -506,6 +615,18 @@ function checkSeed(tables, bag) {
     }
   }
 }
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["run"]);
+function checkReservedColumnNames(tables, bag) {
+  for (const def of tables) {
+    for (const col of tableColumns(def)) {
+      if (!RESERVED_COLUMN_NAMES.has(col.name)) continue;
+      bag.warn(
+        "table.reserved-column-name",
+        `table "${def.name}": the column name \`${col.name}\` is reserved by the engine \u2014 it is the key a block statement stores its sub-stack under, and an insert's parameter map collides with it. The table deploys and reads back correctly, and then EVERY \`s.db.add\` into it fails with HTTP 400 naming \`${col.name}\` and complaining about the value \u2014 at every column type, and whether the statement supplies a value or leaves the default to stand in. Rename the column (\`${col.name}_id\`, \`${col.name}s\`); the match is exact and case sensitive, so nothing else is affected.`
+      );
+    }
+  }
+}
 var GATING_ACTIONS = {
   realtime_server: ["connect"],
   channel: ["join"]
@@ -728,6 +849,34 @@ function checkNullMatchArgs(sections, bag) {
     }
   }
 }
+var URL_ONLY_VERBS = /* @__PURE__ */ new Set(["GET", "DELETE", "HEAD"]);
+function checkPathSegmentCandidates(sections, bag) {
+  for (const obj of sections["query"] ?? []) {
+    if (!obj || typeof obj !== "object") continue;
+    const query = obj;
+    const name = typeof query.name === "string" ? query.name : "";
+    const verb = typeof query.verb === "string" ? query.verb : "";
+    if (!URL_ONLY_VERBS.has(verb)) continue;
+    const statements = [];
+    collectStatements(obj, statements);
+    const addressing = /* @__PURE__ */ new Set();
+    for (const statement of statements) {
+      const matchArg = DB_MATCH_ARG[statement.name];
+      if (matchArg === void 0) continue;
+      const cell = statementInput(statement, matchArg);
+      if (cell?.tag !== "input") continue;
+      if (typeof cell?.value !== "string" || cell.value === "") continue;
+      if (name.includes(`{${cell.value}}`)) continue;
+      addressing.add(cell.value);
+    }
+    for (const param of addressing) {
+      bag.warn(
+        "query.path-segment-candidate",
+        `query "${name}" (${verb}) looks up one row by the \`${param}\` input, but the path declares no \`{${param}}\` segment \u2014 so the value arrives as \`?${param}=\u2026\` instead of addressing the resource. The endpoint works, but the route is not addressable the way a REST client expects, and \`getPath()\` types as static, so a caller cannot pass the value positionally. Put it in the path: \`name: "${name}/{${param}}"\` (the segment may sit anywhere \u2014 \`"${name}/{${param}}/edit"\` routes too), keeping the \`${param}\` input as it is; the segment binds to the input of the same name. Leave it as-is if \`${param}\` really is a query-string param rather than part of the address.`
+      );
+    }
+  }
+}
 function checkSameNameSiblings(sections, bag) {
   const appNames = appNamesByGuid(sections["app"]);
   for (const [payloadKey, arr] of Object.entries(sections)) {
@@ -1457,6 +1606,7 @@ var Xano = class {
     checkStacks(this.tableDefs, sections, bag);
     checkExpressionOperands(sections, bag);
     checkInterpolatedValues(sections, bag);
+    checkRegexOperandOrder(sections, bag);
     checkReferences(this.bundleType, sections, this.workspaceConfig.guid, bag);
     checkDecodeOnlyStatements(sections, bag);
     checkRunFamilyHosts(sections, bag);
@@ -1469,8 +1619,10 @@ var Xano = class {
     checkUnboundVarRefs(sections, bag);
     checkSafeRefMatchArgs(sections, bag);
     checkNullMatchArgs(sections, bag);
+    checkPathSegmentCandidates(sections, bag);
     checkSameNameSiblings(sections, bag);
     checkSeed(this.tableDefs, bag);
+    checkReservedColumnNames(this.tableDefs, bag);
     checkKnowledge(sections, bag, { resolved: options.knowledge !== void 0 });
     checkRealtimePublish(this.bundleType, sections, bag);
     bag.flush();
@@ -1706,4 +1858,4 @@ export {
   Xano,
   workspace
 };
-//# sourceMappingURL=chunk-UDL46O35.js.map
+//# sourceMappingURL=chunk-OWGCOGKK.js.map

package/dist/{chunk-QONOJO45.js → chunk-QK7ZQJLP.js}

@@ -3,6 +3,16 @@ import {
   fillPathParams,
   parsePathParams
 } from "./chunk-WHOJWOSV.js";
+import {
+  appNamesByGuid,
+  deriveGuid,
+  deriveQueryGuid,
+  getLockedCanonical,
+  lockKey,
+  lockNameForObject,
+  queryGroupComponent,
+  resolveRef
+} from "./chunk-VAF6A3YD.js";
 import {
   COLUMN_CONTEXT,
   INPUT_CONTEXT,
@@ -14,16 +24,8 @@ import {
   registerStatement
 } from "./chunk-5XZ744TS.js";
 import {
-  appNamesByGuid,
-  deriveGuid,
-  deriveQueryGuid,
-  getLockedCanonical,
-  lockKey,
-  lockNameForObject,
-  queryGroupComponent,
-  resolveRef,
   sha1Bytes
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-OHX6MIUZ.js";
 
 // src/types/xdo.ts
 var TAGS = [
@@ -287,15 +289,41 @@ function barePatternRefusal(value) {
   if (isValidPcreLiteral(value.value)) return null;
   return `${JSON.stringify(value.value)} is a BARE regex pattern. PHP \`preg_*\` reads the first character as the delimiter, so the engine matches nothing for every input \u2014 the assertion or precondition built on it fails (or passes) against text that plainly should not. Build it with c.regex(${JSON.stringify(value.value)}) instead of c.text(...), which wraps and escapes it into a valid PCRE literal`;
 }
-var REGEX_PATTERN_FILTERS = /* @__PURE__ */ new Set([
-  "regex_test",
-  "regex_match",
-  "regex_match_all",
-  "regex_matches",
-  "regex_replace",
-  "regex_get_all_matches",
-  "regex_get_first_match"
-]);
+var REGEX_SUBJECT_SLOT = {
+  regex_test: 0,
+  regex_match: 0,
+  regex_match_all: 0,
+  regex_matches: 0,
+  regex_replace: 1,
+  regex_get_all_matches: 0,
+  regex_get_first_match: 0
+};
+var REGEX_PATTERN_FILTERS = new Set(Object.keys(REGEX_SUBJECT_SLOT));
+var REGEX_METACHARACTERS = /[\\^$.|?*+()[\]{}]/;
+function readablePattern(value) {
+  if (!value || value.tag !== "const") return null;
+  if (Array.isArray(value.filters) && value.filters.length > 0) return null;
+  return isValidPcreLiteral(value.value) ? value.value : null;
+}
+function reversedOperandRefusal(pattern, subject) {
+  const misplaced = readablePattern(subject);
+  if (misplaced === null || !REGEX_METACHARACTERS.test(misplaced)) return null;
+  if (readablePattern(pattern) !== null) return null;
+  return `the OPERANDS are reversed. ${JSON.stringify(misplaced)} is a delimiter-wrapped regex pattern sitting in the SUBJECT slot, which means the pattern and the text it tests were written the other way round. The regex family is pattern-piped \u2014 the piped value is the PATTERN and the argument is the text matched against it, the reverse of every other filter \u2014 so this runs the subject as a pattern and answers false for every input, with HTTP 200 and no error. Swap them: pipe the c.regex(...) pattern and pass the subject as the argument`;
+}
+function reversedRegexOperands(v2) {
+  const chain = Array.isArray(v2.filters) ? v2.filters : [];
+  for (const [i, applied] of chain.entries()) {
+    const slot = REGEX_SUBJECT_SLOT[applied.name];
+    if (slot === void 0) continue;
+    const pattern = { value: v2.value, tag: v2.tag, filters: chain.slice(0, i) };
+    const message = reversedOperandRefusal(pattern, applied.arg?.[slot]);
+    if (message !== null) {
+      return { filter: applied.name, slot, subject: applied.arg?.[slot]?.value ?? "", message };
+    }
+  }
+  return null;
+}
 function intLiteral(n) {
   if (typeof n === "bigint") return String(n);
   if (typeof n === "string") {
@@ -665,6 +693,16 @@ function withFilters(value, ...filters) {
       `withFilters: argument ${malformed} of the filter chain is not a filter \u2014 got ${JSON.stringify(got) ?? String(got)}. Each entry must come from an \`fl.*\` factory (or \`filter(name, ...)\`), which returns \`{name, arg, disabled}\`. A tagged value is not a filter: to pipe one value through another, pass it as a filter ARGUMENT (\`fl.concat(other)\`), not as a chain member.`
     );
   }
+  const reversed = reversedRegexOperands({
+    value: value.value,
+    tag: value.tag,
+    filters: [...value.filters, ...added]
+  });
+  if (reversed) {
+    throw new Error(
+      `Regex filter \`${reversed.filter}\`: ${reversed.message} \u2014 \`withFilters(c.regex(\u2026), fl.${reversed.filter}(${reversed.slot === 0 ? "" : "\u2026, "}subject))\`. Naming the argument says which slot is which: \`fl.${reversed.filter}({ subject: \u2026 })\`. (issue #298)`
+    );
+  }
   const pipedIsBarePattern = barePatternRefusal(value) !== null;
   const offending = pipedIsBarePattern ? added.find((filter2) => REGEX_PATTERN_FILTERS.has(filter2.name)) : void 0;
   if (offending) {
@@ -1559,8 +1597,79 @@ function encodeInput(name, descriptor2) {
 // src/values/obj.ts
 var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function serializeValue(v2, path) {
+  const record = objSetRecord(v2, path);
+  if (record) return record;
   return serializeAtom(v2, path) + serializeFilters(v2, path);
 }
+function objSetRecord(v2, path) {
+  if (v2.tag !== "const:obj") return null;
+  if (v2.value === "") {
+    throw new Error(
+      `obj(): \`${path}\` is \`c.obj(null)\`, the legacy BLANK object form \u2014 the engine evaluates it to null, not to {}. Write \`c.null()\` for the null, or \`c.obj()\` for an empty object.`
+    );
+  }
+  if (v2.value !== "{}") {
+    const parsed = parseJson(v2.value);
+    if (parsed === NOT_JSON) return null;
+    return serializeJson(parsed, path) + serializeFilters(v2, path);
+  }
+  const parts = [];
+  const keys = /* @__PURE__ */ new Set();
+  let i = 0;
+  for (; i < v2.filters.length; i++) {
+    const f2 = v2.filters[i];
+    if (f2.name !== "set" || f2.disabled || f2.arg.length !== 2) break;
+    const [pathArg, member] = f2.arg;
+    if (pathArg.tag !== "const" || pathArg.filters.length > 0) break;
+    const bracketed = pathArg.value.startsWith("[");
+    const key = parseSetPath(pathArg.value);
+    if (!IDENT.test(key)) {
+      if (!bracketed) break;
+      throw new Error(
+        `obj(): key "${key}" inside the \`c.obj\` at \`${path}\` must be a bare identifier ([A-Za-z_][A-Za-z0-9_]*) \u2014 XanoScript object keys aren't quoted.`
+      );
+    }
+    if (keys.has(key)) break;
+    keys.add(key);
+    parts.push(`${key}: ${serializeValue(member, `${path}.${key}`)}`);
+  }
+  const rendered = parts.length === 0 ? "{}" : `{ ${parts.join(", ")} }`;
+  const rest = { ...v2, filters: v2.filters.slice(i) };
+  return rendered + serializeFilters(rest, path);
+}
+function parseSetPath(stored) {
+  const bracketed = /^\["(.*)"\]$/s.exec(stored);
+  return bracketed ? bracketed[1].replace(/\\(["\\])/g, "$1") : stored;
+}
+var NOT_JSON = /* @__PURE__ */ Symbol("not-json");
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return NOT_JSON;
+  }
+}
+function serializeJson(value, path) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+  if (Array.isArray(value)) {
+    return `[${value.map((el, i) => serializeJson(el, `${path}[${i}]`)).join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const parts = Object.entries(value).map(([key, member]) => {
+      if (!IDENT.test(key)) {
+        throw new Error(
+          `obj(): key "${key}" at \`${path}\` must be a bare identifier ([A-Za-z_][A-Za-z0-9_]*) \u2014 XanoScript object keys aren't quoted.`
+        );
+      }
+      return `${key}: ${serializeJson(member, `${path}.${key}`)}`;
+    });
+    return parts.length === 0 ? "{}" : `{ ${parts.join(", ")} }`;
+  }
+  return "null";
+}
 function serializeFilters(v2, path) {
   let out2 = "";
   for (const f2 of v2.filters) {
@@ -1614,9 +1723,18 @@ function serializeAtom(v2, path) {
     case "const:epochms":
       if (v2.value === "now") return "now";
       break;
+    // `c.array([…])` stores plain JSON, and the literal grammar spells the same
+    // list — so it renders to the identical bytes a bare `[…]` member does. The
+    // bare form always worked and this one used to throw, which made the empty
+    // list (`c.array([])`) an export failure with no named way through (#295).
+    case "const:array": {
+      const parsed = parseJson(v2.value);
+      if (parsed !== NOT_JSON) return serializeJson(parsed, path);
+      break;
+    }
   }
   throw new Error(
-    `obj(): value tag "${v2.tag}" at \`${path}\` isn't supported in a dynamic object literal yet. Supported: inp(), ref(), auth(), col(), env()/setting()/sys.*, c.now(), and c.text/int/decimal/bool/null \u2014 each optionally carrying a filter chain.`
+    `obj(): value tag "${v2.tag}" at \`${path}\` isn't supported in a dynamic object literal yet. Supported: inp(), ref(), auth(), col(), env()/setting()/sys.*, c.now(), c.text/int/decimal/bool/null, and c.obj()/c.array() \u2014 each optionally carrying a filter chain. A constant record or list can also be written bare: \`{ a: 1 }\`, \`[]\`.`
   );
 }
 function serializeMember(m, path) {
@@ -4006,6 +4124,8 @@ export {
   DiagnosticBag,
   isTaggedValue,
   barePatternRefusal,
+  reversedOperandRefusal,
+  reversedRegexOperands,
   c,
   ref,
   inp,
@@ -4117,4 +4237,4 @@ export {
   serializeBundle,
   emitBundle
 };
-//# sourceMappingURL=chunk-QONOJO45.js.map
+//# sourceMappingURL=chunk-QK7ZQJLP.js.map

package/dist/{chunk-3QW5NFZJ.js → chunk-QKM4U5UK.js}

@@ -14,7 +14,7 @@ import {
   resolveOAuthErrorCode,
   resolveScope,
   writeCredential
-} from "./chunk-BKDJN76G.js";
+} from "./chunk-FE5I6S6N.js";
 import {
   detail,
   hostLabel,
@@ -161,7 +161,7 @@ The refresh token may be expired or already spent \u2014 refresh tokens rotate o
       );
     }
     assertHttpsOrigin(instance2, "instance");
-    const { resolveScopedWorkspaceId } = await import("./workspace-K72NP7SX.js");
+    const { resolveScopedWorkspaceId } = await import("./workspace-2COHDBM3.js");
     const workspaceId = await resolveScopedWorkspaceId({ access_token: set.access_token, instance: instance2 });
     return { access_token: set.access_token, instance: instance2, workspaceId, credentialType: "oauth" };
   }
@@ -272,4 +272,4 @@ export {
   envMetaCredentialVarsSet,
   getAccessToken
 };
-//# sourceMappingURL=chunk-3QW5NFZJ.js.map
+//# sourceMappingURL=chunk-QKM4U5UK.js.map

package/dist/{chunk-7OXFMCTX.js → chunk-QYMAZRAU.js}

@@ -6,7 +6,7 @@ import {
   realtimeChannelGuid,
   realtimeServerRefName,
   resolveRealtimeServerRef
-} from "./chunk-ZZLPTHT5.js";
+} from "./chunk-UOZMSF4C.js";
 import {
   assertCanonical,
   assertOneOf,
@@ -25,17 +25,17 @@ import {
   resolveAuthRef,
   resolveMockKeys,
   warnLiveDatasource
-} from "./chunk-QONOJO45.js";
-import {
-  encodeStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-QK7ZQJLP.js";
 import {
   deriveGuid,
   getLockedCanonical,
   lockKey,
   realtimeMessageSeedName,
   resolveRef
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-VAF6A3YD.js";
+import {
+  encodeStatement
+} from "./chunk-5XZ744TS.js";
 
 // src/kinds/canonical.ts
 function resolveCanonicalToken(label, payloadKey, accessor, def, override) {
@@ -667,4 +667,4 @@ export {
   addonKind,
   addon
 };
-//# sourceMappingURL=chunk-7OXFMCTX.js.map
+//# sourceMappingURL=chunk-QYMAZRAU.js.map