v1.0.3 — Agents and MCP servers pass preflight

This patch release fixes xanosdk preflight on workspaces that have agents or MCP servers, and makes pulling an existing workspace into code more reliable. Agents and MCP servers without sign-in no longer fail the round trip. Workspaces pulled with export/codegen now re-export as they were stored and the generated tree typechecks, including shapes older workspaces carry.

npm install @xano/sdk@1.0.3

preflight no longer fails every agent and MCP server without oauth

An agent or MCP server with no oauth reads back from the instance with oauth: null, while the SDK leaves the key out. Preflight treated the two as different and failed with $.oauth: expected (absent), got null. They are now the same "no sign-in" state. A configured oauth block is still compared exactly.

UUID primary keys keep their stored default

A table with a uuid id stores default: "" on it, which the encoder dropped, so a pulled table failed to re-export as it was stored. The default is now kept.

Pulled workspaces decode more statements to typed code

Shapes that used to fall back to raw() now decode typed:

• uncheckedAs: true for a binding name the variable rule refuses
• AddonSpec.envelope for an addon on the paging envelope
• bind: [{ expand: "<alias>.<column>", as }] for list-column expansion joins

Retired statements are reported as superseded rather than raw-fallback, and their bytes are carried through unchanged as before.

Guards the engine accepts are now warnings a def can allow

These were errors, so a pulled workspace that stored them could not compile:

• an addon binding a missing column
• a duplicate addon alias
• an unfit column default on a JSON-storage table (the new table.column-default-unfit)
• route shadowing
• loop control outside a loop

Each is now a warning that diagnostics.allow accepts. --strict still fails it without an allow. Test ids also accept the dashed UUID form.

Workspace defects are reported and the tree still compiles

Stored defects now come out as reported markers in code that still compiles: trim/children on columns that don't support them, a view filter with a blank operator (rawWhere()), stale call inputs and output columns ("key" as never), unparseable lambdas, and db statements missing a required input. lam.raw(..., { unchecked: true }) now also skips the module-syntax check.

Notes

The grounding files now cover expand, envelope and the pulled-tree markers, and the sandbox has a list-column expansion join example (ex_db_query_expand).

Full changelog: xanots/sdk@v1.0.2...v1.0.3