@xanots/sdk 0.0.9 → 0.0.11

package/dist/internal.js

@@ -1,11 +1,7 @@
 import {
   FIELD_METHODS,
-  IMPLEMENTED_STATEMENTS,
-  STATEMENT_SURFACES,
-  SUPERSEDED_STATEMENTS,
-  TOTAL_STATEMENTS,
-  sPathOf
-} from "./chunk-4BXJGVZ3.js";
+  SUPERSEDED_STATEMENTS
+} from "./chunk-BSK7ELHU.js";
 import {
   addonKind,
   agentKind,
@@ -33,7 +29,7 @@ import {
   taskKind,
   toolKind,
   workflowTestKind
-} from "./chunk-7OXFMCTX.js";
+} from "./chunk-QYMAZRAU.js";
 import {
   GENERATED_SPECS,
   GENERATED_STATEMENT_NAMES,
@@ -55,7 +51,13 @@ import {
   registerSpec,
   triggerKind,
   workspaceKind
-} from "./chunk-ZZLPTHT5.js";
+} from "./chunk-UOZMSF4C.js";
+import {
+  IMPLEMENTED_STATEMENTS,
+  STATEMENT_SURFACES,
+  TOTAL_STATEMENTS,
+  sPathOf
+} from "./chunk-BC2C5GVI.js";
 import {
   COMMANDS,
   FLAGS,
@@ -63,7 +65,7 @@ import {
   flagKey,
   flagSummary,
   visibleFlags
-} from "./chunk-OKNSR7MT.js";
+} from "./chunk-DIA7CT7J.js";
 import {
   DECODE_ONLY_STATEMENTS,
   FILTER_NAMES,
@@ -109,13 +111,8 @@ import {
   serializeBundle,
   tableKind,
   toNestedFields
-} from "./chunk-QONOJO45.js";
+} from "./chunk-QK7ZQJLP.js";
 import "./chunk-WHOJWOSV.js";
-import {
-  encodeStatement,
-  getStatementFactory,
-  isRegisteredStatement
-} from "./chunk-5XZ744TS.js";
 import {
   LOCK_VERSION,
   REFERENCEABLE_KINDS,
@@ -137,7 +134,13 @@ import {
   resolveRef,
   serializeLock,
   validateLockModel
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-VAF6A3YD.js";
+import {
+  encodeStatement,
+  getStatementFactory,
+  isRegisteredStatement
+} from "./chunk-5XZ744TS.js";
+import "./chunk-OHX6MIUZ.js";
 
 // src/statements/byte-evidence.ts
 var UNCONFIRMED_STATEMENTS = /* @__PURE__ */ new Set([]);
@@ -313,7 +316,7 @@ var VALUE_CONSTRUCTORS = [
   { name: "c.expression", signature: "(source: string) => Value", description: `Xano Expression Engine source, passed through VERBATIM \u2192 tag "const:expr2". The string IS the expression: c.expression('"Hi, " ~ $input.name'), c.expression("$var.price * $var.qty"). \u26A0\uFE0F NOT VALIDATED \u2014 never parsed or type-checked, invisible to InferResponse, and untouched by a rename that updates every typed ref(); a typo surfaces at runtime or as a wrong answer. Use it ONLY for syntax the typed surfaces cannot express (~ concatenation, inline arithmetic, conditionals) \u2014 prefer ref/inp/col, withFilters+fl.*, and obj() (which BUILDS a checked expression). Not the expr() condition builder.` },
   { name: "c.expressionLegacy", signature: "(source: string) => Value", legacy: true, description: "the older `const:expr` expression form, emitted by codegen for workspaces that still hold one \u2014 author `c.expression` instead." },
   { name: "c.now", signature: "() => Value", description: "Current time as epoch-ms \u2014 the engine-native const:epochms constant (no filter). Valid inline as a where/cmp operand. For cutoff math (cutoff = now - max_age) either compare inline or, for reuse/readability, hoist it into an s.set_var and compare against the var." },
-  { name: "obj", signature: "(fields: Record<string, Value | nested>) => ObjValue<typeof fields>", description: 'Dynamic object value \u2192 tag "const:expr2" (an object-literal expression string). The dynamic sibling of c.obj: members may be inp/ref/auth/col values, env()/setting()/sys.*, c.now(), c.* constants, nested records, or arrays \u2014 and each member may carry a FILTER CHAIN (withFilters + fl.*), which renders as the expression pipe `$var.row|get:"a.b"`. That matters most for the null-safe drill: db.get binds null on a miss, so ref(path, { safe: true }) inside an obj() is the normal shape, not a workaround \u2014 you do NOT need a preceding s.set_var to hoist it. The member record rides the return type, so InferResponse resolves each member the way it resolves a top-level response key \u2014 `response: { user: obj({ id: ref("row.id") }) }` derives `{ user: { id: Col | null } }`, and a raw nested object literal (`response: { user: { id: ref("row.id") } }`, auto-wrapped through this) derives the same. NEST WITH A RAW RECORD, not an inner obj() call: an inner call yields a const:expr2 value, which the expression serializer has no spelling for and THROWS. Still rejected: a filter ARGUMENT carrying its own chain (a trailing | binds to the whole value, not one argument), a DISABLED filter (an expression string cannot record that), and the output/response/toolset/reg tags \u2014 build those in a prior step and ref() them. Use for e.g. s.ai.agent.run args.' },
+  { name: "obj", signature: "(fields: Record<string, Value | nested>) => ObjValue<typeof fields>", description: 'Dynamic object value \u2192 tag "const:expr2" (an object-literal expression string). The dynamic sibling of c.obj: members may be inp/ref/auth/col values, env()/setting()/sys.*, c.now(), c.* constants, nested records, or arrays \u2014 and each member may carry a FILTER CHAIN (withFilters + fl.*), which renders as the expression pipe `$var.row|get:"a.b"`. That matters most for the null-safe drill: db.get binds null on a miss, so ref(path, { safe: true }) inside an obj() is the normal shape, not a workaround \u2014 you do NOT need a preceding s.set_var to hoist it. The member record rides the return type, so InferResponse resolves each member the way it resolves a top-level response key \u2014 `response: { user: obj({ id: ref("row.id") }) }` derives `{ user: { id: Col | null } }`, and a raw nested object literal (`response: { user: { id: ref("row.id") } }`, auto-wrapped through this) derives the same. A constant record or list has two spellings that both work and render identically: bare (`{ a: 1 }`, `[]`) or `c.obj(...)`/`c.array([...])` \u2014 reach for the bare form, it is shorter. NEST WITH A RAW RECORD, not an inner obj() call: an inner call yields a const:expr2 value, which the expression serializer has no spelling for and THROWS. The legacy blank `c.obj(null)` is refused here (it evaluates to null, not {}) \u2014 write c.null() or c.obj(). Still rejected: a filter ARGUMENT carrying its own chain (a trailing | binds to the whole value, not one argument), a DISABLED filter (an expression string cannot record that), and the output/response/toolset/reg tags \u2014 build those in a prior step and ref() them. Use for e.g. s.ai.agent.run args.' },
   { name: "ref", signature: "(name: string, opts?: { safe?: boolean }) => Value", description: 'Reference a stack variable \u2192 tag "var". Pass { safe: true } for null-safe nested access \u2014 a dotted ref("owner.user_id", { safe: true }) compiles through the get filter so it resolves to null instead of raising "Unable to locate var" when the base is null.' },
   {
     name: "inp",
@@ -541,6 +544,14 @@ var FILTER_NOTES = {
   ends_with: "piped value is the subject text; the arg is the substring searched for",
   starts_with: "piped value is the subject text; the arg is the substring searched for",
   icontains: "case-insensitive; piped value is the subject, the arg is the substring",
+  // The regex family REVERSES that direction, which is the whole reason it needs
+  // its own note: the pattern is piped and the subject is the argument. Written
+  // the other way round it reads correctly, type-checks, and answers false for
+  // every input, so the note has to state the order and the symptom.
+  regex_test: 'piped value is the PATTERN (build it with `c.regex(...)`); the arg is the subject \u2014 the REVERSE of `contains`/`starts_with`. Swapped, it answers false for every input with no error, so write `withFilters(c.regex("^a+$"), fl.regex_test(inp("s")))` (or name the arg: `fl.regex_test({ subject: inp("s") })`). A pattern found in the subject slot is refused at build time',
+  regex_match: "piped value is the PATTERN, the arg is the subject \u2014 see `regex_test`",
+  regex_match_all: "piped value is the PATTERN, the arg is the subject \u2014 see `regex_test`",
+  regex_replace: "piped value is the PATTERN, `subject` is the text searched \u2014 see `regex_test`. The replacement comes FIRST",
   iends_with: "case-insensitive; piped value is the subject, the arg is the substring",
   istarts_with: "case-insensitive; piped value is the subject, the arg is the substring",
   // "empty" is a specific set of values, not just null.
@@ -774,7 +785,7 @@ function renderTestsSection() {
     "",
     "`xanots test run-all` runs the unit tests AND the `workflowTest()` objects an environment carries. It takes no entry file and compiles nothing: it runs what is DEPLOYED, so deploy before testing.",
     "",
-    "- `--dest ephemeral` (DEFAULT, `--name <env>` to pick one), `--dest sandbox`, or `--dest workspace`. Unlike `deploy`, `workspace` is allowed here \u2014 running a test reads.",
+    "- `--env ephemeral` (DEFAULT \u2014 the one this project last deployed to), `--env ephemeral:<name>`, or `--env workspace`. Same grammar as `init --from`. `deploy` takes no `--env` at all; `test` does, and `workspace` is allowed here because running a test only reads.",
     '- `xanots test list` shows what is there without running it; `xanots test run "<name>"` runs one. When a name is ambiguous the error prints the qualified `function:math/happy path` form, which `run` also accepts.',
     "- `--kind unit|workflow` narrows to one family. `--concurrency <n>` defaults to 1: tests share the environment database.",
     "- A failing suite exits 5, distinct from a crash. Tests that could not be REACHED exit 6 \u2014 retry that one, investigate the other. An environment with no tests is success, not failure.",
@@ -811,7 +822,9 @@ function renderSections(m) {
     "below \u2014 open the one whose condition matches the task, and skip the rest. For",
     "exhaustive per-entry detail in NEITHER \u2014 a statement's full field schema with engine",
     "defaults, a filter's complete argument list, the engine `storedName` mapping \u2014 do a",
-    "TARGETED lookup in the shipped `manifest.json` (grep or `jq` the one entry you need;",
+    "TARGETED lookup in the shipped `manifest.json` (a program imports it as",
+    '`@xanots/sdk/manifest.json`, which Node ESM needs `with { type: "json" }` on;',
+    "grep or `jq` the one entry you need;",
     "it is ~65k tokens, so never read it whole). Its top-level keys are `" + Object.keys(m).join("`, `") + "`. `statements` and `filters` are ARRAYS, not maps \u2014 SELECT, do not index:",
     `  jq '.statements[] | select(.sPath=="db.get")' manifest.json`,
     `  jq '.filters[]    | select(.name=="json_decode")' manifest.json`,
@@ -881,7 +894,7 @@ function renderSections(m) {
     "",
     "Set `canonical` on every `apiGroup`. The engine mints the URL token server-side, so",
     "without one a group's client paths are unresolvable until a lock exists: the bundle",
-    "exports fine and `xanots paths` / `getPath()` then fail on the very queries it just",
+    "exports fine and `xanots routes` / `getPath()` then fail on the very queries it just",
     "built. An explicit `canonical` resolves them from the source alone.",
     "",
     "Build warnings: `export()` prints the shapes that deploy clean and then do the wrong",
@@ -900,7 +913,7 @@ function renderSections(m) {
     "To rename an object: rename in code, export (stderr prints the exact fix-up), run",
     "`xanots lock rename <kind> <old> <new>`, export again \u2014 the original guid is emitted",
     "under the new name, so the engine renames in place instead of delete+create. Taking",
-    "over an existing workspace: `xanots lock adopt <its-packageExport.json>` first, then",
+    "over an existing workspace: `xanots lock import <its-packageExport.json>` first, then",
     "export. Pruning, programmatic seeding, and which commands write the lock:",
     "`llms/lock.md`.",
     "",
@@ -913,19 +926,19 @@ function renderSections(m) {
     "AND records \u2014 before importing. The blast radius is a disposable environment, not a",
     "production workspace, but confirm with the user before the first run.",
     "",
-    "**Two destinations, and the choice changes more than the target.**",
+    "**One destination, and no flag for it.**",
     "",
-    "- `--dest ephemeral` (DEFAULT) \u2014 a NAMED, workspace-scoped, auto-expiring tenant",
-    "  (~1h; `--expires-hours` 1\u201372 at create time). The active one is tracked in",
+    "- `xanots deploy` writes to a NAMED, workspace-scoped, auto-expiring ephemeral tenant",
+    "  (~1h; `--expires-hours` 1\u201372 at create time), and to nothing else \u2014 an `--env` here",
+    "  is a usage error, not a choice. The active env is tracked in",
     "  `./.xano/ephemeral.json`, so deploying again REFRESHES it and the URL is unchanged;",
     "  if it expired or was swept, a fresh one is created and the new URL is called out.",
     "  `--static` puts the frontend ON THE EPHEMERAL, so backend and frontend share one",
     "  disposable environment.",
     "  \u26A0 Only the BACKEND URL survives a refresh: the replace clears static hosting too,",
     "  so `--static` publishes a NEW host every run and the previous URL stops serving.",
-    "- `--dest sandbox` \u2014 your single throwaway tenant, no expiry. `--static` puts the",
-    "  frontend on your OWN (parent) workspace instead, because the sandbox tenant does",
-    "  not serve static hosting.",
+    "- `xanots status` names the env this project last deployed to, its URL and its expiry,",
+    "  without your having to remember which one it was.",
     "- `xanots release` promotes to your INSTANCE workspace and MERGES, not replaces:",
     "  adds/updates what you define, deletes nothing, writes no rows. Destruction is",
     "  opt-in per flag, previewed + confirmed, and can drop a table WITH its rows.",
@@ -948,7 +961,7 @@ function renderSections(m) {
     '\u26A0 It is INJECTED in bracket form \u2014 `window["XANO_HOST"]="\u2026"` \u2014 so verifying a deploy',
     "by grepping `window.XANO_HOST` matches nothing and reads as a failed inject. Grep the",
     "bare `XANO_HOST` token.",
-    "\u26A0 `xanots validate` ignores the deploy login and reads `XANO_VALIDATE_INSTANCE` /",
+    "\u26A0 `xanots preflight` ignores the deploy login and reads `XANO_VALIDATE_INSTANCE` /",
     "`XANO_VALIDATE_TOKEN` (+ optional `XANO_VALIDATE_WORKSPACE_ID`) from the environment.",
     "**Displaying a stored file.** A file column comes back as `{ path, name, type, size,",
     "meta, access, url }`. \u26A0 Do NOT use its `url`: on a tenant-scoped environment that field",
@@ -1034,6 +1047,10 @@ function renderSections(m) {
     '  check-in \u2014 use `db.query({ where: [expr(col("habit"), "=", ...), expr(col("date"), "=", ...)], as })`',
     "  (a `where` array is ANDed) and branch on the result, rather than pushing the",
     "  check to the client.",
+    "- **A column named `run` is reserved.** The table deploys and reads back fine, then",
+    "  EVERY `s.db.add` into it 400s \u2014 at any column type, with or without a value \u2014 and",
+    "  the error names the column while complaining about the VALUE. Use `run_id`. Exact,",
+    "  case-sensitive, one name: `Run`/`runs`/`run_id` are fine. `--strict` fails on it.",
     "- **System columns are auto-injected.** `id` + `created_at` are prepended to",
     "  every table (`system: true` by default); declaring them by hand is redundant.",
     '  `id` is an `int` PK by default; pass `idType: "uuid"` on the table for a uuid key.',
@@ -1088,19 +1105,20 @@ function renderSections(m) {
     "  `xanots export`/`deploy` CLI path. Seed rows are never emitted into the bundle",
     "  either way; only `deploy` ships them. The `node:fs` writers",
     "  (`writeBundle`/`writeArtifact`) and lock-file I/O import from `@xanots/sdk/node`,",
-    "  NOT the browser-safe `@xanots/sdk` entry (which a frontend can import query",
-    "  defs from to use `getPath()`/`InferInput` with no Node built-ins in the bundle).",
+    "  NOT the browser-safe `@xanots/sdk` entry (a frontend imports defs from it for",
+    "  `getPath()`/`InferInput`).",
     "  The compiler machinery (per-kind `encode*`, the registries, the bundle serializer,",
     "  the lock model) is on `@xanots/sdk/internal` and is never needed to author.",
+    "  READING a bundle back is `@xanots/sdk/bundle` \u2014 a statement walker (`2.if.0` paths),",
+    "  a structural hash, `mvp:*` catalog, `tableRefOf`.",
     "- **Client bundle size / tree-shaking.** `@xanots/sdk` is `sideEffects: false` and pulls",
     "  no Node built-ins, so a bundler drops unused SDK exports. But importing a **def** for its",
     "  `getPath()`/`verb`/`getUrl()`/`getChannel()` also pulls whatever its `stack` references:",
     "  the `s.*`/`c.*` factory CALLS run at module load to BUILD it. Types are free.",
     "  \u26A0 A FLOOR \u2014 **~289 kB minified (~57 kB gzipped)** for the FIRST def; splitting modules",
     "  never removes it. The floor is the RUNTIME, not the def: a second def, or a much richer",
-    "  one, adds ~1 kB. So the cost is paid by importing ANY def at all, and reducing what a",
-    "  def does will not reduce it.",
-    "  Fix: `xanots paths <entry> --emit xano/routes.gen.ts` (`routes` is an accepted alias) \u2014 verbs, paths, and sockets as",
+    "  one, adds ~1 kB \u2014 so reducing what a def does will not reduce it.",
+    "  Fix: `xanots routes <entry> --emit xano/routes.gen.ts` (`paths` is an accepted alias) \u2014 verbs, paths, and sockets as",
     '  plain data importing NOTHING, still compile-checked: `routePath("blog/{slug}", { slug })`,',
     '  `channelPath("rooms/{room_id}", { room_id })`, `socketUrl("chat", baseUrl)` (tenant base',
     "  URLs lifted to `wss://h/ws/<tenant>:<canonical>`). A rename is a type error, not a 404.",
@@ -1153,17 +1171,18 @@ function renderSections(m) {
     "  return.",
     "- **Build regex-filter patterns with `c.regex(body, flags?)`, never `c.text`.**",
     "  The regex filters (`regex_test`/`regex_match`/`regex_replace`/\u2026) are pattern-piped",
-    "  PHP `preg_*`: the piped value is the PATTERN and must be delimiter-wrapped. A bare",
-    '  `c.text("^[^@\\s]+@...$")` is an invalid pattern that matches *nothing* for every',
-    "  input, so a precondition on it silently rejects all values (valid ones included).",
-    '  `c.regex("^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$", "i")` wraps + escapes it for you (accepts a',
-    "  JS `RegExp` too: `c.regex(/^\u2026$/i)`), and `withFilters` throws on a bare `c.text`",
-    "  pattern pointing here \u2014 from ANY position in the chain, so a normalizer in front",
-    '  (`withFilters(c.text("^hi"), fl.trim(), fl.regex_test(...))`) is refused too; nothing',
-    "  upstream adds the delimiters. `s.expect.to_match`'s `value` is the same PATTERN slot,",
-    "  refused the same way; a `ref`/`inp` pattern is passed through untouched, either place.",
-    "  Better still, prefer a native typed input",
-    "  (`input.email({...})`) over hand-rolled validation.",
+    "  PHP `preg_*`: the piped value is the PATTERN and must be delimiter-wrapped, and the",
+    '  ARGUMENT is the subject. A bare `c.text("^\u2026$")` is an invalid pattern that matches',
+    "  *nothing* for every input, so a precondition on it silently rejects all values.",
+    '  `c.regex(body, "i")` wraps + escapes it for you (a JS `RegExp` too: `c.regex(/^\u2026$/i)`).',
+    "  Reversed \u2014 subject piped, pattern in the argument \u2014 reads correctly, type-checks, and",
+    "  answers false for EVERY input, so an `if (matches) reject` guard admits what it",
+    "  refuses. `withFilters` throws on a bare `c.text` pattern from ANY position in",
+    "  the chain (a normalizer in front of the regex filter is refused too; nothing upstream",
+    "  adds the delimiters) and on a pattern found in the subject slot; `s.expect.to_match`",
+    "  is the same PATTERN slot, refused both ways; a `ref`/`inp` pattern is passed through untouched.",
+    "  `export()` warns on a reversed pair in stored bytes. Better still:",
+    "  a native typed input (`input.email`) over hand-rolled validation.",
     "- **Compose a rule set as SIBLINGS, not a folded chain.** `and(...rules)` takes any",
     "  number of terms and encodes flat; `rules.reduce((acc, r) => and(acc, r))` nests one",
     "  container per rule, which costs quadratic bytes (512 terms: 394 KiB flat, 21 MiB",
@@ -1187,19 +1206,10 @@ function renderSections(m) {
     '  credential the runner has. As a file that triple is `{ "type": "token",',
     '  "instance_base_url": \u2026, "workspace_id": <n>, "meta_api_token": \u2026 }`. The older',
     "  `$XANO_REFRESH_TOKEN` + `$XANO_CLIENT_ID` pair still works but ROTATES: single-use.",
-    "- **Event-driven objects fire on an EPHEMERAL, not in the sandbox.** A `task`",
-    "  (scheduled), an `mcpServer`, and every trigger \u2014 `tableTrigger` included \u2014 run normally",
-    "  on an ephemeral env, which is `deploy`'s DEFAULT destination. So test an event-driven",
-    "  design (screen-on-insert, cron cleanup, MCP tool call) by deploying it and letting it",
-    "  run.",
-    "  \u26A0 Under `--dest sandbox` they import cleanly but their stacks NEVER execute, and there",
-    "  is no way to fire one manually \u2014 an insert on a bound table does not run its",
-    "  `tableTrigger`, and the design silently does nothing. Only synchronously-invoked objects",
-    "  (queries, functions, and the agents an endpoint calls with `s.ai.agent.run`) run there.",
-    "  If you must stay on the sandbox, verify the logic out of band: factor the body into a",
-    "  `defineFunction` (or a callable `query`) and invoke it directly \u2014 a `tableTrigger` that",
-    "  screens a row on insert should delegate to a function a `query` can also call via",
-    "  `s.function.run`, and you assert against that.",
+    "- **Event-driven objects fire on an EPHEMERAL.** A `task` (scheduled), an `mcpServer`,",
+    "  and every trigger \u2014 `tableTrigger` included \u2014 run normally on an ephemeral env, which",
+    "  is where `deploy` sends them. So test an event-driven design (screen-on-insert, cron",
+    "  cleanup, MCP tool call) by deploying it and letting it run.",
     '- **Zero-based numeric keys make `c.obj` a LIST.** `c.obj({ "0": "a" })` evaluates to',
     '  `["a"]`: a numeric key IS an index in the engine\'s data model, so keys that are exactly',
     "  `0..n-1` come back as a list with HTTP 200 and no error. Write `c.array([...])` when you",
@@ -1252,7 +1262,7 @@ function renderSections(m) {
     '  - `verb`: `"GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD"` (required), UPPERCASE. Anything else \u2014 most often a lowercase `"post"` \u2014 makes `query()` THROW, because Xano does NOT reject it: it stores the verb as NULL, a null verb serves as GET, and the endpoint then answers on the wrong method while the one you meant 404s `Unable to locate request.`',
     "  - `apiGroup`: an `apiGroup()` def handle (or its name) \u2014 binds by guid, stable across syncs. Raw numeric `apiGroupId?` is the escape hatch and wins if both given.",
     '  - `auth`: `false` (no auth) or an auth-table id; `responseType`: `"standard" | "stream"` (default `standard`) \u2014 any other spelling THROWS, since Xano stores an unrecognized one as NULL and a null buffers as `standard`, so a misspelled stream quietly does not stream.',
-    '  - `name` is the endpoint PATH within the group. A `{param}` segment is a URL PATH PARAM bound to the input of the same name, and segments chain: `name: "blog/{slug}/review/{review_id}"` + `input: { slug: input.text(), review_id: input.int() }`. Read it with `inp("slug")` like any other input. Every `{param}` MUST have a matching input or `query()` THROWS \u2014 Xano treats an unbound marker as inert route text, so the endpoint would answer on the path and see nothing. A `{param}` need NOT be a whole segment (`"blog/post-{slug}"` routes fine), but its type must fit one segment (no object/list/json/file/geo/vector); there are no wildcards or patterns. `required: true` is NOT demanded (the engine\'s editor leaves path inputs unmarked). Inputs absent from the path are ordinary query-string/body params. Name charset is ONLY `A-Za-z0-9_-/{}`, max 200: a `.` (`"export.zip"`) is NOT rejected by Xano \u2014 it stores an EMPTY name that deploys clean then 404s forever, so `query()` THROWS. Use `"export_zip"` and set the extension in the response headers.',
+    '  - `name` is the endpoint PATH within the group. A `{param}` segment is a URL PATH PARAM bound to the input of the same name, and segments chain: `name: "blog/{slug}/review/{review_id}"` + `input: { slug: input.text(), review_id: input.int() }`. Read it with `inp("slug")` like any other input. Every `{param}` MUST have a matching input or `query()` THROWS \u2014 Xano treats an unbound marker as inert route text, so the endpoint would answer on the path and see nothing. A `{param}` need NOT be a whole segment (`"blog/post-{slug}"` routes fine), but its type must fit one segment (no object/list/json/file/geo/vector); there are no wildcards or patterns. `required: true` is NOT demanded (the engine\'s editor leaves path inputs unmarked). The CONVERSE is warned, not enforced: an input a `GET`/`DELETE`/`HEAD` looks ONE ROW up by (`s.db.get`/`get_by_id`/`has`/by-field edit/patch/delete) belongs in the path \u2014 `export()` warns `query.path-segment-candidate`. It still serves `?blog_id=1`, but the route is not addressable and `getPath()` types STATIC, so a caller cannot pass the value positionally. A segment is any value naming WHICH resource is wanted, not just an id (`"shop/{country}"`). An input that NARROWS A LIST (`s.db.query`) stays a query-string param. Inputs absent from the path are ordinary query-string/body params. Name charset is ONLY `A-Za-z0-9_-/{}`, max 200: a `.` (`"export.zip"`) is NOT rejected by Xano \u2014 it stores an EMPTY name that deploys clean then 404s forever, so `query()` THROWS. Use `"export_zip"` and set the extension in the response headers.',
     '  - **Client recipe:** `q.getPath({ params: { slug: "hello" } })` \u2192 `/api:<canonical>/blog/hello` \u2014 never interpolate by hand. `getPath` percent-encodes each value (so `?`/`#`/spaces stay in their segment) and throws on what encoding cannot contain: a `/`, and a value that IS `.`/`..` (a URL parser drops those before routing \u2014 `%2e` counts \u2014 addressing a different endpoint). The keys are typed from the literal `name`, so a typo is a compile error. The HANDLE\'s `q.toSearchParams(input)` drops path params for a GET; the free `query.toSearchParams(input)` has no view of the route and keeps every key.',
     "- `apiGroup({ name, guid?, canonical?, description?, docs?, swagger?, apiGroupEnabled?, documentation?, cors? })` \u2014 a query container; register it and bind queries to it via their `apiGroup`.",
     "  - `cors?`: `{ mode?, allowOrigins?: string[], allowHeaders?: string[], allowCredentials?, maxAge?, allowMethods?: { get?, post?, put?, patch?, delete?, head? } }`.",
@@ -1260,7 +1270,7 @@ function renderSections(m) {
     '    - \u26A0 Under `"custom"`, `allowOrigins` is matched as EXACT strings (scheme+host+port, no wildcard or subdomain expansion) and `"*"` is compared as a literal origin \u2014 it matches NOTHING. An unmatched origin gets no `access-control-*` headers at all, so the call fails in the browser on a missing `access-control-allow-origin` while export, deploy and the preflight all look fine. Name each origin, or use `mode: "default"` for any-origin. `allowMethods` gates the REAL response too: a verb left off gets no CORS headers back even though its preflight passes. Export warns on an empty origin list, a `"*"` entry, and a policy with no method enabled.',
     '- `defineFunction`/`query`/`apiGroup` above cover the queries+tables core; the four below are the "reach past that" primitives (tasks, workflow tests, middleware, tools). Agents and MCP servers are the same family and live in `llms/kinds-agent-mcp.md`. Same envelope conventions (`guid?`, `description?`, `docs?`, `tags?`, `history?`) unless noted.',
     "- `task({ name, guid?, description?, docs?, datasource?, active?, tags?, history?, schedule?, stack?, middleware? })` \u2014 a scheduled background job (function-like `stack`, no `input`/`response`).",
-    '  - `schedule?`: a `ScheduleDef[]` (NOT a single object) \u2014 `{ startsOn, freq?, repeatEnabled?, endsOn?, endsEnabled? }`. `startsOn`/`endsOn` are **timestamp strings** validated at encode time \u2014 `"2026-01-01T00:00:00Z"`, or the space-separated `"2026-01-01 00:00:00+0000"` a pulled workspace carries \u2014 never epoch numbers, and never zoneless; `freq` is the repeat interval **in seconds** (default `86400` = daily); `endsOn` present \u21D2 the schedule has an end. `endsEnabled?` defaults to that and is recovery-only \u2014 state it to reproduce a stored schedule that remembers an end date with the gate OFF. Fires on an ephemeral; does NOT fire in the sandbox (see Gotchas).',
+    '  - `schedule?`: a `ScheduleDef[]` (NOT a single object) \u2014 `{ startsOn, freq?, repeatEnabled?, endsOn?, endsEnabled? }`. `startsOn`/`endsOn` are **timestamp strings** validated at encode time \u2014 `"2026-01-01T00:00:00Z"`, or the space-separated `"2026-01-01 00:00:00+0000"` a pulled workspace carries \u2014 never epoch numbers, and never zoneless; `freq` is the repeat interval **in seconds** (default `86400` = daily); `endsOn` present \u21D2 the schedule has an end. `endsEnabled?` defaults to that and is recovery-only \u2014 state it to reproduce a stored schedule that remembers an end date with the gate OFF. Fires on an ephemeral (see Gotchas).',
     '- `workflowTest({ name, guid?, description?, docs?, datasource?, active?, tags?, stack? })` \u2014 an end-to-end test. NO `input`/`response`: `.call` something with an `as`, then assert on that var \u2014 `s.function.call({ fn, input, as: "r" })`, `s.expect.to_equal({ expr: ref("r"), value: c.int(42) })`. `s.expect.*` belongs here \u2014 it is not inert elsewhere (a failure 500s the request), so treat one in a query/function/task as a mistake to remove. `active?` defaults `true`; chain tests with `s.workflow_test.call({ workflowTest: <def handle> })`.',
     '  - `datasource?`: **the trap.** Default `""` is an EMPTY datasource (recommended), not "no datasource". Any non-empty name makes the engine CLONE it before EVERY run \u2014 against production-sized data, slow enough to fail the run. `"live"` warns at compile time; other names don\'t.',
     "- `middleware({ name, guid?, description?, docs?, resultStrategy?, exceptionPolicy?, tags?, history?, input?, stack?, response?, responseShape?, tests? })` \u2014 a pre/post interceptor (function-like `stack`); attach it via a host's `middleware: { pre, post }`. \u26A0 `input` ENCODES but an ATTACHED middleware never has it bound \u2014 the host request binds its own inputs, so `inp()` inside pre/post fails at runtime with `Unable to locate input` and a declared default does not stand in (`export()` warns). Read the request body with `s.util.get_all_input` instead; it yields a `{ type, vars }` envelope. `s.middleware.call` is the one path that DOES bind the declared map.",
@@ -1327,7 +1337,7 @@ function renderSections(m) {
     "- `name` takes letters, digits, and `/ _ - { } . ` or a space; anything else is an export error."
   ];
   const kindsAgentMcp = [
-    "- `mcpServer({ name, guid?, description?, instructions?, docs?, enabled?, canonical?, spec?, tags?, history?, tools?, llm?, output? })` \u2014 an MCP toolset. `llm?`/`output?` are the same blocks `agent()` takes and are usually absent: an MCP server and an agent are ONE stored object distinguished by `type`. Returns a handle with `getPath()`/`getUrl(baseUrl)` for the Streamable-HTTP endpoint \u2014 `getUrl` is NOT idempotent, a `baseUrl` already carrying an `/x2/mcp/<\u2026>/stream` path THROWS, so resolve ONCE from the instance base URL. Fires on an ephemeral; not in sandbox.",
+    "- `mcpServer({ name, guid?, description?, instructions?, docs?, enabled?, canonical?, spec?, tags?, history?, tools?, llm?, output? })` \u2014 an MCP toolset. `llm?`/`output?` are the same blocks `agent()` takes and are usually absent: an MCP server and an agent are ONE stored object distinguished by `type`. Returns a handle with `getPath()`/`getUrl(baseUrl)` for the Streamable-HTTP endpoint \u2014 `getUrl` is NOT idempotent, a `baseUrl` already carrying an `/x2/mcp/<\u2026>/stream` path THROWS, so resolve ONCE from the instance base URL. Fires on an ephemeral.",
     "  - `tools?`: a `ToolsetToolEntry[]`. Pass the `tool()` HANDLES directly (`tools: [saveNote]`), like every other collection in the SDK; use the `{ tool, enabled?, auth? }` wrapper only when a tool needs `enabled: false` or per-tool `auth`. `auth` names an auth **table** (a `table({ auth: true })` handle or its name) \u2014 Xano's ONLY MCP auth surface (per-tool; there is no server-level gate). An entry that names no tool (no handle, no `id`) THROWS at export rather than emitting the `id: 0` null reference it used to; a deliberate raw `id: 0` warns and is carried through, so a pulled workspace still round-trips.",
     "- `agent({ name, guid?, description?, docs?, enabled?, canonical?, tags?, history?, llm, tools?, output? })` \u2014 an LLM orchestrator. No top-level `instructions`/`prompt`/`spec` \u2014 the prompt lives under `llm`. Invoke from a stack with `s.ai.agent.run({ agent, args })`.",
     '  - `llm` (REQUIRED): typed provider settings, a discriminated union on `type` (`"xano-free" | "anthropic" | "openai" | "google-genai"`). Shared fields: `systemPrompt?`, `maxSteps?` (default `5`), and `prompt?` XOR `messages?` (genuinely exclusive: both is a type error and throws \u2014 the engine stores ONE `prompt_type`, so one would be dropped); plus provider fields (`apiKey?`, `model?`, `temperature?`, `reasoningEffort?`, \u2026). String fields accept Twig placeholders \u2014 `{{ $args.x }}` for run inputs (the `args` of `s.ai.agent.run`), `{{ $env.NAME }}` for env vars.',
@@ -1381,7 +1391,7 @@ function renderSections(m) {
     "  - **Tenant instances (isolated DB):** a tenant's realtime objects live in the TENANT's database, so BOTH halves of a client must name the tenant.",
     "    - Socket: `server.getUrl(base, { tenant })` \u2192 `/ws/<tenant>:<canonical>`. \u26A0 A bare canonical on a tenant host resolves against the INSTANCE workspace instead.",
     "    - That colon form is PECULIAR TO THE SOCKET. Every other tenant URL gives the tenant its OWN segment \u2014 the HTTP half of the same client is `https://<host>/tenant/<tenant>/api:<canonical>/\u2026`. NO request header is required for either.",
-    "    - Because the shapes differ, `getUrl` TRANSLATES a tenant base URL instead of concatenating: pass the `https://<host>/tenant/<name>` that `sandbox details` prints (and that deploy injects as `window.XANO_HOST`) and the tenant is LIFTED into the socket form. So `getUrl(window.XANO_HOST)` needs no `{ tenant }`, and a CONFLICTING `{ tenant }` alongside it throws.",
+    "    - Because the shapes differ, `getUrl` TRANSLATES a tenant base URL instead of concatenating: pass the `https://<host>/tenant/<name>` that `xanots status` prints (and that deploy injects as `window.XANO_HOST`) and the tenant is LIFTED into the socket form. So `getUrl(window.XANO_HOST)` needs no `{ tenant }`, and a CONFLICTING `{ tenant }` alongside it throws.",
     "    - \u26A0 `getUrl`/`socketUrl` are NOT idempotent \u2014 a `baseUrl` that already carries a `/ws/<\u2026>` path (an earlier result of either) THROWS. Resolve ONCE from the http(s) base; pass that result to `new WebSocket`, never back in as a base.",
     "    - Still pass `{ tenant }` explicitly for a tenant on its OWN DOMAIN \u2014 the hostname carries it for HTTP, but there is nothing in the URL for the socket to lift.",
     "    - \u26A0 Tokens are tenant-scoped (audience `<tenant>:<license>`, not the bare license), so one minted through the instance workspace is REJECTED by a tenant's realtime server \u2014 authenticate and dial through the same tenant.",
@@ -1577,12 +1587,13 @@ function renderSections(m) {
     "which the DB applies atomically. Reserve the pipeline form for low-contention counters",
     "where a rare lost update is acceptable.",
     "\u26A0 `direct_query` needs the table's PHYSICAL Postgres name, which the typed surface",
-    "does NOT expose: the engine derives a physical name from workspace + table ids (of the",
-    "form `x<workspace_id>_<table_id>`, e.g. `x6_203970`), ids assigned at import \u2014 not knowable",
-    "from a `table()` def (identity is a name + guid, not the numeric id), and `sql_name`",
-    "persists empty. So the safe counter drops out of the typed surface: hardcode",
-    "the physical name after inspecting the deployed table. A typed atomic path needs an",
-    "engine change.",
+    "does NOT expose: the engine derives it from ids assigned at import \u2014 not knowable from a",
+    "`table()` def (identity is a name + guid, not the numeric id) \u2014 and `sql_name` persists",
+    "empty. The derived name is also NOT STABLE: a deploy is a full replace, so every table is",
+    "created afresh and the id in its name moves each time, on the same unchanged project. So",
+    "the safe counter drops out of the typed surface: resolve the physical name from",
+    "`information_schema` inside the request that uses it, and never store, cache or hardcode",
+    "one. A typed atomic path needs an engine change.",
     ""
   );
   const argFilters = m.filters.filter((fl) => fl.args?.length);
@@ -1653,7 +1664,7 @@ function renderSections(m) {
     "",
     "- `s.db.get({ table, fieldName?, fieldValue, lock?, output?, as? })` \u2014 one row by field match; `output` restricts returned columns (and overrides column visibility \u2014 it can pull `internal` columns like a password hash).",
     "- `s.db.get_by_id({ table, id, output?, addon?, tableAlias?, as? })` \u2014 get by primary key. Takes `id`, NOT `fieldName`/`fieldValue`; binds the row or `null` for an id that names no row. Both spellings are live in pulled workspaces.",
-    '  - \u26A0 `id` is validated `>= 1`, so the `0` sentinel an optional `f.tableRef` stores fails the request with HTTP 400 `Value is less than the minimum value of 1` \u2014 it does NOT bind `null`. The throw is not scoped to the lookup: inside a `foreach` it kills the whole request, so one unset FK loses every other row\'s work. Read a nullable FK with the field-match form, which binds `null` on `0` and lets the loop finish: `s.db.get({ table, fieldName: "id", fieldValue: ref("row.fk"), as })`.',
+    '  - \u26A0 `id` is validated `>= 1`, so the `0` sentinel an optional `f.tableRef` stores fails the request with HTTP 400 `Value is less than the minimum value of 1` \u2014 it does NOT bind `null`. The throw is not scoped to the lookup: inside a `foreach` it kills the whole request, so one unset FK loses every other row\'s work. Read a nullable FK with the field-match form, which binds `null` on `0` and lets the loop finish: `s.db.get({ table, fieldName: "id", fieldValue: ref("row.fk"), as })`. `export()` warns when the `id` is statically a `0` \u2014 the literal `c.int(0)`, an `inp()` whose declared input default is `0`, or a `ref()` to a column declared `default: 0` \u2014 and `--strict` fails the build.',
     "- `s.db.has({ table, fieldName?, fieldValue, as? })` \u2014 existence test.",
     "- `s.db.del({ table, fieldName?, fieldValue, as? })` \u2014 delete by field match.",
     "- `s.db.add({ table, row?, data?, output?, as? })` \u2014 insert; `row` is a partial keyed by column.",
@@ -1695,6 +1706,8 @@ function renderSections(m) {
     '  - `distinct` \u2014 `"auto"` (default) | `"yes"` | `"no"`, riding `context.return.<list|stream>.distinct`.',
     "- `s.db.truncate({ table, reset?, as? })` \xB7 `s.db.schema({ table, path, as? })`.",
     '- `s.db.direct_query({ sql, responseType?, args?, parser?, as? })` \u2014 `sql` is a **raw string** (not a `Value`); binds go in `args: Value[]`. `parser: "template_engine"` renders the body as a template first \u2014 how a query interpolates a column or table name a bound arg cannot carry; omit it for the default.',
+    "  - Template placeholders are Twig over the request scope: `{{ $input.name }}` for an input, `{{ $var.name }}` for a stack variable. \u26A0 A BARE `{{ name }}` renders as the empty string \u2014 HTTP 200, no error, a query that silently ran with a blank where the value belonged. A bound `?` arg carries a VALUE without the template at all.",
+    "  - \u26A0 A table's PHYSICAL name is **not stable across deploys**. A deploy is a full replace, so every table is created afresh and the id in its name moves every time \u2014 the same unchanged project redeployed three times gave one table three different names. Never store, cache, hardcode or fixture one: resolve it from `information_schema` inside the same request that uses it.",
     "- `s.db.external.<engine>.direct_query({ sql, connectionString, responseType?, args?, parser?, as? })` \u2014 same shape against an EXTERNAL database; `<engine>` is `postgres`/`mysql`/`mssql`/`oracle`/`snowflake`. `connectionString` is a `Value` \u2014 reach for `env(...)`, not a literal \u2014 stored as `context.connection_string_flex`. A bare string stores the older `context.connection_string` instead (an env-var name unless it looks like a URL); each form round-trips as itself.",
     "- `s.db.transaction({ body, as? })` \u2014 run a `Statement[]` atomically. `as` binds whatever the block returned.",
     "- `s.db.bulk.add({ table, items, allowIdField?, as? })` / `s.db.bulk.update` / `s.db.bulk.patch` \u2014 `items` is an array `Value`.",
@@ -1764,11 +1777,11 @@ function renderSections(m) {
     "- `xanots lock rename <kind> <old> <new>` \u2014 `kind` is the payload key (or `table`/`api_group`).",
     "  Run it after renaming in code; the next export emits the original guid under the new name.",
     "- `xanots lock prune <entry-file> [keys\u2026] --yes` \u2014 drops orphaned entries. Finding orphans",
-    "  RUNS the entry's module scope (env assertions included); `--no-verify --yes <kind:name>\u2026`",
+    "  RUNS the entry's module scope (env assertions included); `--identity-only --yes <kind:name>\u2026`",
     "  prunes named keys with no evaluation and no orphan check.",
-    "- `xanots lock adopt <live-bundle.json> [--yes]` \u2014 seed the lock from an engine",
+    "- `xanots lock import <live-bundle.json> [--yes]` \u2014 seed the lock from an engine",
     "  packageExport when taking over an existing workspace.",
-    "- Every lock subcommand accepts `--lock=<path>`. `rename`/`adopt` take no entry file, so",
+    "- Every lock subcommand accepts `--lock=<path>`. `rename`/`import` take no entry file, so",
     "  from outside the lock's directory pass `--lock` (or `--entry=<entry-file>` to derive it).",
     "- Programmatic use: call `seedLockOverrides(readLockFile(path))` BEFORE importing any def",
     "  module \u2014 references bake guids at import time, so late seeding is a silent no-op",
@@ -1776,7 +1789,7 @@ function renderSections(m) {
     "",
     "What writes the lock: `export`/`deploy` of an ENTRY FILE update it via the shared compile",
     "step \u2014 only when a lock exists or `--lock` is passed. Nothing from a DEPLOY is written",
-    "back beyond that (an ephemeral/sandbox is a separate workspace, so its identities must",
+    "back beyond that (an ephemeral is a separate workspace, so its identities must",
     "not pollute yours). The one write-back is `release --replace`, which mints fresh",
     "identities in the workspace the lock describes: it re-pins the lock from the rebuilt",
     "workspace, because otherwise the next release matches nothing and duplicates every",
@@ -2031,7 +2044,7 @@ function renderDocs(m) {
     {
       path: "llms/lock.md",
       title: "Lock file",
-      readWhen: "Read when a `xano.lock` exists or should \u2014 renaming/pruning/adopting identities, seeding the lock programmatically, or asking which commands write it.",
+      readWhen: "Read when a `xano.lock` exists or should \u2014 renaming/pruning/importing identities, seeding the lock programmatically, or asking which commands write it.",
       body: s.lock,
       dropLeadingHeading: true
     },

package/dist/io-P2H75UV2.js

@@ -0,0 +1,12 @@
+import {
+  readLockFile,
+  writeLockFile
+} from "./chunk-XEOX6AM7.js";
+import "./chunk-GNPVYOPB.js";
+import "./chunk-VAF6A3YD.js";
+import "./chunk-OHX6MIUZ.js";
+export {
+  readLockFile,
+  writeLockFile
+};
+//# sourceMappingURL=io-P2H75UV2.js.map

package/dist/{live-diff-QK4KC2FJ.js → live-diff-IXKBVG4K.js}

@@ -2,11 +2,11 @@ import {
   compareToLive,
   diffAgainstLive,
   sharedSchemaChanges
-} from "./chunk-5HCDZ2XN.js";
-import "./chunk-ZOYMZZ3S.js";
+} from "./chunk-DBFU47BJ.js";
+import "./chunk-3INK4Y4E.js";
 export {
   compareToLive,
   diffAgainstLive,
   sharedSchemaChanges
 };
-//# sourceMappingURL=live-diff-QK4KC2FJ.js.map
+//# sourceMappingURL=live-diff-IXKBVG4K.js.map

package/dist/{lock-GFXD6G2E.js → lock-46FWYE4D.js}

@@ -17,7 +17,8 @@ import {
   resolvePayloadKey,
   serializeLock,
   validateLockModel
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-VAF6A3YD.js";
+import "./chunk-OHX6MIUZ.js";
 export {
   CANONICAL_PAYLOAD_KEYS,
   LOCK_PAYLOAD_KEYS,
@@ -38,4 +39,4 @@ export {
   serializeLock,
   validateLockModel
 };
-//# sourceMappingURL=lock-GFXD6G2E.js.map
+//# sourceMappingURL=lock-46FWYE4D.js.map

package/dist/{lock-commands-ET7NIOLH.js → lock-commands-ZZKZ4LZJ.js}

@@ -1,24 +1,24 @@
 import {
   loadDefault
-} from "./chunk-K3YSQDXJ.js";
+} from "./chunk-RCT7UX7B.js";
+import "./chunk-CTD5ZCV6.js";
+import {
+  readLockFile,
+  writeLockFile
+} from "./chunk-XEOX6AM7.js";
 import {
   UsageError,
   missingArgument,
   unknownSubcommand
-} from "./chunk-JQLR64UC.js";
-import {
-  readLockFile,
-  writeLockFile
-} from "./chunk-OYMR5AMJ.js";
+} from "./chunk-F6CYJ7TN.js";
 import "./chunk-GNPVYOPB.js";
 import "./chunk-EZG76F7R.js";
 import {
   Xano
-} from "./chunk-UDL46O35.js";
-import "./chunk-OKNSR7MT.js";
-import "./chunk-QONOJO45.js";
+} from "./chunk-OWGCOGKK.js";
+import "./chunk-DIA7CT7J.js";
+import "./chunk-QK7ZQJLP.js";
 import "./chunk-WHOJWOSV.js";
-import "./chunk-5XZ744TS.js";
 import {
   adoptFromBundle,
   createLockContext,
@@ -27,7 +27,9 @@ import {
   resetLockOverrides,
   resolvePayloadKey,
   seedLockOverrides
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-VAF6A3YD.js";
+import "./chunk-5XZ744TS.js";
+import "./chunk-OHX6MIUZ.js";
 
 // src/emit/lock-commands.ts
 import { existsSync, readFileSync } from "fs";
@@ -39,7 +41,7 @@ async function runLockCommand(args) {
       return lockRename(args);
     case "prune":
       return lockPrune(args);
-    case "adopt":
+    case "import":
       return lockAdopt(args);
     default:
       throw unknownSubcommand("lock", sub);
@@ -101,7 +103,7 @@ async function observedLockKeys(entryFile, lock) {
     throw new Error(
       `lock prune evaluated "${entryFile}" to find out which lock entries are still live, and loading it failed:
   ${reason}
-Finding orphans requires running your workspace source \u2014 anything the entry file does at module scope (asserting env vars, reading config) runs too. To drop entries you can name yourself, no evaluation is needed: \`xanots lock prune --no-verify --yes <kind:name>\u2026\` with \`--lock=<path>\` or \`--entry=<path>\` to locate the lock.`,
+Finding orphans requires running your workspace source \u2014 anything the entry file does at module scope (asserting env vars, reading config) runs too. To drop entries you can name yourself, no evaluation is needed: \`xanots lock prune --identity-only --yes <kind:name>\u2026\` with \`--lock=<path>\` or \`--entry=<path>\` to locate the lock.`,
       { cause: err }
     );
   }
@@ -114,7 +116,7 @@ Finding orphans requires running your workspace source \u2014 anything the entry
 }
 async function lockPrune(args) {
   const [, ...rest] = args.positionals;
-  if (args.noVerify) return lockPruneNamed(args, rest);
+  if (args.identityOnly) return lockPruneNamed(args, rest);
   const [entryFile, ...keys] = rest;
   if (!entryFile) {
     throw missingArgument("entry-file", { command: "lock", subcommand: "prune" });
@@ -146,7 +148,7 @@ async function lockPrune(args) {
 function lockPruneNamed(args, keys) {
   if (keys.length === 0) {
     throw new UsageError(
-      "`lock prune --no-verify` prunes the entries you name, so it needs at least one key (`table:users`). Without keys there is nothing to prune, because finding orphans is exactly the step --no-verify skips \u2014 drop the flag and pass the entry file to do that.",
+      "`lock prune --identity-only` prunes the entries you name, so it needs at least one key (`table:users`). Without keys there is nothing to prune, because finding orphans is exactly the step --identity-only skips \u2014 drop the flag and pass the entry file to do that.",
       { helpFor: { command: "lock", subcommand: "prune" } }
     );
   }
@@ -158,7 +160,7 @@ function lockPruneNamed(args, keys) {
     }
   }
   process.stderr.write(
-    `xanots: --no-verify \u2014 nothing was evaluated, so nothing confirms ${keys.length === 1 ? "this key is" : "these keys are"} orphaned. A key the workspace still exports gets a NEW identity at the next export.
+    `xanots: --identity-only \u2014 nothing was evaluated, so nothing confirms ${keys.length === 1 ? "this key is" : "these keys are"} orphaned. A key the workspace still exports gets a NEW identity at the next export.
 `
   );
   applyPrune(args, lockPath, lock, keys);
@@ -184,9 +186,9 @@ ${canonicalNote}`);
 function lockAdopt(args) {
   const [, bundlePath] = args.positionals;
   if (!bundlePath) {
-    throw missingArgument("bundle.json", { command: "lock", subcommand: "adopt" });
+    throw missingArgument("bundle.json", { command: "lock", subcommand: "import" });
   }
-  const lockPath = commandLockPath(args, "adopt");
+  const lockPath = commandLockPath(args, "import");
   const lock = existsSync(lockPath) ? readLockFile(lockPath) : emptyLock();
   let bundle;
   try {
@@ -206,11 +208,11 @@ function lockAdopt(args) {
     process.stdout.write(`Adoption would overwrite ${changed.length} existing lock entr(y/ies):
 ${lines}
 `);
-    throw new Error("lock adopt overwrites pinned identities \u2014 re-run with --yes to apply.");
+    throw new Error("lock import overwrites pinned identities \u2014 re-run with --yes to apply.");
   }
   if (vaultCount > 0) {
     process.stderr.write(
-      `xanots: WARNING \u2014 ${bundlePath} contains ${vaultCount} vault entr(y/ies) (secrets). Do NOT commit the bundle file; delete it once adoption is done.
+      `xanots: WARNING \u2014 ${bundlePath} contains ${vaultCount} vault entr(y/ies) (secrets). Do NOT commit the bundle file; delete it once the import is done.
 `
     );
   }
@@ -229,4 +231,4 @@ ${lines}
 export {
   runLockCommand
 };
-//# sourceMappingURL=lock-commands-ET7NIOLH.js.map
+//# sourceMappingURL=lock-commands-ZZKZ4LZJ.js.map

package/dist/{login-command-DFCURZLC.js → login-command-Z6CHTA57.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-W5NOKYEG.js";
 import {
   promptLine
-} from "./chunk-4PTSTDIG.js";
+} from "./chunk-AIZKXUNP.js";
 import {
   envMetaCredentialVarsSet
-} from "./chunk-3QW5NFZJ.js";
+} from "./chunk-QKM4U5UK.js";
 import {
   CALLBACK_PATH,
   DEFAULT_PORT,
@@ -23,10 +23,10 @@ import {
   resolveAuthHost,
   resolveScope,
   writeCredential
-} from "./chunk-BKDJN76G.js";
+} from "./chunk-FE5I6S6N.js";
 import {
   UsageError
-} from "./chunk-JQLR64UC.js";
+} from "./chunk-F6CYJ7TN.js";
 import "./chunk-GNPVYOPB.js";
 import {
   blank,
@@ -37,7 +37,7 @@ import {
   success,
   warn
 } from "./chunk-EZG76F7R.js";
-import "./chunk-OKNSR7MT.js";
+import "./chunk-DIA7CT7J.js";
 
 // src/emit/login-command.ts
 import * as client from "openid-client";
@@ -177,7 +177,7 @@ async function attemptLogin(p) {
       `Could not determine the instance from the issued token (no readable \`aud\` claim). This is unexpected \u2014 please report it.`
     );
   }
-  const { resolveScopedWorkspaceId } = await import("./workspace-K72NP7SX.js");
+  const { resolveScopedWorkspaceId } = await import("./workspace-2COHDBM3.js");
   detail("Resolving the workspace this token is scoped to\u2026");
   const workspaceId = await resolveScopedWorkspaceId({
     access_token: tokens.access_token,
@@ -267,4 +267,4 @@ async function acquireByPaste(p) {
 export {
   runLoginCommand
 };
-//# sourceMappingURL=login-command-DFCURZLC.js.map
+//# sourceMappingURL=login-command-Z6CHTA57.js.map