@xano/sdk 1.0.0

package/dist/chunk-SFLHVCKX.js

@@ -0,0 +1,173 @@
+import {
+  resolveProjectEntry
+} from "./chunk-AOSYVMUS.js";
+import {
+  isUnusablePin,
+  readPin,
+  writePin
+} from "./chunk-6ELFRN3P.js";
+import {
+  ENGINE_RELEASES_URL_ENV,
+  EngineReleaseNotFoundError,
+  usesCustomReleaseManager
+} from "./chunk-APWXY5SL.js";
+import {
+  LOCAL_ENGINE_OVERRIDE_ENV,
+  engineOverrideFromEnv,
+  resolveEnginePlatform,
+  resolveEngineSource
+} from "./chunk-AM4FKL4J.js";
+import {
+  ORIGIN_READ_ONLY_BY_REFRESH
+} from "./chunk-NAQDMEHV.js";
+import {
+  UsageError,
+  info,
+  warn
+} from "./chunk-PTHVMXZI.js";
+
+// src/emit/local-engine-choice.ts
+function refuseCredentialFlagsForLocal(args, kinds) {
+  if (kinds.some((k) => k !== "local-engine")) return;
+  const why = "and a local engine takes none \u2014 it is reached with the engine's own bearer.";
+  const or = "or deploy from a hosted backend that reads it.";
+  const refuse = (message) => {
+    throw new UsageError(message, { hintFor: { command: "deploy" } });
+  };
+  if (args.authFile !== void 0) {
+    refuse(`\`--config ${args.authFile}\` names a Xano credential file, ${why} Drop \`--config\`, ${or}`);
+  }
+  if (args.local === true) {
+    refuse(`\`--local\` selects the project-local Xano credential file, ${why} Drop \`--local\`, ${or}`);
+  }
+  if (args.authHost !== void 0) {
+    refuse(`\`--origin\` names a Xano sign-in server, ${why} ${ORIGIN_READ_ONLY_BY_REFRESH}`);
+  }
+}
+async function chooseLocalEngine(flagValue, dir, machineOutput) {
+  if (flagValue !== void 0 && flagValue !== "") {
+    const source = resolveEngineSource(flagValue);
+    announceOverride(source, "--local-engine", "run `--local-engine` bare to go back to it");
+    return { source, pinWrite: void 0, pin: "none", override: "flag" };
+  }
+  const fromEnv = engineOverrideFromEnv();
+  if (fromEnv !== void 0) {
+    announceOverride(fromEnv, LOCAL_ENGINE_OVERRIDE_ENV, "unset the variable to go back to it");
+    return { source: fromEnv, pinWrite: void 0, pin: "none", override: "env" };
+  }
+  if (usesCustomReleaseManager()) {
+    info(
+      `Running the latest engine from ${ENGINE_RELEASES_URL_ENV} instead of this project's pinned engine, downloaded fresh each deploy. The pin is left as is; unset the variable to go back to it.`
+    );
+    return { source: resolveEngineSource(void 0), pinWrite: void 0, pin: "none", override: "releases-url" };
+  }
+  const pin = readPin(dir, {
+    warn: (message) => warn(
+      `${message} This deploy runs the latest local engine and the field is left as written \u2014 set it to a version like "v0.1.5", or run \`xanosdk local-engine update\` to pin one.`,
+      "local-engine.version-invalid"
+    )
+  });
+  if (isUnusablePin(pin)) {
+    return { source: resolveEngineSource(void 0), pinWrite: void 0, pin: "unchanged" };
+  }
+  if (pin === void 0 && resolveProjectEntry(dir) === void 0) {
+    warn(
+      `No package.json in ${dir}, and it is not a Xano SDK project, so the local engine was not pinned \u2014 this deploy runs the latest engine.`,
+      "local-engine.not-pinned"
+    );
+    return { source: resolveEngineSource(void 0), pinWrite: void 0, pin: "none" };
+  }
+  if (pin === null || pin === void 0) {
+    return { source: resolveEngineSource(void 0), pinWrite: "create", pin: "none" };
+  }
+  const keep = {
+    source: resolveEngineSource(void 0, process.env, pin),
+    pinWrite: void 0,
+    pin: "unchanged"
+  };
+  const platform = resolveEnginePlatform();
+  if (platform === void 0) return keep;
+  const check = await import("./local-engine-update-check-6L645VBL.js");
+  const latest = await check.latestKnownVersion({ platform });
+  if (latest === void 0) return keep;
+  const decision = check.decideUpdate({
+    pin,
+    latest,
+    interactive: check.isInteractive({ machineOutput }),
+    declined: check.declinedVersion(dir)
+  });
+  if (decision === "keep") return keep;
+  if (decision === "notify") {
+    info(check.updateNoticeText(pin, latest));
+    return keep;
+  }
+  const { confirm } = await import("./prompt-II3F3LND.js");
+  const yes = await confirm(check.updatePromptText(pin, latest), {
+    flag: "`xanosdk local-engine update`",
+    refusal: { details: { updated: false }, rerun: "xanosdk local-engine update" }
+  });
+  if (!yes) {
+    check.recordDeclined(dir, latest);
+    return keep;
+  }
+  return {
+    source: resolveEngineSource(void 0, process.env, latest),
+    pinWrite: "move",
+    pin: "unchanged"
+  };
+}
+function announceOverride(source, from, back) {
+  const what = source.kind === "release" ? `engine ${source.version ?? "latest"}` : /^https?:\/\//i.test(source.source) ? "the engine at the URL" : `the engine archive ${source.source}`;
+  info(`Running ${what} from ${from} instead of this project's pinned engine. The pin is left as is; ${back}.`);
+}
+function explainOverrideFailure(choice, err) {
+  const override = choice.override;
+  const message = err instanceof Error ? err.message : void 0;
+  const missing = err instanceof EngineReleaseNotFoundError || (message?.includes("has no archive for") ?? false);
+  if (override !== "flag" && override !== "env" || message === void 0 || !missing) throw err;
+  const what = message.split("\n")[0];
+  const remedy = override === "flag" ? "Check the version, or drop it: `xanosdk deploy --local-engine` (bare) runs this project's pinned engine, and `xanosdk local-engine update` moves that pin to the latest release." : `Check ${LOCAL_ENGINE_OVERRIDE_ENV}, or unset it to run this project's pinned engine.`;
+  const text = `${what}
+${remedy}`;
+  throw err instanceof EngineReleaseNotFoundError ? new EngineReleaseNotFoundError(text, { cause: err }) : new Error(text, { cause: err });
+}
+function pinAfterAcquire(choice, dir) {
+  let outcome = choice.pin;
+  let written;
+  let failure;
+  return {
+    onAcquired: (acquired) => {
+      if (choice.pinWrite === void 0 || acquired.version === void 0) return;
+      try {
+        const result = writePin(dir, acquired.version);
+        outcome = choice.pinWrite === "create" ? "created" : "moved";
+        written = { path: result.path, version: acquired.version, created: result.created };
+      } catch (err) {
+        failure = err.message;
+      }
+    },
+    outcome: () => outcome,
+    announce: () => announceLocalEnginePin({ choice, written, failure })
+  };
+}
+function announceLocalEnginePin(ctx) {
+  const { choice, written, failure } = ctx;
+  if (written !== void 0) {
+    info(pinWrittenText({ ...written, moved: choice.pinWrite === "move" }));
+    return;
+  }
+  if (failure !== void 0) warn(`The local engine version was not pinned: ${failure}`, "local-engine.not-pinned");
+}
+function pinWrittenText(written) {
+  const what = written.created ? `Created ${written.path} to pin local engine ${written.version}` : `${written.moved ? "Moved the local engine pin to" : "Pinned local engine"} ${written.version} in ${written.path}`;
+  return `${what} \u2014 commit it so everyone on this project runs the same engine.`;
+}
+
+export {
+  refuseCredentialFlagsForLocal,
+  chooseLocalEngine,
+  explainOverrideFailure,
+  pinAfterAcquire,
+  pinWrittenText
+};
+//# sourceMappingURL=chunk-SFLHVCKX.js.map

package/dist/chunk-STSFNCY4.js

@@ -0,0 +1,127 @@
+import {
+  BARE,
+  COMMANDS,
+  UsageError,
+  getCommand,
+  getSubcommand,
+  isKindShaped,
+  parseSource,
+  sourceSpellings
+} from "./chunk-PTHVMXZI.js";
+
+// src/emit/backend-slot.ts
+function commandPath(command, subcommand) {
+  return subcommand === void 0 ? command : `${command} ${subcommand}`;
+}
+function slotsOf(command, subcommand, spec) {
+  const out = [];
+  const at = subcommand === void 0 ? { command } : { command, subcommand };
+  for (const arg of spec.args ?? []) {
+    if (arg.selector !== void 0) out.push({ ...at, spelling: `<${arg.name}>`, selector: arg.selector });
+  }
+  for (const ref of spec.flags ?? []) {
+    if (typeof ref === "string" || ref.selector === void 0) continue;
+    out.push({ ...at, spelling: `--${ref.key}`, flag: ref.key, selector: ref.selector });
+  }
+  return out;
+}
+function allBackendSlots() {
+  const out = [];
+  for (const [name, raw] of Object.entries(COMMANDS)) {
+    const spec = raw;
+    out.push(...slotsOf(name, void 0, spec));
+    for (const [verb, sub] of Object.entries(spec.subcommands ?? {})) out.push(...slotsOf(name, verb, sub));
+  }
+  return out;
+}
+function backendSlot(command, subcommand, role) {
+  const spec = subcommand === void 0 ? getCommand(command) : getSubcommand(command, subcommand);
+  if (spec === void 0) return void 0;
+  return slotsOf(command, subcommand, spec).find((s) => s.selector.role === role);
+}
+function backendSlotForFlag(command, subcommand, key) {
+  if (command === void 0) return void 0;
+  const spec = subcommand === void 0 ? getCommand(command) : getSubcommand(command, subcommand);
+  if (spec === void 0) return void 0;
+  return slotsOf(command, subcommand, spec).find((s) => s.flag === key);
+}
+function requireBackendSlot(command, subcommand, role) {
+  const slot = backendSlot(command, subcommand, role);
+  if (slot === void 0) {
+    throw new Error(`\`${commandPath(command, subcommand)}\` declares no \`${role}\` selector slot in commands.ts.`);
+  }
+  return slot;
+}
+var ROLE_NOUN = {
+  from: "a source",
+  to: "a destination",
+  on: "a backend",
+  subject: "a backend"
+};
+var KIND_PHRASE = {
+  workspace: "the workspace",
+  ephemeral: "an ephemeral",
+  "local-engine": "a local engine",
+  tenant: "a tenant",
+  release: "a release",
+  file: "a bundle file"
+};
+function helpFor(slot) {
+  return slot.subcommand === void 0 ? { command: slot.command } : { command: slot.command, subcommand: slot.subcommand };
+}
+function slotValueMissing(slot) {
+  const accepted = `${ROLE_NOUN[slot.selector.role]}: ${sourceSpellings(slot.selector.accepted)}`;
+  if (!slot.spelling.startsWith("--")) {
+    return new UsageError(
+      `\`xanosdk ${commandPath(slot.command, slot.subcommand)}\`: missing required ${slot.spelling} \u2014 ${accepted}.`,
+      { helpFor: helpFor(slot) }
+    );
+  }
+  return new UsageError(`${slot.spelling} expects ${accepted}.`, { helpFor: helpFor(slot) });
+}
+function kindOf(raw) {
+  if (isKindShaped(raw)) return raw.slice(0, raw.indexOf(":"));
+  return BARE.includes(raw) ? raw : void 0;
+}
+function exampleOf(slot) {
+  if (!slot.spelling.startsWith("--")) return "";
+  const pick = slot.selector.accepted.includes("ephemeral") ? "ephemeral" : slot.selector.accepted.find((k) => slot.selector.refused?.[k] === void 0 && k !== "file");
+  return pick === void 0 ? "" : `, for example \`${slot.spelling} ${pick}\``;
+}
+function refusedKind(slot, kind, origin) {
+  const declared = slot.selector.refused?.[kind];
+  if (declared === void 0) return void 0;
+  const typedName = origin === "tracked" ? "" : origin.typed.includes(":") ? origin.typed.slice(origin.typed.indexOf(":") + 1).trim() : origin.name ?? "";
+  const reason = typedName === "" ? declared : declared.split(`<${kind} name>`).join(typedName);
+  const path = commandPath(slot.command, slot.subcommand);
+  const accepted = sourceSpellings(slot.selector.accepted);
+  const plural = SELECTOR_NOUN[slot.selector.role].plural;
+  const lead = origin === "tracked" ? `This project last deployed to ${KIND_PHRASE[kind]}, which \`xanosdk ${path}\` cannot serve: ${reason}. Name another with \`${slot.spelling}\`${exampleOf(slot)}. ${plural} are ${accepted}.` : `"${origin.typed}" names ${KIND_PHRASE[kind]}, which \`xanosdk ${path}\` cannot serve: ${reason}. ${plural} are ${accepted}.`;
+  return new UsageError(lead, { hintFor: helpFor(slot) });
+}
+function parseSlot(slot, raw, name) {
+  const kind = kindOf(raw);
+  if (kind !== void 0) {
+    const refusal = refusedKind(slot, kind, name === void 0 ? { typed: raw } : { typed: raw, name });
+    if (refusal !== void 0) throw refusal;
+  }
+  return parseSource(raw, slot.selector.accepted, helpFor(slot), SELECTOR_NOUN[slot.selector.role]);
+}
+var SELECTOR_NOUN = {
+  from: { singular: "source", plural: "Sources" },
+  to: { singular: "destination", plural: "Destinations" },
+  on: { singular: "backend", plural: "Backends" },
+  subject: { singular: "backend", plural: "Backends" }
+};
+
+export {
+  commandPath,
+  allBackendSlots,
+  backendSlot,
+  backendSlotForFlag,
+  requireBackendSlot,
+  slotValueMissing,
+  refusedKind,
+  parseSlot
+};
+//# sourceMappingURL=chunk-STSFNCY4.js.map

package/dist/chunk-SWBF2LTK.js

@@ -0,0 +1,170 @@
+import {
+  environmentKey,
+  getEnvironment,
+  readEphemeralState
+} from "./chunk-5QU2P5CA.js";
+import {
+  andList
+} from "./chunk-622HUCZT.js";
+import {
+  ENV_CREDENTIAL_VARS,
+  contextFlags,
+  credentialFileFlagFor,
+  credentialFileOf,
+  recordedByEnvCredential
+} from "./chunk-NAQDMEHV.js";
+import {
+  loginCommand,
+  profileAddCommand,
+  recordedCredentialPath,
+  recordedProfileStored
+} from "./chunk-XW6KISBB.js";
+import {
+  findPointerFile,
+  readPointerFile
+} from "./chunk-5FBYXK5P.js";
+import {
+  DEFAULT_PROFILE
+} from "./chunk-QXTKSOFI.js";
+import {
+  readEnvVar
+} from "./chunk-X2NL4KUO.js";
+import {
+  CliError,
+  EXIT_SOURCE_UNRESOLVABLE,
+  UsageError
+} from "./chunk-PTHVMXZI.js";
+
+// src/emit/env-target.ts
+var ENV_CREDENTIAL_NAMES = ["XANO_INSTANCE_URL", "XANO_WORKSPACE_ID", "XANO_META_TOKEN", "XANO_REFRESH_TOKEN", "XANO_CLIENT_ID"];
+function projectPin() {
+  try {
+    const file = findPointerFile(process.cwd());
+    return file === void 0 ? void 0 : readPointerFile(file);
+  } catch {
+    return void 0;
+  }
+}
+async function resolveEphemeralName(auth, name, cwd = process.cwd()) {
+  const state = readEphemeralState(cwd);
+  const tracked = getEnvironment(state, auth)?.name;
+  const resolved = name ?? tracked;
+  if (resolved === void 0 || resolved === "") {
+    const other = otherCredentialRefusal(
+      state,
+      auth,
+      `or name one with \`ephemeral:<name>\` (\`xanosdk ephemeral list${contextFlags()}\` shows them)`
+    );
+    if (other !== void 0) throw await reachableFirst(other, auth);
+    throw new CliError(
+      "SDK_ERROR",
+      `No ephemeral environment to target. Name one with \`ephemeral:<name>\` (\`xanosdk ephemeral list${contextFlags()}\` shows the ones that exist), or run \`xanosdk deploy${contextFlags()}\` first \u2014 this project then remembers the env it deployed to, which is what bare \`ephemeral\` reads.`,
+      { exitCode: EXIT_SOURCE_UNRESOLVABLE }
+    );
+  }
+  return resolved;
+}
+function otherCredentialRefusal(state, scope, tail, opts = {}) {
+  const mine = environmentKey(scope);
+  const others = Object.keys(state.environments).filter((k) => k !== mine && k !== String(scope.workspaceId));
+  if (others.length === 0) return void 0;
+  const workspaceOf = (key) => key.slice(key.lastIndexOf("/") + 1);
+  const profileOf = (key) => key.includes("/") ? key.slice(0, key.indexOf("/")) : void 0;
+  const quoted = (names) => names.map((n) => `"${n}"`).join(", ");
+  const fromEnv = scope.profile === void 0;
+  const current = scope.profile?.name ?? DEFAULT_PROFILE;
+  const envMade = fromEnv ? [] : others.filter((k) => recordedByEnvCredential(state.environments[k]));
+  const underOther = others.filter((k) => {
+    const p = profileOf(k);
+    return p !== void 0 && p !== current && !envMade.includes(k);
+  });
+  const sameWorkspace = underOther.filter((k) => workspaceOf(k) === String(scope.workspaceId));
+  const reachable = sameWorkspace.length > 0 ? sameWorkspace : underOther;
+  const profiles = [...new Set(reachable.map((k) => profileOf(k)))];
+  const files = [...new Set(reachable.map((k) => state.environments[k]?.credential_file))];
+  const runFile = credentialFileOf();
+  const known = files.length === 1 ? files[0] : void 0;
+  const fileFlag = known !== void 0 && known !== runFile ? credentialFileFlagFor(known) : "";
+  const fileNote = known === void 0 && runFile !== void 0 && runFile !== "shared" ? ` (${profiles.length === 1 ? "it" : "they"} may live in another credential file than this run read \u2014 add that file's \`--config <path>\` if so)` : known === "shared" && runFile !== void 0 && runFile !== "shared" ? ` (without \`--config\`/\`--local\`: ${profiles.length === 1 ? "it lives" : "they live"} in this machine's shared credential file)` : "";
+  const profileFlag = `${profiles.length === 1 ? `--profile ${profiles[0]}` : "--profile <name>"}${fileFlag}`;
+  const goneKey = reachable.length === 1 ? reachable[0] : void 0;
+  const goneTarget = {
+    path: known !== void 0 ? recordedCredentialPath(known) ?? void 0 : void 0,
+    instance: goneKey === void 0 ? void 0 : state.environments[goneKey]?.instance ?? `https://${goneKey.split("/").slice(1, -1).join("/")}`,
+    workspaceId: goneKey === void 0 ? void 0 : workspaceOf(goneKey)
+  };
+  const gone = profiles.length === 1 && known !== void 0 && !recordedProfileStored(profiles[0], known) ? `\`${loginCommand(profiles[0], goneTarget)}\` (OAuth), or \`${profileAddCommand(profiles[0], goneTarget)}\` (meta API token)` : void 0;
+  const setVars = ENV_CREDENTIAL_NAMES.filter((v) => readEnvVar(v) !== void 0);
+  const pinned = profiles.length === 1 && fileFlag === "" && projectPin() === profiles[0];
+  const remedy = fromEnv ? `This run acts as the credential in the environment, which outranks every stored profile \u2014 run without it (unset ${andList(setVars.length > 0 ? setVars : ENV_CREDENTIAL_NAMES.slice(0, 3))}) ` + (gone !== void 0 ? `and add that profile again with ${gone} \u2014 it is no longer stored` : pinned ? `to act as that profile, which this project's xano.profile.json already pins` : `and with \`${profileFlag}\` to act as ${profiles.length === 1 ? "that profile" : "one of them"}${fileNote}`) : gone !== void 0 ? `That profile is no longer stored \u2014 add it again with ${gone}` : `Re-run with \`${profileFlag}\` for that profile${fileNote}`;
+  if (sameWorkspace.length > 0) {
+    return new UsageError(
+      `This project tracks its ephemeral under a different credential profile (${quoted(profiles)}), not the one this command is acting as. ${remedy}, ${tail}.`,
+      opts
+    );
+  }
+  if (underOther.length > 0) {
+    const workspaces2 = [...new Set(underOther.map(workspaceOf))].join(", ");
+    return sendsElsewhere(new UsageError(
+      `This project tracks its ephemeral under a different credential profile (${quoted(profiles)}) and workspace (${workspaces2}) than the ones this command is acting as (workspace ${scope.workspaceId}). ${remedy}, ${tail}.`,
+      opts
+    ));
+  }
+  if (envMade.length > 0) {
+    const workspaces2 = [...new Set(envMade.map(workspaceOf))].join(", ");
+    return sendsElsewhere(new UsageError(
+      `This project tracks its ephemeral under the environment credential (workspace ${workspaces2}), not the profile this command is acting as. Set ${ENV_CREDENTIAL_VARS} for that workspace to act as it, ${tail}.`,
+      opts
+    ));
+  }
+  const here = hostOf(scope.instance);
+  const hostOfKey = (key) => {
+    const parts = key.split("/");
+    return parts.length >= 3 ? parts.slice(1, -1).join("/") : void 0;
+  };
+  const sameHost = others.filter((k) => (hostOfKey(k) ?? here) === here);
+  if (sameHost.length === 0) {
+    const hosts = [...new Set(others.map((k) => hostOfKey(k)))].join(", ");
+    return new UsageError(
+      `No ephemeral is tracked on ${here} \u2014 run \`xanosdk deploy${contextFlags()}\` to create one there, ${tail}. (This project's record is for ${hosts}.)`,
+      opts
+    );
+  }
+  const workspaces = [...new Set(sameHost.map(workspaceOf))].join(", ");
+  const login = `${current !== DEFAULT_PROFILE ? `xanosdk login -p ${current}` : "xanosdk login"}${credentialFileFlagFor(credentialFileOf() ?? "shared")}`;
+  const signIn = fromEnv ? `Point the environment credential at the workspace it belongs to, or run without it and sign in to that workspace` : `Sign in to the workspace it belongs to (\`${login}\`)`;
+  return sendsElsewhere(new UsageError(
+    `This project tracks its ephemeral under a different workspace than the one you are signed in to on ${here} (workspace ${scope.workspaceId}) \u2014 its record is for workspace ${workspaces}. ${signIn}, ${tail}.`,
+    opts
+  ));
+}
+var SENDS_ELSEWHERE = /* @__PURE__ */ new WeakSet();
+async function reachableFirst(refusal, auth) {
+  if (!(refusal instanceof Error) || !SENDS_ELSEWHERE.has(refusal)) return refusal;
+  if (auth === void 0 || !("access_token" in auth)) return refusal;
+  const { refuseUnreachableWorkspace } = await import("./workspace-binding-56PIIPCP.js");
+  try {
+    await refuseUnreachableWorkspace(auth);
+  } catch (unreachable) {
+    return unreachable;
+  }
+  return refusal;
+}
+function sendsElsewhere(refusal) {
+  SENDS_ELSEWHERE.add(refusal);
+  return refusal;
+}
+function hostOf(instance) {
+  try {
+    return new URL(instance).host;
+  } catch {
+    return instance.replace(/\//g, "_");
+  }
+}
+
+export {
+  resolveEphemeralName,
+  otherCredentialRefusal,
+  reachableFirst
+};
+//# sourceMappingURL=chunk-SWBF2LTK.js.map

package/dist/chunk-T5KELPAR.js

@@ -0,0 +1,109 @@
+import {
+  andList
+} from "./chunk-622HUCZT.js";
+import {
+  contextFlags,
+  isCredentialStoreCommand
+} from "./chunk-NAQDMEHV.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+
+// src/emit/retry-command.ts
+var CREDENTIAL_VALUE_FLAGS = /* @__PURE__ */ new Set(["--config", "--profile", "-p"]);
+var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Map([
+  ["--env-var", "key"],
+  ["--doc-token", "key"],
+  ["--origin", "whole"]
+]);
+var SECRET_POSITIONALS = /* @__PURE__ */ new Map([
+  ["env set", { value: 1, name: 0 }]
+]);
+var STDIN_VALUE = "$VALUE";
+var ASSIGNED = /^([A-Za-z_][A-Za-z0-9_]*)=/;
+function secretPositional(args) {
+  const spec = SECRET_POSITIONALS.get(`${args.command}${args.subcommand === void 0 ? "" : ` ${args.subcommand}`}`);
+  const argv = args.argv;
+  if (spec === void 0 || argv === void 0) return void 0;
+  const locate = (index) => {
+    const word = args.positionals[index];
+    if (word === void 0) return void 0;
+    if (args.positionalArgv !== void 0) {
+      const at = args.positionalArgv[index];
+      return at !== void 0 && argv[at] === word ? at : void 0;
+    }
+    const found = argv.lastIndexOf(word);
+    return found === -1 ? void 0 : found;
+  };
+  const value = locate(spec.value);
+  if (value !== void 0) return { at: value };
+  const name = locate(spec.name);
+  const assigned = name === void 0 ? null : ASSIGNED.exec(argv[name]);
+  return name !== void 0 && assigned !== null ? { at: name, keep: assigned[1] } : void 0;
+}
+var CREATE_ONLY_FLAGS = /* @__PURE__ */ new Set(["--expires-hours"]);
+function retryCommand(args, opts = {}) {
+  const createOnly = opts.creates === true ? /* @__PURE__ */ new Set() : CREATE_ONLY_FLAGS;
+  const flags = contextFlags(args, {
+    credentialStore: isCredentialStoreCommand({ command: args.command ?? opts.command?.split(" ")[0] })
+  });
+  const add = (opts.add ?? []).filter((f) => !(args.argv ?? []).includes(f));
+  if (args.argv === void 0) {
+    return { command: `xanosdk ${opts.command ?? "deploy"}${add.map((f) => ` ${f}`).join("")}${flags}`, withheld: [] };
+  }
+  const drop = new Set(opts.drop ?? []);
+  const kept = [];
+  const withheld = [];
+  const secretAt = secretPositional(args);
+  for (let i = 0; i < args.argv.length; i++) {
+    const token = args.argv[i];
+    if (i === secretAt?.at) {
+      if (secretAt.keep !== void 0) kept.push(shellQuote(secretAt.keep));
+      withheld.push(STDIN_VALUE);
+      continue;
+    }
+    const eq = token.indexOf("=");
+    const spelling = token.startsWith("-") && eq !== -1 ? token.slice(0, eq) : token;
+    const attached = spelling !== token;
+    const secret = SECRET_VALUE_FLAGS.get(spelling);
+    if (secret !== void 0) {
+      const value = attached ? token.slice(eq + 1) : args.argv[i + 1];
+      if (!attached) i += 1;
+      const key = secret === "key" && value !== void 0 && value.includes("=") ? value.slice(0, value.indexOf("=")) : void 0;
+      withheld.push(key !== void 0 && key !== "" ? `${spelling} ${key}` : spelling);
+      continue;
+    }
+    if (CREDENTIAL_VALUE_FLAGS.has(spelling) || createOnly.has(spelling) || drop.has(spelling)) {
+      if (!attached && (CREDENTIAL_VALUE_FLAGS.has(spelling) || createOnly.has(spelling))) i += 1;
+      continue;
+    }
+    if (token === "--local") continue;
+    kept.push(shellQuote(token));
+  }
+  const stdin = secretAt === void 0 ? "" : `printf %s "${STDIN_VALUE}" | `;
+  return { command: `${stdin}xanosdk ${[...kept, ...add].join(" ")}${flags}`, withheld };
+}
+function yesRerun(args, command) {
+  const retry = retryCommand(args, { add: ["--yes"], creates: true, command });
+  return { rerun: retry.command, note: withheldNote(retry.withheld) };
+}
+function pipedYes(args) {
+  return args?.yes === true || process.stdin.isTTY !== true ? " --yes" : "";
+}
+function withheldNote(withheld) {
+  const stdin = withheld.includes(STDIN_VALUE) ? ` The value is not reprinted: set \`VALUE\` to it and the command pipes it in, or pass it as the second argument.` : "";
+  const flags = withheld.filter((w) => w !== STDIN_VALUE);
+  if (flags.length === 0) return stdin;
+  const named = andList(flags.map((w) => `\`${w}\``));
+  return ` It leaves out ${named}: ${flags.length === 1 ? "its value is" : "their values are"} not reprinted, so pass ${flags.length === 1 ? "it" : "them"} again (or keep env values in the backend's \`.env\` and documentation tokens in its \`.secrets.json\`, which a deploy reads).` + stdin;
+}
+
+export {
+  SECRET_POSITIONALS,
+  STDIN_VALUE,
+  retryCommand,
+  yesRerun,
+  pipedYes,
+  withheldNote
+};
+//# sourceMappingURL=chunk-T5KELPAR.js.map