@xano/sdk 1.0.0

package/dist/release-ns-command-3KFDMZ6G.js

@@ -0,0 +1,1745 @@
+import {
+  OperationError,
+  createOperation,
+  runOperation
+} from "./chunk-TLHIFK4M.js";
+import {
+  EXIT_RELEASE_REFUSED,
+  describeOrigin,
+  findReleaseSource,
+  lookupRelease,
+  readUnanswered,
+  releaseOrigin,
+  requireName
+} from "./chunk-AWEIIR2U.js";
+import {
+  confirm
+} from "./chunk-65HWOMGV.js";
+import {
+  guardedIn,
+  listTables,
+  someTableRow
+} from "./chunk-C6RIMRU4.js";
+import {
+  resolveProjectEntry
+} from "./chunk-AOSYVMUS.js";
+import {
+  assertBranchReadSupported,
+  exportWorkspaceBundle
+} from "./chunk-CJHQKJU4.js";
+import {
+  ArchiveTooLargeError,
+  decodeWorkspaceArchive,
+  unwrapGzip
+} from "./chunk-3DRXWLJ5.js";
+import "./chunk-X4DVXBFY.js";
+import {
+  classifyFailure
+} from "./chunk-A6E77GDW.js";
+import {
+  listBranches,
+  liveBranchLabel,
+  requireBranch
+} from "./chunk-TRJCALW3.js";
+import {
+  sha256Hex
+} from "./chunk-NA3PXMEF.js";
+import {
+  resolveOutputTarget,
+  secretsPhrase,
+  writeExportFile
+} from "./chunk-SAVJUS2X.js";
+import {
+  SETTINGS_LABEL,
+  compareToLive,
+  secretsInMultidoc
+} from "./chunk-45UIT5T2.js";
+import "./chunk-HRVBLCVJ.js";
+import "./chunk-YHEFQUQB.js";
+import {
+  assertBundleFile,
+  loadBundleText
+} from "./chunk-ETO6LGLD.js";
+import {
+  assertOneName
+} from "./chunk-ZIY7RNUT.js";
+import "./chunk-DAD3ONIS.js";
+import {
+  memoCredential,
+  selectBackend
+} from "./chunk-HHN734BU.js";
+import "./chunk-LPECSJ2J.js";
+import "./chunk-6NNTNXN7.js";
+import {
+  SourceError,
+  describeBackend,
+  differOnlyInNormalisation,
+  differingCodePoints,
+  isUnansweredLookup,
+  normalisationNote,
+  orNamesNoted,
+  refuseWorkspaceless,
+  resolveSource
+} from "./chunk-QCNYHBL7.js";
+import {
+  RESERVED_DESCRIPTION_PREFIX,
+  assertUsableReleaseName,
+  createRelease,
+  deleteRelease,
+  describeAsCopy,
+  describeWithOrigin,
+  downloadRelease,
+  exportRelease,
+  getRelease,
+  importRelease,
+  listReleases,
+  reservedDescriptionLine,
+  updateReleaseDescription
+} from "./chunk-2ZUEE4EK.js";
+import "./chunk-AN6BL47T.js";
+import {
+  ProfileNotFoundError,
+  getAccessToken,
+  resolveNamedProfile
+} from "./chunk-ET4Y4XCB.js";
+import "./chunk-SWBF2LTK.js";
+import "./chunk-UZ6QQWJT.js";
+import "./chunk-A3UDOZB6.js";
+import "./chunk-2MNLRIOX.js";
+import "./chunk-3M4LFYNQ.js";
+import "./chunk-AM4FKL4J.js";
+import "./chunk-Q325JKYB.js";
+import {
+  requireBackendSlot
+} from "./chunk-STSFNCY4.js";
+import "./chunk-I4F5TCJH.js";
+import "./chunk-5QU2P5CA.js";
+import "./chunk-ZYJP6BOO.js";
+import "./chunk-QO6BVGS5.js";
+import "./chunk-JZGVVJSI.js";
+import "./chunk-7G3CTU7I.js";
+import "./chunk-6PBR37LN.js";
+import {
+  pipedYes,
+  retryCommand,
+  withheldNote,
+  yesRerun
+} from "./chunk-T5KELPAR.js";
+import "./chunk-622HUCZT.js";
+import {
+  contextFlags
+} from "./chunk-NAQDMEHV.js";
+import {
+  backendDirIn
+} from "./chunk-5A2PLKZB.js";
+import "./chunk-AHJWCYQO.js";
+import "./chunk-DX4QR4B2.js";
+import "./chunk-6QXLMMT3.js";
+import "./chunk-ZFDZKNGG.js";
+import {
+  credentialFlags,
+  shellWord
+} from "./chunk-FWD7AL6N.js";
+import "./chunk-2GNFDZA2.js";
+import "./chunk-JTUKLCXS.js";
+import {
+  describeWrite
+} from "./chunk-4KHEMC32.js";
+import "./chunk-U64O2MXY.js";
+import "./chunk-ROY4YAEQ.js";
+import "./chunk-P2HAGF6H.js";
+import "./chunk-TLQE7ZN3.js";
+import "./chunk-WRBKLYSJ.js";
+import "./chunk-3LDULPRE.js";
+import "./chunk-XW6KISBB.js";
+import {
+  writeData
+} from "./chunk-AWQ7BQTQ.js";
+import "./chunk-EUUUMY7J.js";
+import {
+  bindingFor
+} from "./chunk-YLDALTWZ.js";
+import "./chunk-5FBYXK5P.js";
+import "./chunk-LLNZGEFK.js";
+import "./chunk-QXTKSOFI.js";
+import "./chunk-X2NL4KUO.js";
+import "./chunk-OPHB5ORL.js";
+import "./chunk-UCQ2VUTG.js";
+import "./chunk-DGWHAVRG.js";
+import "./chunk-JGE7CAWB.js";
+import {
+  CUT_KINDS,
+  CliError,
+  LocalFileNotFoundError,
+  UsageError,
+  credentialWriteTarget,
+  describeWriteTarget,
+  detail,
+  discloseWriteTarget,
+  displayPath,
+  formatTableListing,
+  info,
+  isMachineOutput,
+  pastePath,
+  printHuman,
+  relForwardSlash,
+  safeText,
+  stdoutStyle,
+  step,
+  success,
+  tablesCommand,
+  unknownSubcommand,
+  warn,
+  writeJson,
+  writeTargetPayload
+} from "./chunk-PTHVMXZI.js";
+import "./chunk-MXHSQOC4.js";
+import "./chunk-6IUMKYWI.js";
+import "./chunk-2CMJZDCL.js";
+import "./chunk-CTMO46PK.js";
+import "./chunk-ZDPP6RKB.js";
+import "./chunk-K5BBGTYZ.js";
+import "./chunk-LQCMKAJ7.js";
+import "./chunk-YGZHHAAB.js";
+import "./chunk-XVBGLISP.js";
+import "./chunk-6HO3NCSJ.js";
+import "./chunk-5V5XU32D.js";
+import "./chunk-GSGDWJB5.js";
+import "./chunk-HVRUQXGD.js";
+import "./chunk-ERVIASGL.js";
+import "./chunk-4POWHT2K.js";
+import "./chunk-H2V3N23D.js";
+import "./chunk-3JDU4VRL.js";
+import "./chunk-WTPZRR4I.js";
+import {
+  suggest
+} from "./chunk-UTI5G6OJ.js";
+import "./chunk-2EZ3ZJZZ.js";
+import "./chunk-6MR5TI5V.js";
+import "./chunk-5ZSO4T2G.js";
+import {
+  HOSTED_ICON_KINDS
+} from "./chunk-XNCP4KYO.js";
+import "./chunk-AKNCFVKZ.js";
+import "./chunk-YU4HSQW7.js";
+import "./chunk-TFFGOFVZ.js";
+import "./chunk-L5JYN3NM.js";
+import "./chunk-G554NZNI.js";
+import "./chunk-N5GKCWE5.js";
+import "./chunk-OXA6PSZT.js";
+import "./chunk-VAX3UZOY.js";
+import "./chunk-NZOWWHU5.js";
+import "./chunk-4BW2SG2N.js";
+import "./chunk-TTEIYD5P.js";
+import "./chunk-CIMQZRRE.js";
+import "./chunk-OHX6MIUZ.js";
+import {
+  withArticle
+} from "./chunk-36JUQZVQ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/emit/release-create.ts
+import { join, resolve } from "path";
+import { existsSync, statSync } from "fs";
+
+// src/deploy/release-hosted-files.ts
+function isFileColumnType(type) {
+  return typeof type === "string" && type.startsWith("blob");
+}
+function fileColumnsIn(schema, prefix = "") {
+  if (!Array.isArray(schema)) return [];
+  return schema.flatMap((col) => {
+    if (col === null || typeof col !== "object") return [];
+    const c = col;
+    if (typeof c.name !== "string" || c.name === "") return [];
+    const path = `${prefix}${c.name}`;
+    return isFileColumnType(c.type) ? [path] : fileColumnsIn(c.children, `${path}.`);
+  });
+}
+function isLibraryIconSrc(src) {
+  return typeof src === "string" && src.startsWith("/vault/");
+}
+function rowHoldsFile(row, column) {
+  const holds = (value, path) => {
+    if (Array.isArray(value)) return value.some((v2) => holds(v2, path));
+    if (value === null || typeof value !== "object") return false;
+    const v = value;
+    if (path.length === 0) return typeof v.path === "string" && v.path !== "";
+    return holds(v[path[0]], path.slice(1));
+  };
+  return holds(row, column.split("."));
+}
+async function uncarriedFiles(payload, seeded, rowsHoldFiles) {
+  const out = [];
+  for (const kind of HOSTED_ICON_KINDS) {
+    const rows = payload[kind];
+    if (!Array.isArray(rows)) continue;
+    for (const row of rows) {
+      if (row === null || typeof row !== "object" || !Array.isArray(row.icons)) continue;
+      row.icons.forEach((icon, i) => {
+        if (icon !== null && typeof icon === "object" && isLibraryIconSrc(icon.src)) {
+          out.push({ kind, name: String(row.name ?? ""), field: `icons[${i}]` });
+        }
+      });
+    }
+  }
+  const library = Array.isArray(payload.vault) ? payload.vault.length : 0;
+  if (seeded !== void 0 && seeded.length > 0 && library > 0) {
+    const tables = Array.isArray(payload.dbo) ? payload.dbo : [];
+    for (const want of seeded) {
+      const table = tables.find((t) => t !== null && typeof t === "object" && t.guid === want.guid) ?? tables.find((t) => t !== null && typeof t === "object" && t.name === want.name);
+      const columns = table === void 0 ? [] : fileColumnsIn(table.schema);
+      if (columns.length > 0 && await rowsHoldFiles(want, columns)) {
+        out.push({ kind: "table", name: want.name, field: columns.join(", ") });
+      }
+    }
+  }
+  return out;
+}
+function describeUncarried(file) {
+  return file.kind === "table" ? `table "${file.name}" rows holding files \u2014 file column${file.field.includes(",") ? "s" : ""} ${file.field}` : `${file.kind} "${file.name}" \`${file.field}\``;
+}
+
+// src/emit/release-create.ts
+async function resolveFrom(args, credential, cwd) {
+  const slot = requireBackendSlot("release", "create", "from");
+  const source = await selectBackend(slot, args.from, { credential, deps: { cwd } });
+  if (!CUT_KINDS.includes(source.kind)) {
+    throw new Error(`Internal: \`release create --from\` selected ${withArticle(source.kind)}, which its slot does not accept.`);
+  }
+  return source;
+}
+var THROWAWAY_TENANT_TYPES = ["ephemeral", "sandbox"];
+async function refuseLiveDeployment(resolved) {
+  if (resolved.kind !== "tenant") return;
+  const type = resolved.target.tenantType;
+  if (type !== void 0 && THROWAWAY_TENANT_TYPES.includes(type)) return;
+  const t = resolved.target.label;
+  const { tenantHasWorkspace } = await import("./tenant-IIHPOHGP.js");
+  const pullable = resolved.backend?.kind !== "hosted" || await tenantHasWorkspace(resolved.backend.auth, resolved.target.base);
+  throw new UsageError(
+    `A release cannot be cut from ${t}${type === void 0 ? "" : ` \u2014 it is a \`${type}\` tenant`}.
+Only a throwaway tenant (${THROWAWAY_TENANT_TYPES.join(" or ")}) can be a source: a standard or run tenant is a live deployment. \`xanosdk tenant get ${t}${contextFlags()}\` names the last release landed there, and that release lands anywhere as it is \u2014 but any \`deploy --to\` merge since may have changed what the tenant runs.
+` + // Never with `--yes`: the pull's own confirmation and its uncommitted-changes
+    // check are what keep it from replacing edits, and off a terminal it
+    // refuses with its own rerun.
+    (pullable ? `To start from what it runs now, pull it into this project (\`xanosdk pull tenant:${t}${contextFlags()}\`), \`xanosdk deploy\` it to an ephemeral, and cut from there.` : `It has no workspace yet \u2014 a tenant on its own domain gets one when its first release lands \u2014 so there is nothing on it to pull or cut from until then.`),
+    { hintFor: { command: "release", subcommand: "create" } }
+  );
+}
+function sourceLabel(resolved, branch) {
+  if (resolved.kind === "ephemeral" || resolved.kind === "tenant") return describeBackend(resolved);
+  return resolved.kind === "workspace" && branch !== void 0 ? `${resolved.target.label} (branch ${JSON.stringify(branch)})` : resolved.target.label;
+}
+function environmentType(resolved) {
+  if (resolved.kind === "ephemeral") return "ephemeral";
+  return resolved.target.tenantType ?? "environment";
+}
+function comparisonInput(args, cwd) {
+  const lockDefaults = {
+    lock: false,
+    lockPath: void 0,
+    noLock: false,
+    frozenLock: false,
+    allowLockOrphans: false,
+    // Read, never written: this compile answers a question, and a cut that
+    // created or rewrote `xano.lock` (with its "commit it" notice) changed the
+    // project behind a command that only reads it.
+    lockReadOnly: true
+  };
+  if (args.bundle !== void 0) return { ...args, ...lockDefaults, file: void 0 };
+  const entry = args.entryPath ?? resolveProjectEntry(cwd);
+  if (entry === void 0) return void 0;
+  return { ...args, ...lockDefaults, file: resolve(cwd, entry), bundle: void 0 };
+}
+function remedyFor(resolved, bundle, branch, name, entry, settings) {
+  const flags = contextFlags();
+  const input = `${entry === void 0 ? "" : ` ${shellWord(entry)}`}${bundle === void 0 ? "" : ` --bundle ${shellWord(bundle)}`}${flags}`;
+  const what = bundle === void 0 ? "the current code" : "that bundle";
+  if (resolved.kind === "workspace") {
+    if (branch === void 0) {
+      return `Run \`xanosdk deploy --to workspace${input}\` first if you meant to cut ${what}.`;
+    }
+    const cutName = name === void 0 ? "<name>" : shellWord(name);
+    const settingsNote = `Workspace settings are shared by every branch, so no branch deploy changes them \u2014 and a promote keeps the destination's own, so they do not change what this release lands. To clear the settings line, declare the workspace's values in this project, or apply yours with \`xanosdk deploy --to workspace${input}\` (onto live).`;
+    if (settings === "only") return settingsNote;
+    return `To cut ${what}, deploy it to a new branch and cut from that: \`xanosdk deploy --to workspace --branch <new-label>${input}\`, then \`xanosdk release create ${cutName} --from workspace --branch <new-label>${flags}\`. (\`deploy --to workspace --branch\` refuses a label that already exists, so it cannot update ${shellWord(branch)}.)` + (settings === "also" ? ` ${settingsNote}` : "");
+  }
+  if (resolved.kind === "tenant") {
+    return `Run \`xanosdk deploy --to tenant:${resolved.target.label}${input}\` first if you meant to cut ${what}.`;
+  }
+  return `Run \`xanosdk deploy${input}\` first if you meant to cut ${what}.`;
+}
+async function warnOnDivergence(args, resolved, cwd, live) {
+  const input = comparisonInput(args, cwd);
+  if (input === void 0) {
+    const looked = relForwardSlash(cwd, join(backendDirIn(cwd), "index.ts"));
+    detail(
+      `No project entry found (looked for ${looked}) - skipped the comparison against a local compile. \`--entry=<path>\` names the entry to compare against.`
+    );
+    return { checked: false, reason: `no project entry found (looked for ${looked})` };
+  }
+  const bundleGiven = input.bundle !== void 0;
+  try {
+    const branch = resolved.kind === "workspace" ? args.branch : void 0;
+    const local = await loadBundleText(input, { command: "release", subcommand: "create" });
+    const { codePinnedCanonicals, releaseCanonicalLock } = await import("./release-command-N4ZPKMHR.js");
+    const pinned = codePinnedCanonicals(
+      local.bundle,
+      releaseCanonicalLock(input, local.classifiedLock),
+      input.file !== void 0
+    );
+    const convergence = compareToLive(
+      JSON.parse(local.bundle),
+      live,
+      new Set(pinned.map((p) => `${p.payloadKey}:${p.name}`)),
+      { documentation: "compare", sample: "all" }
+    );
+    const extra = convergence.liveOnly.length;
+    const behind = convergence.differingCount + convergence.missingCount + extra;
+    const objects = [
+      ...convergence.differing.map(
+        (name) => name === SETTINGS_LABEL && convergence.settingsFields.length > 0 ? `${name} \u2014 ${convergence.settingsFields.join(", ")}` : name
+      ),
+      ...convergence.missing.map((name) => `${name} (not on the source)`),
+      ...convergence.liveOnly.map((name) => `${name} (not in ${bundleGiven ? "the bundle" : "this project"})`)
+    ];
+    const against = displayPath(resolve(cwd, local.source));
+    if (behind > 0) {
+      const label = sentenceStart(sourceLabel(resolved, branch));
+      warn(
+        `${label} does not match ${bundleGiven ? against : "a fresh compile of this project"} (${behind} object${behind === 1 ? "" : "s"} differing, missing or extra).`,
+        "release.drift",
+        [
+          ...objects.slice(0, DRIFT_SHOWN),
+          ...behind > DRIFT_SHOWN ? [`\u2026 and ${behind - DRIFT_SHOWN} more`] : [],
+          `The release will carry what is RUNNING there, not what ${bundleGiven ? "that bundle holds" : "is on your disk"}.`,
+          remedyFor(
+            resolved,
+            bundleGiven ? against : void 0,
+            branch,
+            args.positionals[0]?.trim(),
+            !bundleGiven && args.entryPath !== void 0 ? pastePath(args.entryPath) : void 0,
+            convergence.differing.includes(SETTINGS_LABEL) ? behind === 1 ? "only" : "also" : void 0
+          )
+        ]
+      );
+    }
+    return { checked: true, against, count: behind, objects };
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Invalid lock file ")) {
+      throw new Error(`${err.message}
+Nothing was cut.`, { cause: err });
+    }
+    detail(`Could not compare against a local compile: ${err.message}`);
+    return { checked: false, reason: err.message };
+  }
+}
+var FILES_NOT_CARRIED = "SDK_RELEASE_FILES_NOT_CARRIED";
+function sentenceStart(label) {
+  return label.replace(/^(your|ephemeral|tenant|workspace)\b/, (w) => `${w.charAt(0).toUpperCase()}${w.slice(1)}`);
+}
+async function readSourceExport(args, auth, resolved) {
+  const branch = resolved.kind === "workspace" ? args.branch : void 0;
+  try {
+    if (branch !== void 0) {
+      await assertBranchReadSupported(auth, {
+        base: resolved.target.base,
+        workspaceId: resolved.target.workspaceId,
+        branch
+      });
+    }
+    return await exportWorkspaceBundle(auth, { ...resolved.target, ...branch !== void 0 ? { branch } : {} });
+  } catch (err) {
+    throw cannotVouch(args, resolved, `could not read its export: ${err.message}`);
+  }
+}
+async function readBeforeCut(args, what, read) {
+  try {
+    return await read();
+  } catch (err) {
+    const { command, withheld } = retryCommand(args, { command: "release create", creates: true });
+    throw new CliError(
+      "SDK_ERROR",
+      `Could not ${what}: ${err.message}
+Nothing was cut. Re-run \`${command}\` once it answers.${withheldNote(withheld)}`,
+      { exitCode: 8 }
+    );
+  }
+}
+function cannotVouch(args, resolved, why) {
+  const { command, withheld } = retryCommand(args, { command: "release create", creates: true });
+  return new CliError(
+    "SDK_ERROR",
+    `Could not check ${resolved.target.label} for stored files a release cannot carry \u2014 ${why}
+A release copies no file bytes, and a cut that was not checked could drop them silently. Nothing was cut. Re-run \`${command}\` once it answers.${withheldNote(withheld)}`,
+    { exitCode: 8 }
+  );
+}
+async function refuseUncarriedFiles(payload, selection, resolved, args, auth, cwd) {
+  const byGuid = new Map(selection?.tables.map((t) => [t.guid, t]));
+  const files = await uncarriedFiles(payload, selection?.tables, async (want, columns) => {
+    const table = byGuid.get(want.guid);
+    if (table === void 0) return true;
+    try {
+      return await someTableRow(
+        auth,
+        {
+          workspaceId: resolved.target.workspaceId,
+          tableId: table.id,
+          base: resolved.target.base,
+          binding: bindingFor(auth, resolved.target.workspaceId, resolved.kind !== "workspace")
+        },
+        (row) => columns.some((c) => rowHoldsFile(row, c))
+      );
+    } catch (err) {
+      throw cannotVouch(args, resolved, `could not read table "${table.name}"'s rows: ${err.message}`);
+    }
+  });
+  if (files.length === 0) return;
+  const rows = files.some((f) => f.kind === "table");
+  const effects = [
+    ...rows ? ["those rows' files would be empty"] : [],
+    ...files.some((f) => f.kind !== "table") ? ["those icons would answer 404"] : []
+  ];
+  const entry = remedyEntry(args, cwd);
+  throw new CliError(
+    FILES_NOT_CARRIED,
+    `${sentenceStart(resolved.target.label)} serves stored files this release would point at but cannot carry:
+` + files.map((f) => `  ${describeUncarried(f)}`).join("\n") + `
+A release copies no file bytes, so wherever it lands ${effects.join(" and ")}. Land the project with its files by deploying it directly: \`xanosdk deploy${entry.word}--to tenant:<name>${rows ? " --seed" : ""}${contextFlags(args)}\`${entry.note}. Nothing was cut.`,
+    { exitCode: EXIT_RELEASE_REFUSED, details: { files } }
+  );
+}
+function remedyEntry(args, cwd) {
+  if (args.entryPath !== void 0) return { word: ` ${shellWord(args.entryPath)} `, note: "" };
+  if (args.bundle === void 0 && resolveProjectEntry(cwd) !== void 0) return { word: " ", note: "" };
+  return { word: " <entry> ", note: ` (\`<entry>\`: the backend's \`index.ts\` the source was deployed from)` };
+}
+var DRIFT_SHOWN = 5;
+async function cutFromEnvironment(auth, name, resolved, description, op, lookFor, flags, rerun) {
+  const tenant = resolved.target.env;
+  if (tenant === void 0) {
+    throw new Error(
+      `cut release: ${resolved.target.label} did not resolve to a tenant name, so it cannot be named as a source. Nothing was added to your workspace.`
+    );
+  }
+  const cut2 = await sendCut(
+    auth,
+    op,
+    lookFor,
+    () => createRelease(auth, {
+      workspaceId: auth.workspaceId,
+      name,
+      branch: "",
+      sourceTenant: tenant,
+      // Carries `tableIds` when rows were asked for — the TENANT's ids, resolved
+      // against the tenant's own listing, because a tenant's workspace is always
+      // id 1 and ids from anywhere else name other tables.
+      ...description,
+      // The origin, on the description's last line: the record keeps no source
+      // field and the audit entry that names one is pruned with the log, so
+      // `release show` and a landing's password-hash warning read it here.
+      description: describeWithOrigin(description.description, { type: environmentType(resolved), name: tenant })
+    })
+  );
+  detail(`Confirming it was cut from ${resolved.target.label}`);
+  await confirmCutFrom(auth, op, {
+    name: cut2.name !== "" ? cut2.name : name,
+    tenant,
+    cut: cut2,
+    label: resolved.target.label,
+    flags,
+    rerun
+  });
+  if (cut2.id === void 0) return cut2;
+  try {
+    return await getRelease(auth, { workspaceId: auth.workspaceId, id: cut2.id }) ?? cut2;
+  } catch (err) {
+    const cause = causeOnly(err);
+    const shown = cut2.name !== "" ? cut2.name : name;
+    detail(
+      `The release was cut, but reading it back failed (${cause}); reporting it as the cut returned it. \`xanosdk release show ${shellWord(shown)}${contextFlags()}\` reads it again.`
+    );
+    return cut2;
+  }
+}
+async function confirmCutFrom(auth, op, opts) {
+  let recorded;
+  try {
+    recorded = await findReleaseSource(auth, { workspaceId: auth.workspaceId, releaseName: opts.name });
+  } catch (err) {
+    const unanswered = isUnansweredLookup(err);
+    const again = `re-run \`${opts.rerun.command}\` once it answers.${withheldNote(opts.rerun.withheld)}`;
+    return refuseCut(
+      auth,
+      op,
+      opts.cut,
+      opts.name,
+      opts.flags,
+      (removal) => `Cut "${opts.name}" from ${opts.label}, but could not confirm where it was cut from: ${causeOnly(err)}.
+` + (removal.removed ? `The release has been removed rather than left with contents that cannot be vouched for` + (unanswered ? ` \u2014 ${again.charAt(0).toUpperCase()}${again.slice(1)}` : ".") : `It was left behind and could NOT be removed \u2014 delete it with \`${removal.removeWith}\`` + (unanswered ? `, then ${again}` : ` before re-cutting, or the name will collide.`)),
+      unanswered ? 8 : void 0
+    );
+  }
+  if (recorded !== null && recorded.tenantName === opts.tenant) return;
+  const source = recorded?.tenantName;
+  return refuseCut(
+    auth,
+    op,
+    opts.cut,
+    opts.name,
+    opts.flags,
+    (removal) => source === void 0 ? `Refusing the release "${opts.name}": this instance ignored the source and cut from your workspace instead.
+  instance: ${auth.instance}
+It accepted \`${opts.tenant}\` as a source and recorded no source at all, which is what an instance predating this capability does. The release would have carried YOUR workspace's current state under ${opts.label}'s name \u2014 ` + (removal.removed ? `so it has been removed.` : `and it could NOT be removed: ${removal.remedy}`) + `
+Cut \`--from workspace\` if that is what you want, or wait for this instance to take the update.` : `Refusing the release "${opts.name}": it was cut from "${source}", not from ${opts.label} (\`${opts.tenant}\`). ` + (removal.removed ? `It has been removed.` : `It could NOT be removed \u2014 ${removal.remedy}`)
+  );
+}
+async function discard(auth, cut2) {
+  if (cut2.id === void 0) return false;
+  return deleteRelease(auth, { workspaceId: auth.workspaceId, id: cut2.id }).then(
+    () => true,
+    () => false
+  );
+}
+async function refuseCut(auth, op, cut2, storedName, deleteFlags, message, exitCode) {
+  const removed = await discard(auth, cut2);
+  const removeWith = `xanosdk release delete ${shellWord(storedName)}${deleteFlags}`;
+  if (!removed) {
+    op.setResidue({ ...cut2.id === void 0 ? {} : { id: cut2.id }, name: storedName, removeWith });
+  }
+  op.finish("cut", "no");
+  const text = message({
+    removed,
+    removeWith,
+    remedy: `delete it with \`${removeWith}\` before re-cutting, or the name will collide.`
+  });
+  throw exitCode === void 0 ? new Error(text) : new CliError("SDK_ERROR", text, { exitCode });
+}
+function causeOnly(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return (message.split("\n")[0] ?? "").replace(/\s*Nothing was (?:changed|created)[^.]*\.?/g, "").trim().replace(/[.:;]$/, "");
+}
+var SEED_HELP = { hintFor: { command: "release", subcommand: "create" } };
+var CREATE_HINT = { hintFor: { command: "release", subcommand: "create" } };
+function listingVerb(resolved) {
+  return tablesCommand(resolved.provenance);
+}
+function parseSeedGuids(raw) {
+  const tokens = raw.split(",").map((t) => t.trim());
+  if (tokens.every((t) => t === "")) {
+    throw new UsageError(
+      `\`--seed=\` names no tables. Use bare \`--seed\` for every table's rows, or \`--seed=<guids>\` with guids from \`${tablesCommand()}\`.`,
+      SEED_HELP
+    );
+  }
+  const guids = [];
+  for (const token of tokens) {
+    if (token === "") {
+      throw new UsageError(
+        `\`--seed\` has an empty entry \u2014 a stray comma in ${JSON.stringify(raw)}. List one guid per comma.`,
+        SEED_HELP
+      );
+    }
+    if (/\s/.test(token)) {
+      throw new UsageError(
+        `\`--seed\` takes table GUIDS, and ${JSON.stringify(token)} is not one \u2014 a guid holds no whitespace. A table NAME cannot be used here: a name may contain a comma or a space, and renaming a table would silently re-target a saved selection. Run \`${tablesCommand()}\` for the guids.`,
+        SEED_HELP
+      );
+    }
+    if (!guids.includes(token)) guids.push(token);
+  }
+  return guids;
+}
+var ENGINE_GUID_SHAPE = /^[A-Za-z0-9_-]{20,}$/;
+function isHexGuid(guid) {
+  return /^[0-9a-f]{32}$/i.test(guid);
+}
+function unmatchedGuidCauses(unmatched, tables = []) {
+  const lines = [];
+  const byName = new Map(tables.map((t) => [t.name, t]));
+  const named = unmatched.filter((g) => byName.has(g));
+  for (const name of named) {
+    lines.push(`"${name}" is a table NAME, and \`--seed\` expects a table guid \u2014 its guid is ${byName.get(name).guid}.`);
+  }
+  const byId = tableById(tables);
+  const ids = unmatched.filter((g) => !byName.has(g) && byId.has(g));
+  for (const id of ids) {
+    const t = byId.get(id);
+    lines.push(`${id} is table "${t.name}"'s ID, and \`--seed\` expects its guid \u2014 ${t.guid}. IDs are per host; the guid travels.`);
+  }
+  const guids = tables.flatMap((t) => t.guid === void 0 ? [] : [t.guid]);
+  const byGuid = new Map(tables.map((t) => [t.guid, t]));
+  const typos = /* @__PURE__ */ new Map();
+  for (const g of unmatched) {
+    if (byName.has(g) || byId.has(g) || !isHexGuid(g) && !ENGINE_GUID_SHAPE.test(g)) continue;
+    const near = suggest(g, guids);
+    if (near !== void 0) typos.set(g, byGuid.get(near));
+  }
+  for (const [g, t] of typos) {
+    lines.push(
+      `${g} is close to table "${t.name}"'s guid ${t.guid} but not it \u2014 a mistyped copy? Use ${t.guid}` + (isHexGuid(g) ? "." : ` (an engine guid is matched exactly, case included).`)
+    );
+  }
+  const rest = unmatched.filter((g) => !byName.has(g) && !byId.has(g) && !typos.has(g));
+  const notGuids = rest.filter((g) => !isHexGuid(g) && !ENGINE_GUID_SHAPE.test(g));
+  if (notGuids.length > 0) {
+    lines.push(
+      `${notGuids.map((g) => JSON.stringify(g)).join(", ")} ${notGuids.length === 1 ? "is" : "are"} not a table guid \u2014 \`--seed\` expects table guids.`
+    );
+  }
+  const derived = rest.some(isHexGuid);
+  const engineMinted = rest.some((g) => !isHexGuid(g) && ENGINE_GUID_SHAPE.test(g));
+  if (derived) {
+    lines.push(
+      `A 32-character hex guid is the value THIS PROJECT derives and pins in \`xano.lock\`, and a deploy stores it as-is \u2014 so one that does not match usually means the table was RENAMED or removed in code since the guid was noted (the name is what the guid derives from). Re-read it from the listing below, or run \`xanosdk lock rename\` if the rename was intended.`
+    );
+  }
+  if (engineMinted) {
+    lines.push(
+      `A guid in the engine's own format belongs to a backend this project did not deploy, or to one deployed before guids were preserved. Those are per-environment and do not travel \u2014 the listing below is the source of truth for the source being cut from.`
+    );
+  }
+  return lines.join("\n");
+}
+function tableById(tables) {
+  return new Map(tables.filter((t) => t.guid !== void 0).map((t) => [String(t.id), t]));
+}
+var SeedTableNotFoundError = class extends UsageError {
+  code = "SDK_ERROR";
+  exitCode = 8;
+  /** Every guid meant, when several unmatched guids each had one (`suggestion` is the first). */
+  suggestions;
+  constructor(message, near) {
+    super(message, near.length === 0 ? {} : { suggestion: near[0] });
+    this.suggestions = near.length > 1 ? [...near] : void 0;
+  }
+};
+function nearSeedGuids(unmatched, tables) {
+  const byName = new Map(tables.map((t) => [t.name, t.guid]));
+  const guids = tables.flatMap((t) => t.guid === void 0 ? [] : [t.guid]);
+  const byId = tableById(tables);
+  const near = unmatched.flatMap((g) => {
+    const named = byName.get(g) ?? (byName.has(g) ? void 0 : byId.get(g)?.guid);
+    if (named !== void 0) return [named];
+    if (!isHexGuid(g) && !ENGINE_GUID_SHAPE.test(g)) return [];
+    const close = suggest(g, guids);
+    return close === void 0 ? [] : [close];
+  });
+  return [...new Set(near)];
+}
+async function resolveSeedSelection(args, auth, resolved) {
+  if (!args.seed) return void 0;
+  const requested = args.seedTableGuids === void 0 ? void 0 : parseSeedGuids(args.seedTableGuids);
+  const tables = await readBeforeCut(
+    args,
+    `list ${resolved.target.label}'s tables for \`--seed\``,
+    () => listTables(auth, {
+      workspaceId: resolved.target.workspaceId,
+      base: resolved.target.base,
+      binding: bindingFor(auth, resolved.target.workspaceId, resolved.kind !== "workspace")
+    })
+  );
+  if (tables.length === 0 && resolved.kind === "workspace") {
+    const { refuseUnreachableWorkspace } = await import("./workspace-binding-56PIIPCP.js");
+    await refuseUnreachableWorkspace(auth);
+  }
+  if (tables.length === 0) {
+    throw new UsageError(
+      `${resolved.target.label} has no tables, so there are no rows to carry. Drop \`--seed\`.`
+    );
+  }
+  if (requested === void 0) return { tables };
+  const known = new Map(tables.map((t) => [t.guid, t]));
+  const lookup = (guid) => known.get(guid) ?? (isHexGuid(guid) ? known.get(guid.toLowerCase()) : void 0);
+  const unmatched = requested.filter((guid) => lookup(guid) === void 0);
+  if (unmatched.length > 0) {
+    const listing = `${listingVerb(resolved)}${contextFlags(args)}`;
+    throw new SeedTableNotFoundError(
+      `${resolved.target.label} has no table with ${unmatched.length === 1 ? `guid ${unmatched[0]}` : `guids ${unmatched.join(", ")}`}.
+${unmatchedGuidCauses(unmatched, tables)}
+Run \`${listing}\` for the current ones.
+Tables in ${resolved.target.label}:
+${formatTableListing(tables, "  ")}`,
+      nearSeedGuids(unmatched, tables)
+    );
+  }
+  return { tables: [...new Set(requested.flatMap((guid) => lookup(guid) ?? []))] };
+}
+function withExportedGuards(selection, payload) {
+  const rows = payload?.dbo;
+  const byGuid = /* @__PURE__ */ new Map();
+  for (const r of Array.isArray(rows) ? rows : []) {
+    const row = r;
+    if (typeof row?.guid === "string") byGuid.set(row.guid, row.schema);
+  }
+  const unchecked = [];
+  const tables = selection.tables.map((t) => {
+    if (!byGuid.has(t.guid)) {
+      unchecked.push(t.name);
+      return t;
+    }
+    return { ...t, guardedColumns: [.../* @__PURE__ */ new Set([...t.guardedColumns, ...guardedIn(byGuid.get(t.guid))])] };
+  });
+  return { tables, unchecked };
+}
+async function confirmNonPublicRows(args, selection) {
+  const flagged = selection.tables.filter((t) => t.guardedColumns.length > 0);
+  const unchecked = selection.unchecked ?? [];
+  if (unchecked.length > 0) {
+    warn(
+      `Could not read which columns are sensitive in ${unchecked.length === 1 ? "this table" : "these tables"} \u2014 the source's export does not carry ${unchecked.length === 1 ? "it" : "them"}, so only \`internal\` and password columns were checked: ${unchecked.join(", ")}`,
+      "seed.guarded-columns"
+    );
+  }
+  if (flagged.length === 0) return true;
+  warn(`These tables have non-public columns whose values would ride along:`, "seed.guarded-columns", [
+    ...flagged.map((t) => `${t.name}: ${t.guardedColumns.join(", ")}`),
+    `A release is durable and can be landed on another environment.`
+  ]);
+  if (args.yes) return true;
+  const { yesRerun: yesRerun2 } = await import("./retry-command-AS5EVREX.js");
+  const { rerun, note } = yesRerun2(args, "release create");
+  return confirm(`Carry these rows anyway?`, {
+    flag: "--yes",
+    refusal: {
+      details: {
+        verb: "create",
+        created: false,
+        guardedColumns: Object.fromEntries(flagged.map((t) => [t.name, [...t.guardedColumns]]))
+      },
+      rerun,
+      note
+    }
+  });
+}
+async function assertRowsLanded(auth, op, created, requested, selection, flags) {
+  if (created.seededTables.length >= selection.tables.length) return;
+  const landedGuids = new Set(created.seededTables.flatMap((t) => t.guid === void 0 ? [] : [t.guid]));
+  const landedNames = new Set(created.seededTables.map((t) => t.name));
+  const missing = selection.tables.filter((t) => landedGuids.size > 0 ? !landedGuids.has(t.guid) : !landedNames.has(t.name)).map((t) => t.name);
+  const stored = created.name !== "" ? created.name : requested;
+  return refuseCut(
+    auth,
+    op,
+    created,
+    stored,
+    flags,
+    (removal) => `Release "${stored}" carries rows for ${created.seededTables.length} of the ${selection.tables.length} tables asked for${missing.length === 0 ? "" : ` (missing ${missing.map((m) => JSON.stringify(m)).join(", ")})`}. The server accepted the cut and dropped those tables silently.
+` + (removal.removed ? `The release was removed.` : `It could NOT be removed \u2014 ${removal.remedy}`) + ` Check the ids against the source with \`${tablesCommand()}\`.`
+  );
+}
+function storedIdentity(auth, release, requested) {
+  return {
+    instance: auth.instance,
+    workspaceId: auth.workspaceId,
+    id: release.id,
+    name: release.name !== "" ? release.name : requested
+  };
+}
+function resolveCut(args) {
+  return `xanosdk release list --json${contextFlags(args)}`;
+}
+var CREATED_AFTER_SKEW_MS = 5e3;
+function createdAfterBound(startedAt) {
+  return new Date(Math.floor(startedAt / 1e3) * 1e3 - CREATED_AFTER_SKEW_MS).toISOString();
+}
+function lookForCut(name, startedAt) {
+  return {
+    name,
+    suffixPattern: `^${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}-[0-9a-f]{4}$`,
+    createdAfter: createdAfterBound(startedAt)
+  };
+}
+async function sendCut(auth, op, lookFor, send) {
+  const name = lookFor.name;
+  op.begin("cut");
+  op.set("lookFor", lookFor);
+  op.sending();
+  try {
+    const cut2 = await send();
+    op.set("lookFor", void 0);
+    op.setRelease(storedIdentity(auth, cut2, name));
+    return cut2;
+  } catch (err) {
+    if (classifyFailure(err, { writeSent: true }) === "no") op.set("lookFor", void 0);
+    throw err;
+  }
+}
+async function runReleaseCreate(args) {
+  const typed = args.positionals[0];
+  if (typed === void 0) {
+    throw new UsageError(
+      `\`xanosdk release create\` needs a name for the new release \u2014 one no release in this workspace holds yet, e.g. \`xanosdk release create v2${contextFlags()}\`.`,
+      CREATE_HINT
+    );
+  }
+  const name = typed.trim();
+  assertOneName(typed, "the release name", { args, helpFor: CREATE_HINT.hintFor });
+  try {
+    assertUsableReleaseName(name);
+  } catch (err) {
+    throw new UsageError(err.message, CREATE_HINT);
+  }
+  const reserved = args.description === void 0 ? void 0 : reservedDescriptionLine(args.description);
+  if (reserved !== void 0) {
+    throw new UsageError(
+      `\`--description\` cannot hold a line starting with \`${RESERVED_DESCRIPTION_PREFIX}\`, and this one does: ${JSON.stringify(reserved.trim())}.
+The CLI writes those lines itself to record where a release came from, and \`release show\` reads them back as its origin. Reword that line. Nothing was cut.`,
+      CREATE_HINT
+    );
+  }
+  assertBundleFile(args, { command: "release", subcommand: "create" }, "Nothing was cut.");
+  if (args.entryPath !== void 0) {
+    if (args.bundle !== void 0) {
+      throw new UsageError(
+        "`--entry` and `--bundle` both name what the cut is compared against \u2014 pass one. Nothing was cut.",
+        CREATE_HINT
+      );
+    }
+    if (!existsSync(args.entryPath) || !statSync(args.entryPath).isFile()) {
+      const Refusal = existsSync(args.entryPath) ? UsageError : LocalFileNotFoundError;
+      throw new Refusal(
+        `\`--entry ${args.entryPath}\` ${existsSync(args.entryPath) ? "is not a file" : "does not exist"}. Nothing was cut. Pass the backend's entry file (its \`index.ts\`).`,
+        CREATE_HINT
+      );
+    }
+  }
+  const cwd = process.cwd();
+  const credential = memoCredential(() => getAccessToken(args));
+  const source = await resolveFrom(args, credential, cwd);
+  const auth = await credential();
+  const op = createOperation({
+    operation: "release create",
+    destination: { ...credentialWriteTarget(auth), kind: "workspace" },
+    release: { instance: auth.instance, workspaceId: auth.workspaceId, id: void 0, name },
+    branch: args.branch ?? null,
+    steps: ["cut"],
+    extras: { declined: false }
+  });
+  const lookFor = lookForCut(name, op.startedAt);
+  let done;
+  let declined = false;
+  try {
+    await runOperation(
+      op,
+      { machine: isMachineOutput(args), resolveWith: resolveCut(args), what: "the release cut" },
+      async () => {
+        const result = await cut(args, auth, source, name, cwd, op, lookFor);
+        if (result === "declined") declined = true;
+        else done = result;
+      }
+    );
+  } catch (err) {
+    if (declined) return;
+    if (err instanceof OperationError && err.result.resolveWith !== void 0) {
+      detail(
+        `Look for "${name}", or "${name}-" plus four hex characters, created after ${lookFor.createdAfter}.`
+      );
+    }
+    throw err;
+  }
+  if (done === void 0) return;
+  const { created, provenance } = done;
+  success(`Cut release ${created.name}`);
+  detail(`from ${provenance}`);
+  if (created.seededTables.length === 0) {
+    detail(`Carries no table rows \u2014 every table's schema and logic is included.`);
+  }
+}
+async function cut(args, auth, source, name, cwd, op, lookFor) {
+  const resolved = await resolveSource(source, async () => auth, { cwd, workspaceless: "any" });
+  await refuseLiveDeployment(resolved);
+  await refuseWorkspaceless(resolved, "read");
+  const existing = await lookupRelease(auth, name);
+  if (existing !== null) {
+    const holder = { id: existing.id, name: existing.name !== "" ? existing.name : name };
+    if (resolved.kind === "workspace" && args.branch === void 0) {
+      try {
+        const target = { baseUrl: resolved.target.base, workspaceId: resolved.target.workspaceId };
+        op.setBranch(liveBranchLabel(await listBranches(auth, target)) ?? null);
+      } catch {
+      }
+    }
+    const origin = await releaseOrigin(auth, existing);
+    throw new CliError(
+      "SDK_RELEASE_NAME_TAKEN",
+      `A release named "${name}" already exists (cut ${existing.createdAt ?? "earlier"}${origin === void 0 ? "" : ` from ${describeOrigin(origin)}`}). Releases are not replaced \u2014 cut a new name.`,
+      { exitCode: EXIT_RELEASE_REFUSED, details: { conflictsWith: holder } }
+    );
+  }
+  if (/[\u0080-\uffff]/.test(name)) {
+    const { releaseNames } = await import("./source-resolve-S2XA3XZF.js");
+    const twin = (await releaseNames(auth).catch(() => [])).find((n) => differOnlyInNormalisation(n, name));
+    if (twin !== void 0) {
+      const [there, typed] = differingCodePoints(twin, name);
+      throw new CliError(
+        "SDK_RELEASE_NAME_TAKEN",
+        `A release named "${twin}" already exists, and "${name}" differs from it only in Unicode normalisation (${there} there, ${typed} typed), so the two would read as the same name everywhere. Nothing was cut \u2014 cut a different name.`,
+        { exitCode: EXIT_RELEASE_REFUSED, details: { conflictsWith: { name: twin } } }
+      );
+    }
+  }
+  if (resolved.kind !== "workspace" && args.branch !== void 0) {
+    throw new UsageError(
+      `\`--branch\` names a branch of your workspace, and ${resolved.target.label} has one branch. Drop it, or cut \`--from workspace --branch ${args.branch}\` instead.`,
+      { hintFor: { command: "release", subcommand: "create" } }
+    );
+  }
+  const branchTarget = { baseUrl: resolved.target.base, workspaceId: resolved.target.workspaceId };
+  let branch = "";
+  if (resolved.kind === "workspace" && args.branch !== void 0) {
+    branch = requireBranch(await readBeforeCut(args, "list the workspace's branches", () => listBranches(auth, branchTarget)), args.branch).label;
+    op.setBranch(branch);
+  }
+  const selection = await resolveSeedSelection(args, auth, resolved);
+  const readArgs = args.branch !== void 0 ? { ...args, branch } : args;
+  const live = await readSourceExport(readArgs, auth, resolved);
+  await refuseUncarriedFiles(live.payload, selection, resolved, args, auth, cwd);
+  if (selection !== void 0 && !await confirmNonPublicRows(args, withExportedGuards(selection, live.payload))) {
+    info("Release create cancelled \u2014 nothing was cut.");
+    op.set("declined", true);
+    op.finish("cut", "no");
+    return "declined";
+  }
+  step(`Cutting "${name}" from ${sourceLabel(resolved, args.branch !== void 0 ? branch : void 0)}`);
+  discloseWriteTarget(credentialWriteTarget(auth));
+  if (selection !== void 0) {
+    detail(
+      `Carrying rows from ${selection.tables.length} table${selection.tables.length === 1 ? "" : "s"}: ${selection.tables.map((t) => t.name).join(", ")}`
+    );
+  }
+  op.set("drift", await warnOnDivergence(readArgs, resolved, cwd, live));
+  if (resolved.kind === "workspace" && args.branch === void 0) {
+    branch = liveBranchLabel(await readBeforeCut(args, "list the workspace's branches", () => listBranches(auth, branchTarget))) ?? "";
+    op.setBranch(branch === "" ? null : branch);
+  }
+  const description = args.description !== void 0 ? { description: args.description } : {};
+  const seeding = selection !== void 0 ? { tableIds: selection.tables.map((t) => t.id) } : {};
+  const deleteFlags = `${pipedYes(args)}${contextFlags(args)}`;
+  const created = resolved.kind === "workspace" ? (
+    // The label resolved above: the one named, or the live branch's.
+    await sendCut(
+      auth,
+      op,
+      lookFor,
+      () => createRelease(auth, {
+        workspaceId: auth.workspaceId,
+        name,
+        branch,
+        ...description,
+        ...seeding
+      })
+    )
+  ) : await cutFromEnvironment(
+    auth,
+    name,
+    resolved,
+    { ...description, ...seeding },
+    op,
+    lookFor,
+    deleteFlags,
+    retryCommand(args, { command: "release create", creates: true })
+  );
+  const identity = storedIdentity(auth, created, name);
+  op.setRelease(identity);
+  const stored = identity.name;
+  if (selection !== void 0) await assertRowsLanded(auth, op, created, name, selection, deleteFlags);
+  if (stored !== name) {
+    op.set("requestedName", name);
+    const removeWith = `xanosdk release delete ${shellWord(stored)}${deleteFlags}`;
+    op.setResidue({ ...identity.id === void 0 ? {} : { id: identity.id }, name: stored, removeWith });
+    op.finish("cut", "no");
+    throw new CliError(
+      "SDK_RELEASE_NAME_TAKEN",
+      `The server stored this cut as "${stored}", not the "${name}" asked for \u2014 the name was taken while it was being cut. Anything that addresses "${name}" (a \`promote ${shellWord(name)}\`) does not reach this release.
+Delete this one with \`${removeWith}\`, then cut again under a free name.`,
+      { exitCode: EXIT_RELEASE_REFUSED, details: { conflictsWith: { name }, storedAs: stored } }
+    );
+  }
+  op.set("origin", await releaseOrigin(auth, created).catch(() => void 0) ?? null);
+  op.finish("cut");
+  return {
+    created,
+    provenance: resolved.kind === "workspace" && args.branch !== void 0 ? `${resolved.provenance} (branch ${JSON.stringify(branch)})` : resolved.provenance
+  };
+}
+
+// src/emit/release-transfer.ts
+var HELP = { helpFor: { command: "release", subcommand: "transfer" } };
+var CANDIDATE_LAYER_SLACK = 1024 * 1024;
+var TransferDisagreedError = class extends Error {
+  name = "TransferDisagreedError";
+  exitCode = EXIT_RELEASE_REFUSED;
+};
+async function unreachableDestination(dst, toProfile, args, rerun) {
+  const { readReachableWorkspaces, reachableLines } = await import("./workspace-binding-56PIIPCP.js");
+  const all = await readReachableWorkspaces(dst, 15e3);
+  if (all === void 0 || all.length === 0 || all.some((w) => w.id === dst.workspaceId)) return void 0;
+  const { resolveAuthFilePath, readCredentialFile, readProfile, loginCommand, profileAddCommand } = await import("./store-ARM6VMO5.js");
+  const path = resolveAuthFilePath(args);
+  const only = all.length === 1 ? all[0].id : void 0;
+  let repin;
+  if (dst.credentialType === "token") {
+    repin = `Re-add it pinned to ${only === void 0 ? "one of the workspaces below" : `workspace ${only}`}: \`${profileAddCommand(toProfile, { path, instance: dst.instance, workspaceId: only })} --force\``;
+  } else {
+    let origin;
+    try {
+      const file = readCredentialFile(path);
+      const saved = file === null ? null : readProfile(file, toProfile, path);
+      origin = saved !== null && saved.type !== "token" ? saved.auth_host : void 0;
+    } catch {
+      origin = void 0;
+    }
+    repin = `Sign it in again and choose ${only === void 0 ? "one of the workspaces below" : `workspace ${only}`}: \`${loginCommand(toProfile, { path, origin }, ["--force"])}\``;
+  }
+  return new UsageError(
+    `Workspace ${dst.workspaceId} does not exist on ${new URL(dst.instance).host} (or the \`${toProfile}\` credential cannot see it), and \`--to-profile ${toProfile}\` is pinned to it. Nothing was sent.
+${repin}, then run \`${rerun}\`.
+
+Workspaces the \`${toProfile}\` credential can reach:
+${reachableLines(all)}`
+  );
+}
+function sameBackend(a, b) {
+  const origin = (u) => {
+    try {
+      return new URL(u).origin;
+    } catch {
+      return u.replace(/\/+$/, "");
+    }
+  };
+  return origin(a.instance) === origin(b.instance) && a.workspaceId === b.workspaceId;
+}
+function decodeSourceArchive(bytes) {
+  try {
+    return decodeWorkspaceArchive(bytes);
+  } catch (err) {
+    throw new Error(
+      `The source archive could not be read as a release archive (${err.message}). Nothing was sent.`
+    );
+  }
+}
+function embeddedReleaseName(decoded) {
+  const release = decoded?.payload?.metadata?.release;
+  const name = release?.name;
+  if (typeof name !== "string" || name === "") {
+    throw new Error(
+      `The source archive carries no release name in its metadata, so the destination would not accept it as a release. Nothing was sent.`
+    );
+  }
+  return name;
+}
+function isCandidateName(name, embedded) {
+  if (name === embedded) return true;
+  if (!name.startsWith(`${embedded}-`)) return false;
+  return /^[0-9a-f]{4}$/.test(name.slice(embedded.length + 1));
+}
+function candidateOrder(embedded) {
+  return (a, b) => {
+    const exact = Number(b.name === embedded) - Number(a.name === embedded);
+    if (exact !== 0) return exact;
+    return (a.id ?? Number.MAX_SAFE_INTEGER) - (b.id ?? Number.MAX_SAFE_INTEGER);
+  };
+}
+function contentSha256(bytes) {
+  return sha256Hex(unwrapGzip(bytes));
+}
+async function findIdentical(dst, candidates, sha, tarLength) {
+  const bound = tarLength + CANDIDATE_LAYER_SLACK;
+  for (const c of candidates) {
+    if (c.id === void 0) continue;
+    let theirs;
+    try {
+      theirs = await downloadRelease(dst, { workspaceId: dst.workspaceId, id: c.id });
+    } catch (err) {
+      throw new Error(
+        `Could not download the destination's release "${c.name}" (id ${c.id}) to compare it: ${err.message}
+Nothing was imported \u2014 without its bytes it cannot be told apart from this one. Retry once it downloads.`
+      );
+    }
+    let theirSha;
+    try {
+      theirSha = sha256Hex(unwrapGzip(theirs, { maxBytes: bound }));
+    } catch (err) {
+      if (err instanceof ArchiveTooLargeError) continue;
+      throw err;
+    }
+    if (theirSha === sha) return c;
+  }
+  return void 0;
+}
+function seededRows(found, decoded) {
+  if (found.seededTables.length === 0) return [];
+  const payload = decoded?.payload;
+  const tables = Array.isArray(payload?.dbo) ? payload.dbo : [];
+  const byGuid = /* @__PURE__ */ new Map();
+  const byName = /* @__PURE__ */ new Map();
+  for (const t of tables) {
+    if (t === null || typeof t !== "object" || !Array.isArray(t.schema)) continue;
+    const guarded = guardedIn(t.schema);
+    if (typeof t.guid === "string") byGuid.set(t.guid, guarded);
+    if (typeof t.name === "string") byName.set(t.name, guarded);
+  }
+  return found.seededTables.map((t) => {
+    const columns = (t.guid !== void 0 ? byGuid.get(t.guid) : void 0) ?? byName.get(t.name);
+    return {
+      name: t.name,
+      guid: t.guid,
+      count: t.count,
+      ...columns === void 0 ? {} : { nonPublicColumns: [...columns] }
+    };
+  });
+}
+function reportSeeded(rows) {
+  if (rows.length === 0) return;
+  warn(
+    `This release carries table rows, and they go to the destination with it:`,
+    "release.rows-transferred",
+    rows.map((r) => {
+      const count = r.count === void 0 ? "" : ` (${r.count} row${r.count === 1 ? "" : "s"})`;
+      const guarded = r.nonPublicColumns === void 0 ? " \u2014 non-public columns could not be read" : r.nonPublicColumns.length === 0 ? "" : ` \u2014 non-public columns: ${r.nonPublicColumns.join(", ")}`;
+      return `${r.name}${count}${guarded}`;
+    })
+  );
+}
+async function destinationCommand(words, toProfile, args) {
+  const { environmentCredentialVars } = await import("./token-NICJUTMT.js");
+  const env = environmentCredentialVars();
+  const unset = env.complete && env.vars.length > 0;
+  const prefix = unset ? `env ${env.vars.map((v) => `-u ${v}`).join(" ")} ` : "";
+  const yes = unset ? " --yes" : pipedYes(args);
+  return `${prefix}xanosdk ${words}${yes}${credentialFlags({ profile: toProfile, authFile: args.authFile })}`;
+}
+function identityOf(auth, r) {
+  return { instance: auth.instance, workspaceId: auth.workspaceId, id: r.id, name: r.name };
+}
+async function runReleaseTransfer(args) {
+  const name = args.positionals[0];
+  if (name === void 0 || name === "") {
+    throw new UsageError(
+      `\`xanosdk release transfer\` needs a release name. Run \`xanosdk release list${contextFlags()}\` to see them.`,
+      { hintFor: HELP.helpFor }
+    );
+  }
+  assertOneName(name, "the release name", { args, helpFor: HELP.helpFor });
+  const toProfile = args.toProfile;
+  if (toProfile === void 0) {
+    throw new UsageError(
+      `\`xanosdk release transfer\` needs a destination: \`--to-profile <name>\`, a stored credential profile bound to the workspace that should receive the release. \`xanosdk profile list\` shows them.`,
+      { hintFor: HELP.helpFor }
+    );
+  }
+  const transferCommand = (release, profile) => `xanosdk release transfer ${shellWord(release)} --to-profile ${shellWord(profile)}${args.dryRun === true ? " --dry-run" : ""}${args.json === true ? " --json" : ""}${credentialFlags(args)}`;
+  const again = () => `${transferCommand(name, toProfile)}${args.dryRun === true ? "" : pipedYes(args)}`;
+  const src = await getAccessToken(args);
+  const dst = await resolveNamedProfile(toProfile, args, "--to-profile").catch(async (err) => {
+    if (!(err instanceof ProfileNotFoundError)) throw err;
+    const { readCredentialFile, profileNames, resolveAuthFilePath } = await import("./store-ARM6VMO5.js");
+    const { suggestAll } = await import("./suggest-6FOOYKHG.js");
+    const file = readCredentialFile(resolveAuthFilePath(args));
+    const near = suggestAll(toProfile, file === null ? [] : profileNames(file));
+    if (near.length === 0) throw err;
+    throw new ProfileNotFoundError(
+      `${err.message}${near.map((n) => `
+Did you mean "${safeText(n)}"? \`${transferCommand(name, n)}\``).join("")}`
+    );
+  });
+  if (sameBackend(src, dst)) {
+    throw new UsageError(
+      `\`--to-profile ${toProfile}\` is bound to the same instance and workspace the release is read from (${describeWriteTarget({ base: dst.instance, workspaceId: dst.workspaceId })}). A transfer onto itself can only store a duplicate. Name a profile bound to another workspace.`,
+      // A runtime refusal: the command's shape was fine, so a pointer, not the block.
+      { hintFor: HELP.helpFor }
+    );
+  }
+  const dryRun = args.dryRun === true;
+  const destination = { base: dst.instance, workspaceId: dst.workspaceId, label: `profile "${toProfile}"` };
+  const source = { base: src.instance, workspaceId: src.workspaceId };
+  step(`${dryRun ? "Checking" : "Transferring"} release "${name}"`);
+  detail(`from ${describeWriteTarget(source)}`);
+  discloseWriteTarget(destination);
+  const op = createOperation({
+    operation: "release transfer",
+    // The one destination shape: a workspace is `{ instance, workspaceId, kind }`.
+    // The profile's name is the progress line's label, not a machine field.
+    destination: { base: dst.instance, workspaceId: dst.workspaceId, kind: "workspace" },
+    // The embedded name replaces this once the archive has been read.
+    release: identityOf(dst, { id: void 0, name }),
+    branch: null,
+    steps: ["read", "search", "import", "verify"]
+  });
+  const resolveWith = `xanosdk release transfer ${shellWord(name)} --to-profile ${shellWord(toProfile)} --dry-run${credentialFlags(args)} --json`;
+  const machine = isMachineOutput(args);
+  let answeredNo = false;
+  try {
+    await runOperation(op, { machine, resolveWith, what: `the import of "${name}"` }, async () => {
+      op.begin("read");
+      const found = await lookupRelease(src, name);
+      if (found === null) {
+        const { releaseNames } = await import("./source-resolve-S2XA3XZF.js");
+        const { suggestAll } = await import("./suggest-6FOOYKHG.js");
+        const near = suggestAll(name, (await releaseNames(src).catch(() => [])).filter((n) => n !== name));
+        const meant = near.map(
+          (n) => `
+Did you mean "${safeText(n)}"${normalisationNote(name, n)}? \`${transferCommand(n, toProfile)}\``
+        );
+        throw new SourceError(
+          `No release named "${name}". \`xanosdk release list${contextFlags()}\` shows the ones that exist.${meant.join("")}`,
+          "gone",
+          "release",
+          near[0],
+          near.length > 1 ? near : void 0
+        );
+      }
+      if (found.id === void 0) {
+        throw new Error(`Release "${name}" carries no id, so it cannot be downloaded. Nothing was sent.`);
+      }
+      op.set("source", identityOf(src, { id: found.id, name: found.name }));
+      const bytes = await downloadRelease(src, { workspaceId: src.workspaceId, id: found.id });
+      const tar = unwrapGzip(bytes);
+      const decoded = decodeSourceArchive(tar);
+      const seeded = seededRows(found, decoded);
+      op.set("seededTables", seeded);
+      reportSeeded(seeded);
+      const sha = sha256Hex(tar);
+      op.set("sha256", sha);
+      const embedded = embeddedReleaseName(decoded);
+      op.setRelease(identityOf(dst, { id: void 0, name: embedded }));
+      if (embedded !== found.name) {
+        detail(`Stored at the source as "${found.name}"; the archive names itself "${embedded}".`);
+      }
+      op.finish("read");
+      op.begin("search");
+      let rows;
+      try {
+        rows = await listReleases(dst, { workspaceId: dst.workspaceId });
+      } catch (err) {
+        const unanswered = readUnanswered(
+          "release",
+          `search the destination (${describeWriteTarget(destination)}) for release "${embedded}"`,
+          "a refusal",
+          err
+        );
+        if (unanswered !== err) throw unanswered;
+        const unreachable = await unreachableDestination(dst, toProfile, args, again());
+        if (unreachable !== void 0) throw unreachable;
+        const [head = "", ...rest] = (err instanceof Error ? err.message : String(err)).split("\n");
+        throw new Error(
+          [
+            `The \`${toProfile}\` credential cannot list releases on ${describeWriteTarget(destination)}: ${head.trim().replace(/[.:]$/, "")}. A transfer never imports without searching first. Nothing was sent.`,
+            ...rest
+          ].join("\n")
+        );
+      }
+      const candidates = rows.filter((r) => isCandidateName(r.name, embedded)).sort(candidateOrder(embedded));
+      const match = await findIdentical(dst, candidates, sha, tar.length);
+      const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+      op.set("checkedAt", checkedAt);
+      if (match !== void 0) {
+        op.setRelease(identityOf(dst, match));
+        op.set("reused", true);
+        if (dryRun) op.set("present", "identical");
+        op.finish("search");
+        op.finish("import", "skipped");
+        op.finish("verify");
+        success(
+          `${dryRun ? "Already at" : "Reused"} the destination: "${match.name}" (id ${match.id}) holds the same bytes`
+        );
+        detail(`sha256 ${sha}`);
+        if (match.id !== void 0 && unrecordedCopy(match)) {
+          if (dryRun) detail("It does not record which release it was copied from; a transfer would record it.");
+          else await recordCopy(op, dst, { id: match.id, name: match.name }, found, src, again());
+        }
+        return;
+      }
+      const holder = candidates.find((c) => c.name === embedded);
+      if (holder !== void 0) {
+        if (dryRun) op.set("present", "conflict");
+        op.finish("search", "no");
+        throw new CliError(
+          "SDK_RELEASE_NAME_TAKEN",
+          `The destination already holds a different release named "${embedded}"${holder.id === void 0 ? "" : ` (id ${holder.id})`}, and no release there holds these bytes. Releases are not replaced \u2014 nothing was imported.
+To replace it, delete it there with \`${await destinationCommand(`release delete ${shellWord(holder.name)}`, toProfile, args)}\`, then run \`${again()}\` again.`,
+          { exitCode: EXIT_RELEASE_REFUSED, details: { conflictsWith: { id: holder.id, name: holder.name } } }
+        );
+      }
+      op.finish("search");
+      if (dryRun) {
+        op.set("present", "absent");
+        op.finish("import", "no");
+        answeredNo = true;
+        info(`Not at the destination as of ${checkedAt}. A transfer would import it as "${embedded}".`);
+        return;
+      }
+      if (args.yes !== true) {
+        const { rerun, note } = yesRerun(args, `release transfer ${shellWord(found.name)}`);
+        const ok = await confirm(`Import release "${embedded}" into ${describeWriteTarget(destination)}?`, {
+          flag: "--yes",
+          refusal: { details: { verb: "transfer", imported: false, declined: false }, rerun, note }
+        });
+        if (!ok) {
+          warn("Transfer cancelled \u2014 nothing was imported.", "release.transfer-cancelled");
+          answeredNo = true;
+          return;
+        }
+      }
+      op.set("reused", false);
+      op.begin("import");
+      op.sending();
+      const { id } = await importRelease(dst, { workspaceId: dst.workspaceId, archive: bytes }).catch(async (err) => {
+        throw await unreachableDestination(dst, toProfile, args, again()) ?? err;
+      });
+      op.finish("import");
+      op.setRelease(identityOf(dst, { id, name: embedded }));
+      const stored = await verify(op, { dst, id, embedded, sha, tarLength: tar.length, toProfile, config: args.authFile, yes: pipedYes(args) });
+      await recordCopy(op, dst, { id, name: stored }, found, src, again());
+    });
+  } catch (err) {
+    if (answeredNo) return;
+    throw err;
+  }
+}
+async function verify(op, ctx) {
+  const { dst, id, embedded, sha } = ctx;
+  op.begin("verify");
+  let landed;
+  let landedBytes;
+  try {
+    const got = await getRelease(dst, { workspaceId: dst.workspaceId, id });
+    if (got === null) {
+      throw new Error(`The import answered with id ${id}, and the destination holds no release by that id.`);
+    }
+    landed = got;
+    landedBytes = await downloadRelease(dst, { workspaceId: dst.workspaceId, id });
+  } catch (err) {
+    op.finish("verify", "unknown");
+    throw err;
+  }
+  const stored = landed.name !== "" ? landed.name : embedded;
+  op.setRelease(identityOf(dst, { id, name: stored }));
+  const landedSha = contentSha256(landedBytes);
+  if (landedSha !== sha) {
+    const removeWith = `xanosdk release delete ${shellWord(stored)}${ctx.yes} --profile ${shellWord(ctx.toProfile)}${ctx.config === void 0 ? "" : ` --config ${shellWord(ctx.config)}`}`;
+    op.set("destinationSha256", landedSha);
+    op.setResidue({ id, name: stored, removeWith });
+    op.finish("verify", "no");
+    throw new TransferDisagreedError(
+      `Imported "${stored}" (id ${id}), but what the destination holds does not hash to what was sent (sent ${sha}, holds ${landedSha}).
+It has been kept, not removed \u2014 it is the evidence. Remove it with \`${removeWith}\`.`
+    );
+  }
+  const duplicate = stored === embedded ? void 0 : await concurrentDuplicate(dst, { id, embedded, sha, tarLength: ctx.tarLength });
+  if (duplicate !== void 0) op.set("duplicateOf", duplicate);
+  op.finish("verify");
+  success(`Transferred "${stored}" (id ${id})`);
+  detail(`sha256 ${sha} \u2014 verified on the destination`);
+  if (stored !== embedded) {
+    warn(`The destination stored it as "${stored}": "${embedded}" was taken by the time it landed.`, "release.name-stored");
+  }
+  if (duplicate !== void 0) {
+    detail(
+      `"${duplicate.name}" (id ${duplicate.id}) holds the same release \u2014 a concurrent transfer's. Neither was removed.`
+    );
+  }
+  return stored;
+}
+async function recordCopy(op, dst, copy, source, src, rerun) {
+  const cut2 = source.copiedFrom?.cut ?? source.recordedOrigin ?? (typeof source.branch === "string" && source.branch !== "" ? { type: "branch", name: source.branch } : void 0);
+  const copied = {
+    source: { host: new URL(src.instance).host, workspaceId: src.workspaceId, release: source.name },
+    ...cut2 === void 0 ? {} : { cut: cut2 }
+  };
+  const description = describeAsCopy(source.description, copied);
+  try {
+    const updated = await updateReleaseDescription(dst, { workspaceId: dst.workspaceId, ...copy, description });
+    if (updated.copiedFrom === void 0) {
+      throw new Error("the update answered without the description it was sent");
+    }
+    op.set("copyRecorded", true);
+  } catch (err) {
+    op.set("copyRecorded", false);
+    const cause = (err.message.split("\n")[0] ?? "").trim().replace(/[.:;]$/, "");
+    warn(
+      `Transferred, but recording on "${copy.name}" which release it was copied from failed (${cause}). The copy is intact; until it is recorded, \`release show\` at the destination reports its origin as the branch the import tagged it with.`,
+      "release.copy-unrecorded",
+      [`Run \`${rerun}\` again to record it.`]
+    );
+  }
+}
+function unrecordedCopy(r) {
+  return r.copiedFrom === void 0 && r.recordedOrigin === void 0 && (r.description ?? "") === "";
+}
+async function concurrentDuplicate(dst, ctx) {
+  try {
+    const rows = await listReleases(dst, { workspaceId: dst.workspaceId });
+    const others = rows.filter((r) => r.id !== ctx.id && isCandidateName(r.name, ctx.embedded)).sort(candidateOrder(ctx.embedded));
+    const twin = await findIdentical(dst, others, ctx.sha, ctx.tarLength);
+    return twin?.id === void 0 ? void 0 : { id: twin.id, name: twin.name };
+  } catch {
+    detail(`Could not check the destination for a concurrent copy of "${ctx.embedded}".`);
+    return void 0;
+  }
+}
+
+// src/emit/release-ns-command.ts
+async function runReleaseCommand(args) {
+  switch (args.subcommand) {
+    case "create":
+      return runReleaseCreate(args);
+    case "list":
+      return runList(args);
+    case "show":
+      return runShow(args);
+    case "export":
+      return runExport(args);
+    case "delete":
+      return runDelete(args);
+    case "transfer":
+      return runReleaseTransfer(args);
+    default:
+      throw unknownSubcommand("release", args.subcommand);
+  }
+}
+async function runList(args) {
+  const auth = await getAccessToken(args);
+  const rows = await listReleases(auth, { workspaceId: auth.workspaceId }).catch((err) => {
+    throw readUnanswered("release", "list releases", "an empty list", err);
+  });
+  if (isMachineOutput(args)) {
+    const origins2 = await Promise.all(rows.map((r) => releaseOrigin(auth, r)));
+    writeJson({ releases: rows.map((r, i) => ({ ...publicRelease(r), origin: origins2[i] ?? null })) });
+    return;
+  }
+  if (rows.length === 0) {
+    info(`No releases yet. \`xanosdk release create <name>${contextFlags()}\` cuts one from a running environment.`);
+    return;
+  }
+  const s = stdoutStyle();
+  const origins = await Promise.all(rows.map((r) => releaseOrigin(auth, r)));
+  for (const [i, r] of rows.entries()) {
+    const origin = origins[i];
+    const from = origin === void 0 ? "from: not recorded" : `from ${describeOrigin(origin)}`;
+    printHuman(`${s.bold(safeText(r.name))}  ${from}  ${safeText(r.createdAt ?? "")}
+`);
+    if (r.description !== void 0 && r.description !== "") detail(safeText(oneLine(r.description)));
+  }
+}
+var LIST_DESCRIPTION_WIDTH = 100;
+function oneLine(description) {
+  const lines = description.split("\n").map((l) => l.trim());
+  const first = lines.find((l) => l !== "") ?? "";
+  const more = lines.filter((l) => l !== "").length > 1;
+  if (first.length > LIST_DESCRIPTION_WIDTH) return `${first.slice(0, LIST_DESCRIPTION_WIDTH).trimEnd()}\u2026`;
+  return more ? `${first} \u2026` : first;
+}
+async function runShow(args) {
+  const name = requireName(args, "show");
+  const auth = await getAccessToken(args);
+  const found = await requireRelease(auth, name, contextFlags(args));
+  const origin = await releaseOrigin(auth, found);
+  if (isMachineOutput(args)) {
+    writeJson({ ...publicRelease(found), origin: origin ?? null });
+    return;
+  }
+  const s = stdoutStyle();
+  printHuman(`${s.bold(safeText(found.name))}
+`);
+  detail(`from: ${origin === void 0 ? "not recorded" : describeOrigin(origin)}`);
+  detail(`created: ${safeText(found.createdAt ?? "-")}`);
+  if (found.description !== void 0 && found.description !== "") {
+    for (const line of found.description.split("\n")) detail(safeText(line));
+  }
+  detail(
+    found.seededTables.length === 0 ? "rows: none (every table's schema is included)" : `rows: ${found.seededTables.map((t) => `${safeText(t.name)}${t.count === void 0 ? "" : ` (${t.count})`}`).join(", ")}`
+  );
+  if (!found.hasResource) {
+    warn("Its stored contents are missing \u2014 cut it again from a live environment.", "release.contents-missing");
+  }
+}
+function publicRelease(r) {
+  const { recordedOrigin: _origin, copiedFrom: _copied, ...rest } = r;
+  return rest;
+}
+async function requireRelease(auth, name, flags = "") {
+  const found = await lookupRelease(auth, name);
+  if (found === null) {
+    const { releaseNames } = await import("./source-resolve-S2XA3XZF.js");
+    const { suggestAll } = await import("./suggest-6FOOYKHG.js");
+    const near = suggestAll(name, (await releaseNames(auth).catch(() => [])).filter((n) => n !== name));
+    throw new SourceError(
+      `No release named "${name}". \`xanosdk release list${flags}\` shows the ones that exist.` + (near.length === 0 ? "" : `
+Did you mean ${orNamesNoted(name, near)}?`),
+      "gone",
+      "release",
+      near[0],
+      near
+    );
+  }
+  return found;
+}
+async function runExport(args) {
+  const name = requireName(args, "export");
+  const target = resolveOutputTarget({ path: args.path, name, ext: "xs" });
+  const auth = await getAccessToken(args);
+  const found = await requireRelease(auth, name, contextFlags(args));
+  if (found.id === void 0) {
+    throw new Error(`Release "${name}" carries no id, so it cannot be exported.`);
+  }
+  const seeded = found.seededTables.filter((t) => t.count !== 0);
+  const content = await exportRelease(auth, {
+    workspaceId: auth.workspaceId,
+    id: found.id,
+    records: seeded.length > 0,
+    name: found.name
+  });
+  const rowsLine = seeded.length === 0 ? void 0 : `Includes the rows of ${seeded.length} seeded table${seeded.length === 1 ? "" : "s"}: ${seeded.map((t) => t.name).join(", ")}`;
+  if (target.kind === "stdout") {
+    writeData(process.stdout, content + "\n");
+    if (rowsLine !== void 0) detail(rowsLine);
+    const secrets = secretsInMultidoc(content);
+    if (secrets.length > 0) {
+      warn(
+        `The export carries ${secretsPhrase(secrets)} in cleartext \u2014 written to stdout, where no file permission protects it; do not commit or log it.`,
+        "secrets.cleartext-stdout"
+      );
+    }
+    return;
+  }
+  writeExportFile(target.path, content + "\n", secretsInMultidoc(content));
+  if (isMachineOutput(args)) {
+    writeJson({ path: target.path, name, seededTables: seeded.map((t) => t.name) });
+  }
+  success(`Wrote ${target.path}`);
+  if (rowsLine !== void 0) detail(rowsLine);
+}
+async function runDelete(args) {
+  const name = requireName(args, "delete");
+  const auth = await getAccessToken(args);
+  const destination = credentialWriteTarget(auth);
+  const { asDeleteLookupFailure } = await import("./ephemeral-command-CLJJKOFT.js");
+  const found = await lookupRelease(auth, name).catch((err) => {
+    throw asDeleteLookupFailure(err);
+  });
+  if (found === null || found.id === void 0) {
+    const { releaseNames, SourceError: SourceError2 } = await import("./source-resolve-S2XA3XZF.js");
+    const { suggestAll } = await import("./suggest-6FOOYKHG.js");
+    const near = suggestAll(name, (await releaseNames(auth).catch(() => [])).filter((n) => n !== name));
+    const again = `${args.json === true ? " --json" : ""}${contextFlags(args)}`;
+    const missed = `No release named "${name}" on ${describeWriteTarget(destination)} \u2014 nothing was deleted. \`xanosdk release list${contextFlags(args)}\` shows the ones that exist.`;
+    const meant = near.map((n) => `Did you mean "${safeText(n)}"${normalisationNote(name, n)}? \`xanosdk release delete ${shellWord(n)}${again}\` deletes it, after asking to confirm.`);
+    if (near.length > 0) {
+      throw new SourceError2([missed, ...meant].join("\n"), "gone", "release", near[0], near.length > 1 ? near : void 0);
+    }
+    warn(missed, "release.not-found");
+    if (isMachineOutput(args)) {
+      writeJson({
+        verb: "delete",
+        destination: writeTargetPayload(destination),
+        name,
+        deleted: false,
+        alreadyGone: true,
+        declined: false
+      });
+    }
+    return;
+  }
+  const refusing = args.yes !== true && process.stdin.isTTY !== true;
+  step(`${refusing ? "Would delete" : "Deleting"} release "${name}"`);
+  discloseWriteTarget(destination);
+  const runners = await releaseRunners(auth, { id: found.id, name: found.name });
+  const runBy = runners.tenants.length + runners.branches.length === 0 ? void 0 : runners;
+  const runningIt = runBy === void 0 ? void 0 : describeRunners(runBy);
+  if (runningIt !== void 0) {
+    warn(
+      `Release "${name}" is in use: ${runningIt}. Deleting it leaves what runs it running, but it can no longer be landed again \u2014 nor put back after a deploy there stops partway.`,
+      "release.delete-in-use"
+    );
+  }
+  if (!args.yes) {
+    const ok = await confirm(
+      runningIt === void 0 ? `Delete release "${name}"? Anything running it keeps running; the record goes.` : `Delete release "${name}"? ${runningIt.charAt(0).toUpperCase()}${runningIt.slice(1)} \u2014 it keeps running there; the record goes.`,
+      {
+        flag: "--yes",
+        // Off a terminal, the details `tenant delete` carries, and this delete with `--yes`.
+        refusal: {
+          details: { verb: "delete", name, deleted: false, alreadyGone: false, declined: false, ...runBy === void 0 ? {} : { runBy } },
+          rerun: `xanosdk release delete ${shellWord(name)} --yes${args.json === true ? " --json" : ""}${contextFlags(args)}`
+        }
+      }
+    );
+    if (!ok) {
+      info("Deletion cancelled \u2014 nothing was deleted.");
+      if (isMachineOutput(args)) {
+        writeJson({
+          verb: "delete",
+          destination: writeTargetPayload(destination),
+          name,
+          deleted: false,
+          alreadyGone: false,
+          declined: true,
+          ...runBy === void 0 ? {} : { runBy }
+        });
+      }
+      return;
+    }
+  }
+  const id = found.id;
+  const { alreadyGone } = await describeWrite(
+    { what: `the delete of release "${name}"`, resolveWith: `xanosdk release show ${shellWord(name)}${contextFlags(args)}` },
+    () => deleteRelease(auth, { workspaceId: auth.workspaceId, id })
+  ).catch(async (err) => {
+    const { writeTransportFailure } = await import("./answer-shape-K67TAAPY.js");
+    const { unknownDeleteOutcome } = await import("./ephemeral-command-CLJJKOFT.js");
+    throw unknownDeleteOutcome(writeTransportFailure(err), `release "${name}"`, name, contextFlags(args), "release");
+  });
+  if (alreadyGone) warn(`Release "${name}" was already gone.`, "release.already-gone");
+  else success(`Deleted release ${name}`);
+  if (isMachineOutput(args)) {
+    writeJson({
+      verb: "delete",
+      destination: writeTargetPayload(destination),
+      name,
+      deleted: !alreadyGone,
+      alreadyGone,
+      declined: false,
+      ...runBy === void 0 ? {} : { runBy }
+    });
+  }
+}
+async function releaseRunners(auth, release) {
+  const { listTenants } = await import("./tenant-IIHPOHGP.js");
+  const { listEphemeral } = await import("./ephemeral-P7F3PMAD.js");
+  const { listBranchListing } = await import("./branch-NCRNWQBQ.js");
+  const { isDerivedPromoteLabel } = await import("./promote-command-PCWT5N6S.js");
+  const [tenants, ephemerals, listing] = await Promise.all([
+    listTenants(auth, { workspaceId: auth.workspaceId }).catch(() => []),
+    listEphemeral(auth, { parentWorkspaceId: auth.workspaceId }).catch(() => []),
+    listBranchListing(auth, { baseUrl: auth.instance, workspaceId: auth.workspaceId }).catch(() => void 0)
+  ]);
+  const runners = /* @__PURE__ */ new Map();
+  for (const t of [...tenants, ...ephemerals]) {
+    if (t.deployedReleaseId === release.id && !runners.has(t.name)) runners.set(t.name, t.type === "ephemeral" ? "ephemeral" : "tenant");
+  }
+  const { getEnvironment, readEphemeralState } = await import("./ephemeral-state-PYCBSOGX.js");
+  const { projectDirFrom } = await import("./xanosdk-project-S6DXJONQ.js");
+  const dir = projectDirFrom(process.cwd());
+  const tracked = dir === void 0 ? void 0 : getEnvironment(readEphemeralState(dir), auth);
+  if (tracked?.release === release.name && ephemerals.some((e) => e.name === tracked.name)) runners.set(tracked.name, "ephemeral");
+  return {
+    tenants: [...runners].map(([name, kind]) => ({ name, kind })),
+    branches: (listing?.branches ?? []).filter((b) => isDerivedPromoteLabel(b.label, release.name)).map((b) => b.label)
+  };
+}
+function describeRunners(r) {
+  const list = (named) => named.length === 1 ? named[0] : `${named.slice(0, -1).join(", ")} and ${named.at(-1)}`;
+  return [
+    ...r.tenants.length === 0 ? [] : [`it is the last release landed on ${list(r.tenants.map((t) => `${t.kind} "${t.name}"`))}`],
+    ...r.branches.length === 0 ? [] : [`a promote of it landed ${list(r.branches.map((b) => `branch "${b}"`))}`]
+  ].join("; ");
+}
+export {
+  oneLine,
+  runReleaseCommand
+};
+//# sourceMappingURL=release-ns-command-3KFDMZ6G.js.map