@xano/sdk 1.0.0

package/dist/chunk-ETO6LGLD.js

@@ -0,0 +1,4750 @@
+import {
+  assertOneName,
+  noteRunArgs
+} from "./chunk-ZIY7RNUT.js";
+import {
+  WORKSPACE_ENV_FILE,
+  classifyEnv,
+  declaredEnv,
+  defaultWorkspaceEnvPath,
+  namesInEnvExample,
+  parseEnvFile,
+  readWorkspaceEnvFile
+} from "./chunk-DAD3ONIS.js";
+import {
+  readTrackedBackend
+} from "./chunk-HHN734BU.js";
+import {
+  isCI
+} from "./chunk-Q325JKYB.js";
+import {
+  backendSlotForFlag,
+  slotValueMissing
+} from "./chunk-STSFNCY4.js";
+import {
+  defaultWorkspaceSecretsPath,
+  readSecretsFile
+} from "./chunk-I4F5TCJH.js";
+import {
+  allLandings,
+  getEnvironment,
+  readEphemeralState
+} from "./chunk-5QU2P5CA.js";
+import {
+  isUnwritableError,
+  unwritableError
+} from "./chunk-JZGVVJSI.js";
+import {
+  isExpired
+} from "./chunk-7G3CTU7I.js";
+import {
+  contextFlags,
+  setHintContext
+} from "./chunk-NAQDMEHV.js";
+import {
+  shellWord
+} from "./chunk-FWD7AL6N.js";
+import {
+  buildSeedContentFiles,
+  collectNonPublicSeedValues,
+  hostedFileArchivePath,
+  hostedFileResolver,
+  isMissingFile,
+  registerSeedHostedFiles
+} from "./chunk-U64O2MXY.js";
+import {
+  projectRootFrom
+} from "./chunk-ROY4YAEQ.js";
+import {
+  readLockFile,
+  readLockFileReport,
+  writeLockFile
+} from "./chunk-P2HAGF6H.js";
+import {
+  writeData
+} from "./chunk-AWQ7BQTQ.js";
+import {
+  expandHome
+} from "./chunk-EUUUMY7J.js";
+import {
+  inCredentialScope,
+  lastResolvedAuth,
+  pinnedWorkspaceMissed
+} from "./chunk-YLDALTWZ.js";
+import {
+  assertValidProfileName
+} from "./chunk-QXTKSOFI.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import {
+  bundleCapabilities
+} from "./chunk-JGE7CAWB.js";
+import {
+  BARE,
+  CliError,
+  FLAGS,
+  GLOBAL_FLAGS,
+  LocalFileNotFoundError,
+  REFUSES_EMPTY_DOC_TOKEN,
+  REFUSES_EMPTY_ENV,
+  UsageError,
+  detail,
+  displayPath,
+  envSetArgumentsRefused,
+  extraArguments,
+  failureCode,
+  flagName,
+  flagRefFor,
+  flagValues,
+  getCommand,
+  getSubcommand,
+  inJsonDocumentScope,
+  info,
+  isAuthenticatedCommand,
+  isCommand,
+  isKindShaped,
+  isMachineOutput,
+  isUsageError,
+  jsonWarning,
+  liveSubcommandNames,
+  mergeJsonWarnings,
+  missingArgument,
+  movedVerb,
+  noteRunAccepted,
+  noteRunWarning,
+  pastePath,
+  pathsShownFrom,
+  relForwardSlash,
+  renderGlobalHelp,
+  renderHelpFor,
+  runAccepted,
+  runWarnings,
+  selectorSpellings,
+  setRunFailureExplainer,
+  stdoutStyle,
+  success,
+  tablesCommand,
+  takesProfileFlag,
+  terminalText,
+  unknownCommand,
+  unknownFlag,
+  unknownHelpTopic,
+  unknownSubcommand,
+  warn,
+  withCliPrefix,
+  writeJson
+} from "./chunk-PTHVMXZI.js";
+import {
+  KNOWLEDGE_DIR,
+  KNOWLEDGE_FILE,
+  emit,
+  isOsMetadataFile,
+  registerAllKinds,
+  serializeBundle
+} from "./chunk-MXHSQOC4.js";
+import {
+  Xano,
+  checkFilterOperands,
+  standaloneDefKind
+} from "./chunk-CTMO46PK.js";
+import {
+  knowledgeBodiesAllEmpty
+} from "./chunk-LQCMKAJ7.js";
+import {
+  checkDecodeOnlyStatements,
+  checkExpressionOperands,
+  checkInterpolatedValues,
+  checkLiveDatasourceTests,
+  checkLoopControl,
+  checkNonJsonValues,
+  checkNullMatchArgs,
+  checkPasswordInputHashing,
+  checkPathSegmentCandidates,
+  checkRegexOperandOrder,
+  checkReservedColumnNames,
+  checkReservedInputNames,
+  checkRunFamilyHosts,
+  checkSafeRefMatchArgs,
+  checkSearchOperandFilters,
+  checkSeed,
+  checkStacks,
+  checkSwitchFallthrough,
+  checkToThrowScope,
+  checkUnboundVarRefs,
+  checkZipPasswordKeys,
+  isQueryExpressionFilter
+} from "./chunk-YGZHHAAB.js";
+import {
+  FILTER_NAMES
+} from "./chunk-6HO3NCSJ.js";
+import {
+  isRepresentableName,
+  safeNames
+} from "./chunk-GSGDWJB5.js";
+import {
+  getKind
+} from "./chunk-4POWHT2K.js";
+import {
+  WORKSPACE_SECRETS_FILE,
+  documentationScopeFlagLabel,
+  documentationScopeLabel
+} from "./chunk-3JDU4VRL.js";
+import {
+  suggest
+} from "./chunk-UTI5G6OJ.js";
+import {
+  DiagnosticBag,
+  DiagnosticError,
+  isDiagnosticError,
+  setDiagnosticSink
+} from "./chunk-2EZ3ZJZZ.js";
+import {
+  WORKSPACE_KEY,
+  createLockContext,
+  displayLockKey,
+  emptyLock,
+  fileSpellingNote,
+  lockKey,
+  mergeObserved,
+  serializeLock,
+  toolsetKindsFromPayload,
+  validateLockModel,
+  withoutGuidSources
+} from "./chunk-6MR5TI5V.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+import {
+  HOSTED_FILE_SCHEME,
+  HOSTED_ICON_KINDS,
+  uncarriedHostedIcons
+} from "./chunk-XNCP4KYO.js";
+import {
+  IDENT,
+  installLambdaFreeReads,
+  installLambdaSyntaxCheck
+} from "./chunk-OXA6PSZT.js";
+import {
+  rawDeriveGuid
+} from "./chunk-NZOWWHU5.js";
+import {
+  resetLockOverrides,
+  seedLockOverrides
+} from "./chunk-4BW2SG2N.js";
+
+// src/emit/cli.ts
+import { pathToFileURL as pathToFileURL2, fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync, statSync as statSync3, writeFileSync } from "fs";
+import { basename, dirname as dirname2, isAbsolute, join as join2, relative as relative3, resolve as resolve2 } from "path";
+import { createRequire as createRequire2 } from "module";
+
+// src/emit/authoring-site.ts
+import { dirname, relative, resolve, sep } from "path";
+import { fileURLToPath } from "url";
+var OWN_ROOT = dirname(fileURLToPath(import.meta.url)).replace(/[\\/](src[\\/]emit|dist)$/, "");
+function authorFrame(err, entry) {
+  const stack = err instanceof Error ? err.stack ?? "" : "";
+  const project = projectRootFrom(dirname(resolve(entry))) + sep;
+  let first = true;
+  for (const line of stack.split("\n").slice(1)) {
+    const frame = /(?:file:\/\/)?((?:\/|[A-Za-z]:[\\/])[^\s()]*?):(\d+):(\d+)\)?\s*$/.exec(line);
+    if (!frame) continue;
+    let file = frame[1];
+    if (line.includes("file://")) {
+      try {
+        file = fileURLToPath(`file://${file}`);
+      } catch {
+        continue;
+      }
+    }
+    const top = first;
+    first = false;
+    if (!file.startsWith(project) || file.includes(`${sep}node_modules${sep}`)) continue;
+    if (file.startsWith(OWN_ROOT + sep + "src" + sep) || file.startsWith(OWN_ROOT + sep + "dist" + sep)) continue;
+    return { site: `${relative(process.cwd(), file) || file}:${frame[2]}:${frame[3]}`, top };
+  }
+  return void 0;
+}
+function authorFiles(err) {
+  const files = [];
+  const stack = err.stack;
+  for (const line of (typeof stack === "string" ? stack : "").split("\n").slice(1)) {
+    const frame = /(?:file:\/\/)?((?:\/|[A-Za-z]:[\\/])[^\s()]*?):\d+:\d+\)?\s*$/.exec(line);
+    if (!frame) continue;
+    let file = frame[1];
+    if (line.includes("file://")) {
+      try {
+        file = fileURLToPath(`file://${file}`);
+      } catch {
+        continue;
+      }
+    }
+    if (file.includes(`${sep}node_modules${sep}`)) continue;
+    if (file.startsWith(OWN_ROOT + sep + "src" + sep) || file.startsWith(OWN_ROOT + sep + "dist" + sep)) continue;
+    if (!files.includes(file)) files.push(file);
+  }
+  return files;
+}
+var AUTHORING_STACK_DEPTH = 200;
+async function withAuthoringStacks(load) {
+  const limit = Error.stackTraceLimit;
+  if (typeof limit === "number" && limit >= AUTHORING_STACK_DEPTH) return load();
+  Error.stackTraceLimit = AUTHORING_STACK_DEPTH;
+  try {
+    return await load();
+  } finally {
+    Error.stackTraceLimit = limit;
+  }
+}
+function asUsage(err) {
+  Object.defineProperty(err, "name", { value: "UsageError", configurable: true, writable: true });
+}
+function withAuthoringSite(err, entry) {
+  if (!(err instanceof Error) || err.code !== void 0) return err;
+  const missing = /does not provide an export named '([^']+)'/.exec(err.message);
+  if (err instanceof SyntaxError && missing !== null) {
+    asUsage(err);
+    return err;
+  }
+  const frame = authorFrame(err, entry);
+  if (frame === void 0) return err;
+  if (frame.top || Object.getPrototypeOf(err) === Error.prototype) asUsage(err);
+  if (!err.message.includes(frame.site)) err.message = `${err.message}
+  (thrown while loading ${frame.site})`;
+  return err;
+}
+
+// src/emit/compile-checks.ts
+function payloadKeyOf(def) {
+  registerAllKinds();
+  const kind = standaloneDefKind(def);
+  return kind === void 0 ? "function" : getKind(kind).payloadKey;
+}
+function checkCompiledDef(def, artifact, strict, raised = []) {
+  const encoded = JSON.parse(artifact);
+  const payloadKey = payloadKeyOf(def);
+  const sections = { [payloadKey]: [encoded] };
+  const tables = payloadKey === "dbo" ? [def] : [];
+  const allow = new Set(def.diagnostics?.allow ?? []);
+  const bag = new DiagnosticBag(strict);
+  bag.accepts = (code, subject) => (subject === encoded || subject === def) && allow.has(code);
+  for (const d of raised) bag.warn(d.code, d.message, encoded);
+  checkNonJsonValues(sections, bag);
+  checkStacks(tables, sections, bag, {}, "authored");
+  checkExpressionOperands(sections, bag);
+  checkInterpolatedValues(sections, bag);
+  checkRegexOperandOrder(sections, bag);
+  checkDecodeOnlyStatements(sections, bag);
+  checkRunFamilyHosts(sections, bag);
+  checkLiveDatasourceTests(sections, bag);
+  checkLoopControl(sections, bag);
+  checkSwitchFallthrough(sections, bag);
+  checkSearchOperandFilters(sections, bag);
+  checkFilterOperands(sections, bag);
+  checkUnboundVarRefs(sections, bag);
+  checkToThrowScope(sections, bag);
+  checkPasswordInputHashing(sections, bag);
+  checkZipPasswordKeys(sections, bag);
+  checkSafeRefMatchArgs(sections, bag);
+  checkNullMatchArgs(sections, bag);
+  checkPathSegmentCandidates(sections, bag);
+  checkSeed(tables, bag);
+  checkReservedColumnNames(tables, bag);
+  checkReservedInputNames(sections, bag);
+  bag.flush();
+}
+
+// src/validate/filter-names.ts
+var RESOLVABLE = new Set(FILTER_NAMES);
+var QUERY_EXPRESSION_KEYS = /* @__PURE__ */ new Set(["eval", "search", "sort", "aggregate"]);
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const curr = [i];
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[b.length];
+}
+function suggestFilterNames(name) {
+  const AFFIX_MAX = 6;
+  const affix = (long, short) => (long.startsWith(short) || long.endsWith(short)) && long.length - short.length <= AFFIX_MAX;
+  const substr = FILTER_NAMES.filter(
+    (r) => name.length >= r.length ? affix(name, r) : affix(r, name)
+  ).sort((a, b) => Math.abs(a.length - name.length) - Math.abs(b.length - name.length));
+  if (substr.length) return substr.slice(0, 2);
+  const near = (d) => d === 1 || d === 2 && name.length >= 6;
+  return FILTER_NAMES.map((r) => ({ r, d: editDistance(name, r) })).filter((x) => near(x.d)).sort((a, b) => a.d - b.d).slice(0, 2).map((x) => x.r);
+}
+var SECTION_KIND = {
+  dbo: "table",
+  app: "api group",
+  toolset: "toolset",
+  realtime_server: "realtime server",
+  channel: "realtime channel",
+  message: "realtime message",
+  workflow_test: "workflow test"
+};
+var BRANCH_LABEL = {
+  if: "then",
+  else: "else",
+  elif: "elif"
+};
+var STATEMENT_BRANCH_LABEL = {
+  "mvp:try_catch": { if: "try", else: "catch", then: "finally" },
+  "mvp:switch": { elif: "cases", else: "default" },
+  "mvp:switch_case": { if: "body" }
+};
+function expressionFilterNames(source) {
+  const names = [];
+  for (let i = 0; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === '"' || ch === "'") {
+      for (i++; i < source.length && source[i] !== ch; i++) if (source[i] === "\\") i++;
+      continue;
+    }
+    if (ch !== "|") continue;
+    if (source[i + 1] === "|") {
+      i++;
+      continue;
+    }
+    const name = /^\s*([A-Za-z_][A-Za-z0-9_]*)/.exec(source.slice(i + 1));
+    if (name) names.push(name[1]);
+  }
+  return names;
+}
+function findUnresolvableFilters(bundle) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Map();
+  const walk = (node, owner, path, inQuery = false, parentKey = "", stmt = "") => {
+    if (Array.isArray(node)) {
+      for (const item of node) walk(item, owner, path, inQuery, parentKey, stmt);
+      return;
+    }
+    if (node === null || typeof node !== "object") return;
+    const obj = node;
+    const own = typeof obj.name === "string" && "context" in obj ? obj.name : parentKey === "context" ? stmt : "";
+    const embedded = obj.tag === "const:expr2" && typeof obj.value === "string" ? expressionFilterNames(obj.value).map((name) => ({ name, expr: true })) : [];
+    const filters = Array.isArray(obj.filters) ? [...obj.filters, ...embedded] : embedded;
+    if (filters.length > 0) {
+      for (const f of filters) {
+        const fname = f?.name;
+        const resolvable = typeof fname === "string" && (RESOLVABLE.has(fname) || inQuery && isQueryExpressionFilter(fname));
+        if (typeof fname === "string" && fname !== "" && !resolvable) {
+          const key = `${fname}@${owner}`;
+          let found = seen.get(key);
+          if (found === void 0) {
+            found = { finding: { name: fname, location: owner || "(unknown)", suggestions: suggestFilterNames(fname) }, paths: [] };
+            seen.set(key, found);
+            findings.push(found.finding);
+          }
+          if (f.expr) found.finding.inExpression = true;
+          if (path !== "" && !found.paths.includes(path)) {
+            found.paths.push(path);
+            found.finding.location = `${owner || "(unknown)"} at ${found.paths.join(", ")}`;
+          }
+        }
+      }
+    }
+    for (const [key, value] of Object.entries(obj)) {
+      const query = inQuery || QUERY_EXPRESSION_KEYS.has(key);
+      if (Array.isArray(value) && (key === "run" || path === "" && (key === "result" || key === "input"))) {
+        value.forEach((item, i) => {
+          const name = item?.name;
+          const at = key === "run" ? `${STATEMENT_BRANCH_LABEL[stmt]?.[parentKey] ?? BRANCH_LABEL[parentKey] ?? "stack"}[${i}]` : `${key === "result" ? "response" : "input"}${typeof name === "string" && name !== "" ? `.${name}` : `[${i}]`}`;
+          walk(item, owner, path ? `${path}.${at}` : at, query);
+        });
+      } else walk(value, owner, path, query, key, own);
+    }
+  };
+  const payload = bundle?.payload;
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    walk(bundle, "", "");
+    return findings;
+  }
+  for (const [section, entries] of Object.entries(payload)) {
+    const kind = SECTION_KIND[section] ?? section;
+    for (const entry of Array.isArray(entries) ? entries : [entries]) {
+      const name = entry?.name;
+      walk(entry, typeof name === "string" && name !== "" ? `${kind} "${name}"` : kind, "");
+    }
+  }
+  return findings;
+}
+
+// src/workspace/knowledge.ts
+import { readFileSync, readdirSync, statSync } from "fs";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+import { join, relative as relative2, sep as sep2 } from "path";
+var MAX_KNOWLEDGE_FILE_BYTES = 1024 * 1024;
+function resolveMarker(ref) {
+  const base = /^[a-z][a-z0-9+.-]*:/i.test(ref.base) ? ref.base : pathToFileURL(ref.base).href;
+  return fileURLToPath2(new URL(ref.path, base));
+}
+function utf8Text(bytes) {
+  if (bytes.includes(0)) return { problem: "nul" };
+  try {
+    return { text: new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes) };
+  } catch {
+    return { problem: "encoding" };
+  }
+}
+function notTextReason(problem, remedy) {
+  return problem === "nul" ? `it contains a NUL byte, so it is binary content, not text. ${remedy}` : `it is not valid UTF-8 (binary, or another encoding). ${remedy} \u2014 or, if it is text, re-save it as UTF-8.`;
+}
+function collectRefFiles(dir, itemName, refsWhere, warnings) {
+  const out = [];
+  const links = [];
+  const walk = (cur) => {
+    for (const entry of readdirSync(cur, { withFileTypes: true })) {
+      const full = join(cur, entry.name);
+      const rel = relative2(dir, full).split(sep2).join("/");
+      if (entry.isDirectory()) {
+        walk(full);
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        links.push(rel);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const bytes = readFileSync(full);
+      const decoded = utf8Text(bytes);
+      if ("problem" in decoded) {
+        if (isOsMetadataFile(rel, true)) continue;
+        throw new Error(
+          `knowledge "${itemName}": reference file "${rel}" under ${refsWhere} cannot ship \u2014 a reference file ships as text, and ${notTextReason(decoded.problem, "Move it out of the directory")}`
+        );
+      }
+      const content = decoded.text;
+      const size = bytes.length;
+      if (size > MAX_KNOWLEDGE_FILE_BYTES) {
+        throw new Error(
+          `knowledge "${itemName}": reference file "${rel}" is ${size} bytes, over the ${MAX_KNOWLEDGE_FILE_BYTES}-byte limit the engine accepts. Split it, or move the bulk of it somewhere the agent fetches at run time.`
+        );
+      }
+      out.push({ path: rel, content, size });
+    }
+  };
+  walk(dir);
+  if (links.length > 0) {
+    links.sort();
+    warnings.push({
+      code: "knowledge.refs-symlink-skipped",
+      message: `knowledge "${itemName}": ${refsWhere} contains ${links.map((l) => `"${l}"`).join(", ")}, ${links.length === 1 ? "a symbolic link" : "symbolic links"}, which ${links.length === 1 ? "does" : "do"} not ship \u2014 a link is not followed. Copy the file it points at into the directory to ship it.`
+    });
+  }
+  out.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return out;
+}
+function resolveKnowledge(defs) {
+  const resolved = [];
+  for (const def of defs) {
+    const bodyRef = def.body[KNOWLEDGE_FILE];
+    const where = `knowledgeFile("${bodyRef.path}")`;
+    let content;
+    try {
+      const abs = resolveMarker(bodyRef);
+      if (statSync(abs).isDirectory()) {
+        throw new Error(
+          `knowledge "${def.name}": ${where} points at a DIRECTORY. A body is one markdown file; use \`refs: knowledgeDir(...)\` for a folder of reference files.`
+        );
+      }
+      const decoded = utf8Text(readFileSync(abs));
+      if ("problem" in decoded) {
+        throw new Error(
+          `knowledge "${def.name}": ${where} cannot ship \u2014 a body ships as text, and ` + notTextReason(decoded.problem, "Point the body at a markdown file")
+        );
+      }
+      content = decoded.text;
+    } catch (err) {
+      if (err instanceof Error && /points at a DIRECTORY|cannot ship — a body ships as text/.test(err.message)) throw err;
+      throw new (isMissingFile(err) ? LocalFileNotFoundError : Error)(
+        `knowledge "${def.name}": cannot read ${where} \u2014 ${err.message}. The path resolves relative to the module that declares the item (its \`import.meta.url\`).`
+      );
+    }
+    let files = [];
+    const warnings = [];
+    if (def.refs !== void 0) {
+      const refsRef = def.refs[KNOWLEDGE_DIR];
+      const refsWhere = `knowledgeDir("${refsRef.path}")`;
+      const abs = resolveMarker(refsRef);
+      try {
+        if (!statSync(abs).isDirectory()) {
+          throw new Error(
+            `knowledge "${def.name}": ${refsWhere} is not a directory. Reference files are a FOLDER the agent searches; a single file belongs in the body.`
+          );
+        }
+      } catch (err) {
+        if (err instanceof Error && /is not a directory/.test(err.message)) throw err;
+        throw new (isMissingFile(err) ? LocalFileNotFoundError : Error)(
+          `knowledge "${def.name}": cannot read ${refsWhere} \u2014 ${err.message}.`
+        );
+      }
+      files = collectRefFiles(abs, def.name, refsWhere, warnings);
+      const own = /* @__PURE__ */ new Map([[resolveMarker(bodyRef), where]]);
+      for (const base of [bodyRef.base, refsRef.base]) {
+        const module = base.startsWith("file:") ? fileURLToPath2(base) : /^[a-z][a-z0-9+.-]*:/i.test(base) ? void 0 : base;
+        if (module !== void 0) own.set(module, "the module that declares it");
+      }
+      const shipped = files.map((f) => ({
+        rel: f.path,
+        what: own.get(join(abs, ...f.path.split("/"))) ?? (/\.[cm]?[jt]sx?$/i.test(f.path) ? "a source file" : void 0)
+      })).filter((f) => f.what !== void 0);
+      if (shipped.length > 0) {
+        warnings.push({
+          code: "knowledge.refs-include-source",
+          message: `knowledge "${def.name}": ${refsWhere} contains ${shipped.map((f) => `"${f.rel}" (${f.what})`).join(", ")}, which ${shipped.length === 1 ? "ships" : "ship"} as ${shipped.length === 1 ? "a reference file" : "reference files"} \u2014 everything under the directory is collected. Move ${shipped.length === 1 ? "it" : "them"} out of it, or point \`refs\` at a subdirectory (\`knowledgeDir("./refs", import.meta.url)\`).`
+        });
+      }
+    }
+    resolved.push({ name: def.name, content, files, ...warnings.length > 0 ? { warnings } : {} });
+  }
+  return resolved;
+}
+
+// src/values/lambda-syntax.ts
+import { createRequire } from "module";
+
+// src/values/lambda-scope.ts
+var PUNCTUATORS = ["...", "=>", "?.", "??", "&&", "||", "==", "!=", "<=", ">="];
+var ID_AT = new RegExp(`^#?${IDENT}`, "u");
+function tokenize(mask) {
+  const out = [];
+  let nl = false;
+  let i = 0;
+  while (i < mask.length) {
+    const ch = mask[i];
+    if (ch === "\n") {
+      nl = true;
+      i++;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      i++;
+      continue;
+    }
+    const id = ID_AT.exec(mask.slice(i, i + 256));
+    if (id) {
+      out.push({ text: id[0], kind: "id", nl });
+      i += id[0].length;
+    } else if (/[0-9]/.test(ch)) {
+      const num = /^[0-9][0-9A-Za-z_.]*/.exec(mask.slice(i, i + 64))[0];
+      out.push({ text: num, kind: "num", nl });
+      i += num.length;
+    } else {
+      const multi = PUNCTUATORS.find((p) => mask.startsWith(p, i));
+      const text = multi ?? ch;
+      out.push({ text, kind: "punc", nl });
+      i += text.length;
+    }
+    nl = false;
+  }
+  return out;
+}
+var OPEN = { "(": ")", "[": "]", "{": "}" };
+var CLOSE = /* @__PURE__ */ new Set([")", "]", "}"]);
+function matchBrackets(toks) {
+  const match = new Array(toks.length).fill(-1);
+  const stack = [];
+  toks.forEach((t, i) => {
+    if (t.kind !== "punc") return;
+    if (OPEN[t.text] !== void 0) stack.push(i);
+    else if (CLOSE.has(t.text)) {
+      const open = stack.pop();
+      if (open !== void 0 && OPEN[toks[open].text] === t.text) {
+        match[open] = i;
+        match[i] = open;
+      }
+    }
+  });
+  return match;
+}
+var BLOCK_AFTER_WORD = /* @__PURE__ */ new Set(["else", "do", "try", "finally", "catch"]);
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "let",
+  "new",
+  "null",
+  "of",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield",
+  "await",
+  "async",
+  "undefined"
+]);
+var CONTROL = /* @__PURE__ */ new Set(["if", "for", "while", "switch", "catch", "with", "return", "typeof", "await", "yield", "new"]);
+var Analysis = class {
+  toks;
+  match;
+  /** Brace index → true when it opens an object literal (or object pattern) rather than a block. */
+  objectBrace = /* @__PURE__ */ new Map();
+  /** Token indices that are a binding's own declaration site. */
+  declSites = /* @__PURE__ */ new Set();
+  scopes = [];
+  /** Brace indices that open a class body. */
+  classBodies = /* @__PURE__ */ new Set();
+  /** [from, to] token ranges that are TypeScript type positions, never value reads. */
+  typeRanges = [];
+  /** [from, to] ranges of function bodies (parameters included), outermost first. */
+  functions = [];
+  /** Index of the leading `function` keyword of the analysed function, or -1. */
+  header;
+  constructor(mask, header) {
+    this.toks = tokenize(mask);
+    this.header = !header ? -1 : this.t(0) === "function" ? 0 : this.t(0) === "async" && this.t(1) === "function" ? 1 : -1;
+    this.match = matchBrackets(this.toks);
+    this.functions.push([0, this.toks.length]);
+    this.classifyBraces();
+    this.collect();
+  }
+  t(i) {
+    return this.toks[i]?.text ?? "";
+  }
+  classifyBraces() {
+    const open = [];
+    this.toks.forEach((tok, i) => {
+      if (tok.kind !== "punc") return;
+      if (CLOSE.has(tok.text)) {
+        if (open.length > 0 && this.match[open[open.length - 1]] === i) open.pop();
+        return;
+      }
+      if (tok.text === "(" || tok.text === "[") open.push(i);
+      if (tok.text !== "{") return;
+      const prev = this.toks[i - 1];
+      let object;
+      if (prev === void 0) object = false;
+      else if (prev.text === ":" && prev.kind === "punc") object = !this.statementColon(i - 1, open[open.length - 1]);
+      else if (prev.kind === "punc") object = !["=>", ")", "{", "}", ";"].includes(prev.text);
+      else if (prev.kind === "id") object = !BLOCK_AFTER_WORD.has(prev.text) && KEYWORDS.has(prev.text);
+      else object = false;
+      this.objectBrace.set(i, object);
+      open.push(i);
+    });
+  }
+  /**
+   * Whether the `:` at `colon` ends a `case …:` / `default:` clause or a
+   * statement label — after which `{` opens a block — rather than an object
+   * key, a ternary's second branch or a type annotation. `enclosing` is the
+   * innermost open bracket. Only a colon sitting directly in a block (or at
+   * the top level) can be one; there the statement is read back to its start.
+   */
+  statementColon(colon, enclosing) {
+    if (enclosing !== void 0 && (this.t(enclosing) !== "{" || this.objectBrace.get(enclosing) === true)) return false;
+    for (let k = (enclosing ?? 0) - 1; k >= 0 && ![";", "{", "}"].includes(this.t(k)); k--) {
+      if (this.t(k) === "class") return false;
+    }
+    const boundary = (k) => k < 0 || k === enclosing || [";", "{", "}", ":"].includes(this.t(k)) || this.toks[k].kind === "id" && BLOCK_AFTER_WORD.has(this.t(k)) || this.t(k) === ")" && this.match[k] > 0 && ["if", "for", "while", "with"].includes(this.t(this.match[k] - 1));
+    if (this.t(colon - 1) === "case") return true;
+    if (this.toks[colon - 1]?.kind === "id" && boundary(colon - 2) && this.t(colon - 2) !== "?") {
+      return this.t(colon - 1) === "default" || !KEYWORDS.has(this.t(colon - 1));
+    }
+    let questions = 0;
+    let colons = 0;
+    for (let k = colon - 1; k > (enclosing ?? -1); k--) {
+      const closer = CLOSE.has(this.t(k)) ? this.match[k] : -1;
+      if (closer >= 0) {
+        k = closer;
+        continue;
+      }
+      const text = this.t(k);
+      if (text === "case") return questions === colons;
+      if (text === ";" || text === "{" || text === "}") return false;
+      if (text === "?") questions++;
+      if (text === ":") colons++;
+    }
+    return false;
+  }
+  /**
+   * Skip forward from `i` to the first token in `stops` at bracket depth 0, a
+   * closer of an enclosing bracket, or (with `asi`) a line break that ends the
+   * statement (never before the first token). `angles` counts `<`/`>` as brackets, for type annotations.
+   */
+  skip(i, stops, angles = false, asi = true) {
+    let depth = 0;
+    let angle = 0;
+    const start = i;
+    for (; i < this.toks.length; i++) {
+      const tok = this.toks[i];
+      if (depth === 0 && angle === 0 && stops.includes(tok.text)) return i;
+      if (tok.kind === "punc") {
+        if (OPEN[tok.text] !== void 0) {
+          depth++;
+          continue;
+        }
+        if (CLOSE.has(tok.text)) {
+          if (depth === 0) return i;
+          depth--;
+          continue;
+        }
+        if (angles && tok.text === "<") angle++;
+        if (angles && tok.text === ">" && angle > 0) {
+          angle--;
+          continue;
+        }
+      }
+      if (depth > 0 || angle > 0) continue;
+      if (asi && tok.nl && tok.kind !== "punc" && i !== start) {
+        const prev = this.toks[i - 1];
+        if (prev && (prev.kind !== "punc" || [")", "]", "}"].includes(prev.text))) return i;
+      }
+    }
+    return i;
+  }
+  declare(name, site, from, to) {
+    this.declSites.add(site);
+    this.scopes.push({ name, from, to });
+  }
+  /** Bind every name in the pattern at `i`; returns the index after it. */
+  pattern(i, from, to) {
+    const tok = this.toks[i];
+    if (tok === void 0) return i;
+    if (tok.text === "...") return this.pattern(i + 1, from, to);
+    if (tok.kind === "id") {
+      if (!KEYWORDS.has(tok.text)) this.declare(tok.text, i, from, to);
+      return i + 1;
+    }
+    if (tok.text === "{" || tok.text === "[") {
+      const end = this.match[i];
+      if (end < 0) return i + 1;
+      if (tok.text === "{") this.objectBrace.set(i, true);
+      let j = i + 1;
+      while (j < end) {
+        if (this.t(j) === ",") {
+          j++;
+          continue;
+        }
+        if (tok.text === "{") {
+          if (this.t(j) === "...") {
+            j = this.pattern(j + 1, from, to);
+          } else {
+            let key = j;
+            if (this.t(j) === "[") key = this.match[j] >= 0 ? this.match[j] : j;
+            if (this.t(key + 1) === ":") j = this.pattern(key + 2, from, to);
+            else if (this.t(j) === ":") j = this.pattern(j + 1, from, to);
+            else j = this.pattern(j, from, to);
+          }
+        } else {
+          j = this.pattern(j, from, to);
+        }
+        if (this.t(j) === "=") j = this.skip(j + 1, [","], false, false);
+        if (j < end && this.t(j) !== ",") j = this.skip(j, [","], false, false);
+      }
+      return end + 1;
+    }
+    return i + 1;
+  }
+  /** A parameter list `(` … `)` at `open`, binding into [from, to]. */
+  params(open, from, to) {
+    const close = this.match[open];
+    let j = open + 1;
+    while (j < close) {
+      if (this.t(j) === ",") {
+        j++;
+        continue;
+      }
+      if (this.t(j) === "this" && this.t(j + 1) === ":") {
+        j = this.annotation(j + 2, [","]);
+        continue;
+      }
+      j = this.pattern(j, from, to);
+      if (this.t(j) === "?") j++;
+      if (this.t(j) === ":") j = this.annotation(j + 1, [",", "="]);
+      if (this.t(j) === "=") j = this.skip(j + 1, [","], false, false);
+      if (j < close && this.t(j) !== ",") j = this.skip(j, [","], false, false);
+    }
+  }
+  /** Index of the `{` opening a body after `)` at `close`, skipping a return-type annotation. */
+  bodyBrace(close) {
+    let j = close + 1;
+    if (this.t(j) === ":") j = this.annotation(j + 1, ["{", "=>"]);
+    return this.t(j) === "{" ? j : -1;
+  }
+  /** Skip a type annotation starting at `from`, recording it as a type position. */
+  annotation(from, stops, asi = false) {
+    const end = this.skip(from, stops, true, asi);
+    this.typeRanges.push([from, end - 1]);
+    return end;
+  }
+  /** The end of an arrow body starting at `start`. */
+  arrowEnd(start) {
+    if (this.t(start) === "{" && this.match[start] >= 0) return this.match[start];
+    return this.skip(start, [",", ";"]);
+  }
+  enclosingBlock(i) {
+    let best = [0, this.toks.length];
+    for (let k = i - 1; k >= 0; k--) {
+      if (this.t(k) !== "{" || this.objectBrace.get(k)) continue;
+      const close = this.match[k];
+      if (close > i) {
+        best = [k, close];
+        break;
+      }
+    }
+    return best;
+  }
+  enclosingFunction(i) {
+    let best = this.functions[0];
+    for (const range of this.functions) {
+      if (range[0] <= i && range[1] >= i && range[0] >= best[0]) best = range;
+    }
+    return best;
+  }
+  collect() {
+    const toks = this.toks;
+    for (let i = 0; i < toks.length; i++) {
+      const tok = toks[i];
+      const prev = this.t(i - 1);
+      if (prev === "." || prev === "?.") continue;
+      if (tok.text === "(" && this.match[i] > i) {
+        const close = this.match[i];
+        const before = toks[i - 1];
+        let arrow = this.t(close + 1) === "=>" ? close + 1 : -1;
+        if (arrow < 0 && this.t(close + 1) === ":") {
+          const k = this.skip(close + 2, ["=>", "{", ";", ","], true, false);
+          if (this.t(k) === "=>") {
+            arrow = k;
+            this.typeRanges.push([close + 2, k - 1]);
+          }
+        }
+        if (arrow >= 0) {
+          const end = this.arrowEnd(arrow + 1);
+          this.functions.push([i, end]);
+          this.params(i, i, end);
+          continue;
+        }
+        if (before?.text === "catch") {
+          const body = close + 1;
+          if (this.t(body) === "{" && this.match[body] > body) this.params(i, i, this.match[body]);
+          continue;
+        }
+        const isFunction = before?.text === "function" || before?.kind === "id" && !CONTROL.has(before.text) && (this.t(i - 2) === "function" || this.t(i - 2) === "*") || // A method: `name(` … `) {` directly inside an object literal or class body.
+        before?.kind === "id" && !CONTROL.has(before.text) && !KEYWORDS.has(before.text) && this.bodyBrace(close) >= 0 && [",", "{", "}", ";", "get", "set", "async", "static"].includes(this.t(i - 2));
+        if (isFunction) {
+          const body = this.bodyBrace(close);
+          if (body >= 0 && this.match[body] > body) {
+            const end = this.match[body];
+            this.functions.push([i, end]);
+            this.params(i, i, end);
+          }
+        }
+        continue;
+      }
+      if (tok.kind !== "id") continue;
+      if ((tok.text === "as" || tok.text === "satisfies") && toks[i + 1]?.kind === "id" && i > 0) {
+        this.typeRanges.push([i + 1, i + 1]);
+        continue;
+      }
+      if ((tok.text === "type" || tok.text === "interface") && toks[i + 1]?.kind === "id" && !toks[i + 1].nl && ["=", "<", "{", "extends"].includes(this.t(i + 2)) && (i === 0 || tok.nl || [";", "{", "}"].includes(prev))) {
+        const end = tok.text === "type" ? this.skip(i + 2, [";"], true) : (() => {
+          const brace = this.skip(i + 2, ["{"], true, false);
+          return this.match[brace] > brace ? this.match[brace] : brace;
+        })();
+        this.declSites.add(i + 1);
+        this.typeRanges.push([i + 1, end]);
+        i = end;
+        continue;
+      }
+      if (tok.text === "class") {
+        const brace = this.skip(i + 1, ["{"], true, false);
+        if (this.t(brace) === "{") {
+          this.classBodies.add(brace);
+          this.objectBrace.set(brace, false);
+        }
+      }
+      if (this.t(i + 1) === "=>" && !KEYWORDS.has(tok.text)) {
+        const end = this.arrowEnd(i + 2);
+        this.functions.push([i, end]);
+        this.declare(tok.text, i, i, end);
+        continue;
+      }
+      if (tok.text === "let" || tok.text === "const" || tok.text === "var") {
+        let range;
+        if (prev === "(" && this.t(i - 2) === "for") {
+          const close = this.match[i - 1];
+          const body = close + 1;
+          const end = this.t(body) === "{" && this.match[body] > body ? this.match[body] : this.skip(body, [";"]);
+          range = tok.text === "var" ? this.enclosingFunction(i) : [i, end];
+        } else {
+          range = tok.text === "var" ? this.enclosingFunction(i) : this.enclosingBlock(i);
+        }
+        let j = i + 1;
+        for (; ; ) {
+          j = this.pattern(j, range[0], range[1]);
+          if (this.t(j) === "!") j++;
+          if (this.t(j) === ":") j = this.annotation(j + 1, ["=", ",", ";", "of", "in"], true);
+          if (this.t(j) === "=") j = this.skip(j + 1, [",", ";"]);
+          if (this.t(j) !== ",") break;
+          j++;
+        }
+        continue;
+      }
+      if ((tok.text === "function" || tok.text === "class") && toks[i + 1]?.kind === "id") {
+        const nameAt = i + 1;
+        const [from, to] = tok.text === "function" ? this.enclosingFunction(i) : this.enclosingBlock(i);
+        if (i === this.header) continue;
+        this.declare(this.t(nameAt), nameAt, from, to);
+      }
+    }
+  }
+  /** Whether the identifier at `i` is an object-literal key rather than a read. */
+  isKey(i) {
+    const prev = this.t(i - 1);
+    const next = this.t(i + 1);
+    let opener = -1;
+    if (prev === "{") opener = i - 1;
+    else if (prev === "," || ["get", "set", "async"].includes(prev)) {
+      let depth = 0;
+      for (let k = i - 1; k >= 0; k--) {
+        const t = this.t(k);
+        if (CLOSE.has(t)) depth++;
+        else if (OPEN[t] !== void 0) {
+          if (depth === 0) {
+            opener = k;
+            break;
+          }
+          depth--;
+        }
+      }
+    }
+    if (opener < 0 || this.t(opener) !== "{" || !this.objectBrace.get(opener)) return false;
+    return next === ":" || next === "(";
+  }
+  /** Index of the bracket directly enclosing token `i`, or -1. */
+  opener(i) {
+    for (let k = i - 1; k >= 0; k--) {
+      const m = this.match[k];
+      if (OPEN[this.t(k)] !== void 0 && (m > i || m < 0)) return k;
+      if (CLOSE.has(this.t(k)) && m >= 0) k = m;
+    }
+    return -1;
+  }
+  /** A class member's name: `total = 1`, `total: T`, `total() {}`, `static total`. */
+  isClassMember(i) {
+    if (!this.classBodies.has(this.opener(i))) return false;
+    const prev = this.t(i - 1);
+    const lead = ["{", ";", "}", "static", "readonly", "private", "public", "protected", "declare", "override", "accessor", "async", "get", "set", "*"];
+    if (!lead.includes(prev) && !this.toks[i].nl) return false;
+    const next = this.toks[i + 1];
+    return next === void 0 || next.nl || ["=", ";", ":", "?", "!", "(", "}", "<"].includes(next.text);
+  }
+  /** A statement label (`total: for …`) or a jump to one (`continue total`). */
+  isLabel(i) {
+    const prev = this.t(i - 1);
+    if ((prev === "break" || prev === "continue") && !this.toks[i].nl) return true;
+    if (this.t(i + 1) !== ":") return false;
+    const asi = this.toks[i].nl && this.toks[i - 1]?.kind !== "punc";
+    if (!(i === 0 || asi || [";", "{", "}"].includes(prev))) return false;
+    const open = this.opener(i);
+    return open < 0 || this.t(open) === "{" && !this.objectBrace.get(open) && !this.classBodies.has(open);
+  }
+  /** Whether token `i` sits in a TypeScript type position. */
+  inType(i) {
+    return this.typeRanges.some(([from, to]) => from <= i && i <= to);
+  }
+  /** Whether some declaration of `name` encloses token `i`. */
+  shadowed(name, i) {
+    return this.scopes.some((s) => s.name === name && s.from <= i && i <= s.to);
+  }
+};
+function isFreeRead(analysis, i) {
+  const toks = analysis.toks;
+  const tok = toks[i];
+  const prev = toks[i - 1]?.text;
+  if (prev === "." || prev === "?.") return false;
+  if (analysis.header >= 0 && i <= analysis.header + 2) return false;
+  if (analysis.declSites.has(i)) return false;
+  if (analysis.isKey(i)) return false;
+  if (analysis.isClassMember(i) || analysis.isLabel(i) || analysis.inType(i)) return false;
+  return !analysis.shadowed(tok.text, i);
+}
+function readsFreeName(mask, name) {
+  const analysis = new Analysis(mask, true);
+  return analysis.toks.some((tok, i) => tok.kind === "id" && tok.text === name && isFreeRead(analysis, i));
+}
+function freeReads(mask) {
+  const analysis = new Analysis(mask, false);
+  const seen = /* @__PURE__ */ new Set();
+  analysis.toks.forEach((tok, i) => {
+    if (tok.kind !== "id" || tok.text.startsWith("#") || KEYWORDS.has(tok.text) || seen.has(tok.text)) return;
+    if (isFreeRead(analysis, i)) seen.add(tok.text);
+  });
+  return [...seen];
+}
+
+// src/values/lambda-syntax.ts
+function loadEsbuild() {
+  try {
+    return createRequire(import.meta.url)("esbuild");
+  } catch {
+    return void 0;
+  }
+}
+var PREFIX = "async function __xanosdk_lambda() {\n";
+function installNodeLambdaChecks() {
+  installLambdaFreeReads(freeReads);
+  const esbuild = loadEsbuild();
+  if (esbuild === void 0) return;
+  installLambdaSyntaxCheck((body) => {
+    try {
+      esbuild.transformSync(`${PREFIX}${body}
+}`, { loader: "ts" });
+      return void 0;
+    } catch (err) {
+      const first = err.errors?.[0];
+      if (first?.location == null || typeof first.text !== "string") return void 0;
+      const lines = body.split("\n");
+      const line = (first.location.line ?? 2) - 1;
+      const past = line > lines.length;
+      return {
+        line: past ? lines.length : Math.max(line, 1),
+        column: past ? (lines[lines.length - 1] ?? "").length + 1 : (first.location.column ?? 0) + 1,
+        message: first.text,
+        lineText: past ? lines[lines.length - 1] ?? "" : first.location.lineText ?? ""
+      };
+    }
+  });
+}
+
+// src/emit/bundle-input.ts
+import { existsSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+function assertBundleInput(args, target) {
+  if (args.bundle === void 0 && args.file === void 0) throw missingArgument("file", target);
+  if (args.bundle === void 0) return;
+  if (args.file !== void 0) {
+    throw new UsageError(`Pass either an entry <file> or --bundle <path>, not both.`, { hintFor: target });
+  }
+}
+function assertEntryFile(args) {
+  if (args.bundle === void 0 && args.file !== void 0) assertEntryExists(args.file);
+}
+function assertBundleFile(args, target, consequence) {
+  if (args.bundle === void 0) return;
+  const tail = `${consequence === void 0 ? "" : ` ${consequence}`} Pass the path of a bundle \`xanosdk export <entry> --out <path>\` wrote.`;
+  const typed = args.bundlePositional === true ? `"${args.bundle}"` : `\`--bundle ${args.bundle}\``;
+  if (!existsSync(args.bundle) || !statSync2(args.bundle).isFile()) {
+    const Refusal = existsSync(args.bundle) ? UsageError : LocalFileNotFoundError;
+    throw new Refusal(`${typed} ${existsSync(args.bundle) ? "is not a file" : "does not exist"}.${tail}`, {
+      hintFor: target
+    });
+  }
+  const text = readFileSync2(args.bundle, "utf8");
+  const why = bundleTextProblem(text);
+  if (why !== void 0) throw new UsageError(`${typed} is not a bundle: ${why}.${tail}`, { hintFor: target });
+  const bad = target.command === "workspace" ? [] : bundleEnvNames(text).filter((n) => !isRepresentableName(n));
+  if (bad.length > 0) {
+    const one = bad.length === 1;
+    throw new UsageError(
+      `${typed} sets ${bad.map((n) => `"${safeNames([n])}"`).join(", ")} in its env, which ${one ? "is not a usable env var name" : "are not usable env var names"}. ${envNameRule()} ${consequence === void 0 ? "" : `${consequence} `}Rename ${one ? "it" : "them"} in the source's \`workspaceConfig({ env })\` and \`xano/.env\`, and export the bundle again.`,
+      { hintFor: target }
+    );
+  }
+  const unread = target.command === "workspace" ? void 0 : uncompiledBundleProblem(text);
+  if (unread !== void 0) {
+    throw new UsageError(
+      `${typed} ${unread}, so it would land them empty. It was built in code without the Node compile (\`export()\` / \`emitBundle()\`). ${consequence === void 0 ? "" : `${consequence} `}Write it with \`xanosdk export <entry> --out <path>\` or \`writeBundle(app, path)\` from \`@xano/sdk/node\`, or deploy the entry itself.`,
+      { hintFor: target }
+    );
+  }
+}
+function uncompiledBundleProblem(text) {
+  let payload;
+  let knowledgeRead;
+  try {
+    const parsed = JSON.parse(text);
+    payload = parsed.payload ?? {};
+    knowledgeRead = parsed.knowledge_read === true;
+  } catch {
+    return void 0;
+  }
+  const pending = HOSTED_ICON_KINDS.flatMap(
+    (kind) => (Array.isArray(payload[kind]) ? payload[kind] : []).filter((row) => Array.isArray(row?.icons) && row.icons.some((icon) => String(icon?.src).startsWith(`${HOSTED_FILE_SCHEME}pending/`))).map((row) => `${kind} "${String(row.name ?? "")}"`)
+  );
+  if (pending.length > 0) return `has unresolved hostedFile() icons (${pending.join(", ")})`;
+  if (!knowledgeRead && knowledgeBodiesAllEmpty(payload)) {
+    const knowledge = payload.knowledge;
+    const names = knowledge.map((k) => `"${String(k?.name ?? "")}"`).join(", ");
+    return `carries no markdown body for its knowledge (${names})`;
+  }
+  return void 0;
+}
+function bundleEnvNames(text) {
+  try {
+    const env = JSON.parse(text).payload?.env;
+    if (!Array.isArray(env)) return [];
+    return env.flatMap((e) => e !== null && typeof e === "object" && typeof e.name === "string" ? [e.name] : []);
+  } catch {
+    return [];
+  }
+}
+var BUNDLE_ENVELOPE = [
+  ["app", "string"],
+  ["payload", "object"]
+];
+function bundleTextProblem(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    return `it is not valid JSON (${err.message})`;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return "it is JSON, but not an object";
+  const record = parsed;
+  const missing = BUNDLE_ENVELOPE.filter(([key, type]) => {
+    const value = record[key];
+    return type === "object" ? value === null || typeof value !== "object" || Array.isArray(value) : typeof value !== "string";
+  }).map(([key]) => `\`${key}\``);
+  if (missing.length === 0) return void 0;
+  const list = missing.length === 1 ? missing[0] : `${missing.slice(0, -1).join(", ")} and ${missing.at(-1)}`;
+  return `it is a JSON object with no ${list} (every bundle carries \`app\`, \`version\`, \`type\`, \`payload\` and \`sig\`)`;
+}
+function assertValueFiles(args, target) {
+  for (const [flag, path] of [
+    ["--backend-env-file", args.envFile],
+    ["--secrets-file", args.secretsFile]
+  ]) {
+    if (path === void 0) continue;
+    if (existsSync(path) && statSync2(path).isFile()) continue;
+    throw new (existsSync(path) ? UsageError : LocalFileNotFoundError)(
+      `\`${flag} ${path}\` ${existsSync(path) ? "is not a file" : "does not exist"}. Check the path, and make sure the file is present wherever this runs (a CI secret mounted at deploy time, not a file committed to the repo).`,
+      { hintFor: target }
+    );
+  }
+}
+function refuseValueFlagsBesideBundle(args, target) {
+  if (args.bundle === void 0) return;
+  refuseCompileValueFlags(
+    args,
+    args.bundle,
+    "it is already compiled, and its env values and documentation tokens are the ones the `xanosdk export` that wrote it resolved. Pass them to that export" + // `preflight` tears its environment down, so there is no afterwards.
+    (target.command === "deploy" && compileValueFlagKinds(args).env ? `, or change an env var on the target afterwards with \`xanosdk env set NAME${args.to === void 0 ? "" : ` --to ${shellQuote(args.to)}`}${contextFlags()}\`.` : "."),
+    target
+  );
+}
+function compileValueFlagKinds(args) {
+  return {
+    env: Object.keys(args.envVars).length > 0 || args.envFile !== void 0 || args.allowEmptyEnv.length > 0,
+    docs: Object.keys(args.docTokens).length > 0 || args.secretsFile !== void 0 || args.allowEmptyDocToken.length > 0
+  };
+}
+var DOC_TOKEN_REMEDY = "A documentation token is compiled into the bundle \u2014 deploy the project's entry file with `--doc-token` (or its value in `xano/.secrets.json`) to set one.";
+function compileValueFlagsPassed(args) {
+  return [
+    Object.keys(args.envVars).length > 0 ? "--env-var" : void 0,
+    args.envFile !== void 0 ? "--backend-env-file" : void 0,
+    args.allowEmptyEnv.length > 0 ? "--allow-empty-env" : void 0,
+    args.allowEmptyDocToken.length > 0 ? "--allow-empty-doc-token" : void 0,
+    args.secretsFile !== void 0 ? "--secrets-file" : void 0,
+    Object.keys(args.docTokens).length > 0 ? "--doc-token" : void 0
+  ].filter((f) => f !== void 0);
+}
+function refuseCompileValueFlags(args, input, why, target) {
+  const passed = compileValueFlagsPassed(args);
+  if (passed.length === 0) return;
+  const list = passed.length === 1 ? passed[0] : `${passed.slice(0, -1).join(", ")} and ${passed.at(-1)}`;
+  throw new UsageError(
+    `${list} ${passed.length === 1 ? "applies" : "apply"} only when an entry file is compiled, and ${input} is not: ${why}`,
+    { hintFor: target }
+  );
+}
+async function loadBundleText(args, target, opts = {}) {
+  assertBundleInput(args, target);
+  assertBundleFile(args, target);
+  assertValueFiles(args, target);
+  if (args.bundle !== void 0) {
+    return { bundle: readFileSync2(args.bundle, "utf8"), source: args.bundle, content: [], files: [], nonPublicSeedValues: [] };
+  }
+  if (args.file !== void 0) {
+    const { bundle, bundleObject, content, files, nonPublicSeedValues, commitLock, classifiedLock, warnLockOrphans, warnOrphansUncommitted } = await compileBundle(args, {
+      seed: opts.withSeed,
+      deferLockWrite: opts.deferLockWrite,
+      deferOrphanWarning: opts.deferOrphanWarning
+    });
+    return {
+      bundle,
+      bundleObject,
+      source: args.file,
+      content,
+      files,
+      nonPublicSeedValues,
+      ...commitLock !== void 0 ? { commitLock } : {},
+      ...classifiedLock !== void 0 ? { classifiedLock } : {},
+      ...warnLockOrphans !== void 0 ? { warnLockOrphans } : {},
+      ...warnOrphansUncommitted !== void 0 ? { warnOrphansUncommitted } : {}
+    };
+  }
+  throw missingArgument("file", target);
+}
+
+// src/emit/cli.ts
+installNodeLambdaChecks();
+function wholeNumber(raw) {
+  return raw !== void 0 && /^-?\d{1,15}$/.test(raw) ? Number(raw) : void 0;
+}
+function parsePort(raw) {
+  const n = wholeNumber(raw);
+  if (n === void 0 || n < 0 || n > 65535) {
+    throw new UsageError(`--port must be an integer 0-65535 (got "${raw ?? ""}").`, { hintFor: { command: "login" } });
+  }
+  return n;
+}
+var NOUN_COMMANDS = /* @__PURE__ */ new Set([
+  "profile",
+  "env",
+  "secrets",
+  "ephemeral",
+  "local-engine",
+  "workspace",
+  "marketplace",
+  "test",
+  "release",
+  "tenant"
+]);
+function helpTargetFor(command, subcommand) {
+  if (command === void 0 || !isCommand(command)) return void 0;
+  return subcommand !== void 0 && getSubcommand(command, subcommand) !== void 0 ? { command, subcommand } : { command };
+}
+function selectorValueMissing(key, spelling, command, subcommand) {
+  const slot = backendSlotForFlag(command, subcommand, key);
+  if (slot !== void 0) return slotValueMissing(slot);
+  const noun = key === "to" ? "a destination" : key === "from" ? "a source" : "a backend";
+  return new UsageError(`${spelling} expects ${noun}.`, { helpFor: helpTargetFor(command, subcommand) });
+}
+function throwValueMissing(spelling, command, subcommand, attachedEmpty = false) {
+  const spec = Object.values(FLAGS).find((f) => f.spec.split(/[\s,=[]+/).includes(spelling))?.spec;
+  const placeholder = spec?.match(/<[^>]*>/)?.[0] ?? "a value";
+  const long = spec?.split(/[\s,=[]+/)[0] ?? spelling;
+  throw new UsageError(
+    // `--config=` WAS the attached form, so pointing at it read as the fix it
+    // already was. It is an empty value, and is said to be one.
+    attachedEmpty ? `\`${spelling}=\` gives \`${spelling}\` an empty value \u2014 it expects ${placeholder}: \`${long}=${placeholder}\`.` : `\`${spelling}\` expects ${placeholder}, and none was given. A value that starts with \`-\` goes attached: \`${long}=${placeholder}\`.`,
+    { helpFor: helpTargetFor(command, subcommand) }
+  );
+}
+function expandShortAttached(arg) {
+  const m = /^(-[A-Za-z])=([\s\S]*)$/.exec(arg);
+  if (m === null) return arg;
+  const [, short, value] = m;
+  const spec = Object.values(FLAGS).find((f) => f.spec.split(/[\s,=[]+/).includes(short))?.spec;
+  if (spec === void 0 || !/<[^>]*>/.test(spec)) return arg;
+  return `${spec.split(/[\s,=[]+/)[0]}=${value}`;
+}
+var SCOPED_FLAG_SPELLINGS = new Map(
+  Object.keys(FLAGS).filter((key) => !GLOBAL_FLAGS.includes(key)).flatMap(
+    (key) => FLAGS[key].spec.split(/[\s,=[]+/).filter((token) => /^--?[a-z]/.test(token)).map((token) => [token, key])
+  )
+);
+function maxPositionals(args) {
+  if (args === void 0) return 0;
+  return args.some((a) => a.variadic === true) ? Number.POSITIVE_INFINITY : args.length;
+}
+var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function envNameRule() {
+  return "A name is letters, digits and `_`, and does not start with a digit (e.g. STRIPE_KEY).";
+}
+function quotedNames(names) {
+  return names.map((n) => `"${safeNames([n])}"`).join(", ");
+}
+function refuseReservedKey(flag, key) {
+  if (!RESERVED_OBJECT_KEYS.has(key)) return;
+  throw new Error(
+    `${flag} KEY cannot be \`${key}\` \u2014 \`__proto__\`, \`constructor\` and \`prototype\` are reserved JavaScript object keys, not names a value can be stored under. Choose another name.`
+  );
+}
+function positionalBudget(command, subcommand, positionals) {
+  const spec = getCommand(command);
+  if (spec === void 0) return void 0;
+  if (spec.subcommands === void 0) {
+    return { max: maxPositionals(spec.args), given: positionals, offset: 0, target: { command } };
+  }
+  const offset = command === "lock" ? 1 : 0;
+  const verb = offset === 1 ? positionals[0] : subcommand;
+  if (verb === void 0) return void 0;
+  const sub = getSubcommand(command, verb);
+  if (sub === void 0) return void 0;
+  return {
+    max: maxPositionals(sub.args),
+    given: positionals.slice(offset),
+    offset,
+    target: { command, subcommand: verb }
+  };
+}
+var NAMING_FLAGS = [
+  ["to", "`--to`"],
+  ["from", "`--from`"],
+  ["on", "`--on`"],
+  ["release", "`--release`"],
+  ["name", "`--name`"],
+  ["branch", "`--branch`"],
+  ["expectLive", "`--expect-live`"],
+  ["backupBranch", "`--backup-branch`"]
+];
+function assertNamingFlags(args) {
+  for (const [key, flag] of NAMING_FLAGS) {
+    const value = args[key];
+    if (typeof value === "string") assertOneName(value, `the ${flag} value`, { args });
+  }
+}
+function parseArgs(argv) {
+  const [command, ...afterCommand] = argv;
+  let subcommand;
+  let rest = afterCommand;
+  if (command !== void 0 && NOUN_COMMANDS.has(command)) {
+    subcommand = afterCommand[0];
+    rest = afterCommand.slice(1);
+  }
+  let out;
+  let lock = false;
+  let lockPath;
+  let noLock = false;
+  let entryPath;
+  let frozenLock = false;
+  let allowLockOrphans = false;
+  let strict = false;
+  let yes = false;
+  let check = false;
+  let bundle;
+  let reset = false;
+  let keepData = false;
+  let on;
+  let kind;
+  let concurrency;
+  let test = false;
+  let expiresHours;
+  let staticDir;
+  let to;
+  let localEngine = false;
+  let localEngineUrl;
+  let engineVersion;
+  let description;
+  let release;
+  let staticHost;
+  let staticRouting;
+  const staticEnv = /* @__PURE__ */ Object.create(null);
+  const envVars = /* @__PURE__ */ Object.create(null);
+  let envFile;
+  const allowEmptyEnv = [];
+  const allowEmptyDocToken = [];
+  const docTokens = /* @__PURE__ */ Object.create(null);
+  let secretsFile;
+  let backendDir;
+  let noSecrets = false;
+  let authHost;
+  let authFile;
+  let all = false;
+  let workspaceId;
+  let profile;
+  let profileSeen = false;
+  let useLocal = false;
+  let paste = false;
+  let allWorkspaces = false;
+  let guest = false;
+  let urlOnly = false;
+  let prompt = false;
+  let port;
+  let scope;
+  let runtime = false;
+  let capture = false;
+  let legacyRuntime = false;
+  let verbose = false;
+  let instance;
+  let format;
+  let formatRaw;
+  let path;
+  let name;
+  let noAgentsMd = false;
+  let aiSeen = false;
+  const marketplace = [];
+  let from;
+  let framework;
+  let theme;
+  let radius;
+  let dark;
+  let font;
+  let fontMono;
+  let fontHeading;
+  let icons;
+  let force = false;
+  let noInstall = false;
+  let skipLiveness = false;
+  let skipRoundtrip = false;
+  let identityOnly = false;
+  let requireMicroservices = false;
+  let report;
+  let noDevEnv = false;
+  let dryRun = false;
+  let prune = false;
+  let resetData = false;
+  let seed = false;
+  let table;
+  let write = false;
+  let seedTableGuids;
+  let replace = false;
+  let branch;
+  let setLive = false;
+  let expectLive;
+  let toProfile;
+  let allowSharedSchemaChanges = false;
+  let allowBranchDeletion = false;
+  let backupBranch;
+  let emit2;
+  let exportName;
+  let json = false;
+  let noRefresh = false;
+  let open = false;
+  const positionals = [];
+  const positionalAt = [];
+  const unknownFlags = [];
+  const deferUnknown = command !== void 0 && (getCommand(command)?.deferUnknownFlags === true || subcommand !== void 0 && getSubcommand(command, subcommand)?.deferUnknownFlags === true);
+  let i = 0;
+  const valueAfter = () => {
+    const next = rest[i + 1];
+    if (next === void 0 || next.startsWith("-") && next !== "-") return void 0;
+    i += 1;
+    return next;
+  };
+  const numberAfter = () => /^-\d/.test(rest[i + 1] ?? "") ? rest[++i] : valueAfter();
+  const requireValue = (spelling) => valueAfter() ?? throwValueMissing(spelling, command, subcommand);
+  const attachedValue = (arg, prefix) => {
+    const value = arg.slice(prefix.length);
+    return value !== "" ? value : throwValueMissing(prefix.slice(0, -1), command, subcommand, true);
+  };
+  const spelled = /* @__PURE__ */ new Map();
+  let optionsEnded = false;
+  for (; i < rest.length; i++) {
+    if (optionsEnded || rest[i] === "--") {
+      if (optionsEnded) {
+        positionals.push(rest[i]);
+        positionalAt.push(i);
+      }
+      optionsEnded = true;
+      continue;
+    }
+    const arg = expandShortAttached(rest[i]);
+    const spelling = arg.split("=", 1)[0];
+    const key = SCOPED_FLAG_SPELLINGS.get(spelling);
+    if (key !== void 0 && !spelled.has(key)) spelled.set(key, spelling);
+    if (arg === "--out" || arg === "-o") {
+      out = requireValue(arg);
+    } else if (arg.startsWith("--out=")) {
+      out = attachedValue(arg, "--out=");
+    } else if (arg === "--export") {
+      exportName = requireValue(arg);
+    } else if (arg.startsWith("--export=")) {
+      exportName = attachedValue(arg, "--export=");
+    } else if (arg === "--emit") {
+      emit2 = requireValue(arg);
+    } else if (arg.startsWith("--emit=")) {
+      emit2 = attachedValue(arg, "--emit=");
+    } else if (arg === "--no-lock") {
+      noLock = true;
+    } else if (arg === "--lock") {
+      lock = true;
+    } else if (arg.startsWith("--lock=")) {
+      lock = true;
+      lockPath = arg.slice("--lock=".length);
+    } else if (arg === "--entry") {
+      entryPath = requireValue(arg);
+    } else if (arg.startsWith("--entry=")) {
+      entryPath = attachedValue(arg, "--entry=");
+    } else if (arg === "--frozen-lock") {
+      frozenLock = true;
+    } else if (arg === "--allow-lock-orphans") {
+      allowLockOrphans = true;
+    } else if (arg === "--strict") {
+      strict = true;
+    } else if (arg === "--yes" || arg === "-y") {
+      yes = true;
+    } else if (arg === "--check") {
+      check = true;
+    } else if (arg === "--bundle") {
+      bundle = requireValue(arg);
+    } else if (arg.startsWith("--bundle=")) {
+      bundle = attachedValue(arg, "--bundle=");
+    } else if (arg === "--reset") {
+      reset = true;
+    } else if (arg === "--keep-data") {
+      keepData = true;
+    } else if (arg === "--env" || arg.startsWith("--env=")) {
+      throw new UsageError(
+        "`--env` was renamed `--on` on `test`; other commands name a backend with `--to`, `--from`, or a positional.",
+        { helpFor: helpTargetFor(command, subcommand) }
+      );
+    } else if (arg === "--on" || arg.startsWith("--on=")) {
+      const value = arg === "--on" ? valueAfter() : arg.slice("--on=".length);
+      if (value === void 0 || value === "") throw selectorValueMissing("on", "--on", command, subcommand);
+      on = value;
+    } else if (arg === "--kind") {
+      kind = parseKind(valueAfter());
+    } else if (arg.startsWith("--kind=")) {
+      kind = parseKind(arg.slice("--kind=".length));
+    } else if (arg === "--concurrency") {
+      concurrency = parseConcurrency(numberAfter());
+    } else if (arg.startsWith("--concurrency=")) {
+      concurrency = parseConcurrency(arg.slice("--concurrency=".length));
+    } else if (arg === "--test") {
+      test = true;
+    } else if (arg === "--expires-hours") {
+      expiresHours = parseExpiresHours(numberAfter());
+    } else if (arg.startsWith("--expires-hours=")) {
+      expiresHours = parseExpiresHours(arg.slice("--expires-hours=".length));
+    } else if (arg === "--static-env" || arg.startsWith("--static-env=")) {
+      const kv = arg === "--static-env" ? valueAfter() : arg.slice("--static-env=".length);
+      const eq = kv?.indexOf("=") ?? -1;
+      if (kv === void 0 || eq <= 0) {
+        throw new Error(`--static-env expects KEY=VALUE (got "${kv ?? ""}").`);
+      }
+      const key2 = kv.slice(0, eq);
+      if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key2)) {
+        throw new Error(
+          `--static-env KEY must be a JavaScript identifier \u2014 letters, digits, \`_\` or \`$\`, not starting with a digit \u2014 because it is served as \`window.<KEY>\` (got ${JSON.stringify(key2)}).`
+        );
+      }
+      refuseReservedKey("--static-env", key2);
+      staticEnv[key2] = kv.slice(eq + 1);
+    } else if (arg === "--env-var" || arg.startsWith("--env-var=")) {
+      const kv = arg === "--env-var" ? valueAfter() : arg.slice("--env-var=".length);
+      const eq = kv?.indexOf("=") ?? -1;
+      if (kv === void 0 || eq <= 0) {
+        const got = eq === 0 ? "an empty name" : `"${kv ?? ""}"`;
+        throw new Error(
+          `--env-var expects KEY=VALUE (got ${got}). It sets a BACKEND workspace variable the engine reads with env("NAME"); for public frontend config use \`deploy --static-env\`, and to choose which backend a command acts on use its selector (\`--to\`, \`--from\`, \`--on\`, or its positional).`
+        );
+      }
+      refuseReservedKey("--env-var", kv.slice(0, eq));
+      if (!isRepresentableName(kv.slice(0, eq))) {
+        throw new Error(`--env-var: ${quotedNames([kv.slice(0, eq)])} is not a usable env var name. ${envNameRule()}`);
+      }
+      if (Object.hasOwn(envVars, kv.slice(0, eq))) {
+        throw new UsageError(
+          `--env-var names ${quotedNames([kv.slice(0, eq)])} more than once. Give each name once \u2014 which of the values was meant cannot be guessed.`,
+          { hintFor: helpTargetFor(command, subcommand) }
+        );
+      }
+      envVars[kv.slice(0, eq)] = kv.slice(eq + 1);
+    } else if (arg === "--env-file" || arg.startsWith("--env-file=")) {
+      throw new UsageError(
+        "`--env-file` was renamed `--backend-env-file`: Node itself claims `--env-file` and loads that file into the CLI's own environment before the CLI runs.",
+        // The message names the replacement; a pointer, not the whole block.
+        { hintFor: helpTargetFor(command, subcommand) }
+      );
+    } else if (arg === "--backend-env-file" || arg.startsWith("--backend-env-file=")) {
+      const value = arg === "--backend-env-file" ? valueAfter() : arg.slice("--backend-env-file=".length);
+      if (value === void 0 || value === "") {
+        throw new Error(
+          "--backend-env-file expects a path (e.g. `--backend-env-file ci.env`). It REPLACES the default xano/.env for this run."
+        );
+      }
+      envFile = value;
+    } else if (arg === "--allow-empty-env" || arg.startsWith("--allow-empty-env=")) {
+      const value = arg.startsWith("--allow-empty-env=") ? arg.slice("--allow-empty-env=".length) : "";
+      const names = value.split(",").map((n) => n.trim()).filter((n) => n !== "");
+      if (names.length === 0) {
+        throw new Error(
+          "--allow-empty-env expects the NAMES it may clear (e.g. `--allow-empty-env=STRIPE_KEY,SENTRY_DSN`). There is deliberately no bare form: it would also clear whatever names the backend gains later."
+        );
+      }
+      allowEmptyEnv.push(...names);
+    } else if (arg === "--allow-empty-doc-token" || arg.startsWith("--allow-empty-doc-token=")) {
+      const value = (arg.startsWith("--allow-empty-doc-token=") ? arg.slice("--allow-empty-doc-token=".length) : "").trim();
+      if (value === "") {
+        throw new Error(
+          '--allow-empty-doc-token expects the SCOPE it may clear \u2014 `workspace`, or an API group\'s name (e.g. `--allow-empty-doc-token="Public API"`). Repeat the flag for more than one. There is deliberately no bare form: it would also clear the gate on whatever doc sites the workspace gains later.'
+        );
+      }
+      allowEmptyDocToken.push(value);
+    } else if (arg === "--doc-token" || arg.startsWith("--doc-token=")) {
+      const pair = arg === "--doc-token" ? valueAfter() : arg.slice("--doc-token=".length);
+      const eq = pair === void 0 ? -1 : pair.indexOf("=");
+      if (pair === void 0 || eq <= 0 || pair.slice(eq + 1) === "") {
+        throw new Error(
+          '--doc-token expects `<scope>=<value>` \u2014 `workspace=\u2026`, or an API group\'s name (e.g. `--doc-token "Public API=sk_\u2026"`). Repeat the flag for more than one. An empty value is refused: to clear a gate on purpose, say so with `--allow-empty-doc-token="<scope>"`. Prefer `--secrets-file <path>` for a real value: one here is visible in shell history, in the process list, and in any CI log that echoes the command.'
+        );
+      }
+      docTokens[pair.slice(0, eq).trim()] = pair.slice(eq + 1);
+    } else if (arg === "--no-secrets") {
+      noSecrets = true;
+    } else if (arg === "--secrets-file" || arg.startsWith("--secrets-file=")) {
+      const value = arg === "--secrets-file" ? valueAfter() : arg.slice("--secrets-file=".length);
+      if (value === void 0 || value === "") {
+        throw new Error("--secrets-file expects a path to a documentation-token file.");
+      }
+      secretsFile = value;
+    } else if (arg === "--backend-dir" || arg.startsWith("--backend-dir=")) {
+      const value = arg === "--backend-dir" ? valueAfter() : arg.slice("--backend-dir=".length);
+      if (value === void 0 || value === "") {
+        throw new Error("--backend-dir expects the path of a backend directory inside this project.");
+      }
+      backendDir = value;
+    } else if (arg === "--to" || arg.startsWith("--to=")) {
+      const value = arg === "--to" ? valueAfter() : arg.slice("--to=".length);
+      if (value === void 0 || value === "") throw selectorValueMissing("to", "--to", command, subcommand);
+      to = value;
+    } else if (arg === "--local-engine" || arg.startsWith("--local-engine=")) {
+      if (command === "env" && (subcommand === "set" || subcommand === "unset")) {
+        throw new UsageError("`--local-engine` here is `--to local-engine`.", {
+          helpFor: helpTargetFor(command, subcommand)
+        });
+      }
+      localEngine = true;
+      if (arg.startsWith("--local-engine=")) {
+        const value = arg.slice("--local-engine=".length);
+        if (value === "") {
+          throw new UsageError(
+            "--local-engine= expects an engine version (v0.1.5), a URL to fetch the engine from, or the path to an engine archive on this machine."
+          );
+        }
+        localEngineUrl = value;
+      } else if (/^https?:\/\//.test(rest[i + 1] ?? "") || /\.(tar\.gz|tgz)$/i.test(rest[i + 1] ?? "") || /^v?\d+\.\d+\.\d+$/.test(rest[i + 1] ?? "")) {
+        localEngineUrl = rest[++i];
+      }
+    } else if (arg === "--description" || arg.startsWith("--description=")) {
+      const value = arg === "--description" ? valueAfter() : arg.slice("--description=".length);
+      if (value === void 0 || value === "") {
+        throw new Error('--description expects text (e.g. `--description "what shipped"`).');
+      }
+      description = value;
+    } else if (arg === "--release" || arg.startsWith("--release=")) {
+      const value = arg === "--release" ? valueAfter() : arg.slice("--release=".length);
+      if (value === void 0 || value === "") {
+        throw new Error("--release expects a release name (`xanosdk release list` shows them).");
+      }
+      release = value;
+    } else if (arg === "--static-host") {
+      staticHost = requireValue(arg);
+    } else if (arg.startsWith("--static-host=")) {
+      staticHost = attachedValue(arg, "--static-host=");
+    } else if (arg === "--static-routing" || arg.startsWith("--static-routing=")) {
+      const v = arg === "--static-routing" ? valueAfter() : arg.slice("--static-routing=".length);
+      if (v !== "spa" && v !== "multipage") {
+        throw new Error(`--static-routing expects "spa" or "multipage" (got "${v ?? ""}").`);
+      }
+      staticRouting = v;
+    } else if (arg === "--static") {
+      staticDir = requireValue(arg);
+    } else if (arg.startsWith("--static=")) {
+      staticDir = attachedValue(arg, "--static=");
+    } else if (arg === "--origin") {
+      authHost = requireValue(arg);
+    } else if (arg.startsWith("--origin=")) {
+      authHost = attachedValue(arg, "--origin=");
+    } else if (arg === "--config") {
+      authFile = expandHome(requireValue(arg));
+    } else if (arg.startsWith("--config=")) {
+      authFile = expandHome(attachedValue(arg, "--config="));
+    } else if (arg === "--local") {
+      useLocal = true;
+    } else if (arg === "--paste") {
+      paste = true;
+    } else if (arg === "--version" || arg.startsWith("--version=")) {
+      const value = arg === "--version" ? valueAfter() : arg.slice("--version=".length);
+      if (value === void 0 || value === "" || value.startsWith("-")) {
+        throw new UsageError(`--version expects an engine version, like \`--version v0.1.5\`.`, {
+          helpFor: helpTargetFor(command, subcommand)
+        });
+      }
+      engineVersion = value;
+    } else if (arg === "--all") {
+      all = true;
+    } else if (arg === "--all-workspaces") {
+      allWorkspaces = true;
+    } else if (arg === "--guest" || arg === "-g") {
+      guest = true;
+    } else if (arg === "--url-only" || arg === "-u") {
+      urlOnly = true;
+    } else if (arg === "--prompt") {
+      prompt = true;
+    } else if (arg === "--port") {
+      port = parsePort(numberAfter());
+    } else if (arg.startsWith("--port=")) {
+      port = parsePort(arg.slice("--port=".length));
+    } else if (arg === "--scope") {
+      scope = requireValue(arg);
+    } else if (arg.startsWith("--scope=")) {
+      scope = attachedValue(arg, "--scope=");
+    } else if (arg === "--runtime") {
+      runtime = true;
+    } else if (arg === "--capture") {
+      capture = true;
+    } else if (arg === "--legacy-runtime") {
+      legacyRuntime = true;
+    } else if (arg === "--verbose") {
+      verbose = true;
+    } else if (arg === "--instance") {
+      instance = requireValue(arg);
+    } else if (arg.startsWith("--instance=")) {
+      instance = attachedValue(arg, "--instance=");
+    } else if (arg === "--workspace-id") {
+      workspaceId = requireValue(arg);
+    } else if (arg.startsWith("--workspace-id=")) {
+      workspaceId = attachedValue(arg, "--workspace-id=");
+    } else if (arg === "--format" || arg.startsWith("--format=")) {
+      const value = arg === "--format" ? valueAfter() : arg.slice("--format=".length);
+      formatRaw = { value };
+    } else if (arg === "--path") {
+      path = requireValue(arg);
+    } else if (arg.startsWith("--path=")) {
+      path = attachedValue(arg, "--path=");
+    } else if (arg === "--report") {
+      report = requireValue(arg);
+    } else if (arg.startsWith("--report=")) {
+      report = attachedValue(arg, "--report=");
+    } else if (arg === "--name") {
+      name = requireValue(arg);
+    } else if (arg.startsWith("--name=")) {
+      name = attachedValue(arg, "--name=");
+    } else if (arg === "--framework") {
+      framework = requireValue(arg);
+    } else if (arg.startsWith("--framework=")) {
+      framework = attachedValue(arg, "--framework=");
+    } else if (arg === "--theme") {
+      theme = requireValue(arg);
+    } else if (arg.startsWith("--theme=")) {
+      theme = attachedValue(arg, "--theme=");
+    } else if (arg === "--radius") {
+      radius = requireValue(arg);
+    } else if (arg.startsWith("--radius=")) {
+      radius = attachedValue(arg, "--radius=");
+    } else if (arg === "--dark") {
+      dark = requireValue(arg);
+    } else if (arg.startsWith("--dark=")) {
+      dark = attachedValue(arg, "--dark=");
+    } else if (arg === "--font-mono") {
+      fontMono = requireValue(arg);
+    } else if (arg.startsWith("--font-mono=")) {
+      fontMono = attachedValue(arg, "--font-mono=");
+    } else if (arg === "--font-heading") {
+      fontHeading = requireValue(arg);
+    } else if (arg.startsWith("--font-heading=")) {
+      fontHeading = attachedValue(arg, "--font-heading=");
+    } else if (arg === "--font") {
+      font = requireValue(arg);
+    } else if (arg.startsWith("--font=")) {
+      font = attachedValue(arg, "--font=");
+    } else if (arg === "--icons") {
+      icons = requireValue(arg);
+    } else if (arg.startsWith("--icons=")) {
+      icons = attachedValue(arg, "--icons=");
+    } else if (arg === "--from" || arg.startsWith("--from=")) {
+      const value = arg === "--from" ? valueAfter() : arg.slice("--from=".length);
+      if (value === void 0 || value === "") throw selectorValueMissing("from", "--from", command, subcommand);
+      from = value;
+    } else if (arg === "--marketplace" || arg.startsWith("--marketplace=")) {
+      const raw = arg === "--marketplace" ? requireValue(arg) : attachedValue(arg, "--marketplace=");
+      for (const p of raw.split(",")) {
+        const pkg = p.trim();
+        if (pkg !== "") marketplace.push(pkg);
+      }
+    } else if (arg === "--no-agents-md") {
+      noAgentsMd = true;
+    } else if (arg === "--ai" || arg.startsWith("--ai=")) {
+      aiSeen = true;
+      const raw = arg === "--ai" ? requireValue(arg) : attachedValue(arg, "--ai=");
+      if (raw.split(",").some((p) => p.trim().toLowerCase() === "none")) noAgentsMd = true;
+    } else if (arg === "--force") {
+      force = true;
+    } else if (arg === "--no-install") {
+      noInstall = true;
+    } else if (arg === "--no-dev-env") {
+      noDevEnv = true;
+    } else if (arg === "--skip-liveness") {
+      skipLiveness = true;
+    } else if (arg === "--skip-roundtrip") {
+      skipRoundtrip = true;
+    } else if (arg === "--identity-only") {
+      identityOnly = true;
+    } else if (arg === "--no-verify") {
+      throw new UsageError(
+        `\`--no-verify\` was split into three flags that each name what they skip: \`--skip-liveness\` (deploy: waiting for the deploy to come up), \`--skip-roundtrip\` (init --from: the offline re-export check), and \`--identity-only\` (lock prune: loading the entry file).`,
+        { helpFor: helpTargetFor(command, subcommand) }
+      );
+    } else if (arg === "--require-microservices") {
+      requireMicroservices = true;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg === "--prune") {
+      prune = true;
+    } else if (arg === "--reset-data") {
+      resetData = true;
+    } else if (arg === "--write") {
+      write = true;
+    } else if (arg === "--table" || arg.startsWith("--table=")) {
+      const value = arg.startsWith("--table=") ? arg.slice("--table=".length) : valueAfter();
+      if (value === void 0 || value === "") {
+        throw new UsageError(`\`--table\` needs a table guid. Run \`${tablesCommand("workspace")}\` to list them.`);
+      }
+      table = [...table ?? [], value];
+    } else if (arg === "--seed") {
+      seed = true;
+    } else if (arg.startsWith("--seed=")) {
+      seed = true;
+      seedTableGuids = arg.slice("--seed=".length);
+    } else if (arg === "--replace") {
+      replace = true;
+    } else if (arg === "--branch" || arg.startsWith("--branch=")) {
+      const value = arg === "--branch" ? valueAfter() : arg.slice("--branch=".length);
+      if (value === void 0 || value === "") {
+        throw new Error("--branch expects a branch label (e.g. `--branch staging`).");
+      }
+      branch = value;
+    } else if (arg === "--set-live") {
+      setLive = true;
+    } else if (arg === "--expect-live" || arg.startsWith("--expect-live=")) {
+      const value = arg === "--expect-live" ? valueAfter() : arg.slice("--expect-live=".length);
+      if (value === void 0 || value === "" || value.startsWith("-")) {
+        throw new Error("--expect-live expects the label of the branch you expect to be live (e.g. `--expect-live main`).");
+      }
+      expectLive = value;
+    } else if (arg === "--to-profile" || arg.startsWith("--to-profile=")) {
+      const value = arg === "--to-profile" ? valueAfter() : arg.slice("--to-profile=".length);
+      if (value === void 0 || value === "" || value.startsWith("-")) {
+        throw new Error("--to-profile expects the name of a stored credential profile (e.g. `--to-profile prod`).");
+      }
+      toProfile = value;
+    } else if (arg === "--allow-shared-schema-changes") {
+      allowSharedSchemaChanges = true;
+    } else if (arg === "--allow-branch-deletion") {
+      allowBranchDeletion = true;
+    } else if (arg === "--backup-branch") {
+      backupBranch = true;
+    } else if (arg.startsWith("--backup-branch=")) {
+      const value = arg.slice("--backup-branch=".length);
+      backupBranch = value === "" ? true : value;
+    } else if (arg === "--no-refresh") {
+      noRefresh = true;
+    } else if (arg === "--json") {
+      json = true;
+    } else if (arg === "--open") {
+      open = true;
+    } else if (arg === "--profile" || arg === "-p") {
+      profileSeen = true;
+      profile = valueAfter();
+    } else if (arg.startsWith("--profile=")) {
+      profileSeen = true;
+      profile = arg.slice("--profile=".length);
+    } else if (arg === "--help" || arg === "-h") {
+      continue;
+    } else if (arg.startsWith("-") && arg !== "-") {
+      unknownFlags.push(arg);
+    } else {
+      positionals.push(arg);
+      positionalAt.push(i);
+    }
+  }
+  const secretArgs = command === "env" && subcommand === "set";
+  const moved = movedVerb(command, subcommand, positionals);
+  if (moved !== void 0) throw moved;
+  if (profileSeen && (profile === void 0 || profile === "" || profile.startsWith("-"))) {
+    throw new UsageError(
+      // `login` CREATES the profile it names: "a stored credential profile"
+      // sent its reader to a list that cannot hold it yet (E2E pass 26).
+      command === "login" ? `\`--profile\` needs the name to sign in as, e.g. \`xanosdk login --profile staging\` \u2014 a new name creates that profile, an existing one signs it in again.` : `\`--profile\` needs the name of a stored credential profile, e.g. \`--profile staging\`. Run \`xanosdk profile list\` to see what is signed in.`,
+      { helpFor: helpTargetFor(command, subcommand) }
+    );
+  }
+  if (command === "login" && unknownFlags.some((f) => f === "--token" || f.startsWith("--token="))) {
+    throw new UsageError(
+      `\`xanosdk login\` signs in through the browser and takes no token. Store a meta API token with \`xanosdk profile add <name> --instance <url> --workspace-id <id>\` \u2014 it prompts for the token, or reads it piped on stdin (\`printf %s "$TOKEN" | xanosdk profile add \u2026\`), never from a flag.`,
+      { hintFor: { command: "profile", subcommand: "add" } }
+    );
+  }
+  if (unknownFlags.length > 0 && !deferUnknown) {
+    if (secretArgs) throw envSetArgumentsRefused("flag", unknownFlags);
+    throw unknownFlag(unknownFlags, helpTargetFor(command, subcommand));
+  }
+  const shortUnknown = deferUnknown ? unknownFlags.filter((f) => !f.startsWith("--")) : [];
+  if (shortUnknown.length > 0) throw unknownFlag(shortUnknown, helpTargetFor(command, subcommand));
+  if (formatRaw !== void 0) {
+    const ref = flagRefFor(command, subcommand, "format");
+    const path2 = subcommand === void 0 ? command : `${command} ${subcommand}`;
+    if (ref === void 0) {
+      throw new UsageError(`\`xanosdk ${path2}\` takes no \`--format\` \u2014 it writes one artifact.`, {
+        helpFor: helpTargetFor(command, subcommand)
+      });
+    }
+    format = parseFormat(formatRaw.value);
+    const allowed = flagValues(ref) ?? ["json"];
+    if (!allowed.includes(format)) {
+      const hint = format === "multidoc" ? " (the engine's rendering of a deployed env: `xanosdk ephemeral export --format multidoc`)" : "";
+      throw new UsageError(
+        `\`xanosdk ${path2}\` does not render \`--format ${format}\`${hint}; it takes ${allowed.map((v) => `\`${v}\``).join(", ")}.`,
+        { helpFor: helpTargetFor(command, subcommand) }
+      );
+    }
+  }
+  const refuseUnlessDeclared = (key, spelling, why, suggestion) => {
+    if (command === void 0 || flagRefFor(command, subcommand, key) !== void 0) return;
+    const path2 = subcommand === void 0 ? command : `${command} ${subcommand}`;
+    throw new UsageError(`\`xanosdk ${path2}\` takes no \`${spelling}\` \u2014 ${why}`, {
+      helpFor: helpTargetFor(command, subcommand),
+      ...suggestion === void 0 ? {} : { suggestion }
+    });
+  };
+  if (aiSeen) refuseUnlessDeclared("ai", "--ai", "it only chooses whether `init` writes AGENTS.md.");
+  if (profileSeen && profile !== void 0) {
+    if (command !== void 0 && !isAuthenticatedCommand(command, subcommand)) {
+      const path2 = subcommand === void 0 ? command : `${command} ${subcommand}`;
+      throw new UsageError(
+        `\`xanosdk ${path2}\` takes no \`--profile\` \u2014 it reaches no Xano instance, so there is no credential for a profile to select. The commands that take it are the ones that sign in (\`deploy\`, \`pull\`, \`status\`, \`whoami\`, \`tenant\`, \`release\`, \u2026).`,
+        { hintFor: helpTargetFor(command, subcommand) }
+      );
+    }
+    if (command !== void 0 && !takesProfileFlag(command, subcommand)) {
+      throw new UsageError(
+        `\`xanosdk ${command} ${subcommand}\` takes no \`--profile\` \u2014 the profile it acts on is its <name> argument: \`xanosdk ${command} ${subcommand} <name>\`.`,
+        { hintFor: helpTargetFor(command, subcommand) }
+      );
+    }
+    assertValidProfileName(profile);
+  }
+  if (force) {
+    refuseUnlessDeclared(
+      "force",
+      "--force",
+      command !== void 0 && flagRefFor(command, subcommand, "yes") !== void 0 ? "it asks before it replaces or removes anything, and `--yes` answers that confirmation in advance." : "it overwrites nothing that already exists. A confirmation is answered in advance with `--yes`."
+    );
+  }
+  if (out !== void 0) {
+    refuseUnlessDeclared(
+      "out",
+      "--out",
+      command !== void 0 && flagRefFor(command, subcommand, "path") !== void 0 ? "its output location is `--path` (a file, a directory, or `-` for stdout)." : "it writes no file."
+    );
+  }
+  if (branch !== void 0) {
+    refuseUnlessDeclared(
+      "branch",
+      "--branch",
+      // Tables are the one thing a workspace does not keep per branch, so the
+      // table verbs get the reason that is true of them.
+      command === "workspace" && subcommand === "reset-tables" ? "tables are shared by every branch of a workspace, so a reset reaches all of them and a branch would scope nothing." : "this command does not act on a single workspace branch, so there is nothing for a label to select."
+    );
+  }
+  if (name !== void 0) {
+    refuseUnlessDeclared(
+      "name",
+      "--name",
+      "a name it needs is a positional argument, or part of the backend it names (`--on ephemeral:<name>`, `--to tenant:<name>`)."
+    );
+  }
+  if (on !== void 0) {
+    const own = selectorSpellings(command, subcommand);
+    refuseUnlessDeclared(
+      "on",
+      "--on",
+      "`--on` is `test`'s selector. " + (own.length === 0 ? "This command acts on no backend a selector names." : `This command names its backend with ${own.length === 1 ? own[0] : `${own.slice(0, -1).join(", ")} or ${own.at(-1)}`}` + (/^`--/.test(own[0]) ? `: \`${own[0].slice(1, -1)} ${on}\`.` : ".")),
+      // The flag it names, as `--json`'s `suggestion` (E2E pass 28: only the
+      // message carried it).
+      own.length > 0 && /^`--/.test(own[0]) ? own[0].slice(1, -1) : void 0
+    );
+  }
+  if (localEngine) {
+    refuseUnlessDeclared(
+      "local-engine",
+      "--local-engine",
+      "only `deploy` takes it, because only a deploy downloads, pins and starts an engine. " + // Command-aware: `publish` refuses `--to local-engine` too, so pointing
+      // it there sent the reader from one refusal to the next.
+      (command === "publish" ? "A local engine takes a frontend only through `xanosdk deploy --local-engine --static <dir>`; `publish` publishes to an ephemeral's, a tenant's or your workspace's static host (`--to`)." : "Elsewhere a local engine is a backend: `--to local-engine`, `--from local-engine`, or `local-engine` as the positional.")
+    );
+  }
+  if (guest) {
+    refuseUnlessDeclared(
+      "guest",
+      "--guest",
+      "a guest session is minted only when opening a backend's dashboard (`impersonate`)."
+    );
+  }
+  if (engineVersion !== void 0) {
+    refuseUnlessDeclared(
+      "engine-version",
+      "--version",
+      "it takes no engine version. `xanosdk --version` (as the first argument) prints the CLI's own."
+    );
+  }
+  if (all) {
+    refuseUnlessDeclared(
+      "all",
+      "--all",
+      "it acts on one thing. `xanosdk logout --all` is the one that means every stored profile."
+    );
+  }
+  if (expectLive !== void 0) {
+    const takers = "`xanosdk promote <release> --set-live --expect-live <label>` and `xanosdk workspace branch set-live <branch> --expect-live <label>` are the ones that take it.";
+    refuseUnlessDeclared(
+      "expect-live",
+      "--expect-live",
+      command === "deploy" ? `its \`--set-live\` switches live without checking what is live first. ${takers}` : `it switches no live branch, so there is no switch for the precondition to guard. ${takers}`
+    );
+  }
+  if (toProfile !== void 0) {
+    refuseUnlessDeclared(
+      "to-profile",
+      "--to-profile",
+      "it writes to the workspace its own credential is bound to. `--profile` chooses that credential; `--to-profile` names a second, destination one, and belongs to `xanosdk release transfer`."
+    );
+  }
+  if (workspaceId !== void 0) {
+    refuseUnlessDeclared(
+      "workspace-id",
+      "--workspace-id",
+      "every command acts on the workspace its credential is bound to. `--workspace-id` names the workspace a STORED meta API token addresses, and belongs to `xanosdk profile add`."
+    );
+  }
+  const commandSpec = command === void 0 ? void 0 : getCommand(command);
+  const verb = commandSpec?.subcommands === void 0 ? void 0 : command === "lock" ? positionals[0] : subcommand;
+  const declaring = commandSpec?.subcommands === void 0 ? commandSpec : verb === void 0 ? void 0 : getSubcommand(command, verb);
+  if (declaring !== void 0) {
+    for (const [key, spelling] of spelled) {
+      if (key === "format" || flagRefFor(command, verb, key) !== void 0) continue;
+      const path2 = verb === void 0 ? command : `${command} ${verb}`;
+      throw new UsageError(
+        `\`xanosdk ${path2}\` takes no \`${spelling}\` \u2014 it is not one of this command's flags, so it would change nothing.`,
+        { helpFor: helpTargetFor(command, verb) }
+      );
+    }
+  }
+  if (seedTableGuids !== void 0 && !(command === "release" && subcommand === "create")) {
+    const path2 = subcommand === void 0 ? command : `${command} ${subcommand}`;
+    throw new UsageError(
+      `\`xanosdk ${path2}\` takes the bare \`--seed\`, not \`--seed=<guids>\`. Selecting which tables' rows to carry is \`xanosdk release create <name> --seed=<guids>\`; here \`--seed\` is all-or-nothing.`,
+      { helpFor: helpTargetFor(command, subcommand) }
+    );
+  }
+  if (noLock && lockPath !== void 0) {
+    throw new Error(
+      `\`--no-lock\` and \`--lock=${lockPath}\` ask for opposite things: one builds with no lock at all, the other names the lock file to use. Drop \`--no-lock\` to build against ${lockPath}, or drop \`--lock=\` to build without a lock.`
+    );
+  }
+  if (noLock && lock) {
+    throw new Error(
+      "`--no-lock` and `--lock` are contradictory. The lock is maintained by default, so `--lock` adds nothing \u2014 drop it to keep the lock, or keep `--no-lock` alone to build without one."
+    );
+  }
+  if (noLock && frozenLock) {
+    throw new Error(
+      "`--no-lock` and `--frozen-lock` are contradictory: `--frozen-lock` asserts that the lock is read and honored unchanged, and `--no-lock` reads no lock at all. Use `--frozen-lock` alone in CI."
+    );
+  }
+  const emptyFlagged = Object.keys(envVars).filter((n) => envVars[n] === "" && !allowEmptyEnv.includes(n));
+  if (emptyFlagged.length > 0) {
+    const one = emptyFlagged.length === 1;
+    throw new UsageError(
+      `--env-var gives ${quotedNames(emptyFlagged)} an empty value, which clears what the target holds. Pass \`--allow-empty-env=${emptyFlagged.join(",")}\` if clearing ${one ? "it" : "them"} is meant, or give ${one ? "it a value" : "each a value"}.`,
+      { hintFor: helpTargetFor(command, subcommand) }
+    );
+  }
+  if (command === "export" && check) {
+    const pointless = [
+      ...out !== void 0 ? ["--out"] : [],
+      ...envFile !== void 0 ? ["--backend-env-file"] : [],
+      ...Object.keys(envVars).length > 0 ? ["--env-var"] : [],
+      ...allowEmptyEnv.length > 0 ? ["--allow-empty-env"] : [],
+      ...Object.keys(docTokens).length > 0 ? ["--doc-token"] : [],
+      ...secretsFile !== void 0 ? ["--secrets-file"] : [],
+      ...allowEmptyDocToken.length > 0 ? ["--allow-empty-doc-token"] : []
+    ];
+    if (pointless.length > 0) {
+      throw new UsageError(
+        `\`export --check\` writes no bundle, so ${pointless.map((f) => `\`${f}\``).join(", ")} ${pointless.length === 1 ? "has" : "have"} nothing to act on. Drop ${pointless.length === 1 ? "it" : "them"}, or drop \`--check\` to write the bundle.`,
+        { hintFor: { command: "export" } }
+      );
+    }
+    if (!noLock) frozenLock = true;
+  }
+  if (allowLockOrphans && !frozenLock) {
+    const path2 = subcommand === void 0 ? command : `${command} ${subcommand}`;
+    throw new UsageError(
+      `\`--allow-lock-orphans\` only relaxes \`--frozen-lock\` (or \`export --check\`, which implies it), so on its own it would change nothing. Add \`--frozen-lock\`, or drop the flag.`,
+      { hintFor: path2 === void 0 ? void 0 : { command, ...subcommand ? { subcommand } : {} } }
+    );
+  }
+  if (strict && emit2 === void 0 && (command === "routes" || command === "paths")) {
+    throw new UsageError(
+      `\`${command} --strict\` checks the file \`--emit\` names, so on its own it would change nothing. Add \`--emit <path>\` (e.g. \`--emit xano/routes.gen.ts\`), or drop the flag.`,
+      { hintFor: { command } }
+    );
+  }
+  const budget = command === void 0 ? void 0 : positionalBudget(command, subcommand, positionals);
+  if (budget !== void 0 && budget.given.length > budget.max) {
+    if (secretArgs) throw envSetArgumentsRefused("extra");
+    const longUnknown = deferUnknown ? unknownFlags.filter((f) => f.startsWith("--")) : [];
+    const typo = longUnknown.length > 0 ? unknownFlag(longUnknown, helpTargetFor(command, subcommand)) : void 0;
+    if (typo?.suggestion !== void 0) throw typo;
+    const lockValue = positionals.findIndex((_, n) => rest[(positionalAt[n] ?? 0) - 1] === "--lock");
+    const extras = lockValue >= budget.offset ? [positionals[lockValue]] : budget.given.slice(budget.max);
+    const refused = extraArguments(extras, budget.target, budget.max, lockValue >= budget.offset ? "--lock" : void 0);
+    const backend = extras.length === 1 && extras[0] !== void 0 && isKindShapedOrBare(extras[0]) ? extras[0] : void 0;
+    if (command === "test" && on === void 0 && backend !== void 0) {
+      refused.message += ` The backend is chosen with \`--on\`: \`xanosdk test ${[subcommand, ...budget.given.slice(0, budget.max)].map((t) => shellWord(t)).join(" ")} --on ${shellWord(backend)}\`.`;
+    }
+    throw refused;
+  }
+  let file = positionals[0];
+  let bundlePositional = false;
+  const fileSpec = command === void 0 ? void 0 : subcommand === void 0 ? getCommand(command) : getSubcommand(command, subcommand);
+  const firstArg = fileSpec?.args?.[0];
+  if (file !== void 0 && bundle === void 0 && /\.json$/i.test(file) && firstArg?.path === true && firstArg.satisfiedBy?.includes("bundle") === true && !isKindShaped(file)) {
+    bundle = file;
+    bundlePositional = true;
+    file = void 0;
+  }
+  const parsed = {
+    argv: [...argv],
+    command,
+    subcommand,
+    file,
+    out,
+    positionals,
+    positionalArgv: positionalAt.map((at) => at + (argv.length - rest.length)),
+    lock,
+    lockPath,
+    seedTableGuids,
+    noLock,
+    entryPath,
+    frozenLock,
+    allowLockOrphans,
+    strict,
+    yes,
+    check,
+    bundle,
+    ...bundlePositional ? { bundlePositional } : {},
+    reset,
+    keepData,
+    on,
+    kind,
+    concurrency,
+    test,
+    expiresHours,
+    static: staticDir,
+    staticHost,
+    to,
+    localEngine,
+    localEngineUrl,
+    engineVersion,
+    description,
+    release,
+    staticRouting,
+    staticEnv,
+    envVars,
+    envFile,
+    allowEmptyEnv,
+    allowEmptyDocToken,
+    docTokens,
+    secretsFile,
+    backendDir,
+    noSecrets,
+    authHost,
+    authFile,
+    all,
+    workspaceId,
+    profile,
+    local: useLocal,
+    paste,
+    allWorkspaces,
+    guest,
+    urlOnly,
+    prompt,
+    port,
+    scope,
+    runtime,
+    capture,
+    legacyRuntime,
+    verbose,
+    instance,
+    format,
+    path,
+    name,
+    noAgentsMd,
+    marketplace,
+    from,
+    force,
+    noInstall,
+    framework,
+    theme,
+    radius,
+    dark,
+    font,
+    fontMono,
+    fontHeading,
+    icons,
+    skipLiveness,
+    skipRoundtrip,
+    identityOnly,
+    requireMicroservices,
+    report,
+    noDevEnv,
+    dryRun,
+    prune,
+    resetData,
+    seed,
+    table,
+    write,
+    replace,
+    branch,
+    setLive,
+    expectLive,
+    toProfile,
+    allowSharedSchemaChanges,
+    allowBranchDeletion,
+    backupBranch,
+    emit: emit2,
+    exportName,
+    json,
+    noRefresh,
+    open,
+    unknownFlags
+  };
+  assertNamingFlags(parsed);
+  return parsed;
+}
+function onlyFlags(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (!t.startsWith("-")) return false;
+    if (SEPARATED_VALUE_SPELLINGS.has(t)) i += 1;
+  }
+  return true;
+}
+function resolveHelpRequest(argv) {
+  const asVerb = argv[0] === "help";
+  const [first, second, ...after] = argv;
+  if (first !== void 0 && first !== "init" && second === "help" && isCommand(first) && onlyFlags(after) && !existsSync2("help")) {
+    return { command: first };
+  }
+  const [third, ...rest] = after;
+  if (first !== void 0 && second !== void 0 && third === "help" && isCommand(first) && getSubcommand(first, second) !== void 0 && onlyFlags(rest) && !existsSync2("help")) {
+    return { command: first, subcommand: second };
+  }
+  if (!asVerb && !argv.some((a) => a === "--help" || a === "-h")) return void 0;
+  const tokens = (asVerb ? argv.slice(1) : argv).filter((a) => !a.startsWith("-"));
+  const command = tokens[0];
+  if (command === void 0 || !isCommand(command)) {
+    if (command === void 0) return {};
+    if (asVerb) return { unknownTopic: command };
+    return argv[0] === command && /^[a-z][a-z0-9-]*$/.test(command) ? { unknownCommand: command } : {};
+  }
+  const sub = tokens[1];
+  if (sub !== void 0 && getSubcommand(command, sub) !== void 0) return { command, subcommand: sub };
+  const source = asVerb ? argv.slice(1) : argv;
+  if (sub !== void 0 && liveSubcommandNames(command).length > 0 && source[source.indexOf(command) + 1] === sub && /^[a-z][a-z0-9-]*$/.test(sub)) {
+    return { command, unknownSubcommand: sub, positionals: tokens.slice(2) };
+  }
+  return { command };
+}
+function parseFormat(raw) {
+  if (raw === "json" || raw === "multidoc") return raw;
+  throw new UsageError(`--format must be "json" or "multidoc" (got "${raw ?? ""}").`);
+}
+function parseKind(raw) {
+  if (raw === "unit" || raw === "workflow") return raw;
+  throw new UsageError(`--kind must be "unit" or "workflow" (got "${raw ?? ""}").`);
+}
+function parseConcurrency(raw) {
+  const n = wholeNumber(raw);
+  if (n === void 0 || n < 1 || n > 32) {
+    throw new Error(`--concurrency must be a whole number from 1 to 32 (got "${raw ?? ""}").`);
+  }
+  return n;
+}
+function parseExpiresHours(raw) {
+  const n = wholeNumber(raw);
+  if (n === void 0 || n < 1 || n > 24) {
+    throw new Error(`--expires-hours must be an integer 1\u201324 (got "${raw ?? ""}").`);
+  }
+  return n;
+}
+async function importTsxApi(file) {
+  try {
+    const requireFromEntry = createRequire2(pathToFileURL2(resolve2(file)));
+    const apiPath = requireFromEntry.resolve("tsx/esm/api");
+    return await import(pathToFileURL2(apiPath).href);
+  } catch {
+    return await import("tsx/esm/api");
+  }
+}
+async function tryImportTsxApi(file) {
+  try {
+    return await importTsxApi(file);
+  } catch {
+    return void 0;
+  }
+}
+function entryIsCommonJs(file) {
+  const path = resolve2(file);
+  if (/\.mts$/.test(path)) return false;
+  if (/\.cts$/.test(path)) return true;
+  let dir = dirname2(path);
+  for (; ; ) {
+    const manifest = join2(dir, "package.json");
+    if (existsSync2(manifest)) {
+      try {
+        const pkg = JSON.parse(readFileSync3(manifest, "utf8"));
+        return pkg.type !== "module";
+      } catch {
+        return false;
+      }
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function commonJsEntryError(file, cause) {
+  return new Error(
+    `Cannot load "${file}": it is being evaluated as CommonJS, but Xano SDK workspace files are ES modules. Add \`"type": "module"\` to the nearest package.json, or rename the entry to \`.mts\`.`,
+    cause !== void 0 ? { cause } : void 0
+  );
+}
+function suggestSiblingFile(path) {
+  try {
+    return suggest(basename(path), readdirSync2(dirname2(path)));
+  } catch {
+    return void 0;
+  }
+}
+function findEntryInAncestor(file) {
+  if (isAbsolute(file)) return void 0;
+  let dir = dirname2(resolve2(file));
+  for (; ; ) {
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+    if (existsSync2(resolve2(dir, file))) return dir;
+  }
+}
+async function loadDefault(file) {
+  return (await loadModule(file)).default;
+}
+function noProjectEntryError(file, cause) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  const code = cause?.code;
+  const exportsMain = code === "ERR_PACKAGE_PATH_NOT_EXPORTED" || /No "exports" main defined/.test(message);
+  const notFound = /Cannot find (module|package) '@xano\/sdk'/.test(message);
+  if (!exportsMain && !notFound) return void 0;
+  if (!/@xano[\\/]sdk/.test(message) || hasPackageJsonAbove(file)) return void 0;
+  return new UsageError(
+    `Cannot load "${file}": there is no package.json above it, so it is not part of a project, and @xano/sdk (an ES module) cannot be resolved from it. Run xanosdk on an entry inside a project (\`xanosdk init\` makes one, and \`xanosdk generate --out <dir>\` can write into it), or add a package.json with \`"type": "module"\` beside the entry, then \`npm i @xano/sdk && npm i -D tsx\`.`
+  );
+}
+async function tsxRemedy(file) {
+  const fallback = `Install it in your project (\`npm i -D tsx\`) or precompile the file to .js first.`;
+  for (let dir = dirname2(resolve2(file)); ; dir = dirname2(dir)) {
+    const manifest = join2(dir, "package.json");
+    if (existsSync2(manifest)) {
+      let pkg;
+      try {
+        pkg = JSON.parse(readFileSync3(manifest, "utf8"));
+      } catch {
+        return fallback;
+      }
+      const declared = ["devDependencies", "dependencies"].some(
+        (block) => typeof pkg[block] === "object" && pkg[block] !== null && "tsx" in pkg[block]
+      );
+      if (!declared) return fallback;
+      const { detectPackageManager } = await import("./package-manager-PRAHUSCN.js");
+      const { inProject } = await import("./init-modules-RY7UHAOL.js");
+      return `This project's package.json declares it, but its dependencies are not installed \u2014 run \`${inProject(dir)}${detectPackageManager(dir)} install\` first.`;
+    }
+    if (dirname2(dir) === dir) return fallback;
+  }
+}
+function hasPackageJsonAbove(file) {
+  let dir = dirname2(resolve2(file));
+  for (; ; ) {
+    if (existsSync2(join2(dir, "package.json"))) return true;
+    const parent = dirname2(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function assertEntryExists(file) {
+  const path = resolve2(file);
+  if (!existsSync2(path)) {
+    const elsewhere = findEntryInAncestor(file);
+    const where = elsewhere !== void 0 ? `A relative entry resolves against the current directory (${process.cwd()}), and "${file}" does exist under ${elsewhere} \u2014 run xanosdk from there.` : `A relative entry resolves against the current directory (${process.cwd()}).`;
+    throw new LocalFileNotFoundError(
+      `Cannot find entry file "${file}" (resolved to ${path}).` + (isAbsolute(file) ? "" : `
+  ${where}`),
+      { suggestion: suggestSiblingFile(path) }
+    );
+  }
+}
+async function loadModule(file) {
+  try {
+    return await withAuthoringStacks(() => loadEntryModule(file));
+  } catch (err) {
+    throw withAuthoringSite(err, file);
+  }
+}
+async function loadEntryModule(file) {
+  const path = resolve2(file);
+  assertEntryExists(file);
+  const url = pathToFileURL2(path).href;
+  const isTypeScript = /\.[mc]?ts$/.test(file);
+  if (isTypeScript) {
+    if (entryIsCommonJs(file)) throw commonJsEntryError(file);
+    const tsx = await tryImportTsxApi(file);
+    if (tsx) {
+      const unregister = tsx.register();
+      try {
+        return await import(url);
+      } catch (err) {
+        if (err instanceof Error) void err.stack;
+        throw noProjectEntryError(file, err) ?? err;
+      } finally {
+        unregister();
+      }
+    }
+  }
+  try {
+    return await import(url);
+  } catch (err) {
+    const noProject = noProjectEntryError(file, err);
+    if (noProject !== void 0) throw noProject;
+    if (!isTypeScript) throw err;
+    const code = err?.code;
+    if (code === "ERR_UNKNOWN_FILE_EXTENSION" || code === "ERR_MODULE_NOT_FOUND") {
+      throw new Error(`Loading a TypeScript entry ("${file}") requires \`tsx\`. ${await tsxRemedy(file)}`, { cause: err });
+    }
+    if (err instanceof SyntaxError && /import statement outside a module/.test(err.message)) {
+      throw commonJsEntryError(file, err);
+    }
+    throw err;
+  }
+}
+var cachedVersion;
+function readVersion() {
+  if (cachedVersion !== void 0) return cachedVersion;
+  cachedVersion = resolveVersion();
+  return cachedVersion;
+}
+function resolveVersion() {
+  return ownPackage()?.version ?? "unknown";
+}
+function ownPackage() {
+  let dir = dirname2(fileURLToPath3(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const p = join2(dir, "package.json");
+    if (existsSync2(p)) {
+      try {
+        const pkg = JSON.parse(readFileSync3(p, "utf8"));
+        if (pkg.name === "@xano/sdk" && typeof pkg.version === "string") return { root: dir, version: pkg.version };
+      } catch {
+      }
+    }
+    const up = dirname2(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return void 0;
+}
+async function emitterFor(file) {
+  let manifestPath;
+  try {
+    manifestPath = createRequire2(pathToFileURL2(resolve2(file))).resolve("@xano/sdk/package.json");
+  } catch {
+    return emit;
+  }
+  const root = realpathSync(dirname2(manifestPath));
+  const own = ownPackage();
+  if (own === void 0 || root === realpathSync(own.root)) return emit;
+  try {
+    const pkg = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    const dot = pkg.exports?.["."];
+    const entry = (typeof dot === "string" ? dot : dot?.import) ?? pkg.main;
+    if (entry === void 0) return emit;
+    const mod = await import(pathToFileURL2(join2(root, entry)).href);
+    return typeof mod.emit === "function" ? mod.emit : emit;
+  } catch {
+    return emit;
+  }
+}
+function printHelp() {
+  process.stdout.write(terminalText(withCliPrefix(renderGlobalHelp(stdoutStyle(), readVersion()))));
+}
+function isWithin(path, dir) {
+  const rel = relative3(dir, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function orphanFixUps(key, entryFile, lockPath, kinds, children = [], only) {
+  const shown = displayPath(lockPath);
+  const lockFlag = `--lock=${shellWord(shown)}`;
+  entryFile = pastePath(entryFile);
+  const shownKey = displayLockKey(key, kinds);
+  const pruned = [key, ...children].map((k) => shellWord(displayLockKey(k, kinds))).join(" ");
+  const prune = `xanosdk lock prune ${shellWord(entryFile)} ${pruned} ${lockFlag} --yes`;
+  if (key === WORKSPACE_KEY) return [`deleted? run: ${prune}`];
+  const sep3 = key.indexOf(":");
+  const payloadKey = key.slice(0, sep3);
+  const name = key.slice(sep3 + 1);
+  const kind = shownKey.slice(0, shownKey.indexOf(":"));
+  const newName = only !== void 0 ? shellWord(only) : payloadKey === "query" ? `'<group>|<VERB>|<name>'` : "<new-name>";
+  return [
+    // `--entry` too: the rename replaces the fresh entry this export appended
+    // for the new name, and only the source can tell that from a live object.
+    // The SDK's kind name (`table`, not the lock file's `dbo`): the reader
+    // wrote `table()`, and `lock rename` accepts either spelling.
+    // A placeholder makes it a template, not a command: said so, not "run:".
+    `${only !== void 0 ? "renamed? run:" : `if renamed, put the new ${payloadKey === "query" ? "key" : "name"} in place of ${newName} and run:`} xanosdk lock rename ${kind} ${shellWord(name)} ${newName} ${lockFlag} --entry=${shellWord(entryFile)}` + (children.length === 0 ? "" : ` (it moves ${describeChildren(children)} with it)`),
+    `deleted? run: ${prune}`
+  ];
+}
+var COMPOSED_CHILDREN = {
+  app: ["query"],
+  realtime_server: ["channel", "message"],
+  channel: ["message"]
+};
+function composedChildren(key, keys) {
+  const sep3 = key.indexOf(":");
+  const kids = COMPOSED_CHILDREN[key.slice(0, sep3)];
+  if (kids === void 0) return [];
+  const name = key.slice(sep3 + 1);
+  return keys.filter((k) => kids.some((c) => k.startsWith(`${c}:${name}|`)));
+}
+function orphanFamilies(orphans) {
+  const children = /* @__PURE__ */ new Map();
+  const folded = /* @__PURE__ */ new Set();
+  for (const key of orphans) {
+    const sep3 = key.indexOf(":");
+    const kids = COMPOSED_CHILDREN[key.slice(0, sep3)];
+    if (kids === void 0) continue;
+    const name = key.slice(sep3 + 1);
+    const mine = orphans.filter((k) => kids.some((c) => k.startsWith(`${c}:${name}|`)));
+    if (mine.length === 0) continue;
+    children.set(key, mine);
+    for (const k of mine) folded.add(k);
+  }
+  return { children, folded };
+}
+function describeChildren(keys) {
+  const noun = {
+    query: ["query", "queries"],
+    channel: ["channel", "channels"],
+    message: ["message", "messages"]
+  };
+  const parts = [];
+  for (const kind of ["query", "channel", "message"]) {
+    const n = keys.filter((k) => k.startsWith(`${kind}:`)).length;
+    if (n > 0) parts.push(`${n} ${noun[kind][n === 1 ? 0 : 1]}`);
+  }
+  return `its ${parts.join(" and ")}`;
+}
+function warnOrphans(orphans, dropped, cededCanonicals, previous, observed, entryFile, lockPath, kinds, pending, accepted = false) {
+  const allFamilies = orphanFamilies(orphans);
+  const allRenames = renameCandidatesFor(orphans, previous, observed, kinds);
+  const adopted = orphans.filter(
+    (k) => k !== WORKSPACE_KEY && previous.objects[k]?.adopted === true && !allFamilies.children.has(k) && !allFamilies.folded.has(k) && allRenames.get(k)?.only === void 0 && (allRenames.get(k)?.hint ?? "") === ""
+  );
+  if (adopted.length > 0) {
+    const shared = [
+      ...new Set(adopted.flatMap((k) => {
+        const only = allRenames.get(k)?.shared;
+        return only === void 0 ? [] : [`${displayLockKey(k, kinds).slice(0, displayLockKey(k, kinds).indexOf(":"))}:${only}`];
+      }))
+    ];
+    warnAdoptedOrphans(adopted, entryFile, lockPath, kinds, accepted, shared);
+    const skip = new Set(adopted);
+    orphans = orphans.filter((k) => !skip.has(k));
+  }
+  const families = adopted.length === 0 ? allFamilies : orphanFamilies(orphans);
+  const renames = adopted.length === 0 ? allRenames : renameCandidatesFor(orphans, previous, observed, kinds);
+  const lastHead = accepted ? void 0 : orphans.filter((k) => k !== WORKSPACE_KEY && !families.folded.has(k)).at(-1);
+  const plain = orphans.filter((k) => {
+    if (k === WORKSPACE_KEY || families.folded.has(k)) return false;
+    const c = renames.get(k);
+    return c.only === void 0 && c.inCode === void 0 && (c.hint === "" || c.candidates !== void 0);
+  });
+  const grouped = new Set(plain.length > ORPHANS_SAID_ONE_BY_ONE ? plain : []);
+  if (grouped.size > 0) {
+    warnPlainOrphans(plain, families.children, orphans, entryFile, lockPath, kinds, accepted, lastHead !== void 0 && grouped.has(lastHead), renames);
+  }
+  for (const key of orphans) {
+    if (grouped.has(key)) continue;
+    if (key === WORKSPACE_KEY) {
+      exportWarn(
+        "lock.orphan",
+        `xano.lock entry "${key}" matched nothing this export (no workspace canonical emitted).`,
+        orphanFixUps(key, entryFile, lockPath, kinds),
+        !accepted
+      );
+      continue;
+    }
+    if (families.folded.has(key)) continue;
+    const children = families.children.get(key) ?? [];
+    const candidates = renames.get(key);
+    const [rename, prune] = orphanFixUps(key, entryFile, lockPath, kinds, children, candidates.only);
+    exportWarn(
+      "lock.orphan",
+      `xano.lock entry "${displayLockKey(key, kinds)}" ` + (children.length === 0 ? "" : `(and ${describeChildren(children)}: ${children.map((k) => displayLockKey(k, kinds)).join(", ")}) `) + `matches no exported object \u2014 if this was a rename, the next sync would delete+create unless the entry moves with it.`,
+      [
+        candidates.inCode !== void 0 ? setGuidFixUp(candidates.inCode) : `${rename}${candidates.hint}`,
+        prune,
+        ...key === lastHead ? [ADOPTED_ORPHANS_NOTE] : []
+      ],
+      // Accepted by `--allow-lock-orphans`: still said, never a `--strict`
+      // failure — an adopted, partly ported workspace could otherwise never
+      // pass the scaffold's `xano:check` (E2E pass 27).
+      !accepted
+    );
+  }
+  const droppedChildren = new Map(dropped.map((k) => [k, composedChildren(k, dropped)]));
+  const droppedFolded = new Set([...droppedChildren.values()].flat());
+  for (const key of dropped) {
+    if (droppedFolded.has(key)) continue;
+    const kids = droppedChildren.get(key) ?? [];
+    const withKids = kids.length === 0 ? "" : ` (and ${describeChildren(kids)} with it)`;
+    const guid = previous.objects[key]?.guid;
+    const liveKey = guid === void 0 ? void 0 : Object.keys(observed).find((k) => observed[k]?.guid === guid);
+    const shownLive = liveKey === void 0 ? void 0 : displayLockKey(liveKey, kinds);
+    const drop = pending ? "Would drop" : "Dropped";
+    exportWarn(
+      "lock.dropped-entry",
+      liveKey !== void 0 && guid !== rawDeriveGuid(liveKey) ? `${drop} lock entry "${displayLockKey(key, kinds)}"${withKids} \u2014 "${shownLive}" now carries its guid, so the rename ${pending ? "keeps" : "kept"} its identity; nothing else to do.` : `${drop} stale lock entry "${displayLockKey(key, kinds)}"${withKids} \u2014 its identity reappeared under ${shownLive === void 0 ? "a live name" : `"${shownLive}"`} (a reverted rename).`
+    );
+  }
+  for (const key of cededCanonicals) {
+    const shown = displayLockKey(key, kinds);
+    const children = composedChildren(key, Object.keys(previous.objects));
+    const candidates = allRenames.get(key);
+    const [rename, prune] = orphanFixUps(key, entryFile, lockPath, kinds, children, candidates?.only);
+    exportWarn(
+      "lock.ceded-canonical",
+      `Lock entry "${shown}" ${pending ? "would keep its guid but cede" : "kept its guid but ceded"} its canonical to a live object that now emits it (an explicit in-code canonical). A rename moves the entry, so the object keeps its identity and its URL:`,
+      [rename, prune]
+    );
+  }
+}
+var ORPHANS_SAID_ONE_BY_ONE = 5;
+function warnPlainOrphans(plain, children, orphans, entryFile, lockPath, kinds, accepted, carriesAdoptedNote, renames) {
+  const SHOWN = 5;
+  const keys = plain.flatMap((k) => [k, ...children.get(k) ?? []]);
+  const newcomers = /* @__PURE__ */ new Map();
+  for (const k of plain) {
+    const c = renames.get(k)?.candidates;
+    if (c === void 0) continue;
+    const names = newcomers.get(c.noun) ?? [];
+    for (const n of c.names) if (!names.includes(n)) names.push(n);
+    newcomers.set(c.noun, names);
+  }
+  const maybe = [...newcomers].map(([noun, names]) => `new ${noun} names this export: ${names.join(", ")}`).join("; ");
+  const shown = keys.map((k) => displayLockKey(k, kinds));
+  const list = (names) => names.map((k) => `"${k}"`).join(", ");
+  const head = (names) => `${keys.length} xano.lock entries match no exported object, and this export ${maybe === "" ? "has no new name for any of them" : "fills in no new name for any of them"}: ${names}. If one was renamed, the next sync would delete+create it unless its entry moves with it.`;
+  const lockFlag = `--lock=${shellWord(displayPath(lockPath))}`;
+  const entry = shellWord(pastePath(entryFile));
+  const listed = new Set(keys);
+  const bare = orphans.every((k) => listed.has(k));
+  const prune = `xanosdk lock prune ${entry}${bare ? "" : ` ${shown.map(shellWord).join(" ")}`} ${lockFlag} --yes`;
+  const remedies = [
+    `if one was renamed${maybe === "" ? "" : ` (${maybe})`}, put its kind and names in place of the placeholders and run: xanosdk lock rename <kind> <old-name> <new-name> ${lockFlag} --entry=${entry}`,
+    `deleted? drop ${bare ? "them all" : "these"}: ${prune}`,
+    ...carriesAdoptedNote && !accepted ? [ADOPTED_ORPHANS_NOTE] : []
+  ];
+  const capped = shown.length <= SHOWN ? list(shown) : `${list(shown.slice(0, SHOWN))}, and ${shown.length - SHOWN} more (\`--json\` lists every one)`;
+  exportWarn("lock.orphan", head(capped), remedies, !accepted, [head(list(shown)), ...remedies].join("\n"));
+}
+function warnAdoptedOrphans(adopted, entryFile, lockPath, kinds, accepted, shared = []) {
+  const SHOWN = 5;
+  const shown = adopted.map((k) => displayLockKey(k, kinds));
+  const n = adopted.length;
+  const one = n === 1;
+  const list = (keys) => keys.map((k) => `"${k}"`).join(", ");
+  const head = (keys) => `${n} xano.lock ${one ? "entry" : "entries"} adopted by \`lock import\` ${one ? "matches" : "match"} no exported object: ${keys}. ${one ? "It pins an object" : "They pin objects"} still serving on the backend ${one ? "it was" : "they were"} adopted from \u2014 a part of it this project has not ported \u2014 so a bare \`xanosdk lock prune\` keeps ${one ? "it" : "them"}.`;
+  const lockFlag = `--lock=${shellWord(displayPath(lockPath))}`;
+  const entry = shellWord(pastePath(entryFile));
+  const prune = `xanosdk lock prune ${entry} ${shellWord(shown[0])} ${lockFlag} --yes`;
+  const renameOne = (newcomer) => {
+    const kind = newcomer.slice(0, newcomer.indexOf(":"));
+    const name = newcomer.slice(kind.length + 1);
+    const placeholder = kind === "query" ? `"<group>|<VERB>|<old-name>"` : "<old-name>";
+    return `"${newcomer}" is new this export and could be any one of them renamed, so it is offered to none \u2014 if one is: xanosdk lock rename ${kind} ${placeholder} ${shellWord(name)} ${lockFlag} --entry=${entry}`;
+  };
+  const remedies = [
+    `deleted from that backend? drop it by naming its key: ${prune}` + (one ? "" : " (one key or several)"),
+    ...shared.map(renameOne),
+    // The per-orphan warnings' note, word for word: one answer, one sentence.
+    ...accepted ? [] : [ADOPTED_ORPHANS_NOTE]
+  ];
+  const capped = n <= SHOWN ? list(shown) : `${list(shown.slice(0, SHOWN))}, and ${n - SHOWN} more (\`--json\` lists every one)`;
+  exportWarn("lock.orphan-adopted", head(capped), remedies, !accepted, [head(list(shown)), ...remedies].join("\n"));
+}
+var ADOPTED_ORPHANS_NOTE = `Adopted a live workspace and ported only part of it? Those entries pin objects that are still serving, so pruning them would hand the engine back its own objects as strangers. Pass \`--allow-lock-orphans\` to \`--frozen-lock\` or \`export --check\` to accept them there.`;
+function renameCandidates(key, previous, observed, kinds, landings) {
+  if (key === WORKSPACE_KEY) return { hint: "" };
+  const payloadKey = key.slice(0, key.indexOf(":"));
+  const shown = displayLockKey(key, kinds);
+  const kind = shown.slice(0, shown.indexOf(":"));
+  const orphanName = key.slice(payloadKey.length + 1);
+  const kindKnown = payloadKey !== "toolset" || kinds?.has(orphanName) === true;
+  const sameKind = Object.keys(observed).filter(
+    (k) => k.startsWith(`${payloadKey}:`) && (!kindKnown || displayLockKey(k, kinds).startsWith(`${kind}:`)) && previous.objects[k]?.adopted !== true && // A guid `lock import` took from a live backend stays that object's
+    // after the code declares it — even one its name derives (a backend
+    // deployed from code): offered, the printed rename replaced it (E2E pass 30).
+    previous.objects[k]?.imported !== true
+  );
+  const label = (k) => kindKnown ? k.slice(payloadKey.length + 1) : displayLockKey(k, kinds);
+  const noun = kindKnown ? kind : "agent/mcpServer";
+  const single = (names) => names.length === 1 && kindKnown ? { hint: "", only: names[0] } : void 0;
+  const nameOf = (k) => k.slice(payloadKey.length + 1);
+  const narrowed = (keys) => {
+    const routed = keys.filter((k) => plausibleRename(orphanName, nameOf(k), false));
+    return routed.length === 1 ? routed : routed.filter((k) => plausibleRename(orphanName, nameOf(k), true));
+  };
+  const orphanGuid = previous.objects[key]?.guid;
+  const landed = (k) => landings.some(([, record]) => record[k] !== void 0 && (key in record || record[k].guid !== orphanGuid));
+  const newcomers = likeliestFirst(
+    orphanName,
+    narrowed(sameKind.filter((k) => !(k in previous.objects) && !landed(k))),
+    payloadKey
+  ).map(label);
+  const guessable = (name) => orphanName.split("|").length !== 3 || plausibleRename(orphanName, name, true) || sharesWord(orphanName, name);
+  if (newcomers.length > 0) {
+    const lone = newcomers.length === 1 && guessable(newcomers[0]) ? single(newcomers) : void 0;
+    const seen = lone === void 0 ? void 0 : observed[`${payloadKey}:${lone.only}`];
+    const pinned = typeof seen === "object" ? seen.guid : void 0;
+    const inCode = typeof seen === "object" && seen.guid_source === "code";
+    if (lone !== void 0 && orphanGuid !== void 0 && typeof pinned === "string" && pinned !== orphanGuid && (inCode || pinned !== rawDeriveGuid(`${payloadKey}:${lone.only}`))) {
+      return { hint: "", inCode: { name: lone.only, guid: orphanGuid, pins: pinned } };
+    }
+    return lone ?? { hint: ` (new ${noun} names this export: ${newcomers.join(", ")})`, candidates: { noun, names: newcomers } };
+  }
+  const codePinnedHere = narrowed(
+    sameKind.filter((k) => {
+      const e = previous.objects[k];
+      return e?.guid_source === "code" && e.guid !== orphanGuid && !landed(k);
+    })
+  ).map(label);
+  if (orphanGuid !== void 0 && codePinnedHere.length === 1 && kindKnown && guessable(codePinnedHere[0])) {
+    const pins = previous.objects[`${payloadKey}:${codePinnedHere[0]}`].guid;
+    return { hint: "", inCode: { name: codePinnedHere[0], guid: orphanGuid, pins } };
+  }
+  return { hint: "" };
+}
+function sharesWord(a, b) {
+  const words = (n) => (n.split("|").at(-1) ?? "").split(/[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).map((w) => w.toLowerCase()).filter((w) => w.length >= 3);
+  const mine = new Set(words(a));
+  return words(b).some((w) => mine.has(w));
+}
+function plausibleRename(orphanName, name, near) {
+  const split = (n2) => n2.split("|").length === 3 ? n2.split("|") : ["", "", n2];
+  const [og, ov, on] = split(orphanName);
+  const [g, v, n] = split(name);
+  if (g !== og || v !== ov && n !== on) return false;
+  return !near || editDistance2(on, n) <= Math.max(3, Math.ceil(on.length / 2));
+}
+function setGuidFixUp(inCode) {
+  return `renamed to "${inCode.name}"? set its def to \`guid: "${inCode.guid}"\` \u2014 its def pins its own guid (${inCode.pins}), which replaces any lock entry, so a \`lock rename\` cannot carry the identity`;
+}
+function renameCandidatesFor(orphans, previous, observed, kinds) {
+  const landings = allLandings(process.cwd(), previous);
+  const all = new Map(
+    orphans.map((key) => [key, renameCandidates(key, previous, observed, kinds, landings)])
+  );
+  const target = (key, only) => `${key.slice(0, key.indexOf(":"))}:${only}`;
+  const filled = /* @__PURE__ */ new Map();
+  for (const [key, c] of all) {
+    if (c.only !== void 0) filled.set(target(key, c.only), (filled.get(target(key, c.only)) ?? 0) + 1);
+  }
+  for (const [key, c] of all) {
+    if (c.only === void 0 || filled.get(target(key, c.only)) < 2) continue;
+    if (previous.objects[key]?.adopted === true) {
+      all.set(key, { hint: "", shared: c.only });
+      continue;
+    }
+    const shown = displayLockKey(key, kinds);
+    all.set(key, {
+      hint: ` (its new name may be ${c.only} \u2014 the one candidate for another orphan too, so run the rename only for the entry that was renamed)`,
+      candidates: { noun: shown.slice(0, shown.indexOf(":")), names: [c.only] }
+    });
+  }
+  return all;
+}
+function likeliestFirst(orphanName, keys, payloadKey) {
+  const parts = (name) => name.split("|");
+  const [og, ov, on] = parts(orphanName).length === 3 ? parts(orphanName) : ["", "", orphanName];
+  const score = (key) => {
+    const name = key.slice(payloadKey.length + 1);
+    const [g, v, n] = parts(name).length === 3 ? parts(name) : ["", "", name];
+    return (g === og ? 0 : 2e3) + (v === ov ? 0 : 1e3) + editDistance2(on, n);
+  };
+  return keys.map((key, i) => ({ key, i, s: score(key) })).sort((a, b) => a.s - b.s || a.i - b.i).map((e) => e.key);
+}
+function editDistance2(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const row = [i];
+    for (let j = 1; j <= b.length; j++) {
+      row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    prev = row;
+  }
+  return prev[b.length];
+}
+var DRIFT = "SDK_DRIFT";
+var NULL_DEVICE = process.platform === "win32" ? "NUL" : "/dev/null";
+function frozenChangeMessage(gate, before, after, file, lockPath, def, args, kinds, droppedLandings = []) {
+  const was = before?.objects ?? {};
+  const added = [];
+  const changed = [];
+  const removed = Object.keys(was).filter((k) => !(k in after.objects));
+  let minted = false;
+  for (const [key, entry] of Object.entries(after.objects)) {
+    const prior = was[key];
+    if (prior === void 0) added.push(key);
+    else if (JSON.stringify(prior) !== JSON.stringify(entry)) changed.push(key);
+    if (entry.canonical !== void 0 && entry.canonical !== prior?.canonical && entry.canonical_source === "minted") {
+      minted = true;
+    }
+  }
+  const SHOWN = 5;
+  const list = (label, keys) => keys.length === 0 ? [] : [
+    `  ${label}: ${keys.slice(0, SHOWN).map((k) => JSON.stringify(displayLockKey(k, kinds))).join(", ")}` + (keys.length > SHOWN ? `, and ${keys.length - SHOWN} more` : "")
+  ];
+  const have = availableDocTokenKeys(args, file);
+  const gates = def.documentationTokenNames().filter(
+    (d) => d.gated && d.published && !have.has(d.key) && !Object.hasOwn(args.docTokens, documentationScopeFlagLabel(d.scope))
+  );
+  const one = gates.length === 1;
+  const tokens = gates.length === 0 ? "" : ` It needs the documentation token${one ? "" : "s"} this source gates (${safeNames(gates.map((d) => documentationScopeLabel(d.scope)))}): \`${secretsRemedyFor(file).fill}\` mints ${one ? "one" : "them"} into \`${secretsRemedyFor(file).file}\`, or pass ${gates.map((d) => `\`--doc-token "${documentationScopeFlagLabel(d.scope)}=<value>"\``).join(" ")}.`;
+  const head = before !== void 0 ? `${gate}: this export would change ${displayPath(lockPath)}${fileSpellingNote([...added, ...changed, ...removed])}:` : `${gate}: no xano.lock found at ${displayPath(lockPath)}, and this source has identities to record:`;
+  return [
+    head,
+    ...list("add", added),
+    ...list("change", changed),
+    ...list("remove", removed),
+    ...droppedLandings.length === 0 ? [] : [
+      `  drop: ${droppedLandings.length === 1 ? "an ephemeral's landing record" : `${droppedLandings.length} ephemeral landing records`} (${droppedLandings.slice(0, SHOWN).map((d) => JSON.stringify(d)).join(", ")}${droppedLandings.length > SHOWN ? `, and ${droppedLandings.length - SHOWN} more` : ""}) \u2014 an ephemeral's record now lives in \`.xano/ephemeral.json\`, not the lock`
+    ],
+    // `--out` to the null device: a bare export writes the whole bundle — env
+    // values and documentation tokens in cleartext — to the terminal, when all
+    // the reader needs from it is the lock it records.
+    `Run \`xanosdk export ${shellWord(file)} --out ${NULL_DEVICE}\` locally \u2014 it records the lock and writes the bundle nowhere \u2014 commit the ${before !== void 0 ? "updated " : ""}xano.lock it writes, and retry.${tokens}` + (before === void 0 && args.check ? ` Until then, \`--check --no-lock\` checks everything but the lock.` : "") + (minted ? ` A canonical minted here would be discarded, permanently diverging public URLs.` : "")
+  ].join("\n");
+}
+function frozenOrphanError(orphans, entryFile, lockPath, gate, context) {
+  const { previous, observed, kinds } = context;
+  const where = displayPath(lockPath);
+  const many = orphans.length !== 1;
+  const SHOWN = 5;
+  const families = orphanFamilies(orphans);
+  const heads = orphans.filter((k) => !families.folded.has(k));
+  const shown = heads.slice(0, SHOWN);
+  const rest = heads.length - shown.length;
+  const named = (k) => {
+    const children = families.children.get(k) ?? [];
+    return `${JSON.stringify(displayLockKey(k, kinds))}${children.length === 0 ? "" : ` (and ${describeChildren(children)})`}`;
+  };
+  const lines = [
+    `${gate}: ${where} carries ${orphans.length} ${many ? "entries that match" : "entry that matches"} no exported object: ${shown.map(named).join(", ")}${rest > 0 ? `, and ${rest} more` : ""}.`,
+    `A rename done in code lands here \u2014 the old name's entry stays behind while the new name mints a fresh identity, so the next sync DELETES the object and creates another in its place. A deletion lands here too, and once a plain \`xanosdk export\` has written the lock nothing tells the two apart, so the intent has to be declared rather than guessed.`
+  ];
+  const renames = renameCandidatesFor(heads, previous, observed, kinds);
+  const fixUps = heads.map((key) => {
+    const candidates = renames.get(key);
+    const children = families.children.get(key) ?? [];
+    const [first, ...others] = orphanFixUps(key, entryFile, lockPath, kinds, children, candidates.only);
+    const hint = others.length > 0 ? candidates.hint : "";
+    return {
+      key: displayLockKey(key, kinds),
+      ...children.length === 0 ? {} : { children: children.map((k) => displayLockKey(k, kinds)) },
+      remedies: [candidates.inCode !== void 0 ? setGuidFixUp(candidates.inCode) : `${first}${hint}`, ...others]
+    };
+  });
+  for (const { key, remedies } of fixUps.slice(0, SHOWN)) for (const fix of remedies) lines.push(`  "${key}" ${fix}`);
+  let pruneAll;
+  if (rest > 0) {
+    lines.push(
+      `  \u2026and ${rest} more (${heads.slice(SHOWN).map(named).join(", ")}), each fixed the same two ways \u2014 \`--json\` lists every entry's commands under \`error.details.orphans\`.`
+    );
+    const plain = heads.filter((k) => {
+      const c = renames.get(k);
+      return k !== WORKSPACE_KEY && previous.objects[k]?.adopted !== true && c.only === void 0 && c.inCode === void 0 && c.hint === "";
+    });
+    if (plain.length > 1) {
+      const keys = plain.flatMap((k) => [k, ...families.children.get(k) ?? []]);
+      const listed = new Set(keys);
+      const bare = orphans.every((k) => listed.has(k));
+      pruneAll = `xanosdk lock prune ${shellWord(pastePath(entryFile))}${bare ? "" : ` ${keys.map((k) => shellWord(displayLockKey(k, kinds))).join(" ")}`} --lock=${shellWord(displayPath(lockPath))} --yes`;
+      lines.push(`  Deleted ${bare ? "them all" : `the ${plain.length} with no new name`}? Drop ${bare ? "every one" : "those"} at once: ${pruneAll}`);
+    }
+  }
+  lines.push(
+    `Adopted a live workspace and ported only part of it? Those entries pin objects that are still serving, so pruning them would hand the engine back its own objects as strangers. Pass \`--allow-lock-orphans\` to accept them and keep the rest of this check.`
+  );
+  lines.push(`Then commit the updated ${basename(lockPath)} and retry.`);
+  return new CliError(DRIFT, lines.join("\n"), { details: { orphans: fixUps, ...pruneAll === void 0 ? {} : { pruneAll } } });
+}
+function run(argv) {
+  return inJsonDocumentScope(
+    () => inCredentialScope(() => {
+      setRunFailureExplainer(explainRunCredential);
+      return dispatch(argv).catch(async (err) => {
+        await refineGonePullHint(err);
+        throw await explainRunCredential(await nameLookupRerun(unresolvableEnvInstance(err)));
+      }).catch((err) => {
+        throw carryRunWarnings(maskAssignments(err, argv));
+      });
+    })
+  ).finally(() => {
+    setHintContext(void 0);
+    noteRunScope(void 0);
+    runArgs = void 0;
+    noteRunArgs(void 0);
+    offeredPull = void 0;
+    mergeExcusedEnv = void 0;
+    mergeExcusedDocToken = void 0;
+  });
+}
+var ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=(.+)$/s;
+function maskAssignments(err, argv) {
+  if (!(err instanceof Error)) return err;
+  const words = [...new Set(argv.filter((a) => !a.startsWith("-") && ASSIGNMENT.test(a)))];
+  if (words.length === 0) return err;
+  const masked = (text) => words.reduce((t, w) => t.split(w).join(`${ASSIGNMENT.exec(w)[1]}=\u2026`), text);
+  err.message = masked(err.message);
+  const suggestion = err.suggestion;
+  if (typeof suggestion === "string") Object.defineProperty(err, "suggestion", { value: masked(suggestion) });
+  const args = runArgs ?? positionalsOf(argv);
+  const positional = args?.positionals.find((p) => ASSIGNMENT.test(p));
+  if (args !== void 0 && positional !== void 0 && flagRefFor(args.command, args.subcommand, "env-var") !== void 0) {
+    const name = ASSIGNMENT.exec(positional)[1];
+    err.message += `
+  Did you mean \`--env-var ${name}=\u2026\`? A backend env var is set with the flag, not as an argument.`;
+  }
+  return err;
+}
+function positionalsOf(argv) {
+  const [command, ...rest] = argv;
+  if (command === void 0 || !isCommand(command)) return void 0;
+  const subcommand = NOUN_COMMANDS.has(command) ? rest.shift() : void 0;
+  const positionals = [];
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--") {
+      positionals.push(...rest.slice(i + 1));
+      break;
+    }
+    if (SEPARATED_VALUE_SPELLINGS.has(a)) i += 1;
+    else if (!a.startsWith("-")) positionals.push(a);
+  }
+  return { command, subcommand, positionals };
+}
+function carryRunWarnings(err) {
+  if (!(err instanceof Error)) return err;
+  const own = err;
+  const coded = typeof own.code === "string" && own.code.startsWith("SDK_");
+  if (coded && Array.isArray(own.details)) {
+    const pending = own.code === "SDK_EXPORT_INVALID" ? takePendingStrictFindings() : [];
+    const listed = own.details;
+    const joining = pending.filter((p) => !listed.some((d) => d.code === p.code && d.message === p.message));
+    own.details = { diagnostics: [...listed, ...joining], warnings: [] };
+  }
+  let details = coded ? own.details : void 0;
+  if (details !== void 0 && (typeof details !== "object" || details === null || Array.isArray(details))) return err;
+  for (const [key, extra] of [["warnings", runWarnings()], ["accepted", runAccepted()]]) {
+    if (extra.length === 0) continue;
+    const merged = mergeJsonWarnings(details?.[key], extra);
+    if (merged === void 0) continue;
+    if (!coded) own.code = failureCode(err);
+    details = { ...details, [key]: merged };
+    own.details = details;
+  }
+  return err;
+}
+var runArgs;
+async function explainRunCredential(err) {
+  return explainRejectedCredential(await explainUnreachableWorkspace(err));
+}
+var unreachableVerdicts = /* @__PURE__ */ new WeakMap();
+async function explainUnreachableWorkspace(err) {
+  const resolved = lastResolvedAuth();
+  if (!(err instanceof Error) || err instanceof UsageError || resolved === void 0 || !pinnedWorkspaceMissed()) return err;
+  const { auth } = resolved;
+  let verdict = unreachableVerdicts.get(auth);
+  if (verdict === void 0) {
+    verdict = (async () => {
+      const { readReachableWorkspaces, unreachableWorkspaceMessage } = await import("./workspace-binding-56PIIPCP.js");
+      const all = await readReachableWorkspaces(auth, 15e3);
+      if (all === void 0 || all.length === 0 || all.some((w) => w.id === auth.workspaceId)) return void 0;
+      return new UsageError(unreachableWorkspaceMessage(auth, all));
+    })();
+    unreachableVerdicts.set(auth, verdict);
+  }
+  return await verdict ?? err;
+}
+async function explainRejectedCredential(err) {
+  const resolved = lastResolvedAuth();
+  if (!(err instanceof Error) || resolved === void 0) return err;
+  const [first = "", ...rest] = err.message.split("\n");
+  if (!/\(401\b[^)]*\)|\banswered (HTTP )?401\b/.test(first) || /\brejected\b/.test(err.message)) return err;
+  const { asRejectedCredential, rejectedRemedy } = await import("./whoami-command-STGINTXH.js");
+  const { auth, args } = resolved;
+  err.message = [first, rejectedRemedy(auth, args), ...rest].join("\n");
+  if (failureCode(err) === "SDK_ERROR") asRejectedCredential(err, auth, args);
+  return err;
+}
+function unresolvableEnvInstance(err) {
+  const resolved = lastResolvedAuth();
+  const url = readEnvVar("XANO_INSTANCE_URL");
+  if (!(err instanceof Error) || resolved === void 0 || resolved.auth.profile !== void 0 || url === void 0) return err;
+  let code;
+  for (let e = err, depth = 0; e !== void 0 && e !== null && depth < 5 && typeof code !== "string"; depth++) {
+    code = e.code;
+    e = e.cause;
+  }
+  let host;
+  try {
+    host = new URL(url).host;
+  } catch {
+    return err;
+  }
+  if (code !== "ENOTFOUND" || !err.message.includes(host) || / redirected to /.test(err.message)) return err;
+  return new UsageError(
+    `The host of XANO_INSTANCE_URL (${url}) does not resolve (ENOTFOUND), so nothing was sent. Check the variable \u2014 it is your instance's origin, e.g. https://x8ki-letl-twmt.n7.xano.io.`
+  );
+}
+function withoutSecretValue(args) {
+  const at = args.positionalArgv?.[1];
+  if (args.argv === void 0 || at === void 0) return args;
+  return {
+    ...args,
+    argv: args.argv.filter((_, i) => i !== at),
+    positionals: args.positionals.filter((_, i) => i !== 1),
+    positionalArgv: args.positionalArgv.filter((_, i) => i !== 1).map((i) => i > at ? i - 1 : i)
+  };
+}
+async function nameLookupRerun(failure) {
+  if (!(failure instanceof Error) || runArgs?.argv === void 0) return failure;
+  const { LookupFailedError, rateLimitedFailure } = await import("./source-resolve-S2XA3XZF.js");
+  const err = rateLimitedFailure(failure);
+  if (!(err instanceof LookupFailedError)) return err;
+  const { retryCommand, withheldNote } = await import("./deploy-command-JVZPWHMK.js");
+  if (runArgs.command === "env" && runArgs.subcommand === "set") {
+    const retry2 = retryCommand(withoutSecretValue(runArgs));
+    return err.withRerun(
+      retry2.command,
+      "",
+      ` It leaves out the value of \`${runArgs.positionals[0] ?? "NAME"}\`: it is not reprinted, so pass it again (or pipe it on stdin).${withheldNote(retry2.withheld)}`
+    );
+  }
+  const retry = retryCommand(runArgs);
+  const token = runArgs.command === "profile" && runArgs.subcommand === "add" ? " with the token on stdin" : "";
+  return err.withRerun(retry.command, token, withheldNote(retry.withheld));
+}
+function hoistLeadingGlobalFlags(argv) {
+  const lead = [];
+  let i = 0;
+  while (i < argv.length) {
+    const arg = expandShortAttached(argv[i]);
+    if (arg === "--json" || arg === "--no-refresh" || arg.startsWith("--profile=")) {
+      lead.push(arg);
+      i += 1;
+    } else if (arg === "--profile" || arg === "-p") {
+      const value = argv[i + 1];
+      lead.push(...value === void 0 ? [arg] : [arg, value]);
+      i += value === void 0 ? 1 : 2;
+    } else {
+      break;
+    }
+  }
+  if (lead.length === 0) return { argv: [...argv], command: [...argv] };
+  const rest = argv.slice(i);
+  if (rest.length === 0) {
+    const shown = lead.map(
+      (f, n) => (f === "-p" || f === "--profile") && n === lead.length - 1 ? `${f} <profile>` : f === "--profile=" ? "--profile=<profile>" : f
+    );
+    throw new UsageError(
+      `No command given after \`${lead.join(" ")}\` \u2014 global flags modify a command: \`xanosdk <command> ${shown.join(" ")}\`.`,
+      { helpFor: {} }
+    );
+  }
+  return { argv: [...rest, ...lead], command: rest };
+}
+var PATHLESS_VERBS = {
+  ephemeral: /* @__PURE__ */ new Set(["list", "get", "delete"]),
+  tenant: /* @__PURE__ */ new Set(["list", "get", "delete", "details"]),
+  release: /* @__PURE__ */ new Set(["list", "show", "delete"]),
+  "local-engine": /* @__PURE__ */ new Set(["token", "stop"]),
+  test: /* @__PURE__ */ new Set(["list", "run", "run-all"])
+};
+var PATHLESS_COMMANDS = /* @__PURE__ */ new Set(["tables", "impersonate"]);
+function isPathlessRun(args) {
+  const command = args.command ?? "";
+  return PATHLESS_COMMANDS.has(command) || PATHLESS_VERBS[command]?.has(args.subcommand ?? "") === true;
+}
+async function atProjectRoot(args, command, positional) {
+  const { enterProjectRoot } = await import("./xanosdk-project-S6DXJONQ.js");
+  const entered = enterProjectRoot(args, process.cwd(), positional);
+  if (entered === void 0) return command(args);
+  if (isPathlessRun(args)) {
+    setHintContext(entered.args);
+    try {
+      return await command(entered.args);
+    } finally {
+      entered.restore();
+      setHintContext(args);
+    }
+  }
+  const note = `Using the project at ${entered.root}; printed paths and commands read from where you typed them.
+`;
+  const errWrite = process.stderr.write;
+  const outWrite = process.stdout.write;
+  let noted = false;
+  const unwrap = () => {
+    process.stderr.write = errWrite;
+    process.stdout.write = outWrite;
+  };
+  const sayNote = () => {
+    if (noted) return;
+    noted = true;
+    unwrap();
+    errWrite.call(process.stderr, note);
+  };
+  process.stderr.write = function(...rest) {
+    sayNote();
+    return errWrite.apply(process.stderr, rest);
+  };
+  process.stdout.write = function(...rest) {
+    sayNote();
+    return outWrite.apply(process.stdout, rest);
+  };
+  setHintContext(entered.args);
+  try {
+    await command(entered.args);
+  } catch (err) {
+    if (!isUsageError(err)) sayNote();
+    throw err;
+  } finally {
+    if (!noted) unwrap();
+    entered.restore();
+    setHintContext(args);
+  }
+}
+function entryPositional(args) {
+  if (args.bundlePositional === true) return "entry";
+  return args.file !== void 0 && !isKindShapedOrBare(args.file) ? "entry" : void 0;
+}
+function isKindShapedOrBare(raw) {
+  return isKindShaped(raw) || BARE.includes(raw);
+}
+function globalVersionAsked(argv) {
+  const at = globalVersionToken(argv);
+  if (at === void 0) return false;
+  const next = at.own[at.index + 1];
+  return next === void 0 || next.startsWith("-");
+}
+function globalVersionMisuse(argv) {
+  const at = globalVersionToken(argv);
+  if (at === void 0) return void 0;
+  const flag = at.own[at.index];
+  const next = at.own[at.index + 1];
+  if (next === void 0 || next.startsWith("-")) return void 0;
+  if (flag === "--version" && /^v?\d/.test(next)) return void 0;
+  const shown = next.includes("=") ? `${flagName(next)}=\u2026` : next;
+  const where = [argv[0], NOUN_COMMANDS.has(argv[0]) ? argv[1] : void 0].filter((t) => t !== void 0).join(" ");
+  return new UsageError(
+    `\`${flag}\` prints the CLI version and takes no argument, so "${shown}" after it was not read. Run \`xanosdk --version\` on its own, or drop \`${flag}\` from \`xanosdk ${where}\`.`,
+    { hintFor: { command: argv[0] } }
+  );
+}
+var SEPARATED_VALUE_SPELLINGS = new Set(
+  Object.values(FLAGS).flatMap(({ spec }) => {
+    const m = /^((?:--?[\w-]+)(?:,\s*-[\w-]+)*)\s+\S/.exec(spec);
+    return m === null ? [] : m[1].split(/,\s*/).filter((t) => t !== "--version" && t !== "-v");
+  })
+);
+function globalVersionToken(argv) {
+  const [command, ...rest] = argv;
+  if (command === void 0 || !isCommand(command)) return void 0;
+  const verb = NOUN_COMMANDS.has(command) ? rest[0] : void 0;
+  if (command === "env" && verb === "set") return void 0;
+  if (flagRefFor(command, verb, "engine-version") !== void 0) return void 0;
+  const end = rest.indexOf("--");
+  const own = end === -1 ? rest : rest.slice(0, end);
+  for (let i = 0; i < own.length; i++) {
+    const a = own[i];
+    if (a === "--version" || a === "-v") return { own, index: i };
+    if (SEPARATED_VALUE_SPELLINGS.has(a)) i += 1;
+  }
+  return void 0;
+}
+async function dispatch(rawArgv) {
+  while (rawArgv[0] === "--") rawArgv = rawArgv.slice(1);
+  const { argv, command: typed } = hoistLeadingGlobalFlags(rawArgv);
+  if (typed[0] === "init") {
+    const web = typed.indexOf("--web", 1);
+    if (web !== -1) {
+      const { runInitWebCommand } = await import("./init-web-M4YZSZK6.js");
+      return runInitWebCommand([...typed.slice(1, web), ...typed.slice(web + 1)]);
+    }
+  }
+  if (globalVersionAsked(argv)) {
+    if (argv.includes("--json")) writeJson({ version: readVersion() });
+    else process.stdout.write(`${readVersion()}
+`);
+    return;
+  }
+  const helpRequest = resolveHelpRequest(argv);
+  if (helpRequest) {
+    if (helpRequest.unknownTopic !== void 0) throw unknownHelpTopic(helpRequest.unknownTopic);
+    if (helpRequest.unknownCommand !== void 0) throw unknownCommand(helpRequest.unknownCommand, { help: true });
+    if (helpRequest.unknownSubcommand !== void 0 && helpRequest.command !== void 0) {
+      throw unknownSubcommand(helpRequest.command, helpRequest.unknownSubcommand, helpRequest.positionals ?? []);
+    }
+    if (argv.includes("--json")) {
+      const { helpDocument } = await import("./commands-GJMJ4XYZ.js");
+      writeJson({ version: readVersion(), ...helpDocument(helpRequest) });
+      return;
+    }
+    process.stdout.write(terminalText(withCliPrefix(renderHelpFor(helpRequest, stdoutStyle(), readVersion()))));
+    return;
+  }
+  const versionMisuse = globalVersionMisuse(argv);
+  if (versionMisuse !== void 0) throw versionMisuse;
+  let args;
+  try {
+    args = parseArgs(argv);
+  } catch (err) {
+    if (!(err instanceof Error)) throw err;
+    const hintFor = argv[0] === "deploy" && (!isUsageError(err) || err.hintFor === void 0 && err.helpFor === void 0) ? { hintFor: { command: "deploy" } } : void 0;
+    if (isUsageError(err) && hintFor === void 0) throw err;
+    throw new UsageError(err.message, { ...isUsageError(err) && err.suggestion !== void 0 ? { suggestion: err.suggestion } : {}, ...hintFor });
+  }
+  setHintContext(args);
+  runArgs = args;
+  noteRunArgs(args);
+  if (isMachineOutput(args)) (await import("./update-check-2W2NLDTC.js")).routeUpdateNoticeToDocument();
+  const { command } = args;
+  const out = args.out === "-" ? void 0 : args.out;
+  if (command === void 0) {
+    printHelp();
+    return;
+  }
+  if (command === "version" || command === "--version" || command === "-v") {
+    const stray = [args.subcommand, ...args.positionals].find((t) => t !== void 0);
+    if (stray !== void 0) {
+      throw new UsageError(
+        `\`${command}\` prints the CLI version and takes no argument, so "${stray}" after it was not read. Run \`xanosdk --version\` on its own.`,
+        { hintFor: {} }
+      );
+    }
+    if (args.json) writeJson({ version: readVersion() });
+    else process.stdout.write(`${readVersion()}
+`);
+    return;
+  }
+  if (command === "init") {
+    const { runInitCommand } = await import("./init-command-X2FR4UAK.js");
+    return runInitCommand(args);
+  }
+  if (command === "completion") {
+    const { isCompletionShell, runCompletionCommand, COMPLETION_SHELLS, UNSUPPORTED_SHELLS } = await import("./completion-ZQLO6PB6.js");
+    const shell = args.positionals[0];
+    if (shell === void 0) throw missingArgument("shell", { command: "completion" });
+    if (!isCompletionShell(shell)) {
+      const known = UNSUPPORTED_SHELLS.has(shell.toLowerCase());
+      throw new UsageError(
+        `\`xanosdk completion\`: ${known ? `${shell} is not supported` : `unknown shell "${shell}"`}. Supported: ${COMPLETION_SHELLS.join(", ")}.`,
+        known ? {} : { suggestion: suggest(shell, COMPLETION_SHELLS) }
+      );
+    }
+    if (args.json) {
+      throw new UsageError(
+        "`xanosdk completion` prints a shell script to source, and has no JSON form. Drop `--json`.",
+        { hintFor: { command: "completion" } }
+      );
+    }
+    return runCompletionCommand(shell);
+  }
+  if (command === "upgrade") {
+    const { runUpgradeCommand } = await import("./upgrade-command-QHNFWM7O.js");
+    return runUpgradeCommand(args);
+  }
+  if (command === "lock") {
+    const { runLockCommand } = await import("./lock-commands-2QG25HL7.js");
+    const verb = args.positionals[0];
+    const { isProjectDir } = await import("./xanosdk-project-S6DXJONQ.js");
+    const here = verb !== "prune" && args.lockPath === void 0 && args.entryPath === void 0 && existsSync2("xano.lock") && !isProjectDir(process.cwd()) ? { ...args, lockPath: "xano.lock" } : args;
+    return atProjectRoot(here, runLockCommand, verb === "prune" || verb === "import" ? "verb-path" : void 0);
+  }
+  if (command === "login") {
+    const { runLoginCommand } = await import("./login-command-QPYRWOXZ.js");
+    return runLoginCommand(args);
+  }
+  if (command === "logout") {
+    const { runLogoutCommand } = await import("./logout-command-WOIQLDP6.js");
+    return runLogoutCommand(args);
+  }
+  if (command === "deploy") {
+    const { runDeployCommand } = await import("./deploy-command-JVZPWHMK.js");
+    return atProjectRoot(args, runDeployCommand, entryPositional(args));
+  }
+  if (command === "ephemeral") {
+    const { runEphemeralCommand } = await import("./ephemeral-command-CLJJKOFT.js");
+    return atProjectRoot(args, runEphemeralCommand);
+  }
+  if (command === "local-engine") {
+    const { runLocalEngineCommand } = await import("./local-engine-command-Z3OL7VOD.js");
+    const project = ["token", "stop", "update"].includes(args.subcommand ?? "");
+    return project ? atProjectRoot(args, runLocalEngineCommand) : runLocalEngineCommand(args);
+  }
+  if (command === "env") {
+    if (args.subcommand === "set" || args.subcommand === "unset") {
+      const { runEnvVarCommand } = await import("./env-var-command-ZIRDCAZA.js");
+      return atProjectRoot(args, (a) => runEnvVarCommand(a, args.subcommand));
+    }
+    if (args.subcommand !== "pull") throw unknownSubcommand("env", args.subcommand);
+    const { runEnvPullCommand } = await import("./env-pull-command-TNMNB3CV.js");
+    return atProjectRoot(args, runEnvPullCommand);
+  }
+  if (command === "secrets") {
+    if (args.subcommand !== "fill") throw unknownSubcommand("secrets", args.subcommand);
+    const { runSecretsFillCommand } = await import("./secrets-fill-command-TTCPSVXN.js");
+    return atProjectRoot(args, runSecretsFillCommand, entryPositional(args));
+  }
+  if (command === "release") {
+    const { runReleaseCommand: runReleaseNs } = await import("./release-ns-command-3KFDMZ6G.js");
+    return atProjectRoot(args, runReleaseNs);
+  }
+  if (command === "pull") {
+    const { runPullCommand } = await import("./pull-command-VBO7C4S3.js");
+    const first = args.positionals[0];
+    const file = first !== void 0 && !isKindShaped(first) && (/\.json$/i.test(first) || /[\\/]/.test(first));
+    return file ? runPullCommand(args) : atProjectRoot(args, runPullCommand);
+  }
+  if (command === "generate") {
+    const { runGenerateCommand } = await import("./generate-command-AYEOLA26.js");
+    return runGenerateCommand(args);
+  }
+  if (command === "tables") {
+    const { runTablesCommand } = await import("./tables-command-GUPXXSB5.js");
+    return atProjectRoot(args, runTablesCommand);
+  }
+  if (command === "impersonate") {
+    const { runImpersonateCommand } = await import("./impersonate-command-5JAS3WSV.js");
+    return atProjectRoot(args, runImpersonateCommand);
+  }
+  if (command === "promote") {
+    const { runPromoteCommand } = await import("./promote-command-PCWT5N6S.js");
+    return atProjectRoot(args, runPromoteCommand);
+  }
+  if (command === "publish") {
+    const { runPublishCommand } = await import("./publish-command-TTDUUJI5.js");
+    return atProjectRoot(args, runPublishCommand, "path");
+  }
+  if (command === "tenant") {
+    const { runTenantCommand } = await import("./tenant-command-D5HGI2X4.js");
+    return atProjectRoot(args, runTenantCommand);
+  }
+  if (command === "test") {
+    const { runTestCommand } = await import("./test-command-TIKZMDPZ.js");
+    return atProjectRoot(args, runTestCommand);
+  }
+  if (command === "workspace") {
+    const { runWorkspaceCommand } = await import("./workspace-command-JEXQETJD.js");
+    return runWorkspaceCommand(args);
+  }
+  if (command === "status") {
+    const { runStatusCommand } = await import("./status-command-RUDXTF7I.js");
+    return runStatusCommand(args);
+  }
+  if (command === "whoami") {
+    const { runWhoamiCommand } = await import("./whoami-command-STGINTXH.js");
+    return runWhoamiCommand(args);
+  }
+  if (command === "profile") {
+    const { runProfileCommand } = await import("./profile-command-AH3PIM4X.js");
+    return runProfileCommand(args);
+  }
+  if (command === "marketplace") {
+    if (!["list", "search", "details", "install", "reinstall", "remove"].includes(args.subcommand ?? "")) {
+      throw unknownSubcommand("marketplace", args.subcommand);
+    }
+    const marketplace = await import("./marketplace-command-K5YL42NO.js");
+    const { withCatalogueRerun } = await import("./marketplace-resolve-LY32JES5.js");
+    try {
+      if (args.subcommand === "list") return await marketplace.runMarketplaceListCommand(args);
+      if (args.subcommand === "search") return await marketplace.runMarketplaceSearchCommand(args);
+      if (args.subcommand === "details") return await marketplace.runMarketplaceDetailsCommand(args);
+      if (args.subcommand === "reinstall") return await atProjectRoot(args, marketplace.runMarketplaceReinstallCommand);
+      if (args.subcommand === "remove") return await atProjectRoot(args, marketplace.runMarketplaceRemoveCommand);
+      return await atProjectRoot(args, marketplace.runMarketplaceInstallCommand);
+    } catch (err) {
+      throw await withCatalogueRerun(err, args, `marketplace ${args.subcommand}`);
+    }
+  }
+  if (command === "preflight") {
+    const { runPreflightCommand } = await import("./preflight-command-2T5Z36MI.js");
+    return runPreflightCommand(args);
+  }
+  if (command !== "compile" && command !== "export" && command !== "paths" && command !== "routes") {
+    throw unknownCommand(command);
+  }
+  if (!args.file) {
+    throw missingArgument("file", { command });
+  }
+  if (command === "compile") {
+    return runCompile(args);
+  }
+  if (command === "paths" || command === "routes") {
+    return runPaths(args);
+  }
+  const { discoverToolchainPlugins } = await import("./toolchain-modules-5EAZUONB.js");
+  const toolchain = await discoverToolchainPlugins(process.cwd(), {
+    frozen: args.frozenLock === true || args.check === true
+  });
+  if (out && !args.check) {
+    const { assertWritableTarget } = await import("./output-target-AL3I44GG.js");
+    assertWritableTarget(out, "--out");
+  }
+  const { bundle: json, bundleObject, omittedSeedTables, lock: lockOutcome, declaredEnvNames } = await compileBundle(args);
+  if (omittedSeedTables.length > 0 && !args.check) {
+    const names = omittedSeedTables.map((n) => `"${n}"`).join(", ");
+    info(
+      `Exported bundle omits seed rows for ${countOf(omittedSeedTables.length, "table")}: ${names}. Seed is applied only by \`xanosdk deploy <entry>\` \u2014 deploying this bundle via \`--bundle\` ships schema without seed data.`
+    );
+  }
+  const { hostedIconOwners } = await import("./hosted-file-PSHJB3HX.js");
+  const hostedOwners = hostedIconOwners(bundleObject.payload ?? {});
+  if (hostedOwners.length > 0 && !args.check) {
+    warn(
+      `Exported bundle names hostedFile() icons whose files it does not carry: ${hostedOwners.join(", ")}. Deploying it with \`--bundle\` is refused; \`xanosdk deploy ${shellWord(pastePath(args.file))}\` ships the files.`,
+      "export.hosted-files-omitted"
+    );
+  }
+  const { runBundleHooks } = await import("./toolchain-hooks-GHKLUJOH.js");
+  await runBundleHooks(
+    toolchain.loaded,
+    {
+      bundle: bundleObject,
+      entry: args.file,
+      cwd: process.cwd(),
+      command: "export",
+      frozen: args.frozenLock === true || args.check === true,
+      sdkVersion: readVersion()
+    },
+    ""
+  );
+  const { refreshEnvExample, bundleEnvNames: bundleEnvNames2 } = await import("./env-example-refresh-ET5HMMDW.js");
+  const { backendDirFor } = await import("./backend-dir-2U53CIAL.js");
+  const declaredSet = new Set(declaredEnvNames);
+  const templateDir = backendDirFor(args.file);
+  const ownsTemplate = isWithin(resolve2(args.file), templateDir) && (dirname2(resolve2(args.file)) === templateDir || !existsSync2(join2(templateDir, "index.ts")));
+  const templateEnv = Object.fromEntries(
+    Object.entries(bundleEnvNames2(bundleObject)).filter(([name]) => declaredSet.has(name))
+  );
+  const { skewedProjectSdk, skewNote, installedCliCommand } = await import("./project-sdk-REPPOIBD.js");
+  const projectSdk = skewedProjectSdk(dirname2(resolve2(args.file)), readVersion());
+  const regenerate = projectSdk === void 0 ? `xanosdk export ${shellWord(pastePath(args.file))} --out ${NULL_DEVICE}` : installedCliCommand(projectSdk.root, (path) => `export ${path(args.file)} --out ${NULL_DEVICE}`);
+  if (args.check) {
+    const staleEnvExample = ownsTemplate ? refreshEnvExample(templateDir, templateEnv, { write: false }) : void 0;
+    if (staleEnvExample !== void 0) {
+      const listed = new Set(
+        [...readFileSync3(staleEnvExample, "utf8").matchAll(/^# ([^\s=`]+)=/gm)].map((m) => m[1])
+      );
+      const quoted = (names) => names.map((n) => `\`${n}\``).join(", ");
+      const missing = Object.keys(templateEnv).filter((n) => !listed.has(n));
+      const extra = [...listed].filter((n) => !(n in templateEnv));
+      const drift = [
+        missing.length > 0 ? `omits ${quoted(missing)}, which this source declares` : "",
+        extra.length > 0 ? `still lists ${quoted(extra)}, which this source no longer declares` : ""
+      ].filter(Boolean);
+      if (drift.length === 0 && projectSdk !== void 0) {
+        info(skewNote(displayPath(staleEnvExample), readVersion(), projectSdk.version, regenerate));
+      } else {
+        throw new CliError(
+          DRIFT,
+          `--check: ${displayPath(staleEnvExample)} ${drift.length > 0 ? drift.join(", and ") : `lists the env names this source declares, but in other words than @xano/sdk ${readVersion()} renders the template`}. Run \`${regenerate}\` locally \u2014 it rewrites the template (names only, never a value) and writes the bundle nowhere \u2014 then commit it and retry.`
+        );
+      }
+    }
+    const lockPath = resolveLockPath(args, args.file);
+    const lock = !args.noLock && existsSync2(lockPath) ? { path: displayPath(lockPath), changed: false } : null;
+    if (isMachineOutput(args)) writeJson({ checked: resolve2(args.file), lock, written: false });
+    else {
+      success(
+        `Checked ${args.file}: ` + (args.noLock ? `it compiles and every guard, toolchain check and .env.example passes; no xano.lock yet, so identities were not checked \u2014 \`${regenerate}\` records one to commit.` : lock === null ? "nothing to record in xano.lock." : "xano.lock is up to date.") + ` Nothing was written.`
+      );
+    }
+    return;
+  }
+  const hadEnvExample = existsSync2(join2(templateDir, ".env.example"));
+  const held = ownsTemplate && projectSdk !== void 0 ? refreshEnvExample(templateDir, templateEnv, { write: false }) : void 0;
+  if (held !== void 0) {
+    warn(skewNote(displayPath(held), readVersion(), projectSdk.version, regenerate), "export.env-example-cli-skew");
+  }
+  let refreshed;
+  try {
+    refreshed = ownsTemplate && projectSdk === void 0 ? refreshEnvExample(templateDir, templateEnv) : void 0;
+  } catch (err) {
+    if (isUnwritableError(err)) throw unwritableError(join2(templateDir, ".env.example"));
+    throw err;
+  }
+  if (refreshed !== void 0) {
+    info(`${hadEnvExample ? "Updated" : "Wrote"} ${displayPath(refreshed)} to list the env names this source declares.`);
+  }
+  if (out) {
+    const { secretsCarriedBy } = await import("./live-diff-YONW2VI3.js");
+    const { writeExportFile } = await import("./output-target-AL3I44GG.js");
+    const written = lockOutcome?.changed ? `Only ${lockOutcome.path} was written` : void 0;
+    writeExportFile(out, json + "\n", secretsCarriedBy(bundleObject), "--out", written);
+    reportWrote(args, out, lockOutcome);
+  } else {
+    process.stdout.write(json + "\n");
+    const { secretsCarriedBy } = await import("./live-diff-YONW2VI3.js");
+    const { secretsPhrase } = await import("./output-target-AL3I44GG.js");
+    const secrets = secretsCarriedBy(bundleObject);
+    if (secrets.length > 0) {
+      warn(
+        `The export carries ${secretsPhrase(secrets)} in cleartext \u2014 written to stdout, where no file permission protects it; do not commit or log it.`,
+        "secrets.cleartext-stdout"
+      );
+    }
+  }
+}
+function reportWrote(args, out, lock) {
+  if (isMachineOutput(args)) {
+    writeJson({ out: resolve2(out), written: true, ...lock === void 0 ? {} : { lock } });
+  } else success(`Wrote ${out}`);
+}
+async function refreshAgentGuidance(args) {
+  if (args.noRefresh) return;
+  if (args.check || args.frozenLock || args.dryRun) return;
+  try {
+    const { installedSdk, skewedProjectSdk, skewNote, installedCliCommand } = await import("./project-sdk-REPPOIBD.js");
+    const entryProject = args.file === void 0 ? void 0 : installedSdk(dirname2(resolve2(args.file)))?.root;
+    const projectDir = existsSync2(join2(process.cwd(), "AGENTS.md")) || entryProject === void 0 ? process.cwd() : entryProject;
+    const projectSdk = skewedProjectSdk(projectDir, readVersion());
+    const { refreshAgentFiles } = await import("./agent-file-refresh-ZEMK33AX.js");
+    if (projectSdk !== void 0) {
+      const stale = refreshAgentFiles({ projectDir, sdkVersion: readVersion(), write: false });
+      const file = args.file;
+      const command = installedCliCommand(
+        projectSdk.root,
+        (path) => `export${file === void 0 ? "" : ` ${path(file)}`} --out ${NULL_DEVICE}`
+      );
+      for (const path of stale) info(skewNote(displayPath(join2(projectDir, path)), readVersion(), projectSdk.version, command));
+      return;
+    }
+    const refreshed = refreshAgentFiles({
+      projectDir,
+      sdkVersion: readVersion()
+    });
+    for (const path of refreshed) {
+      process.stderr.write(`Refreshed ${displayPath(join2(projectDir, path))} for @xano/sdk ${readVersion()}.
+`);
+    }
+  } catch {
+  }
+}
+function nearestLockPath(file) {
+  const start = dirname2(resolve2(file));
+  let dir = start;
+  for (; ; ) {
+    const candidate = join2(dir, "xano.lock");
+    if (existsSync2(candidate)) return candidate;
+    if (existsSync2(join2(dir, "package.json"))) return join2(start, "xano.lock");
+    const parent = dirname2(dir);
+    if (parent === dir) return join2(start, "xano.lock");
+    dir = parent;
+  }
+}
+function missingLockDir(args) {
+  if (args.lockPath === void 0) return void 0;
+  const dir = dirname2(resolve2(args.lockPath));
+  if (existsSync2(dir)) return void 0;
+  return `\`--lock=${args.lockPath}\`: ${displayPath(dir)}/ doesn't exist \u2014 create it, or pass a \`--lock\` path in an existing directory.`;
+}
+function resolveLockPath(args, file) {
+  return args.lockPath !== void 0 ? resolve2(args.lockPath) : join2(dirname2(resolve2(file)), "xano.lock");
+}
+function isParseableLock(lockPath) {
+  try {
+    readLockFile(lockPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function noteUnlockedBuild() {
+  info("Building without an identity lock (`--no-lock`).");
+  detail("Identities derive from names, so renaming an object becomes delete-and-create on sync.");
+  detail(
+    "Public URLs not pinned in code are left for the instance to invent, and this project will not learn them; a `canonical` written on a def still applies."
+  );
+  detail(
+    "`xanosdk deploy --to <backend> --prune` needs the lock to know what this project owns there, so it is unavailable except onto an ephemeral, whose landing record is kept in .xano/ephemeral.json instead."
+  );
+}
+function adoptBeforeFirstLock(lockPath, args) {
+  const deploying = args?.command === "deploy";
+  if (deploying && (args.localEngine || args.to === void 0 || args.to.startsWith("local-engine"))) return void 0;
+  const importLine = `\`xanosdk lock import live.json --lock=${shellWord(displayPath(lockPath))} --yes\``;
+  const ending = "so the lock adopts the URLs it already serves instead of values it will not accept.";
+  const target = deploying ? args.to : "workspace";
+  const colon = target.indexOf(":");
+  const kind = colon === -1 ? target : target.slice(0, colon);
+  const name = colon === -1 ? void 0 : target.slice(colon + 1);
+  if (kind === "ephemeral") {
+    return `Deploying to an ephemeral that already holds objects? Adopt what it serves first \u2014 \`xanosdk ephemeral export${name === void 0 || name === "" ? "" : ` ${shellWord(name)}`} --path live.json${contextFlags()}\`, then ${importLine} \u2014 ${ending}`;
+  }
+  if (kind === "tenant") return void 0;
+  return `Deploying to a workspace that already exists? Adopt what it serves first \u2014 \`xanosdk workspace export --path live.json${contextFlags()}\`, then ${importLine} \u2014 ${ending}`;
+}
+function noteLockCreated(lockPath, args, opts = {}) {
+  info(`Wrote ${displayPath(lockPath)} \u2014 commit it.`);
+  detail("It pins this project's object identities and public URLs: renames stay renames, and the");
+  detail("URLs stay yours. A later deploy honors what it records.");
+  const adopt = opts.adopt === false ? void 0 : adoptBeforeFirstLock(lockPath, args);
+  if (adopt !== void 0) detail(adopt);
+  if (isCI()) {
+    warn(
+      "This lock was created in CI, which means the repository does not have one.",
+      "lock.created-in-ci",
+      [
+        "It is discarded with the checkout and re-minted next run, so the identities it froze",
+        "do not survive. Commit the lock, or add `--frozen-lock` to fail instead."
+      ]
+    );
+  }
+}
+function commandLabel(args) {
+  return [args.command ?? "export", args.subcommand].filter((p) => p !== void 0).join(" ");
+}
+function describeDefaultExport(def) {
+  if (def === void 0) return "no default export";
+  if (def === null) return "null";
+  if (Array.isArray(def)) return "an array (export one def, not a list)";
+  if (typeof def !== "object") return `a ${typeof def}`;
+  return "an object with no `name`";
+}
+async function runCompile(args) {
+  const file = args.file;
+  if (existsSync2(file) && statSync3(file).isDirectory()) {
+    const example = readdirSync2(file).filter((n) => /\.[mc]?ts$/.test(n) && !n.endsWith(".d.ts")).sort()[0] ?? "<def>.ts";
+    throw new UsageError(
+      `compile: "${file}" is a directory. \`compile\` takes one module that exports a single def \u2014 \`xanosdk compile ${shellWord(join2(file, example))}\`; for a whole workspace, \`xanosdk export <entry>\`.`,
+      { hintFor: { command: "compile" } }
+    );
+  }
+  const lockPath = args.lockPath !== void 0 ? resolve2(args.lockPath) : nearestLockPath(file);
+  if (args.lockPath !== void 0 && !existsSync2(lockPath)) {
+    throw new UsageError(
+      `compile: no lock file at ${displayPath(lockPath)}. \`compile\` reads the lock and never writes one \u2014 point \`--lock\` at the xano.lock \`xanosdk export\` wrote, or drop it to use the nearest one.`,
+      { hintFor: { command: "compile" } }
+    );
+  }
+  resetLockOverrides();
+  if (existsSync2(lockPath)) {
+    seedLockOverrides(readLockFile(lockPath));
+  }
+  const mod = await loadModule(file);
+  const namedDefs = () => Object.entries(mod).filter(
+    ([key, value]) => key !== "default" && value !== null && typeof value === "object" && !Xano.isXano(value) && typeof value.name === "string"
+  );
+  if (args.exportName !== void 0 && !Object.hasOwn(mod, args.exportName)) {
+    const names = namedDefs().map(([key]) => `\`${key}\``);
+    throw new UsageError(
+      `Module "${file}" has no export \`${args.exportName}\`.` + (names.length > 0 ? ` Its named defs: ${names.join(", ")}.` : ""),
+      { hintFor: { command: "compile" } }
+    );
+  }
+  let def = args.exportName !== void 0 ? mod[args.exportName] : mod.default;
+  if (def === void 0 && args.exportName === void 0) {
+    const named = namedDefs();
+    if (named.length === 1) {
+      def = named[0][1];
+      info(`Compiling the named export \`${named[0][0]}\` (the module has no default export).`);
+    } else if (named.length > 1) {
+      throw new UsageError(
+        `Module "${file}" has no default export and ${named.length} named defs \u2014 ${named.map(([key]) => `\`${key}\``).join(", ")} \u2014 so \`compile\`, which takes one def, cannot tell which to compile. Name one: \`xanosdk compile ${shellWord(file)} --export ${named[0][0]}\`, or export the workspace with \`xanosdk export\`.`,
+        { hintFor: { command: "compile" } }
+      );
+    }
+  }
+  if (Xano.isXano(def)) {
+    throw new UsageError(
+      `Module "${file}" default-exports a workspace \u2014 use \`xanosdk export\` (or \`xanosdk routes\`) for a workspace entry. \`compile\` takes a single object def (a query, function, table, \u2026) and prints its JSON artifact.`,
+      { hintFor: { command: "compile" } }
+    );
+  }
+  if (!def || typeof def !== "object" || typeof def.name !== "string") {
+    throw new UsageError(
+      `Module "${file}" must default-export a single object def (a query, function, table, \u2026) \u2014 one object with a \`name\`. Got: ${describeDefaultExport(def)}.`,
+      { hintFor: { command: "compile" } }
+    );
+  }
+  const one = def;
+  const encode = await emitterFor(file);
+  if (encode === emit && standaloneDefKind(one) === void 0) throw unplaceableDef(file, one.name);
+  const raised = [];
+  const previousSink = setDiagnosticSink((d) => raised.push(d));
+  const docTokens = /* @__PURE__ */ Object.create(null);
+  for (const [key, entry] of Object.entries(readSecretsFile(join2(dirname2(lockPath), ".secrets.json"))?.documentationTokens ?? {})) {
+    docTokens[key] = entry.value;
+  }
+  let artifact;
+  try {
+    artifact = withPinnedGuid(encode(one, { hostedFiles: hostedFileResolver(), documentationTokens: docTokens }), one);
+  } catch (err) {
+    if (encode !== emit && err instanceof Error && /cannot tell what kind of def/.test(err.message)) {
+      throw unplaceableDef(file, one.name);
+    }
+    throw err;
+  } finally {
+    setDiagnosticSink(previousSink);
+  }
+  if (standaloneDefKind(one) === "knowledge") artifact = withKnowledgeContent(artifact, one, raised);
+  const parsedArtifact = JSON.parse(artifact);
+  const gate = one.documentation;
+  if (standaloneDefKind(one) === "api_group" && gate?.require_token === true && parsedArtifact.documentation === void 0) {
+    raised.push({
+      severity: "warning",
+      code: "doc-token.unsupplied",
+      message: `API group "${one.name}" declares a documentation gate and no token was found for it in \`${displayPath(join2(dirname2(lockPath), ".secrets.json"))}\`, so this artifact carries no \`documentation\` block \u2014 the bytes an export would write CLEAR the group's gate. \`xanosdk pull\` stores the token there.`
+    });
+  }
+  checkCompiledDef(one, artifact, args.strict === true, raised);
+  if (args.out && args.out !== "-") {
+    mkdirSync(dirname2(resolve2(args.out)), { recursive: true });
+    writeFileSync(args.out, artifact + "\n", "utf8");
+    reportWrote(args, args.out);
+  } else {
+    writeData(process.stdout, artifact + "\n");
+  }
+}
+function withKnowledgeContent(artifact, def, raised) {
+  const [resolved] = resolveKnowledge([def]);
+  if (resolved === void 0) return artifact;
+  for (const w of resolved.warnings ?? []) raised.push({ severity: "warning", code: w.code, message: w.message });
+  return JSON.stringify({ ...JSON.parse(artifact), content: resolved.content }, null, 2);
+}
+function unplaceableDef(file, name) {
+  return new UsageError(
+    `Module "${file}" exports "${name}", which nothing marks as a kind of def \u2014 no factory brand, no \`verb\`, \`schema\` or group key \u2014 so \`compile\` cannot tell which encoder to use. Build it with its factory (\`defineFunction({...})\`, \`table({...})\`, \`task({...})\`, \u2026) rather than as an object literal or a spread copy.`,
+    { hintFor: { command: "compile" } }
+  );
+}
+function withPinnedGuid(artifact, def) {
+  if (typeof def.guid !== "string" || def.guid === "") return artifact;
+  const parsed = JSON.parse(artifact);
+  if (parsed.guid !== void 0) return artifact;
+  return JSON.stringify({ ...parsed, guid: def.guid }, null, 2);
+}
+async function runPaths(args) {
+  const file = args.file;
+  if (args.emit === "-" && args.strict) {
+    throw new UsageError(
+      "`--strict` checks a committed route manifest, and `--emit -` writes to stdout \u2014 name the file it should check: `--emit <path> --strict`.",
+      { hintFor: { command: "routes" } }
+    );
+  }
+  const lockPath = resolveLockPath(args, file);
+  resetLockOverrides();
+  const lockModel = existsSync2(lockPath) ? readLockFile(lockPath) : void 0;
+  const def = await loadDefault(file);
+  if (!Xano.isXano(def)) {
+    throw new UsageError(
+      `Module "${file}" must default-export a Xano registry for \`${commandLabel(args)}\` \u2014 \`export default workspace("\u2026")\u2026\`. Got: ${describeDefaultExport(def)}.`
+    );
+  }
+  const outerSink = setDiagnosticSink((d) => {
+    if (d.code !== "microservice.early-surface") outerSink(d);
+  });
+  let bundle;
+  try {
+    bundle = def.export({ strict: args.strict, documentationTokens: checkStandInTokens(def).values });
+  } finally {
+    setDiagnosticSink(outerSink);
+  }
+  const payload = bundle.payload;
+  const { planRouteManifest } = await import("./routes-manifest-SNWUVBT6.js");
+  const plan = planRouteManifest(payload, (kind, name) => lockModel?.objects[lockKey(kind, name)]?.canonical);
+  const queryCount = plan.rows.length;
+  const realtimeCount = plan.servers.length + plan.unresolvedServers.length;
+  const machine = isMachineOutput(args);
+  const emptiedManifest = args.emit !== void 0 && queryCount === 0 && realtimeCount === 0 && existsSync2(args.emit);
+  if (queryCount === 0 && !(args.emit !== void 0 && realtimeCount > 0) && !emptiedManifest) {
+    info("No API queries registered in this workspace.");
+    if (machine && args.emit !== "-") writeJson(args.emit !== void 0 ? { emit: resolve2(args.emit), written: false, routes: 0, channels: 0 } : { routes: [] });
+    return;
+  }
+  const unresolved = plan.unresolved;
+  const resolved = plan.resolved;
+  if (args.emit !== void 0) {
+    const unresolvedServers = plan.unresolvedServers.map((name) => ({ name }));
+    const describableServers = plan.servers;
+    const channelRows = plan.channels;
+    if (unresolvedServers.length > 0) {
+      warn(
+        `${args.emit}: leaving out ${countOf(unresolvedServers.length, "realtime server")} \u2014 ${unresolvedServers.map((s) => `"${s.name}"`).join(", ")} \u2014 whose canonical URL token resolves nowhere, along with their channels. Set an explicit \`realtimeServer({ canonical })\`, or run \`xanosdk export ${shellWord(file)} --out ${NULL_DEVICE}\` once (it mints a unique canonical and freezes it in xano.lock, and writes the bundle nowhere), then re-run to include them.`,
+        "routes.realtime-unresolved"
+      );
+    }
+    if (unresolved.length > 0) {
+      const { unresolvedCanonicalMessage } = await import("./routes-manifest-SNWUVBT6.js");
+      const why = `${args.emit} was not written: ${unresolvedCanonicalMessage(unresolved, shellWord(file))}`;
+      if (args.strict) throw new Error(`--strict: ${why}`);
+      warn(why, "routes.not-written");
+      if (machine && args.emit !== "-") writeJson({ emit: resolve2(args.emit), written: false, routes: 0, channels: 0 });
+      return;
+    }
+    if (resolved.length === 0 && describableServers.length === 0 && !emptiedManifest) {
+      info(`Nothing to write to ${args.emit} yet.`);
+      if (machine && args.emit !== "-") writeJson({ emit: resolve2(args.emit), written: false, routes: 0, channels: 0 });
+      return;
+    }
+    const { renderPlannedManifest, renderRouteManifest } = await import("./routes-manifest-SNWUVBT6.js");
+    const source = emptiedManifest ? renderRouteManifest([]) : renderPlannedManifest(plan);
+    const routeCount = resolved.length === 1 ? "1 route" : `${resolved.length} routes`;
+    const channelCount = channelRows.length === 1 ? "1 channel" : `${channelRows.length} channels`;
+    const count = describableServers.length > 0 ? `${routeCount}, ${channelCount}` : routeCount;
+    if (args.emit === "-") {
+      writeData(process.stdout, source);
+      return;
+    }
+    const { installedSdk, skewedProjectSdk, skewNote, installedCliCommand } = await import("./project-sdk-REPPOIBD.js");
+    const emitDir = dirname2(resolve2(args.emit));
+    const projectSdk = skewedProjectSdk(installedSdk(emitDir) !== void 0 ? emitDir : dirname2(resolve2(file)), readVersion());
+    if (projectSdk !== void 0 && existsSync2(args.emit) && readFileSync3(args.emit, "utf8") !== source) {
+      const emit2 = args.emit;
+      const installed = installedCliCommand(
+        projectSdk.root,
+        (path) => `routes ${path(file)} --emit ${path(emit2)}${args.strict ? " --strict" : ""}`
+      );
+      if (args.strict) {
+        throw new CliError(
+          DRIFT,
+          `--strict: ${displayPath(emit2)} differs from what this CLI (@xano/sdk ${readVersion()}) renders, and the project has ${projectSdk.version} installed, whose wording the table follows \u2014 so this CLI cannot tell a stale table from a current one. Run \`${installed}\` to check it with the installed CLI.`
+        );
+      }
+      warn(skewNote(emit2, readVersion(), projectSdk.version, installed), "routes.cli-skew");
+      if (machine) writeJson({ emit: resolve2(emit2), written: false, routes: resolved.length, channels: 0 });
+      return;
+    }
+    if (args.strict) {
+      const current = existsSync2(args.emit) ? readFileSync3(args.emit, "utf8") : void 0;
+      if (current !== source) {
+        throw new CliError(
+          DRIFT,
+          `--strict: ${args.emit} is ${current === void 0 ? "missing" : "out of date"}. Run ${routesRegenerateCommand(file, args.emit)} and commit the result \u2014 a stale route manifest keeps compiling while the endpoints have moved.`
+        );
+      }
+      info(`${args.emit} is up to date (${count}).`);
+    }
+    let written = false;
+    if (!args.strict) {
+      const current = existsSync2(args.emit) ? readFileSync3(args.emit, "utf8") : void 0;
+      if (current === source) {
+        info(`${args.emit} is already up to date (${count}).`);
+      } else {
+        try {
+          mkdirSync(dirname2(resolve2(args.emit)), { recursive: true });
+          writeFileSync(args.emit, source, "utf8");
+        } catch (err) {
+          if (isUnwritableError(err)) throw unwritableError(args.emit, "pass `--emit` a path you can write");
+          throw err;
+        }
+        written = true;
+        info(`Wrote ${args.emit} (${count}).`);
+      }
+    }
+    if (machine) {
+      writeJson({
+        emit: resolve2(args.emit),
+        written,
+        routes: resolved.length,
+        channels: describableServers.length > 0 ? channelRows.length : 0
+      });
+    }
+  } else if (machine) {
+    if (unresolved.length === 0) {
+      writeJson({
+        routes: resolved.map((r) => ({
+          verb: r.verb,
+          path: `/api:${r.canonical}/${r.name}`,
+          ref: `api:${r.canonical}/${r.name}`
+        }))
+      });
+    }
+  } else {
+    const verbWidth = Math.max(0, ...resolved.map((r) => r.verb.length));
+    for (const r of resolved) {
+      const path = `/api:${r.canonical}/${r.name}`;
+      process.stdout.write(`${r.verb.padEnd(verbWidth)}  ${path}  api:${r.canonical}/${r.name}
+`);
+    }
+  }
+  if (unresolved.length > 0) {
+    const { unresolvedCanonicalMessage } = await import("./routes-manifest-SNWUVBT6.js");
+    throw new UsageError(`${commandLabel(args)}: ${unresolvedCanonicalMessage(unresolved, shellWord(file))}`);
+  }
+}
+async function refreshRouteManifest(entry, emit2) {
+  resetLockOverrides();
+  const lockPath = join2(dirname2(resolve2(entry)), "xano.lock");
+  const lockModel = existsSync2(lockPath) ? readLockFile(lockPath) : void 0;
+  const def = await loadDefault(entry);
+  if (!Xano.isXano(def)) return { manifest: "absent", lockOrphans: 0 };
+  const previousSink = setDiagnosticSink(() => {
+  });
+  let payload;
+  try {
+    payload = def.export({ documentationTokens: checkStandInTokens(def).values }).payload;
+  } finally {
+    setDiagnosticSink(previousSink);
+  }
+  const { pulledIdentities } = await import("./pull-command-VBO7C4S3.js");
+  const live = pulledIdentities(payload);
+  const lockOrphans = lockModel === void 0 ? 0 : Object.keys(lockModel.objects).filter((k) => k !== WORKSPACE_KEY && !live.has(k)).length;
+  if (!existsSync2(emit2)) return { manifest: "absent", lockOrphans };
+  const { planRouteManifest, renderPlannedManifest, renderRouteManifest } = await import("./routes-manifest-SNWUVBT6.js");
+  const plan = planRouteManifest(payload, (kind, name) => lockModel?.objects[lockKey(kind, name)]?.canonical);
+  if (plan.unresolved.length > 0) return { manifest: "skipped", lockOrphans };
+  const source = renderPlannedManifest(plan) ?? (plan.resolved.length === 0 && plan.servers.length === 0 ? renderRouteManifest([]) : void 0);
+  if (source === void 0) return { manifest: "skipped", lockOrphans };
+  if (readFileSync3(emit2, "utf8") === source) return { manifest: "unchanged", lockOrphans };
+  try {
+    writeFileSync(emit2, source, "utf8");
+  } catch (err) {
+    if (isUnwritableError(err)) throw unwritableError(emit2);
+    throw err;
+  }
+  return { manifest: "written", lockOrphans };
+}
+function routesRegenerateCommand(file, emit2) {
+  try {
+    const pkg = JSON.parse(readFileSync3(join2(process.cwd(), "package.json"), "utf8"));
+    const script = pkg.scripts?.["xano:routes"];
+    if (typeof script === "string" && script.includes(`--emit ${emit2}`)) return "`npm run xano:routes`";
+  } catch {
+  }
+  return `\`xanosdk routes ${shellWord(file)} --emit ${shellWord(emit2)}\``;
+}
+async function exportBundleJson(args) {
+  return (await compileBundle(args)).bundle;
+}
+async function compileBundle(args, opts = {}) {
+  const file = args.file;
+  const lockPath = resolveLockPath(args, file);
+  const lockExists = existsSync2(lockPath);
+  resetLockOverrides();
+  let lockCtx;
+  let originalSerialized;
+  let droppedLandings = [];
+  strictFindings = args.strict ? [] : void 0;
+  exportFindings = [];
+  let lockReport = null;
+  let commitLock;
+  let deferredOrphans;
+  let uncommittedOrphans;
+  let classifiedLock;
+  if (args.noLock) {
+    if (lockExists && isParseableLock(lockPath)) {
+      if (args.command === "export" && args.check) {
+        throw new UsageError(
+          `\`--no-lock\` refused: ${displayPath(lockPath)} exists, and a check without it would skip the identities it pins. Drop \`--no-lock\`: \`xanosdk export ${shellWord(pastePath(args.file ?? ""))} --check\` checks them too.`
+        );
+      }
+      throw new UsageError(
+        `\`--no-lock\` refused: ${displayPath(lockPath)} exists and pins this project's identities.
+Building without it derives guids from names instead, so every object the lock pins under a different guid is deleted and recreated by whatever this bundle is released to.
+Drop \`--no-lock\` to build against the lock, or delete the lock first if you really mean to abandon those identities.`
+      );
+    }
+    assertEntryExists(file);
+    if (!(args.command === "export" && args.check)) noteUnlockedBuild();
+  } else {
+    const loaded = lockExists ? readLockFileReport(lockPath) : { lock: emptyLock(), droppedLandings: [] };
+    const lockModel = loaded.lock;
+    droppedLandings = loaded.droppedLandings;
+    if (lockExists) originalSerialized = serializeLock(lockModel);
+    seedLockOverrides(lockModel);
+    lockCtx = createLockContext(lockModel);
+  }
+  const buildWarnings = [];
+  const previousSink = setDiagnosticSink((diagnostic) => {
+    if (diagnostic.severity === "warning") buildWarnings.push(diagnostic);
+    if (!(args.strict && diagnostic.severity === "warning")) {
+      previousSink(diagnostic);
+      if (diagnostic.severity === "warning") noteRunWarning(diagnostic.code, diagnostic.message, diagnostic.subject);
+    }
+  });
+  const checkOnly = args.command === "export" && args.check;
+  const accepted = [];
+  let def;
+  let bundle;
+  let libraryRefusal;
+  const hostedFiles = hostedFileResolver();
+  let exportForChecks;
+  try {
+    const loaded = await loadDefault(file);
+    if (!Xano.isXano(loaded)) {
+      throw new UsageError(
+        `Module "${file}" must default-export a Xano registry for \`${commandLabel(args)}\` \u2014 \`export default workspace("\u2026")\u2026\`. Got: ${describeDefaultExport(loaded)}.`
+      );
+    }
+    def = loaded;
+    if (opts.seed) await registerSeedHostedFiles(loaded.tables(), hostedFiles, loaded.workspaceSettings().use_xdo === true);
+    const resolvedKnowledge = resolveKnowledge(def.knowledge());
+    const envOverrides = checkOnly ? {} : resolveWorkspaceEnv(args, file, def.workspaceSettings());
+    const docTokens = checkOnly ? checkStandInTokens(def) : resolveDocumentationTokens(args, file, def);
+    const exportOptions = {
+      knowledge: resolvedKnowledge,
+      ...Object.keys(envOverrides).length > 0 ? { envOverrides } : {},
+      documentationTokens: docTokens.values,
+      allowEmptyDocToken: docTokens.allowEmpty,
+      secretsRemedy: secretsRemedyFor(file)
+    };
+    const built = def;
+    exportForChecks = () => built.export({ ...exportOptions, hostedFiles: hostedFileResolver() });
+    bundle = def.export({ ...lockCtx ? { lock: lockCtx } : {}, strict: args.strict, ...exportOptions, hostedFiles, accepted });
+  } catch (err) {
+    if (!(args.strict && isDiagnosticError(err))) throw err;
+    libraryRefusal = err;
+  } finally {
+    setDiagnosticSink(previousSink);
+    noteRunAccepted(accepted);
+  }
+  checkFilterNames(bundle ?? quietly(exportForChecks));
+  const library = [...buildWarnings, ...libraryRefusal?.details ?? []];
+  if (args.strict && library.some((d) => d.severity === "warning")) failStrictFindings(args, library);
+  if (libraryRefusal !== void 0) throw libraryRefusal;
+  failStrictFindings(args);
+  if (bundle === void 0 || def === void 0) throw new Error("unreachable: no bundle and no refusal");
+  const literalIcons = uncarriedHostedIcons(
+    bundle.payload ?? {},
+    new Set(hostedFiles.files().map((f) => f.canonical))
+  );
+  if (literalIcons.length > 0) {
+    throw new UsageError(
+      `${countOf(literalIcons.length, "icon")} name${literalIcons.length === 1 ? "s" : ""} a hosted file by a literal \`xanosdk-file://\` src, which carries no bytes \u2014 a bundle's placeholder copied into source:
+` + literalIcons.map((i) => `  ${i.owner} \`icons[${i.index}]\`: save the image as ${i.name} beside its module and write \`src: hostedFile("./${i.name}", import.meta.url)\``).join("\n")
+    );
+  }
+  if (lockCtx) {
+    const { lock: merged, orphans, dropped, cededCanonicals } = mergeObserved(
+      lockCtx.lock,
+      lockCtx.observed,
+      // A gate that never writes keeps the `lock import` provenance note: its
+      // clearing is not drift. A writing export clears it for what it declares.
+      {
+        keepAdopted: args.frozenLock === true || args.lockReadOnly === true,
+        landedGuids: new Set(allLandings(process.cwd(), lockCtx.lock).flatMap(([, record]) => Object.values(record).map((e) => e.guid)))
+      }
+    );
+    validateLockModel(merged, displayPath(lockPath), lockCtx.observed);
+    classifiedLock = merged;
+    const gate = checkOnly ? "export --check" : "--frozen-lock";
+    const kinds = toolsetKindsFromPayload(bundle.payload, lockCtx.lock.objects);
+    if (args.frozenLock && !args.allowLockOrphans && orphans.length > 0) {
+      throw frozenOrphanError(orphans, file, lockPath, gate, { previous: lockCtx.lock, observed: lockCtx.observed, kinds });
+    }
+    const changed = originalSerialized === void 0 ? Object.keys(merged.objects).length > 0 : serializeLock(merged) !== originalSerialized || droppedLandings.length > 0;
+    const identitiesChanged = changed && (originalSerialized === void 0 || droppedLandings.length > 0 || serializeLock(withoutGuidSources(merged)) !== serializeLock(withoutGuidSources(lockCtx.lock)));
+    if (args.frozenLock && identitiesChanged) {
+      throw new CliError(
+        DRIFT,
+        frozenChangeMessage(gate, lockExists ? lockCtx.lock : void 0, merged, file, lockPath, def, args, kinds, droppedLandings)
+      );
+    }
+    if (args.strict && args.lockReadOnly !== true) {
+      warnOrphans(orphans, dropped, cededCanonicals, lockCtx.lock, lockCtx.observed, file, lockPath, kinds, args.frozenLock || args.dryRun === true, args.allowLockOrphans);
+      failStrictFindings(args);
+    }
+    const skipWrite = args.lockReadOnly === true || args.frozenLock || !lockExists && Object.keys(merged.objects).length === 0;
+    const observedLock = lockCtx.lock;
+    const observed = lockCtx.observed;
+    const repinned = lockCtx.repinned ?? [];
+    const dryRun = args.dryRun === true;
+    let orphansWarned = false;
+    const warnLockOrphans = (pruned) => {
+      if (orphansWarned || args.strict || args.lockReadOnly === true && !dryRun) return;
+      orphansWarned = true;
+      const unexplained = pruned === void 0 ? orphans : orphans.filter((key) => !pruned.has(key));
+      const ceded = pruned === void 0 ? cededCanonicals : cededCanonicals.filter((key) => !pruned.has(key));
+      warnOrphans(unexplained, dropped, ceded, observedLock, observed, file, lockPath, kinds, dryRun || skipWrite, args.allowLockOrphans);
+    };
+    const writeLock = (commitOpts) => {
+      try {
+        if (!skipWrite) writeLockFile(lockPath, merged);
+      } catch (err) {
+        const noDir = missingLockDir(args);
+        if (noDir !== void 0) throw new UsageError(noDir);
+        const reason = err instanceof Error ? err.message : String(err);
+        const remedy = lockExists ? "Point at a writable location with `--lock=<path>`, or make the directory writable." : "Build without a lock with `--no-lock` (identities then derive from names), or make the directory writable.";
+        const message = `Could not write ${displayPath(lockPath)}: ${reason}
+${remedy}`;
+        throw isUnwritableError(err) ? new UsageError(message) : new Error(message);
+      }
+      if (!lockExists && !skipWrite) {
+        noteLockCreated(lockPath, commitOpts?.to === void 0 ? args : { ...args, to: commitOpts.to }, {
+          adopt: commitOpts?.nothingToAdopt !== true
+        });
+      } else if (lockExists && !skipWrite && changed) info(`Updated ${displayPath(lockPath)} \u2014 commit it.`);
+      if (!skipWrite) {
+        for (const r of repinned) {
+          const shown = displayLockKey(r.key, kinds);
+          if (!r.key.startsWith("dbo:")) {
+            detail(`${shown} now pins ${r.to}, the guid its def declares (the lock had ${r.from}).`);
+            continue;
+          }
+          const name = r.key.slice("dbo:".length);
+          if (merged.objects[r.key]?.replaced?.includes(r.from) !== true) {
+            detail(`${shown} now pins ${r.to}, the guid its def declares (the lock had ${r.from}).`);
+            continue;
+          }
+          warn(
+            `${shown} now pins ${r.to}, the guid its def declares \u2014 the lock had ${r.from}. An environment holding the table under ${r.from} would drop it with its rows at the next merge, so xano.lock keeps ${r.from} as \`replaced\` and a keep-data deploy there refuses until you choose. If it is the same table, set its def to \`guid: "${r.from}"\`.`,
+            "lock.repinned-table",
+            [
+              `if the old table is not wanted: xanosdk lock prune --identity-only ${shellWord(`table:${name}`)} --lock=${shellWord(displayPath(lockPath))} --yes \u2014 then, where an environment holds it, rename the def to "${name}_tmp" and deploy, then back to "${name}" and deploy again: a merge cannot replace a table with another of its own name, so the first drops the old table with its rows and the second renames the new one`
+            ]
+          );
+        }
+      }
+      if (opts.deferOrphanWarning !== true) warnLockOrphans(commitOpts?.pruned);
+    };
+    if (opts.deferOrphanWarning === true) deferredOrphans = warnLockOrphans;
+    lockReport = !lockExists && Object.keys(merged.objects).length === 0 ? null : { path: displayPath(lockPath), changed: !skipWrite && changed };
+    if (opts.deferLockWrite === true && !skipWrite) {
+      commitLock = writeLock;
+      if (opts.deferOrphanWarning !== true) uncommittedOrphans = () => warnLockOrphans();
+      if (dryRun && opts.deferOrphanWarning !== true) warnLockOrphans();
+    } else writeLock();
+  }
+  reportCapabilities(bundle);
+  const files = hostedFiles.files().map((f) => ({ name: hostedFileArchivePath(f), content: f.bytes }));
+  const resolvedContent = await buildSeedContentFiles(
+    def.tables(),
+    opts.seed ? hostedFiles : hostedFileResolver(),
+    def.workspaceSettings().use_xdo === true
+  );
+  const content = opts.seed ? resolvedContent : [];
+  const nonPublicSeedValues = opts.seed ? await collectNonPublicSeedValues(def.tables()) : [];
+  const omittedSeedTables = opts.seed ? [] : def.tables().filter((t) => t.seed !== void 0 && !(Array.isArray(t.seed) && t.seed.length === 0)).map((t) => t.name);
+  await refreshAgentGuidance(args);
+  return {
+    bundle: serializeBundle(bundle),
+    bundleObject: bundle,
+    content,
+    files,
+    omittedSeedTables,
+    nonPublicSeedValues,
+    lock: lockReport,
+    declaredEnvNames: declaredEnv(def.workspaceSettings()).map((e) => e.name),
+    warnings: [
+      ...buildWarnings.map(jsonWarning),
+      ...exportFindings
+    ],
+    ...classifiedLock !== void 0 ? { classifiedLock } : {},
+    ...commitLock !== void 0 ? { commitLock } : {},
+    ...deferredOrphans !== void 0 ? { warnLockOrphans: deferredOrphans } : {},
+    ...uncommittedOrphans !== void 0 ? { warnOrphansUncommitted: uncommittedOrphans } : {}
+  };
+}
+function projectRelative(path, entryFile, fallback) {
+  if (pathsShownFrom() !== void 0) return displayPath(path);
+  return relForwardSlash(process.cwd(), path) || relForwardSlash(projectRootFrom(dirname2(resolve2(entryFile))), path) || fallback;
+}
+function secretsRemedyFor(entryFile) {
+  const path = defaultWorkspaceSecretsPath(entryFile);
+  const fill = `xanosdk secrets fill ${shellWord(entryFile)}`;
+  const dir = dirname2(path);
+  return {
+    file: projectRelative(path, entryFile, WORKSPACE_SECRETS_FILE),
+    fill: existsSync2(dir) ? fill : `mkdir ${shellWord(displayPath(dir))} && ${fill}`
+  };
+}
+function resolveWorkspaceEnv(args, file, settings) {
+  const declared = declaredEnv(settings);
+  const declaredNames = declared.map((e) => e.name);
+  const declaredValues = Object.fromEntries(declared.map((e) => [e.name, e.value]));
+  const explicit = args.envFile !== void 0 ? resolve2(args.envFile) : void 0;
+  const defaultPath = defaultWorkspaceEnvPath(file);
+  const defaultLabel = projectRelative(defaultPath, file, WORKSPACE_ENV_FILE);
+  const fileValues = explicit !== void 0 ? parseEnvFile(explicit) : readWorkspaceEnvFile(defaultPath);
+  const badDeclared = declaredNames.filter((n) => !isRepresentableName(n));
+  if (badDeclared.length > 0) {
+    const one = badDeclared.length === 1;
+    throw new UsageError(
+      `\`workspaceConfig({ env })\` declares ${quotedNames(badDeclared)}, which ${one ? "is not a usable env var name" : "are not usable env var names"}. ${envNameRule()} Rename ${one ? "it" : "them"} there, and in every \`env("\u2026")\` that reads ${one ? "it" : "them"}.`
+    );
+  }
+  const badInFile = Object.keys(fileValues ?? {}).filter((n) => !isRepresentableName(n));
+  if (badInFile.length > 0) {
+    const one = badInFile.length === 1;
+    const where = explicit !== void 0 ? displayPath(explicit) : defaultLabel;
+    throw new UsageError(
+      `\`${where}\` sets ${quotedNames(badInFile)}, which ${one ? "is not a usable env var name" : "are not usable env var names"}. ${envNameRule()} Rename ${one ? "it" : "them"} in the file.`
+    );
+  }
+  const resolution = classifyEnv({
+    fileValues: fileValues ?? {},
+    flagValues: args.envVars,
+    declaredNames,
+    declaredValues
+  });
+  const source = explicit !== void 0 ? displayPath(explicit) : fileValues !== void 0 ? defaultLabel : void 0;
+  const allowed = new Set(args.allowEmptyEnv);
+  const undeclared = [...allowed].filter((n) => !declaredNames.includes(n) && args.envVars[n] !== "");
+  if (undeclared.length > 0) {
+    throw new UsageError(
+      `--allow-empty-env: ${safeNames(undeclared)} ${undeclared.length === 1 ? "is" : "are"} not declared.` + (declaredNames.length === 0 ? ` This workspace declares no env vars \u2014 a name is declared in \`workspaceConfig({ env })\`.` : ` Declared: ${safeNames(declaredNames)}.`)
+    );
+  }
+  const unsupplied = resolution.clearing.filter((n) => !allowed.has(n));
+  const refuses = REFUSES_EMPTY_ENV.has(args.command ?? "");
+  const flagged = Object.keys(args.envVars).length;
+  const comparesOnly = args.command === "workspace" && args.subcommand === "diff";
+  const cutsRelease = args.command === "release" && args.subcommand === "create";
+  const merges = refuses && args.command === "deploy" && args.keepData && !args.reset && args.to === void 0;
+  const toMerge = refuses && args.command === "deploy" && args.to !== void 0 && !args.replace;
+  reportWorkspaceEnv({
+    declaredNames,
+    resolution,
+    source,
+    flagged,
+    allowed,
+    refuses,
+    defaultLabel,
+    comparesOnly,
+    cutsRelease,
+    merges: merges ? "`--keep-data`" : toMerge ? "`--to`" : void 0
+  });
+  const examplePath = `${defaultPath}.example`;
+  const exampleLacks = existsSync2(examplePath) ? unsupplied.filter((n) => !namesInEnvExample(examplePath).includes(n)) : void 0;
+  const dryRun = args.dryRun === true;
+  const refusal = (replaceWhy) => unsuppliedEnvError(unsupplied, source ?? defaultLabel, source !== void 0, exampleLacks, {
+    ...replaceWhy !== void 0 ? { replaceWhy } : {},
+    mode: replaceWhy === void 0 && toMerge ? "merge" : "replace",
+    dryRun
+  });
+  mergeExcusedEnv = merges && unsupplied.length > 0 ? refusal : void 0;
+  if (refuses && !merges && unsupplied.length > 0) {
+    if (dryRun) warn(refusal(), "workspace-env.unsupplied");
+    else throw new Error(refusal());
+  }
+  return resolution.values;
+}
+function resolveDocumentationTokens(args, file, def) {
+  const declared = def.documentationTokenNames();
+  const byLabel = /* @__PURE__ */ new Map();
+  for (const d of declared) {
+    const label = documentationScopeFlagLabel(d.scope);
+    byLabel.set(label, [...byLabel.get(label) ?? [], d]);
+  }
+  const keyFor = (label, flag) => {
+    const reserved = declared.find((d) => d.scope.kind === "workspace");
+    if (label === "workspace" && reserved !== void 0) return reserved.key;
+    const matches = (byLabel.get(label) ?? []).filter((d) => d.scope.kind === "api_group");
+    if (matches.length === 1) return matches[0].key;
+    const known = [...byLabel.keys()];
+    if (matches.length === 0) {
+      throw new UsageError(
+        `${flag}: no documentation gate is declared for ${JSON.stringify(label)}.` + (known.length === 0 ? ` This workspace declares none \u2014 a gate is \`documentation: { require_token: true }\`.` : ` Declared: ${safeNames(known)}.`)
+      );
+    }
+    throw new Error(
+      `${flag}: ${matches.length} API groups are named ${JSON.stringify(label)}, so that name does not say which one you mean. Rename one of them, or pull again so the group you want carries its own entry in \`${projectRelative(defaultWorkspaceSecretsPath(file), file, WORKSPACE_SECRETS_FILE)}\`.` + (label === "workspace" ? ` (\`workspace\` addresses the WORKSPACE's own gate, which this source does not declare \u2014 a group of that name cannot take the label.)` : "")
+    );
+  };
+  const values = /* @__PURE__ */ Object.create(null);
+  const secretsPath = args.secretsFile !== void 0 ? resolve2(args.secretsFile) : defaultWorkspaceSecretsPath(file);
+  const stored = readSecretsFile(secretsPath, args.secretsFile !== void 0 ? "--secrets-file" : void 0);
+  const source = args.secretsFile !== void 0 ? displayPath(secretsPath) : projectRelative(secretsPath, file, WORKSPACE_SECRETS_FILE);
+  for (const [key, entry] of Object.entries(stored?.documentationTokens ?? {})) {
+    values[key] = entry.value;
+  }
+  for (const [label, value] of Object.entries(args.docTokens)) {
+    values[keyFor(label, "--doc-token")] = value;
+  }
+  const allowEmpty = new Set(args.allowEmptyDocToken.map((l) => keyFor(l, "--allow-empty-doc-token")));
+  const declaredKeys = new Set(declared.map((d) => d.key));
+  const supplied = declared.filter((d) => Object.hasOwn(values, d.key));
+  const cleared = declared.filter((d) => !Object.hasOwn(values, d.key) && allowEmpty.has(d.key));
+  const unsupplied = declared.filter(
+    (d) => d.gated && !Object.hasOwn(values, d.key) && !allowEmpty.has(d.key)
+  );
+  if (supplied.length > 0 || declared.some((d) => d.gated)) {
+    const flagKeys = new Set(Object.keys(args.docTokens).map((label) => keyFor(label, "--doc-token")));
+    const fromFlag = supplied.filter((d) => flagKeys.has(d.key)).length;
+    const toResolve = declared.filter((d) => d.gated || Object.hasOwn(values, d.key));
+    info(
+      `Documentation tokens: ${supplied.length} of ${countOf(toResolve.length, "scope")} resolved` + suppliedFrom(supplied.length - fromFlag, source, fromFlag, "--doc-token", " from")
+    );
+  }
+  const orphans = Object.entries(stored?.documentationTokens ?? {}).filter(([key]) => !declaredKeys.has(key)).map(([, entry]) => entry.label);
+  if (orphans.length > 0) {
+    exportWarn(
+      "doc-token.orphan",
+      `Documentation tokens: \`${source}\` holds ${orphans.length} entr${orphans.length === 1 ? "y" : "ies"} no scope in this source claims \u2014 ${safeNames(orphans)}. Nothing is sent for ${orphans.length === 1 ? "it" : "them"}, and nothing is deleted. ` + // A lock keeps a renamed group's identity, so there the cause is a
+      // group removed, or its gate dropped from the source.
+      (existsSync2(join2(dirname2(secretsPath), "xano.lock")) ? `Usually an API group that was removed, or whose \`documentation\` gate was dropped; ` : `Usually a renamed API group in a project with no lock; `) + // Only a decoded project has a pull that rebuilds the file.
+      (existsSync2(join2(dirname2(secretsPath), ".xanosdk-codegen.json")) ? `pull again to rebuild the file.` : `move the token to the group's new entry, or delete ${orphans.length === 1 ? "the entry" : "them"} from \`${source}\`.`)
+    );
+  }
+  const refuses = REFUSES_EMPTY_DOC_TOKEN.has(args.command ?? "");
+  const workspaceKept = refuses ? docMergeOf(args) : void 0;
+  const clearedWs = workspaceKept === void 0 ? [] : cleared.filter((d) => d.scope.kind === "workspace");
+  const clearedApplied = cleared.filter((d) => !clearedWs.includes(d));
+  if (clearedApplied.length > 0) {
+    exportWarn(
+      "doc-token.cleared",
+      `Documentation tokens: ${safeNames(clearedApplied.map((d) => documentationScopeFlagLabel(d.scope)))} will be sent EMPTY (--allow-empty-doc-token). Whatever gate the target holds for ${clearedApplied.length === 1 ? "that doc site" : "those doc sites"} is cleared, and its docs become publicly readable.`
+    );
+  }
+  if (clearedWs.length > 0) {
+    exportWarn(
+      "doc-token.cleared",
+      `Documentation tokens: workspace \u2014 --allow-empty-doc-token is not applied: a merge leaves the workspace's documentation gate as it is.` + (workspaceKept === "keep-data" ? ` If \`--keep-data\` cannot keep this environment and the deploy replaces it instead, the gate is cleared and its docs become publicly readable.` : "")
+    );
+  }
+  const unsuppliedWs = workspaceKept === void 0 ? [] : unsupplied.filter((d) => d.scope.kind === "workspace");
+  mergeExcusedDocToken = workspaceKept === "keep-data" && unsuppliedWs.length > 0 ? (why) => `${why}, so the deploy replaces it \u2014 which writes the workspace's documentation block.
+${unsuppliedDocTokenError(unsuppliedWs, secretsRemedyFor(file))}` : void 0;
+  if (unsuppliedWs.length > 0) {
+    exportWarn(
+      "doc-token.unsupplied",
+      `Documentation tokens: the workspace declares a gate and no token was supplied \u2014 a merge does not write the workspace's \`documentation\` block, so the live gate stays as it is.`
+    );
+  }
+  const applied = unsupplied.filter((d) => !unsuppliedWs.includes(d));
+  if (applied.length > 0) {
+    if (refuses) throw new Error(unsuppliedDocTokenError(applied, secretsRemedyFor(file)));
+    const ws = applied.filter((d) => d.scope.kind === "workspace");
+    const groups = applied.filter((d) => d.scope.kind === "api_group" && !d.published);
+    if (ws.length > 0) {
+      exportWarn(
+        "doc-token.unsupplied",
+        `Documentation tokens: the workspace declares a gate and no token was supplied; no \`documentation\` key is emitted, so this bundle leaves the workspace's gate as it is rather than clearing it \u2014 and cannot restore it either.`
+      );
+    }
+    if (groups.length > 0) {
+      exportWarn(
+        "doc-token.unsupplied",
+        `Documentation tokens: ${countOf(groups.length, "API group")} ${groups.length === 1 ? "declares" : "declare"} a gate with no token (${safeNames(groups.map((d) => documentationScopeFlagLabel(d.scope)))}). Unlike the workspace's, a group's \`documentation\` key is written as the engine default when it is absent, so these bytes CLEAR that group's gate on import. ${groups.length === 1 ? "That group does" : "Those groups do"} not publish docs (\`swagger\` is off), so nothing is exposed \u2014 turn it on and the export fails until the value is supplied.`
+      );
+    }
+  }
+  return { values, allowEmpty };
+}
+function availableDocTokenKeys(args, file) {
+  const keys = /* @__PURE__ */ new Set();
+  try {
+    const secretsPath = args.secretsFile !== void 0 ? resolve2(args.secretsFile) : defaultWorkspaceSecretsPath(file);
+    const stored = readSecretsFile(secretsPath, void 0);
+    for (const key of Object.keys(stored?.documentationTokens ?? {})) keys.add(key);
+  } catch {
+  }
+  return keys;
+}
+function checkStandInTokens(def) {
+  const values = /* @__PURE__ */ Object.create(null);
+  for (const declared of def.documentationTokenNames()) values[declared.key] = "xanosdk-check";
+  return { values, allowEmpty: /* @__PURE__ */ new Set() };
+}
+function docMergeOf(args) {
+  if (args.command !== "deploy" || args.localEngine) return void 0;
+  if (args.to !== void 0) return args.replace || args.to.startsWith("local-engine") ? void 0 : "to";
+  return args.keepData && !args.reset ? "keep-data" : void 0;
+}
+function unsuppliedDocTokenError(unsupplied, remedy) {
+  const one = unsupplied.length === 1;
+  const labels = unsupplied.map((d) => documentationScopeFlagLabel(d.scope));
+  const scopes = unsupplied.map((d) => documentationScopeLabel(d.scope));
+  return `Refusing to deploy: ${unsupplied.length} declared documentation gate${one ? "" : "s"} ${one ? "has" : "have"} no token \u2014 ${safeNames(scopes)}.
+Deploying without ${one ? "it" : "them"} would leave ${one ? "that" : "those"} doc site${one ? "" : "s"} without the gate this source describes \u2014 and \`--allow-empty-doc-token\` would actively clear whatever gate the target holds, making every endpoint, input and response shape in ${one ? "it" : "them"} publicly readable.
+Run \`${remedy.fill}\` to mint ${one ? "a token" : "tokens"} into \`${remedy.file}\`, pass ${one ? "it" : "them"} with ${labels.map((l) => `\`--doc-token "${l}=<value>"\``).join(" ")}, point at a mounted file with \`--secrets-file <path>\`, or \u2014 if opening ${one ? "that doc site" : "those doc sites"} is what you meant \u2014 ${labels.map((l) => `\`--allow-empty-doc-token="${l}"\``).join(" ")}.
+Do not put the token back into \`documentation: { token }\` \u2014 a value there is committed to the repo, which is what \`${remedy.file}\` replaces, and the export refuses it.`;
+}
+var runScope;
+function noteRunScope(scope) {
+  runScope = scope === void 0 ? void 0 : { workspaceId: scope.workspaceId, instance: scope.instance, profile: scope.profile };
+}
+function trackedBackend(cwd = process.cwd(), scope = runScope) {
+  try {
+    const kind = readTrackedBackend({ cwd, scope }).kind;
+    if (kind !== "ephemeral" || scope === void 0) return { kind };
+    const record = getEnvironment(readEphemeralState(cwd), scope);
+    return record === void 0 ? { kind } : { kind, ephemeral: { name: record.name, expired: isExpired(record.expires_at) } };
+  } catch {
+    return { kind: null };
+  }
+}
+var offeredPull;
+var mergeExcusedEnv;
+var mergeExcusedDocToken;
+function docTokenRefusalIfReplaced(replaceWhy) {
+  return mergeExcusedDocToken?.(replaceWhy);
+}
+function envRefusalIfReplaced(replaceWhy) {
+  return mergeExcusedEnv?.(replaceWhy);
+}
+function fillFrom(source, exampleLacks, one = false) {
+  const tracked = trackedBackend();
+  const expired = tracked.ephemeral?.expired === true;
+  const pull = `run \`xanosdk env pull${contextFlags()}\` to fetch ${one ? "it" : "them"} from the backend this project deployed`;
+  const copy = exampleLacks === void 0 ? void 0 : exampleLacks.length === 0 ? `copy \`${source}.example\` to start` : `copy \`${source}.example\` to start and add ${exampleLacks.join(", ")}, which it does not list`;
+  const ways = [
+    ...copy !== void 0 ? [copy] : [],
+    ...tracked.kind !== null && !expired ? [pull] : []
+  ];
+  offeredPull = tracked.ephemeral !== void 0 && !expired ? { name: tracked.ephemeral.name, clause: pull } : void 0;
+  return ways.length === 0 ? "" : ` (${ways.join(", or ")})`;
+}
+function expiredPullNote() {
+  const tracked = trackedBackend();
+  return tracked.ephemeral?.expired === true ? `
+${pullGone(tracked.ephemeral.name, "has expired")}` : "";
+}
+function pullGone(name, how) {
+  return `The ephemeral this project deployed (${name}) ${how}, so there is no backend to pull the values from.`;
+}
+var DO_NOT_COMMIT = "\nDo not put the value back into `workspaceConfig({ env })`";
+async function refineGonePullHint(err) {
+  const offer = offeredPull;
+  offeredPull = void 0;
+  const auth = lastResolvedAuth()?.auth;
+  if (offer === void 0 || auth === void 0 || !(err instanceof Error) || !err.message.includes(offer.clause)) return;
+  let gone;
+  try {
+    const { lookupEphemeral } = await import("./source-resolve-S2XA3XZF.js");
+    gone = await lookupEphemeral(auth, offer.name) === null;
+  } catch {
+    return;
+  }
+  if (!gone) return;
+  const taken = err.message.includes(`, or ${offer.clause})`) ? err.message.replace(`, or ${offer.clause})`, ")") : err.message.replace(` (${offer.clause})`, "");
+  err.message = taken.replace(DO_NOT_COMMIT, `
+${pullGone(offer.name, "is gone")}${DO_NOT_COMMIT}`);
+}
+function unsuppliedEnvError(unsupplied, source, found, exampleLacks, opts) {
+  const one = unsupplied.length === 1;
+  const { replaceWhy } = opts;
+  const merge = opts.mode === "merge" && replaceWhy === void 0;
+  return (opts.dryRun ? "Dry run \u2014 the deploy would refuse: " : "Refusing to deploy: ") + `${unsupplied.length} declared env variable${one ? "" : "s"} ${one ? "has" : "have"} no value \u2014 ${unsupplied.join(", ")}.
+` + (merge ? `A \`--to\` deploy merges the env add-only: where the target holds ${one ? "that name" : "those names"}, the live value is kept, and where it does not, ${one ? "it" : "each"} would be created there with no value.
+` : (replaceWhy !== void 0 ? `${replaceWhy}: this deploy REPLACES` : "A deploy REPLACES") + ` the backend's env set, so sending this bundle would clear ${one ? "that value" : "those values"} in the target.
+`) + // `source` is the RESOLVED default even when no file was found, so the way
+  // out names the directory this project actually uses. Naming the `xano/`
+  // constant here told a project whose backend is a sibling to put its values
+  // in a directory that is not its backend — the fatal message contradicting
+  // the info line printed one moment earlier.
+  (found ? `Add ${one ? "it" : "them"} to \`${source}\`, ` : `Put the value${one ? "" : "s"} in \`${source}\`` + fillFrom(source, exampleLacks, one) + `, `) + `pass ${one ? "it" : "them"} with \`--env-var NAME=value\`, or \u2014 if ${merge ? "sending" : "clearing"} ${one ? "it" : "them"}${merge ? " empty" : ""} is what you meant \u2014 \`--allow-empty-env=${unsupplied.join(",")}\`.` + (found ? "" : expiredPullNote()) + // The one thing the ways out do not say. For a project scaffolded without
+  // `AGENTS.md`, this message is the ONLY text in the loop, and the tempting
+  // repair is the exact habit `xano/.env` exists to break.
+  `${DO_NOT_COMMIT} \u2014 a value there is committed to the repo, which is what ${source} replaces.`;
+}
+function suppliedFrom(fromFile, file, fromFlag, flag, flagOnly) {
+  if (fromFile > 0 && fromFlag > 0) return ` \u2014 ${fromFile} from \`${file}\`, ${fromFlag} from ${flag}.`;
+  if (fromFile > 0) return ` from \`${file}\`.`;
+  if (fromFlag > 0) return `${flagOnly} ${flag}.`;
+  return ".";
+}
+function reportWorkspaceEnv(r) {
+  const sent = Object.keys(r.resolution.values).length;
+  const cleared = r.resolution.clearing.filter((n) => r.allowed.has(n));
+  const unsupplied = r.resolution.clearing.filter((n) => !r.allowed.has(n));
+  if (r.declaredNames.length === 0 && sent === 0) {
+    info("Workspace env: no env vars are declared and none were supplied.");
+  } else if (sent > 0) {
+    info(
+      `Workspace env: ${countOf(sent, "value")}` + suppliedFrom(sent - r.flagged, r.source ?? r.defaultLabel, r.flagged, "--env-var", " supplied with")
+    );
+  } else if (r.source !== void 0) {
+    info(`Workspace env: 0 values from \`${r.source}\`.`);
+  } else {
+    const empty = r.resolution.clearing.length;
+    info(
+      `Workspace env: no \`${r.defaultLabel}\` found` + (empty === 0 ? r.declaredNames.length === 1 ? `; the 1 declared value comes from the source.` : `; the ${r.declaredNames.length} declared values come from the source.` : empty === 1 ? `; 1 declared name has no value.` : `; ${empty} declared names have no value.`)
+    );
+  }
+  if (cleared.length > 0) {
+    const those = cleared.length === 1 ? "that name" : "those names";
+    warn(
+      r.comparesOnly === true ? `Workspace env: ${cleared.join(", ")} ${cleared.length === 1 ? "is" : "are"} compared as EMPTY (--allow-empty-env).` : r.merges !== void 0 ? `Workspace env: ${cleared.join(", ")} will be sent EMPTY (--allow-empty-env). A ${r.merges} merge keeps whatever the target holds for ${those}, and adds ${cleared.length === 1 ? "it" : "them"} empty where it holds none.` : `Workspace env: ${cleared.join(", ")} will be sent EMPTY (--allow-empty-env). Whatever the target holds for ${those} is cleared.`,
+      "workspace-env.compared-empty"
+    );
+  }
+  if (unsupplied.length > 0 && r.merges === "`--keep-data`") {
+    const one = unsupplied.length === 1;
+    info(
+      `Workspace env: ${unsupplied.join(", ")} ${one ? "has" : "have"} no value. A \`--keep-data\` merge keeps whatever the target holds for ${one ? "it" : "them"}, and adds ${one ? "it" : "them"} empty where it holds none.`
+    );
+  }
+  if (unsupplied.length > 0 && !r.refuses && r.merges === void 0) {
+    exportWarn(
+      "workspace-env.unsupplied",
+      r.comparesOnly === true ? `Workspace env: ${unsupplied.length === 1 ? `1 declared name is unsupplied (${unsupplied[0]})` : `${unsupplied.length} declared names are unsupplied (${unsupplied.join(", ")})`}, so this project's side of the comparison holds no value for ${unsupplied.length === 1 ? "it" : "them"}.` : r.cutsRelease === true ? `Workspace env: ${unsupplied.length === 1 ? `1 declared name is unsupplied (${unsupplied[0]})` : `${unsupplied.length} declared names are unsupplied (${unsupplied.join(", ")})`}. A release carries no env values, so this changes nothing it carries: set ${unsupplied.length === 1 ? "it" : "them"} on each destination it lands on with \`xanosdk env set\`.` : (unsupplied.length === 1 ? `Workspace env: 1 declared name is unsupplied (${unsupplied[0]}); this bundle will clear it if it is imported.` : `Workspace env: ${unsupplied.length} declared names are unsupplied (${unsupplied.join(", ")}); this bundle will clear them if it is imported.`) + ` Put the value${unsupplied.length === 1 ? "" : "s"} in \`${r.source ?? r.defaultLabel}\`, pass \`--env-var NAME=value\`, or \u2014 if empty is meant \u2014 \`--allow-empty-env=${unsupplied.join(",")}\`.`
+    );
+  }
+  if (r.resolution.additions.length > 0) {
+    const added = r.resolution.additions;
+    exportWarn(
+      "workspace-env.undeclared",
+      `Workspace env: ${added.join(", ")} ${added.length === 1 ? "is" : "are"} not declared in \`workspaceConfig({ env })\` and ${r.comparesOnly === true ? `${added.length === 1 ? "is" : "are"} supplied only by this project's env values (a deploy would add ${added.length === 1 ? "it" : "them"})` : "will be ADDED"}. Declare the name there with an empty value so the stack's \`env()\` reads stay checkable; if this is a typo, this is the only place you will see it.`
+    );
+  }
+}
+function reportCapabilities(bundle) {
+  const needs = bundleCapabilities(bundle);
+  if (needs.length === 0) return;
+  info(`This bundle needs ${needs.length} instance capabilit${needs.length === 1 ? "y" : "ies"}:`);
+  for (const need of needs) {
+    const where = need.objects.length ? ` (e.g. ${need.objects[0]}${need.objects.length > 1 ? ` +${need.objects.length - 1} more` : ""})` : "";
+    detail(`${need.label} \u2014 ${need.effect}${where}`);
+  }
+  detail("Check these against the plan of anything you promote to; the deploy cannot.");
+}
+var strictFindings;
+var exportFindings = [];
+function countOf(n, noun) {
+  return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+function exportWarn(code, message, remedies = [], strict = true, machine) {
+  const full = [message, ...remedies].join("\n");
+  if (strict && strictFindings !== void 0) {
+    strictFindings.push({ code, message: full });
+    noteRunWarning(code, machine ?? full);
+  } else {
+    warn(message, code, remedies, machine);
+  }
+  exportFindings.push({ code, message: machine ?? full });
+}
+function failStrictFindings(args, library = []) {
+  if (library.length > 0) throw strictRefusal(args, library);
+  if (!args.strict || strictFindings === void 0 || strictFindings.length === 0) return;
+  throw strictRefusal(args, []);
+}
+function strictRefusal(args, library) {
+  const all = [];
+  for (const d of [...library, ...takePendingStrictFindings()]) {
+    if (!all.some((a) => a.code === d.code && a.message === d.message)) all.push(d);
+  }
+  const n = all.length;
+  const hard = all.filter((d) => d.severity === "error").length;
+  const why = hard === 0 ? "" : ` \u2014 ${countOf(hard, "error")}, and ${countOf(n - hard, "warning")} that --strict makes errors`;
+  const remedy = hard === 0 ? `Resolve ${n === 1 ? "it" : "them"}, or run without --strict to proceed with ${n === 1 ? "it" : "them"}.` : "Resolve them.";
+  return new DiagnosticError(
+    `\`${commandLabel(args)}\` stopped: ${countOf(n, "finding")} ${n === 1 ? "fails" : "fail"} --strict${why}
+` + // A finding's remedies are its later lines: each on its own line under it.
+    all.map((d, i) => `  ${i + 1}. ${d.message.split("\n").join("\n     ")}`).join("\n") + `
+${remedy}`,
+    all
+  );
+}
+function quietly(fn) {
+  if (fn === void 0) return void 0;
+  const previous = setDiagnosticSink(() => {
+  });
+  try {
+    return fn();
+  } catch {
+    return void 0;
+  } finally {
+    setDiagnosticSink(previous);
+  }
+}
+function takePendingStrictFindings() {
+  const pending = strictFindings ?? [];
+  if (strictFindings !== void 0) strictFindings = [];
+  return pending.map(({ code, message }) => ({ severity: "warning", code, message }));
+}
+function checkFilterNames(bundle) {
+  for (const f of findUnresolvableFilters(bundle)) {
+    const hint = f.suggestions.length ? ` \u2014 did you mean ${f.suggestions.map((s) => `\`${s}\``).join(" or ")}?` : "";
+    exportWarn(
+      "filter.unresolvable",
+      `Filter "${f.name}" (in ${f.location}) is not engine-resolvable and will 500 at runtime${hint}`,
+      [
+        f.inExpression ? "Replace it with a resolvable name (see `fl.*` / llms.txt) where it is piped: the `filter()` inside the `obj()` member, or the `|name` in the `c.expression` source." : "Replace it with a resolvable name (see `fl.*` / llms.txt) or drop the raw `filter()` call."
+      ]
+    );
+  }
+}
+
+export {
+  readsFreeName,
+  authorFiles,
+  resolveKnowledge,
+  assertBundleInput,
+  assertEntryFile,
+  assertBundleFile,
+  assertValueFiles,
+  refuseValueFlagsBesideBundle,
+  compileValueFlagKinds,
+  DOC_TOKEN_REMEDY,
+  refuseCompileValueFlags,
+  loadBundleText,
+  expandShortAttached,
+  envNameRule,
+  parseArgs,
+  resolveHelpRequest,
+  loadDefault,
+  tsxRemedy,
+  assertEntryExists,
+  loadModule,
+  readVersion,
+  emitterFor,
+  printHelp,
+  orphanFixUps,
+  composedChildren,
+  setGuidFixUp,
+  renameCandidatesFor,
+  run,
+  maskAssignments,
+  carryRunWarnings,
+  withoutSecretValue,
+  isPathlessRun,
+  globalVersionAsked,
+  globalVersionMisuse,
+  refreshAgentGuidance,
+  nearestLockPath,
+  missingLockDir,
+  resolveLockPath,
+  noteLockCreated,
+  refreshRouteManifest,
+  exportBundleJson,
+  compileBundle,
+  checkStandInTokens,
+  noteRunScope,
+  docTokenRefusalIfReplaced,
+  envRefusalIfReplaced
+};
+//# sourceMappingURL=chunk-ETO6LGLD.js.map