@xano/sdk 1.0.0

package/dist/chunk-WKQLGKCL.js

@@ -0,0 +1,2823 @@
+import {
+  EXIT_STATIC_FAILED,
+  assertStaticHostExists,
+  noteStaticTakenDown,
+  readStaticTeardown,
+  refuseStaticHostAReplaceClears,
+  staticRemovedField,
+  staticRetryCommand,
+  staticRetryHint,
+  unknownStaticOutcome,
+  warnStaticTeardown
+} from "./chunk-FQJ2TTHP.js";
+import {
+  shownLabel
+} from "./chunk-K6RXBGUB.js";
+import {
+  confirm,
+  needsConfirmation
+} from "./chunk-65HWOMGV.js";
+import {
+  landedRecordFor,
+  landingLockPath,
+  recordForeignLanding,
+  recordLanding
+} from "./chunk-CGVQZXYG.js";
+import {
+  assertStorageModesKept,
+  discloseCanonicalMoves,
+  movesClause,
+  storageChangesPayload
+} from "./chunk-BWPNT55T.js";
+import {
+  listTables,
+  tableRowCounter,
+  tableRowIds
+} from "./chunk-C6RIMRU4.js";
+import {
+  XANOSDK_IMPORT_CONFLICT_CODE,
+  XANOSDK_IMPORT_UNIQUENESS_CODE,
+  XanoSdkImportRefusal,
+  xanosdkImport
+} from "./chunk-WQFNASK4.js";
+import {
+  archiveSeedContent
+} from "./chunk-AOSYVMUS.js";
+import {
+  encodeWorkspaceArchive
+} from "./chunk-3DRXWLJ5.js";
+import {
+  DEFAULT_BRANCH_LABEL,
+  assertBranchAbsent,
+  assertUsableBranchLabel,
+  createBranch,
+  derivedLabelTail,
+  listBranchListing,
+  liveBranchLabel,
+  setLiveBranch
+} from "./chunk-TRJCALW3.js";
+import {
+  compareToLive,
+  envValuesOf,
+  payloadOf,
+  planTypeSection,
+  rowLabeler,
+  sectionKind,
+  sharedSchemaChanges,
+  storedColumnsAfter,
+  uniqueIndexLabels
+} from "./chunk-45UIT5T2.js";
+import {
+  assertBundleFile,
+  assertBundleInput,
+  loadBundleText,
+  resolveLockPath
+} from "./chunk-ETO6LGLD.js";
+import {
+  LookupFailedError,
+  isUnansweredLookup,
+  unansweredCause
+} from "./chunk-QCNYHBL7.js";
+import {
+  isSignatureRefusal
+} from "./chunk-AN6BL47T.js";
+import {
+  getAccessToken
+} from "./chunk-ET4Y4XCB.js";
+import {
+  ephemeralLandedOn
+} from "./chunk-5QU2P5CA.js";
+import {
+  pipedYes,
+  retryCommand,
+  withheldNote
+} from "./chunk-T5KELPAR.js";
+import {
+  contextFlags
+} from "./chunk-NAQDMEHV.js";
+import {
+  backendDirIn
+} from "./chunk-5A2PLKZB.js";
+import {
+  shellWord
+} from "./chunk-FWD7AL6N.js";
+import {
+  describeWrite
+} from "./chunk-4KHEMC32.js";
+import {
+  seedRowsByTableGuid
+} from "./chunk-U64O2MXY.js";
+import {
+  readLockFile
+} from "./chunk-P2HAGF6H.js";
+import {
+  destinationKey,
+  groupNames,
+  isEphemeralDestinationKey,
+  landedIdentities,
+  landedKeyForRow,
+  storedColumnsOf,
+  withStoredColumns
+} from "./chunk-TLQE7ZN3.js";
+import {
+  TransportError,
+  isTimeoutError
+} from "./chunk-YLDALTWZ.js";
+import {
+  CliError,
+  EXIT_OUTCOME_UNKNOWN,
+  UsageError,
+  backendDestinationPayload,
+  blank,
+  describeWriteTarget,
+  detail,
+  displayPath,
+  info,
+  isMachineOutput,
+  link,
+  pastePath,
+  statesOutcomeUnknown,
+  step,
+  success,
+  warn,
+  writeJson,
+  writeTargetPayload
+} from "./chunk-PTHVMXZI.js";
+import {
+  calcSignatureJson,
+  signatureHolds
+} from "./chunk-LQCMKAJ7.js";
+import {
+  safeNames
+} from "./chunk-GSGDWJB5.js";
+import {
+  adoptFromBundle,
+  codePinnedTables,
+  identityNamesByGuid,
+  lockKey,
+  lockNameForObject,
+  sdkKindName2 as sdkKindName
+} from "./chunk-6MR5TI5V.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+import {
+  REFERENCEABLE_KIND_PAYLOAD_KEYS,
+  rawDeriveGuid
+} from "./chunk-NZOWWHU5.js";
+import {
+  withArticle
+} from "./chunk-36JUQZVQ.js";
+
+// src/emit/release-command.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, relative, resolve, sep } from "path";
+
+// src/emit/plan-presentation.ts
+function nounOf(ctx) {
+  return ctx.noun ?? (ctx.tenant ? "tenant" : "workspace");
+}
+function rowsOf(payload, section) {
+  const rows = payload[section];
+  return Array.isArray(rows) ? rows.filter((r) => r !== null && typeof r === "object") : [];
+}
+function sdkKindForPlanType(type, row) {
+  return sectionKind(planTypeSection(type), row);
+}
+function guidOf(row) {
+  return typeof row.guid === "string" && row.guid !== "" ? row.guid : void 0;
+}
+function deletedRows(ops, ctx) {
+  const ours = payloadOf(ctx.bundle);
+  const theirs = payloadOf(ctx.live);
+  const used = /* @__PURE__ */ new Set();
+  const carried = /* @__PURE__ */ new Map();
+  const carriedIn = (section) => {
+    let set = carried.get(section);
+    if (set === void 0) {
+      set = new Set(rowsOf(ours, section).map(guidOf).filter((g) => g !== void 0));
+      carried.set(section, set);
+    }
+    return set;
+  };
+  return ops.map((op) => {
+    if (op.action !== "delete") return void 0;
+    const section = planTypeSection(op.type);
+    const kept = carriedIn(section);
+    const named = rowsOf(theirs, section).filter((r) => !used.has(r) && r.name === op.name);
+    const row = named.find((r) => {
+      const guid = guidOf(r);
+      return guid === void 0 || !kept.has(guid);
+    }) ?? named[0];
+    if (row !== void 0) used.add(row);
+    return row;
+  });
+}
+function presentOperations(ops, ctx) {
+  const ours = payloadOf(ctx.bundle);
+  const theirs = payloadOf(ctx.live);
+  const ourLabel = rowLabeler(ours);
+  const theirLabel = rowLabeler(theirs);
+  const cursor = /* @__PURE__ */ new Map();
+  const deleted = deletedRows(ops, ctx);
+  const created = new Set(ops.filter((o) => o.action === "create").map((o) => `${o.type}\0${o.name}`));
+  return ops.map((op, index) => {
+    const section = planTypeSection(op.type);
+    let row;
+    let labeler = ourLabel;
+    if (op.action === "delete") {
+      labeler = theirLabel;
+      row = deleted[index];
+    } else if (op.action === "create" || op.action === "update") {
+      const rows = rowsOf(ours, section);
+      const at = cursor.get(section) ?? 0;
+      row = rows[at]?.name === op.name ? rows[at] : rows.find((r) => r.name === op.name);
+      cursor.set(section, at + 1);
+    } else {
+      row = rowsOf(ours, section).find((r) => r.name === op.name);
+    }
+    const type = sdkKindForPlanType(op.type, row);
+    const query = section === "query" && row !== void 0 ? queryParts(row, labeler(section, row)) : {};
+    const label = row !== void 0 && section !== "workspace" ? labeler(section, row) : `${type}:${op.name}`;
+    const provenance = op.action === "delete" ? ctx.provenance?.(op, row) : void 0;
+    const worded = op.action === "delete" && created.has(`${op.type}\0${op.name}`) ? "recreate" : op.action;
+    const details = sdkWords(op.details, nounOf(ctx), provenance, ctx.rows, worded);
+    const reason = sdkWords(op.reason, nounOf(ctx), provenance, ctx.rows, worded);
+    return {
+      type,
+      name: op.name,
+      ...query,
+      label,
+      action: op.action,
+      ...details === void 0 ? {} : { details },
+      ...reason === void 0 ? {} : { reason }
+    };
+  });
+}
+function tableRenames(bundle, live) {
+  const liveNames = /* @__PURE__ */ new Map();
+  for (const row of rowsOf(payloadOf(live), "dbo")) {
+    const guid = guidOf(row);
+    if (guid !== void 0 && typeof row.name === "string") liveNames.set(guid, row.name);
+  }
+  const out = [];
+  for (const row of rowsOf(payloadOf(bundle), "dbo")) {
+    const guid = guidOf(row);
+    if (guid === void 0 || typeof row.name !== "string") continue;
+    const from = liveNames.get(guid);
+    if (from !== void 0 && from !== row.name) out.push({ from, to: row.name });
+  }
+  return out;
+}
+function queryParts(row, label) {
+  const verb = typeof row.verb === "string" && row.verb !== "" ? row.verb : void 0;
+  const group = / \(apiGroup (.+)\)$/.exec(label)?.[1];
+  return { ...verb === void 0 ? {} : { verb }, ...group === void 0 ? {} : { apiGroup: group } };
+}
+function countActions(ops) {
+  const out = { create: 0, update: 0, delete: 0, truncate: 0 };
+  for (const op of ops) out[op.action] = (out[op.action] ?? 0) + 1;
+  return out;
+}
+function countTypes(ops) {
+  const out = {};
+  for (const op of ops) {
+    const counts = out[op.type] ??= { create: 0, update: 0, delete: 0, truncate: 0 };
+    counts[op.action] = (counts[op.action] ?? 0) + 1;
+  }
+  return out;
+}
+function presentRows(rows) {
+  if (rows === null || typeof rows !== "object" || Array.isArray(rows)) return void 0;
+  const out = {};
+  for (const [key, value] of Object.entries(rows)) {
+    out[key.replace(/_([a-z])/g, (_, c) => c.toUpperCase())] = value;
+  }
+  return out;
+}
+function sdkWords(text, target, provenance, rows, action) {
+  if (text === void 0 || text === "") return void 0;
+  const known = KNOWN_SENTENCES.find(([match]) => match.test(text));
+  if (known !== void 0) return known[1](target, provenance, rows, action);
+  return ENGINE_VOCABULARY.test(text) ? void 0 : text;
+}
+function recreated(rows) {
+  const source = rows?.source ?? "project";
+  const carried = rows?.carried ?? true;
+  if (source === "bundle") {
+    return carried ? "The bundle's tables are re-created with the rows it carries; anything it does not carry is gone." : "The bundle carries no rows \u2014 every table comes back empty.";
+  }
+  return carried ? "This project's own tables are re-created with its seed rows; anything it does not declare is gone." : "This project's own tables are re-created empty \u2014 this deploy carries no seed rows; anything it does not declare is gone.";
+}
+function notRecreated(rows) {
+  return (rows?.source ?? "project") === "bundle" ? "The bundle does not carry this table, so it is dropped, not re-created." : "This project does not declare this table, so it is dropped, not re-created.";
+}
+var ENGINE_VOCABULARY = /\b(?:mode|delete|records|truncate)=|\bobj_type\b|\b[a-z]+:[a-z_]+\b/;
+var KNOWN_SENTENCES = [
+  [
+    /^Workspace settings and environment variables will be updated from the archive, and the workspace will be CLEARED/,
+    (t) => `Settings are updated from the archive, after the ${t} is CLEARED`
+  ],
+  [/^Workspace settings and environment variables will be updated from the archive/, () => "Settings are updated from the archive"],
+  [/^mode=replace wipes the destination workspace/, (t) => `\`--replace\` clears the ${t} before importing`],
+  [
+    /^Will be created: no object in this workspace carries the archive's guid/,
+    (t) => `Created: nothing in the ${t} carries this object's identity`
+  ],
+  [/^Will be deleted by the workspace clear that mode=replace performs/, () => "Deleted by the clear `--replace` runs before importing"],
+  [
+    /^Will be deleted: the archive does not carry this object and delete=true/,
+    (_t, provenance) => `Deleted: ${whyPruned(provenance)}, and \`--prune\` removes what the project omits`
+  ],
+  [
+    /^ROW LOSS: mode=replace drops every table/,
+    (t, _provenance, rows, action) => `ROW LOSS: \`--replace\` drops every table in the ${t} before importing, destroying its rows. ` + // On a table being DELETED — one the archive does not carry — nothing
+    // brings it back; "every table comes back empty" described a table that
+    // does not come back at all.
+    (action === "delete" ? notRecreated(rows) : recreated(rows))
+  ],
+  [
+    /^ROW LOSS: this table is deleted because the archive does not carry it/,
+    (_t, provenance) => `ROW LOSS: \`--prune\` deletes this table because ${whyPruned(provenance)}, and its rows go with it. Leaving out \`--seed\` does NOT protect them. Nothing in this deploy restores them.`
+  ],
+  [
+    /^truncate=true empties the tables the archive carries, and records=true/,
+    () => "`--reset-data` empties the tables this project declares, and `--seed` then loads its seed rows into them"
+  ],
+  [
+    /^truncate=true empties the tables the archive carries/,
+    () => "`--reset-data` empties the tables this project declares, and without `--seed` nothing is loaded back"
+  ],
+  [
+    /^Matched by obj_type, not by guid/,
+    (t) => `Matched as the ${t}'s one error trigger rather than by identity, which the import replaces with the ${t}'s own. It is updated in place, not replaced.`
+  ]
+];
+function whyPruned(provenance) {
+  switch (provenance) {
+    case "landed":
+      return "this project no longer declares it";
+    case "adopted":
+      return "it was adopted by `lock import`, not declared by this project";
+    case "locked":
+      return "this project no longer declares it, though it never landed it here \u2014 it may be another project's of the same name";
+    case "never":
+      return "this project never declared it \u2014 it is another project's or was made by hand";
+    default:
+      return "this project does not declare it";
+  }
+}
+
+// src/emit/release-command.ts
+var DESTRUCTIVE_ACTIONS = /* @__PURE__ */ new Set(["delete", "truncate", "drop"]);
+var IDENTITY_EXEMPT_TYPES = /* @__PURE__ */ new Set(["workspace"]);
+var BRANCH_INCOMPATIBLE = [
+  {
+    flag: "--replace",
+    why: "a replace wipes the whole workspace, which is not something a branch can scope"
+  },
+  {
+    flag: "--backup-branch",
+    why: "a deploy to a branch does not overwrite the live branch, so there is nothing for a backup to protect"
+  }
+];
+function resolveRequest(args) {
+  let branch;
+  if (args.branch !== void 0) {
+    branch = assertUsableBranchLabel(args.branch, "--branch");
+    const conflicting = BRANCH_INCOMPATIBLE.filter(
+      ({ flag }) => flag === "--replace" ? args.replace : args.backupBranch !== void 0
+    );
+    if (conflicting.length > 0) {
+      const { flag, why } = conflicting[0];
+      throw new UsageError(
+        `\`--branch\` cannot be combined with \`${flag}\`: ${why}.
+Drop \`${flag}\` to stage this deploy on "${branch}", or drop \`--branch\` to deploy to the live branch.`,
+        { helpFor: { command: "deploy" } }
+      );
+    }
+  } else if (args.setLive) {
+    throw new UsageError(
+      `\`--set-live\` promotes the branch a deploy just landed on, and this deploy names no branch.
+Add \`--branch <label>\` to stage the deploy and promote it, or use \`xanosdk workspace branch set-live <label>${contextFlags()}\` to promote a branch that already exists.`,
+      { helpFor: { command: "deploy" } }
+    );
+  }
+  if (typeof args.backupBranch === "string") {
+    assertUsableBranchLabel(args.backupBranch, "--backup-branch", "drop the flag to deploy without a snapshot");
+  }
+  if (args.replace) {
+    if (args.backupBranch !== void 0) {
+      throw new UsageError(
+        `\`--replace\` cannot be combined with \`--backup-branch\`: a replace deletes the workspace's non-live branches, so it would destroy the snapshot along with everything else and leave you with a rollback target that does not exist.
+Drop \`--replace\` to merge (which a backup CAN protect), or take a workspace export first with \`xanosdk workspace export${contextFlags()}\`.`,
+        { helpFor: { command: "deploy" } }
+      );
+    }
+    const clearedByReplace = [args.prune ? "--prune" : "", args.resetData ? "--reset-data" : ""].filter(Boolean);
+    if (clearedByReplace.length > 0) {
+      throw new UsageError(
+        `\`--replace\` cannot be combined with ${clearedByReplace.join(" or ")}. A replace already clears every object and every table row, so there is nothing left for those flags to describe. Drop \`--replace\` to merge, or drop ${clearedByReplace.join("/")}.`,
+        { helpFor: { command: "deploy" } }
+      );
+    }
+    if (args.seed) {
+      throw new UsageError(
+        "`--replace` cannot be combined with `--seed`, because a replace already writes this project's seed rows \u2014 the archive carries them and the replaced workspace comes back with them. The flag is redundant here, not refused because seeding is impossible.\nDrop `--seed` to keep the replace (your seed rows still land), or drop `--replace` to merge and seed an existing workspace.",
+        { helpFor: { command: "deploy" } }
+      );
+    }
+    return { mode: "replace", preserveGuids: true };
+  }
+  return {
+    mode: "merge",
+    prune: args.prune,
+    records: args.seed,
+    truncate: args.resetData,
+    ...branch !== void 0 ? { branch } : {}
+  };
+}
+function derivedBackupLabel(now) {
+  return `backup-${derivedLabelTail(now)}`;
+}
+function plannedBackupLabel(flag, branches) {
+  const label = assertUsableBranchLabel(
+    typeof flag === "string" ? flag : derivedBackupLabel(/* @__PURE__ */ new Date()),
+    "--backup-branch",
+    "drop the flag to deploy without a snapshot"
+  );
+  assertBranchAbsent(branches, label, "backup");
+  return label;
+}
+function isDestructive(req) {
+  return req.mode === "replace" || req.prune === true || req.truncate === true || req.records === true;
+}
+function countByAction(operations) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const op of operations) {
+    counts.set(op.action, (counts.get(op.action) ?? 0) + 1);
+  }
+  return counts;
+}
+function correspondence(plan) {
+  let matched = 0;
+  let created = 0;
+  let orphaned = 0;
+  for (const op of plan.operations) {
+    if (IDENTITY_EXEMPT_TYPES.has(op.type)) continue;
+    if (op.action === "create") created++;
+    else if (op.action === "delete") orphaned++;
+    else matched++;
+  }
+  return { matched, created, orphaned };
+}
+function warnOnZeroCorrespondence(plan, req, targetIsEmpty2, noun = "workspace", sameNamed, dryRun = true, presented = plan.operations) {
+  if (req.mode !== "merge") return;
+  const { matched, created, orphaned } = correspondence(plan);
+  if (matched > 0 || created === 0) return;
+  if (targetIsEmpty2) return;
+  const objects = (n) => `${n} object${n === 1 ? "" : "s"}`;
+  const would = dryRun ? "would" : "will";
+  blank();
+  if (orphaned > 0) {
+    warn(
+      `NOTHING MATCHED. ${created === 1 ? "The 1 object" : `All ${objects(created)}`} ${would} be created and ${objects(orphaned)} already in this ${noun} deleted \u2014 not one of them shares an identity with this project.`,
+      "plan.nothing-matched",
+      [
+        `This is not an update. It empties the ${noun} and rebuilds it from scratch.`,
+        // "Never released to" was false beside a stale record: the question is what it holds NOW.
+        `That is what landing on ${withArticle(noun)} with no current landing of this project looks like.`,
+        "To adopt what is already there, pin those objects' guids on your defs first. A prune here is not recoverable."
+      ]
+    );
+  } else {
+    const settings = presented.some(
+      (op) => IDENTITY_EXEMPT_TYPES.has(op.type) && !["create", "delete", "unchanged"].includes(op.action)
+    );
+    const landing = `Only ${withArticle(noun)} holding a current landing of this project will match.`;
+    let line;
+    if (sameNamed === void 0) {
+      line = `If this ${noun} is already populated, its objects carry different identities and you will end up with two of everything. ${landing}`;
+    } else if (sameNamed.length === 0) {
+      line = `None of them shares a name with anything already in this ${noun}: they are all new objects, added beside what is there.`;
+    } else {
+      const shown = sameNamed.slice(0, 5).join(", ") + (sameNamed.length > 5 ? `, \u2026 ${sameNamed.length - 5} more` : "");
+      line = `${sameNamed.length === 1 ? "1 of them shares its name" : `${sameNamed.length} of them share a name`} with an object already in this ${noun} under a different identity (${shown}) \u2014 you will end up with two of ${sameNamed.length === 1 ? "it" : "each"}. ${landing}`;
+    }
+    warn(
+      `Nothing matched: ${created === 1 ? "the 1 object" : `all ${objects(created)}`} ${would} be created, ${settings ? `none updated but the ${noun}'s own settings` : "none updated"}.`,
+      "plan.nothing-matched",
+      [line]
+    );
+  }
+}
+function sameNamedCreates(plan, presented, live) {
+  if (live === void 0) return void 0;
+  const payload = payloadOf(live);
+  const label = rowLabeler(payload);
+  const out = [];
+  plan.operations.forEach((op, i) => {
+    if (op.action !== "create" || IDENTITY_EXEMPT_TYPES.has(op.type)) return;
+    const section = planTypeSection(op.type);
+    const rows = payload[section];
+    const shown = presented[i]?.label;
+    const composed = COMPOSED_IDENTITY_SECTIONS.has(section) && shown !== void 0;
+    const held = Array.isArray(rows) && rows.some(
+      (r) => r !== null && typeof r === "object" && r.name === op.name && (!composed || label(section, r) === shown)
+    );
+    if (held) out.push(shown ?? `${op.type}:${op.name}`);
+  });
+  return out;
+}
+function envCarriedBy(bundle, live) {
+  if (live === void 0) return void 0;
+  const ours = envValuesOf(bundle);
+  const theirs = envValuesOf(live);
+  return { names: ours.size, created: [...ours.keys()].filter((name) => !theirs.has(name)) };
+}
+var COMPOSED_IDENTITY_SECTIONS = /* @__PURE__ */ new Set(["query", "channel", "message"]);
+function payloadKeyFor(type) {
+  return (Object.hasOwn(REFERENCEABLE_KIND_PAYLOAD_KEYS, type) ? REFERENCEABLE_KIND_PAYLOAD_KEYS[type] : void 0) ?? type;
+}
+function splitPruneDeletes(plan, record, ctx) {
+  const rows = deletedRows(plan.operations, ctx);
+  const ownedIdentities = {};
+  const ownedAs = landedOwnerKey(record, ctx.live);
+  const collateral = [];
+  const owned = [];
+  plan.operations.forEach((op, index) => {
+    if (op.action !== "delete") return;
+    if (IDENTITY_EXEMPT_TYPES.has(op.type)) return;
+    const key = ownedAs(op, rows[index]);
+    if (key === void 0) {
+      collateral.push(op);
+      return;
+    }
+    owned.push(op);
+    ownedIdentities[key] = record[key];
+  });
+  return { collateral, owned, ownedIdentities };
+}
+function landedOwnerKey(record, live) {
+  const liveGroups = groupNamesByRef(live);
+  return (op, row) => {
+    if (record === void 0) return void 0;
+    const payloadKey = payloadKeyFor(op.type);
+    const key = row !== void 0 ? landedKeyForRow(payloadKey, { ...row, name: op.name }, liveGroups) : payloadKey === "query" ? void 0 : lockKey(payloadKey, op.name);
+    const entry = key === void 0 ? void 0 : record[key];
+    if (key === void 0 || entry === void 0) return void 0;
+    const guid = typeof row?.guid === "string" && row.guid !== "" ? row.guid : void 0;
+    if (guid !== void 0 && entry.guid !== guid) return void 0;
+    if (payloadKey === "toolset") {
+      const isAgent = row !== void 0 ? row.type === "agent" : op.type === "agent";
+      if (entry.type === "agent" !== isAgent) return void 0;
+    }
+    return key;
+  };
+}
+function pruneProvenance(args, landingKey, live) {
+  let record;
+  let objects;
+  try {
+    const lockPath = resolveLockPath(args, args.file ?? ".");
+    const lockExists = existsSync(lockPath);
+    if (landingKey !== void 0 && (lockExists || isEphemeralDestinationKey(landingKey))) {
+      record = landedRecordFor(lockPath, landingKey).record;
+    }
+    if (lockExists) objects = readLockFile(lockPath).objects;
+  } catch {
+  }
+  const landed = landedOwnerKey(record, live);
+  const declared = landedOwnerKey(objects, live);
+  return (op, row) => {
+    if (record === void 0 && objects === void 0) return void 0;
+    const landedKey = landed(op, row);
+    if (landedKey !== void 0) return objects?.[landedKey]?.adopted === true ? "adopted" : "landed";
+    return declared(op, row) !== void 0 ? "locked" : "never";
+  };
+}
+function groupNamesByRef(bundle) {
+  const payload = bundle?.payload;
+  return payload !== null && typeof payload === "object" ? groupNames(payload) : /* @__PURE__ */ new Map();
+}
+function assertLiveWorkspaceWasRead(live, destNoun, branch, failure, kind = "workspace") {
+  if (live !== void 0) return;
+  const scope = branch === void 0 ? "" : ` on branch "${branch}"`;
+  const reason = liveReadReason(failure);
+  const because = reason === void 0 ? "" : ` (${reason})`;
+  if (failure !== void 0 && isUnansweredLookup(failure)) {
+    const cause = unansweredCause(failure);
+    throw new LookupFailedError(
+      `Refusing to deploy into ${destNoun}${scope}: it could not be read${because}, so whether this deploy drops a column or renames the workspace is unknown. ${cause} \u2014 nothing was written`,
+      "unreachable",
+      kind
+    );
+  }
+  throw new UsageError(
+    `Refusing to deploy into ${destNoun}${scope}: it could not be read${because}, so whether this deploy drops a column or renames the workspace is unknown.
+The import reports a dropped column as a routine table update, and the data in it is not recoverable \u2014 so the one check that would have caught it has to have run.
+Retry when the instance is reachable. \`--dry-run\` still prints the plan and says which checks could not be made.`,
+    { hintFor: { command: "deploy" } }
+  );
+}
+async function readLiveWorkspace(auth, dest, branch) {
+  return (await readLive(auth, dest, branch)).live;
+}
+var LIVE_READ_RETRY_PAUSES_MS = [250, 750];
+function isTransientReadFailure(err) {
+  const cause = err?.cause;
+  if (isTimeoutError(err) || isTimeoutError(cause) || err instanceof TransportError && err.timeout) return false;
+  return isUnansweredLookup(err);
+}
+async function readLive(auth, dest, branch) {
+  const { exportWorkspaceBundle } = await import("./workspace-export-OJSH2HIW.js");
+  let failure;
+  for (let attempt = 0; attempt <= LIVE_READ_RETRY_PAUSES_MS.length; attempt++) {
+    try {
+      const live = await exportWorkspaceBundle(auth, {
+        base: dest.base,
+        workspaceId: dest.workspaceId,
+        label: "reading the target workspace",
+        ...branch !== void 0 ? { branch } : {}
+      });
+      return { live };
+    } catch (err) {
+      failure = err;
+      const pause = LIVE_READ_RETRY_PAUSES_MS[attempt];
+      if (pause === void 0 || !isTransientReadFailure(err)) break;
+      await new Promise((r) => setTimeout(r, pause));
+    }
+  }
+  return { live: void 0, failure };
+}
+function liveReadReason(failure) {
+  if (failure === void 0) return void 0;
+  const first = ((failure instanceof Error ? failure.message : String(failure)).split("\n")[0] ?? "").trim();
+  return first === "" ? void 0 : first.replace(/[.:]$/, "");
+}
+function keepWorkspaceName(bundle, live) {
+  const liveWs = live?.payload?.workspace;
+  const liveName = typeof liveWs?.name === "string" && liveWs.name !== "" ? liveWs.name : void 0;
+  if (liveName === void 0) return bundle;
+  let parsed;
+  try {
+    parsed = JSON.parse(bundle);
+  } catch {
+    return bundle;
+  }
+  const ws = parsed?.payload?.workspace;
+  if (ws === null || typeof ws !== "object" || Array.isArray(ws) || ws.name === liveName) return bundle;
+  const held = signatureHolds(bundle) !== false;
+  ws.name = liveName;
+  return resigned(parsed, held);
+}
+function resigned(parsed, held) {
+  const { sig, ...unsigned } = parsed;
+  if (sig === void 0) return JSON.stringify(unsigned);
+  return JSON.stringify({ ...unsigned, sig: held ? calcSignatureJson(unsigned) : sig });
+}
+var WORKSPACE_LEVEL_SETTINGS = /* @__PURE__ */ new Set(["name", "description", "preferences", "realtime", "history", "middleware"]);
+var OMITTABLE_WORKSPACE_SETTINGS = ["preferences", "realtime", "history", "middleware"];
+function withholdWorkspaceSettings(bundle, live) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bundle);
+  } catch {
+    return { bundle, withheld: [] };
+  }
+  const ws = parsed?.payload?.workspace;
+  if (ws === null || ws === void 0 || typeof ws !== "object" || Array.isArray(ws)) return { bundle, withheld: [] };
+  const held = signatureHolds(bundle) !== false;
+  let withheld = [];
+  if (live !== void 0) {
+    try {
+      const order = [...WORKSPACE_LEVEL_SETTINGS];
+      const rank = (path) => order.indexOf(path.split(".")[0]);
+      withheld = compareToLive(parsed, live, void 0, { documentation: "skip", sample: "all" }).settingsFields.filter((path) => rank(path) !== -1).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+    } catch {
+      withheld = [];
+    }
+  }
+  const liveWs = live?.payload?.workspace;
+  let changed = false;
+  for (const key of ["name", "description"]) {
+    const value = liveWs?.[key];
+    if (typeof value === "string") {
+      if (ws[key] !== value) {
+        ws[key] = value;
+        changed = true;
+      }
+    } else if (key === "description" && live !== void 0 && Object.hasOwn(ws, key)) {
+      delete ws[key];
+      changed = true;
+    }
+  }
+  for (const key of OMITTABLE_WORKSPACE_SETTINGS) {
+    if (Object.hasOwn(ws, key)) {
+      delete ws[key];
+      changed = true;
+    }
+  }
+  if (!changed) return { bundle, withheld };
+  return { bundle: resigned(parsed, held), withheld };
+}
+function collisionBranch(branches, target) {
+  if (target === void 0) return void 0;
+  return branches.some((b) => b.label === target) ? target : void 0;
+}
+function targetIsEmpty(live) {
+  if (live === void 0) return false;
+  const payload = live.payload;
+  if (payload === null || typeof payload !== "object") return false;
+  return !Object.entries(payload).some(
+    // The workspace settings row is present in every workspace, empty or not.
+    ([key, value]) => key !== "workspace" && Array.isArray(value) && value.length > 0
+  );
+}
+async function convergedWithLive(live, req, outgoingBundle, pinned) {
+  if (live === void 0 || req.mode !== "merge") return false;
+  if (req.records === true || req.truncate === true) return false;
+  const { compareToLive: compareToLive2 } = await import("./live-diff-YONW2VI3.js");
+  let result;
+  try {
+    result = compareToLive2(
+      JSON.parse(outgoingBundle),
+      live,
+      new Set(pinned.map((p) => `${p.payloadKey}:${p.name}`)),
+      // A merge does not write the `documentation` block, so it can never be a
+      // reason to send; `warnAboutLiveLosses` says what stays behind instead.
+      { documentation: "skip" }
+    );
+  } catch {
+    return false;
+  }
+  if (!result.converged) return false;
+  if (req.prune === true && result.liveOnly.length > 0) return false;
+  return true;
+}
+async function unchangedWithLive(live, req, outgoingBundle, pinned) {
+  if (live === void 0 || req.mode !== "merge") return void 0;
+  if (req.records === true || req.truncate === true) return void 0;
+  const { compareToLive: compareToLive2, declaredLabels, payloadOf: payloadOf2, SETTINGS_LABEL } = await import("./live-diff-YONW2VI3.js");
+  try {
+    const outgoing = JSON.parse(outgoingBundle);
+    const result = compareToLive2(outgoing, live, new Set(pinned.map((p) => `${p.payloadKey}:${p.name}`)), {
+      documentation: "skip",
+      sample: "all"
+    });
+    const changed = /* @__PURE__ */ new Set([...result.differing, ...result.missing]);
+    const declared = declaredLabels(outgoing);
+    const once = declared.filter((l, i) => declared.indexOf(l) === i && declared.lastIndexOf(l) === i);
+    const settings = "workspace" in payloadOf2(outgoing) && !changed.has(SETTINGS_LABEL);
+    return { labels: new Set(once.filter((l) => !changed.has(l))), settings };
+  } catch {
+    return void 0;
+  }
+}
+function markUnchanged(presented, unchanged, noun) {
+  if (unchanged === void 0) return [...presented];
+  return presented.map((op) => {
+    if (op.action !== "update") return op;
+    const same = op.type === "workspace" ? unchanged.settings : unchanged.labels.has(op.label);
+    if (!same) return op;
+    const { details: _d, reason: _r, ...rest } = op;
+    return { ...rest, action: "unchanged", details: `Already matches the ${noun}; nothing about it changes` };
+  });
+}
+var REPLACE_DROPS = "which deletes every table's rows there (only seed rows come back)";
+async function replaceCommandHint(args) {
+  const { retryCommand: retryCommand2, withheldNote: withheldNote2 } = await import("./deploy-command-JVZPWHMK.js");
+  const valued = /* @__PURE__ */ new Set(["--branch", "--backup-branch", "--expect-live"]);
+  const dropped = /* @__PURE__ */ new Set(["--prune", "--reset-data", "--seed", "--set-live", "--dry-run", "--replace", "--yes", "-y"]);
+  const argv = [];
+  const typed = args.argv ?? [];
+  for (let i = 0; i < typed.length; i++) {
+    const spelling = typed[i].split("=")[0];
+    if (valued.has(spelling)) {
+      if (spelling === typed[i]) i += 1;
+    } else if (!dropped.has(spelling)) argv.push(typed[i]);
+  }
+  const { command, withheld } = retryCommand2(args.argv === void 0 ? args : { ...args, argv }, { add: ["--replace"] });
+  return `\`${command}\`.${withheldNote2(withheld)}`;
+}
+function landingTableFields(losses) {
+  const { droppedColumns, retypedColumns, narrowedEnums, retargetedRefs, indexChanges, notNullKept, notNullTightened, renamedTables, pairedColumns } = losses;
+  return {
+    renamedTables,
+    droppedColumns,
+    // The dropped-and-added pairs the column-drop warning names, as `--keep-data` carries them.
+    ...pairedColumns.length > 0 ? { pairedColumns } : {},
+    notNullKept,
+    retypedColumns,
+    narrowedEnums,
+    retargetedRefs,
+    indexChanges,
+    notNullTightened,
+    storageChanges: storageChangesPayload(losses.storageChanges)
+  };
+}
+async function warnAboutLiveLosses(live, req, outgoingBundle, setWhere = "workspace", fromBundle = false, replaceHint = "`xanosdk deploy <source> --to <destination> --replace`.", noun = "workspace", failure, stored) {
+  const { NO_TABLE_EFFECTS, tableEffectsOf, discloseTableEffects, tableEffectFields, alteringChanges, droppedAndAdded } = await import("./plan-disclosure-6G4MLZKD.js");
+  const none = {
+    ...tableEffectFields(NO_TABLE_EFFECTS),
+    renamedTables: [],
+    pairedColumns: [],
+    unchangedEnv: [],
+    droppedEnv: [],
+    unappliedDocumentation: [],
+    storageChanges: []
+  };
+  if (live === void 0) {
+    const reason = liveReadReason(failure);
+    warn(
+      `Could not read the target ${noun}${reason === void 0 ? "" : ` (${reason})`}, so this plan does not account for dropped columns or env that will not update.`,
+      "plan.target-unreadable"
+    );
+    blank();
+    return none;
+  }
+  const { diffAgainstLive, tableAdditions } = await import("./live-diff-YONW2VI3.js");
+  let diff;
+  let additions;
+  try {
+    const outgoing = JSON.parse(outgoingBundle);
+    diff = diffAgainstLive(outgoing, live, { mode: req.mode, ...stored === void 0 ? {} : { stored } });
+    additions = tableAdditions(outgoing, live);
+  } catch {
+    return none;
+  }
+  const effects = tableEffectsOf(diff, additions, { mode: req.mode === "replace" ? "rebuild" : "merge" });
+  discloseTableEffects(effects, {
+    subject: "the deploy",
+    stages: "deploys",
+    remedies: {
+      "plan.column-drop": "The plan reports these as a routine in-place table update; they are not recoverable.",
+      "plan.not-null-kept": `Later plans cannot see it. A replace recreates the table, which relaxes it \u2014 and replaces its rows: ${replaceHint}`,
+      "plan.not-null-tightened": `A replace recreates the table \u2014 and replaces its rows: ${replaceHint}`
+    }
+  });
+  if (alteringChanges(effects).length > 0) blank();
+  if (diff.unchangedEnv.length > 0) {
+    warn(
+      `${diff.unchangedEnv.length} environment variable${diff.unchangedEnv.length === 1 ? "" : "s"} will NOT be updated: ${diff.unchangedEnv.map((e) => e.name).join(", ")}`,
+      "plan.env-kept",
+      [
+        "A merge is add-only for env: it creates keys that do not exist and leaves existing ones as they are.",
+        // The command, not "set them in tenant … directly" (E2E pass 23).
+        // `--yes`: a workspace or tenant write asks first, and off a terminal
+        // refuses without it — the printed command has to run as printed.
+        `To change these values, run \`printf %s "$VALUE" | xanosdk env set NAME --to ${shellQuote(setWhere)}${noun === "ephemeral" ? "" : " --yes"}${contextFlags()}\` for each, or rebuild the ${noun} with a replace, ${REPLACE_DROPS}: ${replaceHint}`
+      ]
+    );
+    blank();
+  }
+  if (diff.droppedEnv.length > 0) {
+    const one = diff.droppedEnv.length === 1;
+    warn(
+      `${diff.droppedEnv.length} environment variable${one ? "" : "s"} will be DROPPED: ${safeNames(diff.droppedEnv.map((e) => e.name))}`,
+      "plan.env-drop",
+      // A `--bundle` sends that file's env set, not this project's: worded by
+      // what the BUNDLE carries (E2E pass 13 L3) — "not declared in this
+      // project" was false for a name the project declares and the bundle lacks.
+      fromBundle ? [
+        `A replace rebuilds the ${noun} from the archive, so its env set becomes exactly what the bundle carries.`,
+        `${one ? "This one is" : "These are"} set on the target and not carried by the bundle.`,
+        `Send a bundle that carries ${one ? "it" : "them"} to keep ${one ? "it" : "them"}, or deploy without \`--replace\` (a merge leaves existing values alone).`
+      ] : [
+        `A replace rebuilds the ${noun} from the archive, so its env set becomes exactly what \`workspaceConfig({ env })\` declares.`,
+        `${one ? "This one is" : "These are"} set on the target and not declared in this project \u2014 added through the UI, or by an earlier deploy \u2014 so nothing else here mentions ${one ? "it" : "them"}.`,
+        `Declare ${one ? "the name" : "the names"} to keep ${one ? "it" : "them"}, or deploy without \`--replace\` (a merge leaves existing values alone).`
+      ]
+    );
+    blank();
+  }
+  if (diff.unappliedDocumentation.length > 0) {
+    const what = diff.unappliedDocumentation.includes("require_token") ? diff.unappliedDocumentation.includes("token") ? "documentation gate and token" : "documentation gate" : "documentation token";
+    warn(
+      `The workspace ${what} will NOT be updated.`,
+      "plan.doc-not-updated",
+      [
+        "A merge does not write the workspace's `documentation` block; the live one stays as it is.",
+        `To apply it, rebuild the ${noun} with a replace, ${REPLACE_DROPS}: ${replaceHint}`
+      ]
+    );
+    blank();
+  }
+  if (diff.workspaceRename !== void 0) {
+    warn(
+      `This workspace will be RENAMED: "${diff.workspaceRename.from}" \u2192 "${diff.workspaceRename.to}"`,
+      "plan.workspace-rename",
+      [
+        "An import carries the workspace's own settings, so deploying a project renames the workspace it lands in.",
+        // A `--bundle` has no project source to edit (E2E pass 20): its name is what lands.
+        fromBundle ? `The bundle's name replaces the workspace's. To keep "${diff.workspaceRename.from}", send a bundle exported under that name.` : `To keep the current name, change the name in \`workspace("\u2026")\` to "${diff.workspaceRename.from}".`
+      ]
+    );
+    blank();
+  }
+  return {
+    ...tableEffectFields(effects),
+    // The plan's "rename table … (rows kept)" lines, for the `--json` reader.
+    renamedTables: req.mode === "merge" ? tableRenames(JSON.parse(outgoingBundle), live) : [],
+    pairedColumns: droppedAndAdded(effects),
+    unchangedEnv: diff.unchangedEnv.map((e) => e.name),
+    droppedEnv: diff.droppedEnv.map((e) => e.name),
+    unappliedDocumentation: [...diff.unappliedDocumentation],
+    ...diff.workspaceRename !== void 0 ? { workspaceRename: diff.workspaceRename } : {},
+    storageChanges: effects.storageChanges ?? []
+  };
+}
+function assertPruneStaysInScope(args, plan, where, ctx = { bundle: void 0, live: void 0, tenant: false }, presented = presentOperations(plan.operations, ctx), refusal) {
+  const ephemeral = where.key !== void 0 && isEphemeralDestinationKey(where.key);
+  if (!ephemeral && args.lockPath === void 0 && args.file === void 0) {
+    throw new UsageError(
+      "`--prune` needs a lock file to know which objects this project landed here, and `--bundle` carries none. Pass `--lock=<path>` to name the project's lock, release from the entry file instead, or drop `--prune`.",
+      { helpFor: { command: "deploy" } }
+    );
+  }
+  const lockPath = resolveLockPath(args, args.file ?? ".");
+  const noLock = !ephemeral && !existsSync(lockPath);
+  const kept = where.key === void 0 ? void 0 : noLock ? { record: void 0, file: displayPath(lockPath), local: false } : landedRecordFor(lockPath, where.key);
+  const record = kept?.record;
+  const { collateral, owned, ownedIdentities } = splitPruneDeletes(plan, record, ctx);
+  if (collateral.length === 0 && noLock) {
+    throw refusalError(
+      refusal?.frame,
+      "pruneOutOfScope",
+      `\`--prune\` is unavailable here: there is no lock at ${displayPath(lockPath)}, so no landing record for ${where.noun}${where.key === void 0 ? "" : ` (${where.key})`} to say what this project owns there. Nothing was written. Drop \`--prune\`${args.noLock ? " and keep `--no-lock`" : ""}, or deploy here once without \`--prune\`${args.noLock ? " or `--no-lock`" : ""} \u2014 that writes the lock and records what it lands.`,
+      { branch: refusal?.branch, outOfScope: [] }
+    );
+  }
+  if (collateral.length === 0) return ownedIdentities;
+  const lines = collateral.map((op) => {
+    const shown = presented[plan.operations.indexOf(op)];
+    const reason = shown?.reason;
+    return `  ${shown?.label ?? `${op.type}:${op.name}`}${reason !== void 0 ? ` \u2014 ${reason}` : ""}`;
+  });
+  const n = collateral.length;
+  const outOfScope = collateral.map((op) => {
+    const shown = presented[plan.operations.indexOf(op)];
+    return {
+      type: shown?.type ?? op.type,
+      name: op.name,
+      label: shown?.label ?? `${op.type}:${op.name}`,
+      ...shown?.reason === void 0 ? {} : { reason: shown.reason }
+    };
+  });
+  const lastLine = ephemeral ? `To keep the objects above, drop \`--prune\`. If one of them is this project's, it was landed from another checkout of it (${kept?.file ?? ".xano/ephemeral.json"} is kept per project, on this machine) or before the record existed: delete it by hand, or define it again, deploy here, and remove it once the landing is recorded.` : `To keep the objects above, drop \`--prune\`. If one of them is this project's, it was landed before the record existed or from a lock that was not committed: delete it by hand, or define it again, deploy, and remove it once the landing is recorded.`;
+  throw refusalError(
+    refusal?.frame,
+    "pruneOutOfScope",
+    `\`--prune\` would delete ${n} object${n === 1 ? "" : "s"} this project never landed on ${where.noun}:
+${lines.join("\n")}
+
+\`--prune\` deletes only what this project put here, as ${kept?.file ?? displayPath(lockPath)} records it per destination \u2014 but the endpoint deletes everything absent from the bundle, including objects another project or a person put there. Sharing a name with an object in this project's lock does not make it this project's. Dropping a populated table is not recoverable.
+` + (record === void 0 ? noLock ? `There is no lock at ${displayPath(lockPath)}, so no landing record for ${where.noun}${where.key === void 0 ? "" : ` (${where.key})`}. Deploy here once without \`--prune\`${args.noLock ? " or `--no-lock`" : ""} \u2014 that writes the lock and records what it lands \u2014 and commit the lock. A lock written by \`xanosdk export\` records no landing, so a prune would still be refused.
+` : kept?.local === true ? `${kept.file} has no landing record for ${where.noun} (${where.key}): this project has not deployed to it (not from this checkout), or its record was cleared when a release or another backend's copy that is not this project's replaced what it serves. Deploy here once without \`--prune\` \u2014 that records what it lands.
+` : `The lock has no landing record for ${where.noun} (${where.key ?? "unknown destination"}): this project has not landed here since the lock started recording landings, this is a fresh clone of a lock whose record was never committed, or the record was cleared when ${clearedBy(where.key)}. Deploy here once without \`--prune\` \u2014 that records what it lands \u2014 and commit the lock.
+` : owned.length > 0 ? `The ${owned.length} deletion${owned.length === 1 ? "" : "s"} this project did land here would have been correct.
+` : "") + lastLine,
+    // No `--help` pointer: the flags are fine, and the help cannot say which
+    // objects this project landed. The message above is the whole answer.
+    { branch: refusal?.branch, outOfScope }
+  );
+}
+function clearedBy(key) {
+  if (key !== void 0 && /\/workspace\/[^/]+$/.test(key)) {
+    return "a `deploy --to workspace --replace` of a bundle that is not this project's replaced what it serves";
+  }
+  if (key !== void 0 && /\/tenant\/[^/]+$/.test(key)) {
+    return "a release or a bundle that is not this project's replaced what it serves (`tenant deploy`, or `deploy --to tenant:<name> --replace --bundle`)";
+  }
+  return "a release or another backend's copy that is not this project's replaced what it serves";
+}
+function seedWritePhrase(t) {
+  const rows = `${t.rows} ${t.rows === 1 ? "row" : "rows"}`;
+  if (t.overwrites === null) return `${rows} written; how many overwrite a live row could not be read`;
+  return `${rows} written, ${t.overwrites} of them overwriting ${t.overwrites === 1 ? "a live row" : "live rows"}`;
+}
+function seedOverwriteClause(seeded) {
+  const hit = seeded.filter((t) => t.overwrites !== null && t.overwrites > 0);
+  const total = hit.reduce((n, t) => n + t.overwrites, 0);
+  const unread = seeded.filter((t) => t.overwrites === null).map((t) => t.table);
+  const parts = [
+    total > 0 ? ` It overwrites ${total} live ${total === 1 ? "row" : "rows"} by id (${hit.map((t) => `${t.table}: ${t.overwrites}`).join(", ")}).` : "",
+    unread.length > 0 ? ` The live rows of ${unread.join(", ")} could not be read, so what it overwrites there is unknown.` : ""
+  ];
+  return parts.join("");
+}
+async function seedWrites(auth, archive, bundle, dest) {
+  const byGuid = seedRowsByTableGuid(archiveSeedContent(archive));
+  if (byGuid.size === 0) return [];
+  const tables = bundle?.payload?.dbo;
+  const names = /* @__PURE__ */ new Map();
+  for (const t of Array.isArray(tables) ? tables : []) {
+    if (typeof t.guid === "string" && typeof t.name === "string") names.set(t.guid, t.name);
+  }
+  const listed = await listTables(auth, { workspaceId: dest.workspaceId, base: dest.base }).catch(() => void 0);
+  const out = [];
+  for (const [guid, rows] of byGuid) {
+    if (rows.length === 0) continue;
+    const table = names.get(guid) ?? guid;
+    const here = listed?.find((l) => l.guid === guid) ?? listed?.find((l) => l.name === table);
+    const overwrites = listed === void 0 ? null : here === void 0 ? 0 : await tableRowIds(auth, { workspaceId: dest.workspaceId, tableId: here.id, base: dest.base }).then(
+      (ids) => rows.filter((r) => r.id !== void 0 && r.id !== null && ids.has(String(r.id))).length,
+      () => null
+    );
+    out.push({ table, rows: rows.length, overwrites });
+  }
+  return out;
+}
+function renderPlan(plan, req, workspaceId, targetIsEmpty2, converged = false, listing = { branches: [], unaddressable: [] }, branchReadFailed = false, tenantLabel, presented = presentOperations(plan.operations, {
+  bundle: void 0,
+  live: void 0,
+  tenant: tenantLabel !== void 0
+}), noun = tenantLabel === void 0 ? "workspace" : "tenant", sameNamed, envCarried, dryRun = true, renamed = [], seeded = []) {
+  const counts = countByAction(presented);
+  const label = plan.workspaceName !== void 0 ? `${plan.workspaceName} (#${workspaceId})` : `#${workspaceId}`;
+  blank();
+  const onBranch = tenantLabel === void 0 && req.branch !== void 0 ? ` branch ${JSON.stringify(req.branch)}` : "";
+  step(tenantLabel !== void 0 ? `Plan for ${tenantLabel}` : `Plan for workspace ${label}${onBranch}`);
+  if (converged) {
+    detail(
+      `no changes \u2014 every object this project defines already matches the ${noun}`
+    );
+    return;
+  }
+  const order = ["create", "update", "delete", "truncate", "drop"];
+  const seen = [...order.filter((a) => counts.has(a)), ...[...counts.keys()].filter((a) => !order.includes(a))];
+  if (seen.length === 0) {
+    detail("no changes");
+  } else {
+    for (const action of seen) {
+      detail(`${action}: ${counts.get(action)}`);
+    }
+  }
+  if (req.mode === "merge") {
+    for (const { from, to } of renamed) detail(`The merge ${dryRun ? "would" : "will"} rename table ${from} \u2192 ${to} (rows kept).`);
+  }
+  const destructive = presented.filter((op) => DESTRUCTIVE_ACTIONS.has(op.action));
+  if (destructive.length > 0) {
+    blank();
+    warn(
+      `${destructive.length} destructive operation${destructive.length === 1 ? "" : "s"}:`,
+      "deploy.destructive",
+      destructive.map((op) => `${op.action} ${op.label}${op.reason !== void 0 ? ` \u2014 ${op.reason}` : ""}`)
+    );
+  }
+  if (plan.hasRecords) {
+    blank();
+    if (seeded.length === 0) {
+      warn(`Table rows from the bundle ${dryRun ? "would be" : "WILL be"} written.`, "deploy.rows-written");
+    } else {
+      warn(
+        `Table rows from the bundle ${dryRun ? "would be" : "WILL be"} written \u2014 each by its id, overwriting the row the ${noun} holds at that id:`,
+        "deploy.rows-written",
+        [
+          ...seeded.map((t) => `table ${t.table}: ${seedWritePhrase(t)}`),
+          "A seed row authored without an `id` is numbered by its position (1, 2, \u2026), so it lands on that id too."
+        ]
+      );
+    }
+  }
+  blank();
+  if (plan.hasEnv && req.mode === "merge" && envCarried !== void 0 && envCarried.names > 0 && envCarried.created.length === 0) {
+    detail(
+      `Every environment variable the bundle carries already exists on the ${noun} \u2014 a merge is add-only, so none is written and existing keys are NOT updated.`
+    );
+  } else if (plan.hasEnv) {
+    warn(
+      `Environment variables from the bundle ${dryRun ? "would be" : "WILL be"} written.`,
+      "deploy.env-written",
+      req.mode === "merge" ? ["Merge is add-only: keys that do not exist are created; existing keys are NOT updated."] : []
+    );
+  } else if (req.mode === "replace") {
+    warn(
+      `The archive carries no environment variables, and \`--replace\` clears the ${noun}'s env \u2014 it comes back with none.`,
+      "release.no-env"
+    );
+  } else {
+    detail("The archive carries no environment variables \u2014 existing env is left untouched.");
+  }
+  const notes = (Array.isArray(plan.summary.notes) ? plan.summary.notes : []).filter(
+    (note) => typeof note === "string"
+  );
+  if (notes.length > 0) {
+    blank();
+    for (const note of notes) warn(note, "plan.server-note");
+  }
+  if (req.mode === "replace") {
+    blank();
+    warn(
+      tenantLabel !== void 0 ? `\`--replace\` wipes ${tenantLabel} before importing \u2014 including table data and history.` : "`--replace` wipes this workspace before importing \u2014 including table data, history, and every one of its branches.",
+      "deploy.replace-wipe"
+    );
+    if (branchReadFailed) {
+      blank();
+      warn(
+        "The branch inventory could not be read, so what this wipe destroys is UNKNOWN.",
+        "branch.inventory-unknown",
+        ["`--allow-branch-deletion` accepted the deletion; it did not establish what is lost."]
+      );
+    }
+    const doomed = branchReadFailed ? { named: [], unnamed: 0, total: 0, backups: 0, authored: 0 } : doomedBranches(listing);
+    if (doomed.total > 0) {
+      blank();
+      warn(`${doomedHeadline(doomed)} will be permanently deleted and CANNOT be recovered:`, "branch.deletion", branchDisclosureLines(doomed));
+    }
+  }
+  warnOnZeroCorrespondence(plan, req, targetIsEmpty2, noun, sameNamed, dryRun, presented);
+  blank();
+}
+var BRANCH_DISCLOSURE_LIMIT = 10;
+function doomedBranches(listing) {
+  const named = listing.branches.filter((b) => b.label !== DEFAULT_BRANCH_LABEL);
+  const unnamedRows = listing.unaddressable;
+  const backups = named.filter((b) => b.backup).length + unnamedRows.filter((b) => b.backup).length;
+  const total = named.length + unnamedRows.length;
+  return { named, unnamed: unnamedRows.length, total, backups, authored: total - backups };
+}
+function doomedHeadline(doomed) {
+  const noun = `branch${doomed.total === 1 ? "" : "es"}`;
+  const counted = `${doomed.total} ${noun} besides ${DEFAULT_BRANCH_LABEL}`;
+  if (doomed.backups === 0 || doomed.authored === 0) return counted;
+  return `${counted} \u2014 ${doomed.authored} yours, ${doomed.backups} platform backup${doomed.backups === 1 ? "" : "s"}`;
+}
+function branchDisclosureLines(doomed) {
+  const shown = doomed.named.slice(0, BRANCH_DISCLOSURE_LIMIT);
+  const lines = shown.map(
+    (b) => `${shownLabel(b.label)}${b.live ? " (live \u2014 the deploy lands on " + DEFAULT_BRANCH_LABEL + " instead)" : ""}${b.backup ? " (platform backup)" : ""}`
+  );
+  const rest = doomed.named.length - shown.length;
+  if (rest > 0) {
+    lines.push(`\u2026 and ${rest} more \u2014 \`xanosdk workspace branch list${contextFlags()}\` prints the full inventory`);
+  }
+  if (doomed.unnamed > 0) {
+    lines.push(
+      doomed.unnamed === 1 ? `1 branch with no label, which cannot be named here or exported \u2014 it is deleted all the same` : `${doomed.unnamed} branches with no label, which cannot be named here or exported \u2014 they are deleted all the same`
+    );
+  }
+  return lines;
+}
+function branchDeletionReport(req, listing, readFailed, destHasBranches) {
+  if (req.mode !== "replace" || !destHasBranches) return void 0;
+  if (readFailed) return { unknown: true };
+  const doomed = doomedBranches(listing);
+  return {
+    unknown: false,
+    total: doomed.total,
+    authored: doomed.authored,
+    platformBackups: doomed.backups,
+    unlabeled: doomed.unnamed,
+    labels: doomed.named.map((b) => ({ label: b.label, backup: b.backup }))
+  };
+}
+function assertBranchDeletionAcknowledged(args, req, listing, readError, workspaceId) {
+  if (req.mode !== "replace") return;
+  if (args.allowBranchDeletion) return;
+  if (readError !== void 0) {
+    throw new UsageError(
+      `Refusing to \`--replace\` workspace #${workspaceId}: its branch list could not be read, so whether this wipe destroys other branches is unknown.
+A replace deletes every branch in the workspace and none of them can be recovered. A failed read is not evidence that there are none.
+Retry when the instance is reachable, or pass \`--allow-branch-deletion\` to proceed anyway.`,
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  const doomed = doomedBranches(listing);
+  if (doomed.total === 0) return;
+  const listed = branchDisclosureLines(doomed).map((l) => `  - ${l}`).join("\n");
+  const liveDoomed = doomed.named.find((b) => b.live);
+  const copy = doomed.named.length === 0 ? `A label-less branch cannot be exported, because every branch route addresses a branch by label` : liveDoomed !== void 0 ? `Take a copy of each one first \u2014 \`xanosdk workspace export --branch <label>${contextFlags()}\`, once per branch. The live branch, ${JSON.stringify(liveDoomed.label)}, is deleted too: back it up with \`xanosdk workspace export --branch ${shellWord(liveDoomed.label)}${contextFlags()}\`` : `Take a copy of each one first \u2014 \`xanosdk workspace export --branch <label>${contextFlags()}\`, once per branch (a bare \`workspace export\` reads only the live branch, ${DEFAULT_BRANCH_LABEL}, which the replace keeps but overwrites)`;
+  throw new UsageError(
+    `Refusing to \`--replace\` workspace #${workspaceId}: it has ${doomedHeadline(doomed)}, and the clear deletes branches by WORKSPACE.
+These will be permanently deleted and CANNOT be recovered:
+${listed}
+
+\`--yes\` does not cover this \u2014 it waives the confirmation, not the loss.
+${copy}.
+Or drop \`--replace\` to merge (which leaves other branches untouched), or pass \`--allow-branch-deletion\` to accept the deletion.`,
+    // A one-line pointer, as every refusal of what the TARGET holds gets here:
+    // the flags parsed fine, and a usage block under this list would bury it.
+    { hintFor: { command: "deploy" } }
+  );
+}
+function assertSharedSchemaAcknowledged(args, live, bundle, branch) {
+  const changes = gatedSchemaChanges(sharedSchemaChanges(JSON.parse(bundle), live, { prune: args.prune }));
+  const waive = retryCommand(args, { add: ["--allow-shared-schema-changes"] });
+  const waived = `\`${waive.command}\`${withheldNote(waive.withheld)}`;
+  if (changes === void 0) {
+    if (args.allowSharedSchemaChanges) return void 0;
+    return refuseOrReport(
+      args,
+      `Refusing to deploy to branch "${branch}": the live workspace could not be read, so whether this deploy changes shared schema is unknown.
+Tables and microservices are shared by every branch, so a schema change reaches production even on a deploy to a branch. A failed read is not evidence that there is none.
+Retry when the instance is reachable. \`--allow-shared-schema-changes\` waives THIS check, but a deploy that cannot read its target is refused either way \u2014 use \`--dry-run\` to see the plan without writing.`,
+      void 0,
+      { reason: "tables-unreadable", changes: null }
+    );
+  }
+  if (changes.length === 0 || args.allowSharedSchemaChanges) return changes;
+  const lines = changes.map((c) => {
+    const detailText = c.details === void 0 || c.details.length === 0 ? "" : ` \u2014 ${c.details.join(", ")}`;
+    return `  ${c.action} ${c.kind === "dbo" ? "table" : "microservice"} "${c.name}"${detailText}`;
+  });
+  return refuseOrReport(
+    args,
+    `\`--branch ${branch}\` cannot stage ${changes.length} change${changes.length === 1 ? "" : "s"} to this workspace's SHARED schema:
+${lines.join("\n")}
+
+Tables and microservices carry no branch in Xano \u2014 one set is shared by every branch. These would be applied to the LIVE workspace by the same import that stages your logic on "${branch}", and the plan would report them as routine.
+Deploy without \`--branch\` if applying them is what you want, take them out of this deploy, or stage the logic and apply the schema knowing both happen: ${waived}.`,
+    changes,
+    { reason: "shared-schema-changes", changes: lines.map((l) => l.trim()) }
+  );
+}
+function ungatedSchemaChanges(changes) {
+  const gated = gatedSchemaChanges(changes) ?? [];
+  return (changes ?? []).flatMap((c) => {
+    if (c.action !== "alter" || c.details === void 0) return [];
+    const kept = gated.find((g) => g.kind === c.kind && g.name === c.name)?.details ?? [];
+    return c.details.filter((d) => !kept.includes(d)).map((d) => `table "${c.name}": ${d}`);
+  });
+}
+function gatedSchemaChanges(changes) {
+  if (changes === void 0) return void 0;
+  const gated = (d) => !/^drop index /.test(d) && !/^add index (?!unique\()/.test(d);
+  return changes.flatMap((c) => {
+    if (c.action !== "alter" || c.details === void 0) return [c];
+    const details = c.details.filter(gated);
+    return details.length === 0 ? [] : [{ ...c, details }];
+  });
+}
+function refuseOrReport(args, message, result, details) {
+  if (!args.dryRun) {
+    throw new CliError("SDK_SHARED_SCHEMA_CHANGE", message, {
+      exitCode: 2,
+      details: { landed: false, declined: false, ...details }
+    });
+  }
+  const [head, ...rest] = message.split("\n");
+  warn(/^Refusing/.test(head) ? head.replace(/^Refusing/, "A real run would refuse") : `A real run would refuse: ${head}`, "deploy.dry-run-refusal");
+  for (const line of rest) {
+    if (line.trim() === "") continue;
+    detail(line.trim());
+  }
+  blank();
+  return result;
+}
+function releaseCanonicalLock(args, classified) {
+  if (classified !== void 0) return classified;
+  const lockPath = args.lockPath ?? (args.file !== void 0 ? resolveLockPath(args, args.file) : void 0);
+  if (lockPath === void 0 || !existsSync(lockPath)) return void 0;
+  return readLockFile(lockPath);
+}
+function codePinnedCanonicals(bundle, lock, compiledFromSource = false) {
+  if (lock === void 0 && !compiledFromSource) return [];
+  let payload;
+  try {
+    const parsed = JSON.parse(bundle)?.payload;
+    if (parsed === null || typeof parsed !== "object") return [];
+    payload = parsed;
+  } catch {
+    return [];
+  }
+  const pinned = [];
+  for (const payloadKey of ["app", "toolset", "realtime_server"]) {
+    const section = payload[payloadKey];
+    if (!Array.isArray(section)) continue;
+    for (const row of section) {
+      if (row === null || typeof row !== "object") continue;
+      const { name, canonical, guid } = row;
+      if (typeof name !== "string" || name === "") continue;
+      if (typeof canonical !== "string" || canonical === "") continue;
+      if (lock !== void 0 && lock.objects[lockKey(payloadKey, name)]?.canonical_source !== "code") {
+        continue;
+      }
+      pinned.push({
+        payloadKey,
+        name,
+        canonical,
+        ...typeof guid === "string" && guid !== "" ? { guid } : {}
+      });
+    }
+  }
+  return pinned;
+}
+function pinnedCanonicalGuids(bundle, lock, compiledFromSource = false) {
+  const guids = [];
+  for (const entry of codePinnedCanonicals(bundle, lock, compiledFromSource)) {
+    if (entry.guid !== void 0 && !guids.includes(entry.guid)) guids.push(entry.guid);
+  }
+  return guids;
+}
+var EXIT_IMPORT_CONFLICT = 2;
+function parsedOrUndefined(bundle) {
+  try {
+    return JSON.parse(bundle);
+  } catch {
+    return void 0;
+  }
+}
+function namedRow(ctx, kind, name) {
+  const section = planTypeSection(kind);
+  for (const side of [ctx?.bundle, ctx?.live]) {
+    const rows = payloadOf(side)[section];
+    if (!Array.isArray(rows)) continue;
+    const row = rows.find((r) => r !== null && typeof r === "object" && r.name === name);
+    if (row !== void 0) return row;
+  }
+  return void 0;
+}
+function canonicalsForOutput(canonicals, ctx) {
+  return canonicals.map((c) => ({ ...c, kind: sdkKindForPlanType(c.kind, namedRow(ctx, c.kind, c.name)) }));
+}
+function plannedCanonicalsForOutput(canonicals, ctx) {
+  return canonicalsForOutput(canonicals, ctx).map((c, i) => ({ ...c, live: liveSlug(ctx.live, canonicals[i]) ?? null }));
+}
+function liveSlug(live, c) {
+  const rows = payloadOf(live)[planTypeSection(c.kind)];
+  if (!Array.isArray(rows)) return void 0;
+  const records = rows.filter((r) => r !== null && typeof r === "object");
+  const row = (c.guid === void 0 ? void 0 : records.find((r) => r.guid === c.guid)) ?? records.find((r) => r.name === c.name && (typeof r.guid !== "string" || r.guid === ""));
+  return typeof row?.canonical === "string" && row.canonical !== "" ? row.canonical : void 0;
+}
+function plannedCanonicalMoves(canonicals, ctx) {
+  return plannedCanonicalsForOutput(canonicals, ctx).filter((c) => c.live !== null && c.served !== void 0 && c.served !== c.live).map((c) => ({ kind: c.kind, name: c.name, from: c.live, to: c.served }));
+}
+function reportPlannedCanonicalMoves(moves, will, when) {
+  if (moves.length === 0) return;
+  discloseCanonicalMoves(moves, { subject: "the deploy", will, ...when === void 0 ? {} : { when } });
+  blank();
+}
+function conflictsForOutput(conflicts, ctx) {
+  return conflicts.map((c) => ({ ...c, kind: sdkKindForPlanType(c.kind, namedRow(ctx, c.kind, c.identity)) }));
+}
+function planForOutput(plan, presented, tenant, converged = false, noun = tenant ? "tenant" : "workspace") {
+  const { branch, operations: _operations, summary, ...rest } = plan;
+  const {
+    types: _types,
+    actions: _actions,
+    delete: _delete,
+    records: _records,
+    truncate: _truncate,
+    rows,
+    ...kept
+  } = summary;
+  const shownRows = presentRows(rows);
+  const shown = converged ? presented.map(({ details: _d, reason: _r, ...op }) => ({
+    ...op,
+    action: "unchanged",
+    details: `Already matches the ${noun}; nothing is sent for it`
+  })) : presented;
+  return {
+    ...rest,
+    summary: {
+      ...kept,
+      actions: countActions(shown),
+      types: countTypes(shown),
+      ...shownRows === void 0 ? {} : { rows: shownRows }
+    },
+    operations: shown,
+    ...tenant ? {} : { branch: branch ?? null }
+  };
+}
+function destinationPayload(resolved, dest, auth) {
+  if (dest?.kind !== "tenant") return writeTargetPayload({ base: resolved.base, workspaceId: resolved.workspaceId, kind: "workspace" });
+  return backendDestinationPayload(auth, {
+    kind: dest.type ?? "tenant",
+    name: dest.name ?? resolved.label ?? "",
+    url: resolved.base,
+    ...dest.display === void 0 ? {} : { display: dest.display }
+  });
+}
+function planFromRoute(res, tenant = false, otherBranches) {
+  const { notes, ...summary } = res.plan.summary;
+  return {
+    workspaceName: res.workspace.name,
+    summary: notes === void 0 ? summary : { ...summary, notes: presentableNotes(notes, tenant, otherBranches) },
+    hasRecords: res.plan.hasRecords,
+    hasEnv: res.plan.hasEnv,
+    operations: res.plan.operations,
+    branch: res.branch
+  };
+}
+var INTERNAL_IDENTIFIER = /\b[a-z]+:[a-z_]+\b/;
+var REPLACE_CLEAR_NOTE = /other branch/i;
+var BRANCHES_IN_LIST = /\bbranches, /;
+var REPLACE_CLEAR_TEXT = "A replace clears the whole workspace, not one branch: every object on every other branch of this workspace is destroyed too, and none of them is listed in this plan.";
+function presentableNotes(notes, tenant = false, otherBranches) {
+  const all = typeof notes === "string" ? [notes] : Array.isArray(notes) ? notes : [];
+  const shown = [];
+  let withheld = 0;
+  for (const note of all) {
+    if (typeof note !== "string" || note === "") continue;
+    if (tenant && REPLACE_CLEAR_NOTE.test(note)) continue;
+    if (otherBranches === 0 && REPLACE_CLEAR_NOTE.test(note)) continue;
+    if (tenant && BRANCHES_IN_LIST.test(note)) {
+      shown.push(note.replace(BRANCHES_IN_LIST, ""));
+      continue;
+    }
+    if (!INTERNAL_IDENTIFIER.test(note)) shown.push(note);
+    else if (REPLACE_CLEAR_NOTE.test(note)) {
+      shown.push(REPLACE_CLEAR_TEXT);
+    } else withheld += 1;
+  }
+  if (withheld > 0) {
+    shown.push(
+      `The instance attached ${withheld} more note${withheld === 1 ? "" : "s"} about this preview that the CLI cannot show \u2014 treat the plan as incomplete.`
+    );
+  }
+  return shown;
+}
+function codePinnedGuid(args) {
+  let lock;
+  try {
+    lock = readLockFile(resolveLockPath(args, args.file ?? "."));
+  } catch {
+    lock = void 0;
+  }
+  return (guid, sending) => {
+    const key = lockKey(sending.payloadKey, sending.lockName);
+    const entry = lock?.objects[key];
+    if (entry?.guid === guid && entry.guid_source === "code") return true;
+    if (guid === rawDeriveGuid(key)) return false;
+    const legacy = sending.payloadKey === "query" ? lock?.objects[lockKey("query", sending.name)]?.guid : void 0;
+    return lock?.objects[key]?.guid !== guid && legacy !== guid;
+  };
+}
+function lockRenameRemedy(args) {
+  const lockPath = resolveLockPath(args, args.file ?? ".");
+  let lock;
+  try {
+    lock = readLockFile(lockPath);
+  } catch {
+    return void 0;
+  }
+  return (ownerGuid, sending) => {
+    const prefix = `${sending.payloadKey}:`;
+    const key = Object.keys(lock.objects).find(
+      (k) => k.startsWith(prefix) && lock.objects[k]?.guid === ownerGuid && k !== `${prefix}${sending.lockName}`
+    );
+    if (key === void 0) return void 0;
+    let [kind, oldName, newName] = [sending.kind, key.slice(prefix.length), sending.lockName];
+    const [og, ...orest] = oldName.split("|");
+    const [ng, ...nrest] = newName.split("|");
+    if (sending.payloadKey === "query" && og !== ng && orest.join("|") === nrest.join("|") && `app:${og}` in lock.objects) {
+      [kind, oldName, newName] = ["apiGroup", og, ng];
+    }
+    const [o, n] = [oldName.split("|"), newName.split("|")];
+    if (sending.payloadKey === "channel" || sending.payloadKey === "message") {
+      if (og !== ng && orest.join("|") === nrest.join("|") && `realtime_server:${og}` in lock.objects) {
+        [kind, oldName, newName] = ["realtimeServer", og, ng];
+      } else if (sending.payloadKey === "message" && o[1] !== n[1] && o[0] === n[0] && o[2] === n[2] && `channel:${o[0]}|${o[1]}` in lock.objects) {
+        [kind, oldName, newName] = ["realtimeChannel", `${o[0]}|${o[1]}`, `${n[0]}|${n[1]}`];
+      }
+    }
+    const entry = args.file === void 0 ? "" : ` --entry=${shellWord(displayPath(args.file))}`;
+    return `This is a rename of ${kind} "${oldName}" to "${newName}": xano.lock still pins that guid under the old name. Run \`xanosdk lock rename ${kind} ${shellWord(oldName)} ${shellWord(newName)} --lock=${shellWord(displayPath(lockPath))}${entry}\`, then retry \u2014 the object already there is updated in place, keeping its guid and canonical.`;
+  };
+}
+function adoptRemedy(args, dest) {
+  const lockPath = resolveLockPath(args, args.file ?? ".");
+  const lockFlag = lockPath === resolve("xano.lock") ? "" : ` --lock=${shellWord(displayPath(lockPath))}`;
+  const creds = contextFlags(args);
+  const importIt = `\`xanosdk lock import live.json${lockFlag} --yes\``;
+  const scope = " \u2014 every identity in that file becomes this project's, and a later `--prune` from this project can delete any of those objects once they have landed";
+  if (dest?.kind !== "tenant") {
+    return `export it with \`xanosdk workspace export --path live.json${creds}\`, then ${importIt}${scope}`;
+  }
+  if (dest.name === void 0 || dest.name === "") return void 0;
+  if (dest.type !== "ephemeral") return pullRemedy(dest.name, lockPath, creds);
+  return `export it with \`xanosdk ephemeral export ${shellWord(dest.name)} --format json --path live.json${creds}\`, then ${importIt}${scope}`;
+}
+function pullRemedy(tenant, lockPath, creds) {
+  const backend = dirname(lockPath);
+  if (!existsSync(join(backend, "index.ts"))) return void 0;
+  const cwd = process.cwd();
+  const rel = relative(cwd, backend).split(sep).join("/");
+  if (rel === "" || rel === ".." || rel.startsWith("../") || rel.startsWith("/")) return void 0;
+  const dirFlag = resolve(backendDirIn(cwd)) === resolve(backend) ? "" : ` --backend-dir ${shellWord(pastePath(rel))}`;
+  const yes = process.stdin.isTTY === true ? "" : " --yes";
+  return `pull it into this project with \`xanosdk pull tenant:${shellWord(tenant)}${dirFlag}${creds}${yes}\` (commit first) \u2014 it rewrites the files a decode wrote in ${rel}/, your edits to them included, and keeps the files you added; every identity the tenant holds becomes this project's, and a later \`--prune\` from this project can delete any of those objects once they have landed`;
+}
+function adoptionAddsNothing(args, live) {
+  if (live === void 0 || kindsByGuid(live).size === 0) return false;
+  const lockPath = resolveLockPath(args, args.file ?? ".");
+  if (!existsSync(lockPath)) return false;
+  try {
+    const { added, changed } = adoptFromBundle(readLockFile(lockPath), live, "the destination");
+    return added.length === 0 && changed.length === 0;
+  } catch {
+    return false;
+  }
+}
+var REFUSAL_CODES = {
+  identityConflict: "SDK_IDENTITY_CONFLICT",
+  renamePending: "SDK_IDENTITY_CONFLICT",
+  kindConflict: "SDK_KIND_CONFLICT",
+  importRefused: "SDK_IMPORT_REFUSED",
+  uniqueViolation: "SDK_IMPORT_REFUSED",
+  pruneOutOfScope: "SDK_PRUNE_OUT_OF_SCOPE"
+};
+async function unrecordedTableRenames(args, bundle, live, plan, classified) {
+  const entry = args.file;
+  if (entry === void 0) return [];
+  const created = plan.operations.filter((o) => o.action === "create" && (o.type === "table" || o.type === "dbo")).map((o) => o.name);
+  if (created.length === 0) return [];
+  const lockPath = resolveLockPath(args, entry);
+  let lock;
+  try {
+    lock = readLockFile(lockPath);
+  } catch {
+    return [];
+  }
+  const guidsOf = (doc) => {
+    const rows = payloadOf(doc).dbo;
+    const out2 = /* @__PURE__ */ new Map();
+    for (const r of Array.isArray(rows) ? rows : []) {
+      const row = r;
+      if (typeof row?.guid === "string" && row.guid !== "") out2.set(row.guid, typeof row.name === "string" ? row.name : row.guid);
+    }
+    return out2;
+  };
+  let outgoingDoc;
+  try {
+    outgoingDoc = JSON.parse(bundle);
+  } catch {
+    return [];
+  }
+  const outgoing = guidsOf(outgoingDoc);
+  const outgoingNames = new Set(outgoing.values());
+  const held = guidsOf(live);
+  const codePinned = codePinnedTables(outgoingDoc, lock, classified);
+  const { orphanFixUps } = await import("./cli.js");
+  const { setGuidRemedy, clearReplacedCommand } = await import("./keep-data-merge-7MPLVAVI.js");
+  const run = (line) => (line ?? "").replace(/^(renamed|deleted)\? run: /, "");
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, e] of Object.entries((classified ?? lock).objects)) {
+    if (!key.startsWith("dbo:")) continue;
+    const orphan = !outgoingNames.has(key.slice("dbo:".length));
+    const guids = [...typeof e.guid === "string" ? [e.guid] : [], ...e.replaced ?? []];
+    for (const guid of guids) {
+      if (outgoing.has(guid) || seen.has(guid)) continue;
+      const table = held.get(guid);
+      if (table === void 0) continue;
+      seen.add(guid);
+      const [rename, prune] = orphanFixUps(key, entry, lockPath, void 0, [], created.length === 1 ? created[0] : void 0);
+      const setGuid = setGuidRemedy(guid, created, codePinned) ?? (orphan ? void 0 : { ...created.length === 1 ? { table: created[0] } : {}, guid, pins: [] });
+      out.push({
+        table,
+        guid,
+        candidates: created,
+        ...setGuid === void 0 ? { rename: run(rename) } : { setGuid },
+        prune: orphan ? run(prune) : clearReplacedCommand(key.slice("dbo:".length), lockPath)
+      });
+    }
+  }
+  for (const [name, t] of codePinned) {
+    for (const guid of t.replaces ?? []) {
+      if (outgoing.has(guid) || seen.has(guid)) continue;
+      const table = held.get(guid);
+      if (table === void 0) continue;
+      seen.add(guid);
+      const setGuid = setGuidRemedy(guid, created, codePinned);
+      const [rename] = orphanFixUps(`dbo:${name}`, entry, lockPath, void 0, [], created.length === 1 ? created[0] : void 0);
+      out.push({
+        table,
+        guid,
+        candidates: created,
+        ...setGuid === void 0 ? { rename: run(rename) } : { setGuid },
+        prune: clearReplacedCommand(name, lockPath)
+      });
+    }
+  }
+  return out;
+}
+async function pendingRenameRefusal(frame, pending, prune, branch) {
+  const { pendingRenameLines, pendingRenameFollowUp, pendingRenameDetail, sameNameRepin } = await import("./keep-data-merge-7MPLVAVI.js");
+  const one = pending.length === 1;
+  const lines = pending.flatMap(
+    (p) => pendingRenameLines(
+      p,
+      prune ? "the old table would still be dropped" : "the new table would still be created empty beside the old one",
+      prune ? {} : { addFlag: "--prune" }
+    )
+  );
+  const err = refusalError(
+    frame,
+    "renamePending",
+    (pending.every(sameNameRepin) ? `Refusing to deploy into ${frame.noun}: ${one ? "a table's def pins" : "table defs pin"} a new guid under the name the table already has. A merge matches on guid, so it would create the new table empty ` + (prune ? `and DROP the old one with every row.` : `beside the old one, which the target refuses by name.`) : `Refusing to deploy into ${frame.noun}: the project adds a table while xano.lock still pins ${one ? "a table" : "tables"} the build no longer declares \u2014 a rename the lock was not told about. A merge matches on guid, so it would create the new table empty ` + (prune ? `and DROP the old one with every row.` : `beside the old one, which keeps the rows the app no longer reads.`)) + `
+${lines.join("\n")}
+Nothing was written. ` + pendingRenameFollowUp(pending, `it is no longer this project's.`),
+    { branch }
+  );
+  err.details.renames = pending.map(pendingRenameDetail);
+  return err;
+}
+function refusalError(frame, refused, message, lists) {
+  const details = {
+    refused,
+    ...lists.serverCode === void 0 ? {} : { serverCode: lists.serverCode },
+    landed: false,
+    ...frame === void 0 ? {} : {
+      dryRun: frame.dryRun,
+      declined: false,
+      workspaceId: frame.workspaceId,
+      destination: frame.destination,
+      mode: frame.mode,
+      prune: frame.prune,
+      // A tenant has no branches: the route's echo of its internal default
+      // describes nothing the reader chose.
+      branch: frame.tenant ? null : lists.branch ?? null
+    },
+    conflicts: frame === void 0 ? [...lists.conflicts ?? []] : conflictsForRefusal(lists.conflicts ?? [], frame),
+    kindConflicts: lists.kindConflicts ?? [],
+    canonicals: lists.canonicals ?? [],
+    outOfScope: lists.outOfScope ?? [],
+    ...lists.indexes === void 0 ? {} : { uniqueViolation: true, indexes: lists.indexes.map((i) => ({ ...i })) },
+    ...lists.seededIndexes === void 0 ? {} : { seededIndexes: lists.seededIndexes.map((i) => ({ ...i })) },
+    // Nothing was written, so nothing was landed.
+    landingRecord: null
+  };
+  return new CliError(lists.code ?? REFUSAL_CODES[refused], message, {
+    details,
+    exitCode: lists.exitCode ?? EXIT_IMPORT_CONFLICT
+  });
+}
+function ownerIsDestination(owner, frame) {
+  return owner.workspaceId === frame.workspaceId;
+}
+function conflictsForRefusal(conflicts, frame) {
+  if (!frame.tenant) return [...conflicts];
+  return conflicts.map((c) => {
+    if (!ownerIsDestination(c.owner, frame)) return c;
+    return { ...c, owner: { ...c.owner, workspaceName: void 0, branch: void 0 } };
+  });
+}
+function describeOwner(owner, frame) {
+  const guid = owner.guid !== void 0 ? ` (${owner.guid})` : "";
+  const deleted = owner.deleted ? ", deleted but still holding the name" : "";
+  if (frame.tenant && ownerIsDestination(owner, frame)) return `${frame.noun}${guid}${deleted}`;
+  const where = ownerIsDestination(owner, frame) ? "this workspace" : `workspace #${owner.workspaceId}`;
+  const named = owner.workspaceName !== void 0 ? ` "${owner.workspaceName}"` : "";
+  const branch = owner.branch !== void 0 && !frame.tenant ? ` on branch "${owner.branch}"` : "";
+  return `${where}${named}${branch}${guid}${deleted}`;
+}
+function conflictRemedy(c, frame, bundle, all = []) {
+  const purge = c.owner.deleted ? " A deleted object still holds its identity, so it has to be purged before the name is free." : "";
+  const sibling = siblingHolder(c, frame, bundle);
+  if (sibling !== void 0) return siblingRemedy(c, sibling, all);
+  if (!ownerIsDestination(c.owner, frame)) {
+    const named = c.owner.workspaceName !== void 0 ? ` ("${c.owner.workspaceName}")` : "";
+    return `Nothing in this project can free it: the identity is held by workspace #${c.owner.workspaceId}${named}, not by the one being released into. ${c.kind === "canonical" ? "Change the `canonical` on yours (or drop it to have one minted)" : "Rename yours"}, or free it in workspace #${c.owner.workspaceId}.${purge}`;
+  }
+  if (c.owner.guid !== void 0 && c.archiveGuid !== void 0 && frame.lockRename !== void 0) {
+    const sending = kindsByGuid(bundle).get(c.archiveGuid);
+    const rename = sending === void 0 ? void 0 : frame.lockRename(c.owner.guid, sending);
+    if (rename !== void 0) return `${rename}${purge}`;
+  }
+  const holder = frame.tenant ? frame.noun : "the workspace";
+  const pin = c.owner.guid !== void 0 ? (
+    // A def's `guid:` wins over the lock's entry for it (the next build
+    // re-pins the lock and says so), so this is the whole step.
+    `pin it on the def (\`guid: "${c.owner.guid}"\`) so this ${frame.verb ?? "deploy"} UPDATES the object that is already there`
+  ) : void 0;
+  const fix = c.kind === "canonical" ? `change the \`canonical\` on this project's def to a slug nothing else serves, or drop it to have the instance mint one` : "rename it in this project";
+  const Fix = `${fix.charAt(0).toUpperCase()}${fix.slice(1)}`;
+  const sent = c.archiveGuid === void 0 ? void 0 : kindsByGuid(bundle).get(c.archiveGuid);
+  if (c.kind !== "canonical" && sent !== void 0 && frame.pinnedInCode?.(c.archiveGuid, sent) === true) {
+    const setIt = c.owner.guid !== void 0 ? `change it to \`guid: "${c.owner.guid}"\` so this ${frame.verb ?? "deploy"} UPDATES the object that is already there, or remove it` : "change or remove it";
+    return `${Fix}, or ${setIt}: the def pins \`guid: "${c.archiveGuid}"\` in code, and a def's \`guid:\` wins over xano.lock, so adopting into the lock cannot change what this ${frame.verb ?? "deploy"} sends.${purge}`;
+  }
+  if (frame.adopt === void 0) {
+    return `${Fix}${pin === void 0 ? "" : `, or ${pin}`}.${purge}`;
+  }
+  if (frame.adoptAddsNothing === true) {
+    const why = c.kind === "canonical" ? `the slug is held by an object under a different name (a differently named group, say), which adopting cannot make this one` : `adopting cannot free it`;
+    return `${pin === void 0 ? Fix : `${pin.charAt(0).toUpperCase()}${pin.slice(1)}, or ${fix}`}. Adopting again changes nothing: xano.lock already holds every identity ${holder} holds, and ${why}.${purge}`;
+  }
+  if (pin !== void 0) {
+    return `${pin.charAt(0).toUpperCase()}${pin.slice(1)}, or ${fix}. To adopt everything ${holder} holds instead: ${frame.adopt}.${purge}`;
+  }
+  return `${Fix}, or adopt everything ${holder} holds: ${frame.adopt}.${purge}`;
+}
+function withSignatureHint(err, bundlePath) {
+  if (!isSignatureRefusal(err)) return err;
+  err.message += `
+The archive's signature does not match its content` + (bundlePath === void 0 ? "." : `: ${bundlePath} was changed after it was exported. ${exportAgain(bundleOrigin(bundlePath))} rather than editing the bundle, or deploy from the entry file.`);
+  return err;
+}
+function bundleOrigin(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    const ws = parsed.payload?.workspace;
+    if (ws === void 0 || ws === null || typeof ws !== "object") return void 0;
+    return "guid" in ws || "iv" in ws ? "live" : "compiled";
+  } catch {
+    return void 0;
+  }
+}
+function exportAgain(origin) {
+  if (origin === "compiled") return "Export it again (`xanosdk export <entry>`)";
+  if (origin === "live") {
+    return "Export it again from the backend it came from (`xanosdk ephemeral export <name>` or `xanosdk workspace export`)";
+  }
+  return "Export it again with the command that wrote it (`xanosdk export <entry>`, `xanosdk ephemeral export <name>` or `xanosdk workspace export`)";
+}
+function conflictLine(c, frame, ctx, all = []) {
+  const other = otherKindHolder(c, frame, ctx?.live);
+  return `  ${c.kind} "${c.identity}" \u2014 held by ` + (other === void 0 ? "" : `${other.kind} "${other.name}" in `) + describeOwner(c.owner, frame) + (c.archiveGuid !== void 0 ? `; this ${frame.verb ?? "deploy"} carries ${c.archiveGuid}` : "") + `
+      ${other === void 0 ? conflictRemedy(c, frame, ctx?.bundle, all) : otherKindRemedy(c, other, frame)}`;
+}
+function otherKindHolder(c, frame, live) {
+  if (live === void 0 || c.kind === "canonical" || c.owner.guid === void 0) return void 0;
+  if (!ownerIsDestination(c.owner, frame)) return void 0;
+  const held = kindsByGuid(live).get(c.owner.guid);
+  return held === void 0 || held.kind === c.kind ? void 0 : held;
+}
+function otherKindRemedy(c, holder, frame) {
+  const purge = c.owner.deleted ? " A deleted object still holds its identity, so it has to be purged before the name is free." : "";
+  const where = frame.tenant ? frame.noun : "the workspace";
+  return `${c.kind.charAt(0).toUpperCase()}${c.kind.slice(1)} and ${holder.kind} names share one name space, and pinning that guid would turn the ${holder.kind} into this ${c.kind}. Rename one of them: this project's ${c.kind}, or the ${holder.kind} on ${where} if it is yours to rename.${purge}`;
+}
+function siblingHolder(c, frame, bundle) {
+  if (bundle === void 0 || c.owner.guid === void 0 || !ownerIsDestination(c.owner, frame)) return void 0;
+  if (c.owner.guid === c.archiveGuid) return void 0;
+  const defs = kindsByGuid(bundle);
+  const holder = defs.get(c.owner.guid);
+  if (holder === void 0) return void 0;
+  return { holder, sending: c.archiveGuid === void 0 ? void 0 : defs.get(c.archiveGuid) };
+}
+function siblingRemedy(c, { holder, sending }, all = []) {
+  const what = c.kind === "canonical" ? "canonical" : "name";
+  const held = `${holder.kind} "${holder.name}"`;
+  const mine = sending === void 0 ? "the def that asks for it" : `${sending.kind} "${sending.name}"`;
+  const swap = all.some(
+    (o) => o !== c && o.kind === c.kind && o.archiveGuid === c.owner.guid && o.owner.guid === c.archiveGuid
+  );
+  const move = swap ? `They trade ${what}s, and one deploy checks each against what the destination holds when it starts, so it takes three: deploy with ${mine}'s ${what} set to one nobody holds and ${held}'s left as it is now, then with ${held}'s as declared, then with ${mine}'s as declared.` : `To move it from one to the other, deploy once with ${mine}'s ${what} set to something else (that lands ${held}'s change and frees it), then claim it in a second deploy.`;
+  return `It is held by ${held}, which this project also declares \u2014 so pinning its guid would give two defs one identity, and adopting cannot free it. Change the ${what} on one of the two: keep it on ${held}, or give ${mine} another. ${move}`;
+}
+function assertNoImportConflicts(res, frame, ctx = { bundle: void 0, live: void 0, tenant: false }) {
+  if (res.conflicts.length === 0) return;
+  const conflicts = conflictsForOutput(res.conflicts, ctx);
+  const lines = conflicts.map((c) => conflictLine(c, frame, ctx, res.conflicts));
+  throw refusalError(
+    frame,
+    "identityConflict",
+    `Refusing to deploy into ${frame.noun}: ${res.conflicts.length} identit${res.conflicts.length === 1 ? "y is" : "ies are"} already taken by something else.
+${lines.join("\n")}
+
+Nothing was written. The instance refuses these rather than inventing a name or a URL for them \u2014 a suffixed second object reports success and then splits your workspace in half, and a substituted public URL answers 404 on every route built from the one you pinned.`,
+    { branch: res.branch, conflicts, canonicals: canonicalsForOutput(res.canonicals, ctx) }
+  );
+}
+function kindsByGuid(bundle) {
+  const out = /* @__PURE__ */ new Map();
+  const payload = bundle?.payload;
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return out;
+  const apps = identityNamesByGuid(payload);
+  for (const payloadKey of Object.values(REFERENCEABLE_KIND_PAYLOAD_KEYS)) {
+    const rows = payload[payloadKey];
+    if (!Array.isArray(rows)) continue;
+    for (const row of rows) {
+      if (row === null || typeof row !== "object") continue;
+      const { guid, name, type } = row;
+      if (typeof guid !== "string" || guid === "" || typeof name !== "string") continue;
+      const kind = payloadKey === "toolset" ? type === "agent" ? "agent" : "mcpServer" : sdkKindName(payloadKey);
+      out.set(guid, { kind, name, payloadKey, lockName: lockNameForObject(payloadKey, row, apps) });
+    }
+  }
+  return out;
+}
+function assertNoKindSwap(bundle, live, frame, branch, lock) {
+  if (live === void 0 || bundle === void 0) return;
+  const destNoun = frame.noun;
+  const held = kindsByGuid(live);
+  const swaps = [];
+  const pinnedDefs = [];
+  const pinnedOthers = [];
+  const lockPinned = [];
+  let shared = 0;
+  for (const [guid, sent] of kindsByGuid(bundle)) {
+    const there = held.get(guid);
+    if (there === void 0 || there.kind === sent.kind) continue;
+    swaps.push({ guid, name: sent.name, sending: sent.kind, holds: there.kind, holdsName: there.name });
+    const key = lockKey(sent.payloadKey, sent.name);
+    const pinned = sent.payloadKey !== "query" && guid !== rawDeriveGuid(key);
+    if (pinned && there.name !== sent.name && lock?.file.objects[key]?.guid === guid) lockPinned.push(`${sent.kind}:${sent.name}`);
+    else if (pinned && there.name !== sent.name) pinnedOthers.push(`${sent.kind} "${sent.name}"`);
+    else {
+      shared++;
+      if (pinned) pinnedDefs.push(`${sent.kind} "${sent.name}"`);
+    }
+  }
+  if (swaps.length === 0) return;
+  const lines = swaps.map(
+    (s) => `  ${s.sending} "${s.name}" \u2014 ${destNoun} holds ${s.holds} "${s.holdsName}" under the same identity (${s.guid})`
+  );
+  const one = swaps.length === 1;
+  const oneShared = shared === 1;
+  throw refusalError(
+    frame,
+    "kindConflict",
+    `Refusing to deploy into ${destNoun}: ${swaps.length} object${one ? "" : "s"} would replace a different kind of object in place.
+${lines.join("\n")}
+
+A merge matches objects by identity, so this would turn the ${swaps[0].holds} there into this project's ${swaps[0].sending}, and the plan would call it an update. Nothing was written.` + (shared === 0 ? "" : `
+An agent and an MCP server of the same name share one identity. Rename ${oneShared ? "the object" : "these objects"} in this project, or remove the ${oneShared ? "one" : "ones"} on ${destNoun} first if ${oneShared ? "it is" : "they are"} yours to remove.` + (pinnedDefs.length === 0 ? "" : `
+A rename alone keeps the guid ${pinnedDefs.join(", ")} ${pinnedDefs.length === 1 ? "pins" : "pin"} in code (\`guid:\` on the def): remove that \`guid:\`, or change it, when you rename.`)) + (pinnedOthers.length === 0 ? "" : `
+${pinnedOthers.join(", ")} ${pinnedOthers.length === 1 ? "pins" : "pin"} another object's guid in code (\`guid:\` on the def). Removing that \`guid:\` alone resolves it \u2014 no rename is needed.`) + (lockPinned.length === 0 || lock === void 0 ? "" : `
+${displayPath(lock.path)} pins another object's guid to ${lockPinned.join(", ")} \u2014 the lock, not code. Drop ${lockPinned.length === 1 ? "that entry" : "those entries"} so the next compile derives ${lockPinned.length === 1 ? "its" : "their"} own (and remove any \`guid:\` on the def): \`xanosdk lock prune --identity-only ${lockPinned.map(shellWord).join(" ")} --yes --lock=${shellWord(displayPath(lock.path))}\`.`),
+    { branch, kindConflicts: swaps }
+  );
+}
+function canonicalDifferences(canonicals) {
+  return canonicals.filter(
+    (c) => c.requested !== void 0 && c.requested !== "" && c.served !== c.requested
+  );
+}
+function warnAboutUnnamedPublicUrls(bundle, hasLock) {
+  if (hasLock) return [];
+  let payload;
+  try {
+    const parsed = JSON.parse(bundle)?.payload;
+    if (parsed === null || typeof parsed !== "object") return [];
+    payload = parsed;
+  } catch {
+    return [];
+  }
+  const unnamed = [];
+  for (const payloadKey of ["app", "toolset", "realtime_server"]) {
+    const section = payload[payloadKey];
+    if (!Array.isArray(section)) continue;
+    for (const row of section) {
+      if (row === null || typeof row !== "object") continue;
+      const { name, canonical } = row;
+      if (typeof name !== "string" || name === "") continue;
+      if (typeof canonical === "string" && canonical !== "") continue;
+      unnamed.push(`${sectionKind(payloadKey, row)}:${name}`);
+    }
+  }
+  if (unnamed.length === 0) return [];
+  warn(
+    `${unnamed.length} public URL${unnamed.length === 1 ? "" : "s"} will be invented by the instance, and this project will not know ${unnamed.length === 1 ? "it" : "them"}:`,
+    "canonical.invented",
+    [
+      ...unnamed,
+      "A workspace has to serve some URL, so the instance mints one \u2014 a different one in every workspace you deploy to.",
+      "Set `canonical` on the def to choose it, or build with a lock \u2014 an ordinary `xanosdk export <entry>` writes one \u2014 which records the minted value and sends it back on every later release.",
+      "A deploy from `--no-lock` or from a pre-exported `--bundle` has no lock to record it in, which is why this is the only case left where the instance still decides."
+    ]
+  );
+  blank();
+  return unnamed;
+}
+function reportCanonicalDifferences(differences, ctx, planned = false) {
+  if (differences.length === 0) return;
+  differences = canonicalsForOutput(differences, ctx);
+  if (!planned) blank();
+  const one = differences.length === 1;
+  warn(
+    `${differences.length} public URL${one ? "" : "s"} ${planned ? "would not be" : one ? "is not" : "are not"} the value this project compiled:`,
+    "canonical.differs",
+    [
+      ...differences.map(
+        (c) => `${c.kind} "${c.name}" \u2014 asked for "${c.requested ?? ""}", ${planned ? "would serve" : "serves"} "${c.served ?? ""}" (${c.outcome})`
+      ),
+      "A public URL is unique across the whole instance, not per workspace, so an import keeps the one an object already had and substitutes a token when another workspace owns the one asked for.",
+      "Anything built from the compiled value answers 404. Pin these in code to make the instance serve them or refuse."
+    ]
+  );
+  if (planned) blank();
+}
+function assertStaticMatchesServedUrls(differences, ctx) {
+  if (differences.length === 0) return;
+  differences = canonicalsForOutput(differences, ctx);
+  const lines = differences.map(
+    (c) => `  ${c.kind} "${c.name}" \u2014 built against "${c.requested ?? ""}", the workspace serves "${c.served ?? ""}"`
+  );
+  throw new Error(
+    `The workspace was updated, but \`--static\` was not published: the frontend was built against ${differences.length} public URL${differences.length === 1 ? "" : "s"} the workspace does not serve:
+${lines.join("\n")}
+
+Every route derived from ${differences.length === 1 ? "that value" : "those values"} would answer 404, and a published build that 404s is harder to diagnose than one that was never published.
+Pin ${differences.length === 1 ? "the slug" : "the slugs"} in code so the instance must serve ${differences.length === 1 ? "it" : "them"} or refuse the release, or free ${differences.length === 1 ? "it" : "them"} on whichever workspace holds ${differences.length === 1 ? "it" : "them"} and deploy again.`
+  );
+}
+function seededUniqueIndexes(bundle, content) {
+  const seeded = new Set(seedRowsByTableGuid(content).keys());
+  if (seeded.size === 0) return [];
+  const dbo = JSON.parse(bundle).payload?.dbo;
+  if (!Array.isArray(dbo)) return [];
+  return dbo.flatMap((t) => {
+    const table = t ?? {};
+    if (typeof table.guid !== "string" || typeof table.name !== "string" || !seeded.has(table.guid)) return [];
+    const name = table.name;
+    return uniqueIndexLabels(table).map((index) => ({ table: name, index }));
+  });
+}
+function reportApplyRefusal(err, frame, branch, backupLabel, rerun, indexChanges = [], seededUnique = []) {
+  if (backupLabel !== void 0) {
+    blank();
+    detail(`The pre-deploy snapshot on branch "${backupLabel}" is redundant \u2014 nothing was written for it to protect.`);
+    detail(`Delete it with \`xanosdk workspace branch delete ${backupLabel}${pipedYes()}${contextFlags()}\`.`);
+  }
+  const conflicts = err.conflicts.length > 0 ? `
+${err.conflicts.map((c) => conflictLine(c, frame)).join("\n")}
+` : "";
+  if (err.code === XANOSDK_IMPORT_UNIQUENESS_CODE) {
+    const uniqueAdds = indexChanges.filter((c) => c.action === "add" && c.unique);
+    const added = new Set(uniqueAdds.map((c) => `${c.table}\0${c.index}`));
+    const seeded = seededUnique.filter((c) => !added.has(`${c.table}\0${c.index}`));
+    const lines = (list) => list.length === 0 ? "" : `${list.map((c) => `  table ${c.table}: ${c.index}`).join("\n")}
+`;
+    const why = uniqueAdds.length > 0 && seeded.length === 0 ? `the rows already there break a unique index this deploy adds` : uniqueAdds.length === 0 && seeded.length > 0 ? `the seed rows this deploy writes collide with rows already there on a unique index` : uniqueAdds.length > 0 ? `the rows already there break a unique index this deploy adds, or the seed rows it writes collide with them` : `rows break a unique index`;
+    const remedy = uniqueAdds.length > 0 && seeded.length === 0 ? `Remove the duplicate rows or the index, then deploy again.` : seeded.length > 0 ? (uniqueAdds.length > 0 ? `Remove the duplicate rows or the index you add, or ` : ``) + `${uniqueAdds.length > 0 ? "change" : "Change"} the colliding seed values, or delete or merge the live rows they collide with, then deploy again.` : `Remove the duplicate rows, then deploy again.`;
+    throw refusalError(
+      frame,
+      "uniqueViolation",
+      `${frame.noun.charAt(0).toUpperCase()}${frame.noun.slice(1)} was NOT changed: ${why}, so the instance refused the import. Nothing was written.
+` + lines(uniqueAdds) + (seeded.length > 0 ? `${uniqueAdds.length > 0 ? "Seeded tables' unique indexes:\n" : ""}${lines(seeded)}` : "") + remedy,
+      {
+        branch,
+        serverCode: err.code,
+        indexes: uniqueAdds.map((c) => ({ table: c.table, index: c.index })),
+        ...seeded.length > 0 ? { seededIndexes: seeded.map((c) => ({ table: c.table, index: c.index })) } : {}
+      }
+    );
+  }
+  const conflict = err.code === XANOSDK_IMPORT_CONFLICT_CODE;
+  throw refusalError(
+    frame,
+    "importRefused",
+    `${frame.noun.charAt(0).toUpperCase()}${frame.noun.slice(1)} was NOT changed: the instance refused the import when it ran it.
+${err.reason}
+${conflicts}` + (err.retryable ? `
+It was busy with another import. Nothing here has to change \u2014 ` + (rerun === void 0 ? "deploy again in a moment." : `run \`${rerun.command}\` again in a moment.${rerun.note}`) : `
+The preview passed and this did not, so something changed on ${frame.noun} in between. Deploy again once the identities above are free.`),
+    {
+      branch,
+      serverCode: err.code,
+      conflicts: conflictsForOutput(err.conflicts),
+      canonicals: canonicalsForOutput(err.canonicals),
+      // In progress is transient: exit 8, as a failure to reach the instance is.
+      ...conflict ? { code: REFUSAL_CODES.identityConflict } : { exitCode: err.retryable ? 8 : 1 }
+    }
+  );
+}
+function reportWithheldSettings(branch, withheld) {
+  if (withheld.length === 0) return;
+  warn(
+    `${withheld.length} workspace setting${withheld.length === 1 ? "" : "s"} will NOT be applied from branch "${branch}": ${withheld.join(", ")}`,
+    "branch.settings-withheld",
+    [
+      "Workspace settings are shared by every branch, so a branch landing leaves them as the workspace has them.",
+      "To apply them, deploy without `--branch` \u2014 onto the live branch, which after `--set-live` is the one you staged."
+    ]
+  );
+  blank();
+}
+async function restoreLiveAfterReplace(auth, target, landed) {
+  const repair = () => {
+    warn(
+      `No branch reports as live after the replace, so the workspace serves nothing.`,
+      "branch.none-live",
+      [`Set it with \`xanosdk workspace branch set-live ${landed} --yes${contextFlags()}\`.`]
+    );
+  };
+  let listing;
+  try {
+    listing = await listBranchListing(auth, target);
+  } catch {
+    warn(
+      `Could not verify whether a branch is live after the replace.`,
+      "branch.live-unverified",
+      [
+        `If none is, the workspace serves nothing \u2014 set it with \`xanosdk workspace branch set-live ${landed} --yes${contextFlags()}\`.`
+      ]
+    );
+    return void 0;
+  }
+  try {
+    if (liveBranchLabel(listing.branches) !== void 0 || listing.unaddressable.some((b) => b.live)) {
+      return void 0;
+    }
+    if (!listing.branches.some((b) => b.label === landed)) {
+      repair();
+      return void 0;
+    }
+    await setLiveBranch(auth, { ...target, label: landed });
+  } catch {
+    repair();
+    return void 0;
+  }
+  success(`Branch "${landed}" is live again \u2014 a replace clears the live flag.`);
+  return landed;
+}
+function reportBranchCaveats(branch, setLive, changed, indexChanges = [], yes = "") {
+  blank();
+  if (changed === void 0) {
+    warn(
+      "The live workspace could not be read, so whether this changed shared schema is UNKNOWN.",
+      "branch.shared-schema-unknown",
+      ["Tables and microservices are shared by every branch \u2014 a change there reached production."]
+    );
+  } else if (changed > 0) {
+    warn(
+      `${changed} shared-schema change${changed === 1 ? " was" : "s were"} applied to the LIVE workspace.`,
+      "branch.shared-schema-changed",
+      ["Tables and microservices are shared by every branch \u2014 only your logic is staged."]
+    );
+  } else if (indexChanges.length > 0) {
+    warn(
+      `Only logic was staged on "${branch}", but ${indexChanges.length === 1 ? "an index change was" : `${indexChanges.length} index changes were`} applied to the tables every branch shares, live included:`,
+      "branch.shared-schema-changed",
+      [...indexChanges, "A non-unique index changes how rows are found, not what they hold."]
+    );
+  } else {
+    detail(`Only logic was staged on "${branch}" \u2014 this deploy changed no shared schema.`);
+  }
+  detail(`See what staged with \`xanosdk workspace export --branch ${branch}${contextFlags()}\`.`);
+  if (!setLive) {
+    detail(`Nothing serves "${branch}" yet. Promote it with \`xanosdk workspace branch set-live ${branch}${yes}${contextFlags()}\`.`);
+  }
+}
+async function runReleaseCommand(args, dest, opts = {}) {
+  const req = resolveRequest(args);
+  if (req.mode === "merge" && req.branch !== void 0) args = { ...args, branch: req.branch };
+  assertBundleInput(args, { command: "deploy" });
+  assertBundleFile(args, { command: "deploy" });
+  const auth = opts.auth ?? await getAccessToken(args);
+  const withSeed = req.mode === "replace" || req.records === true;
+  const { discoverToolchainPlugins } = await import("./toolchain-modules-5EAZUONB.js");
+  const toolchain = await discoverToolchainPlugins(process.cwd(), { frozen: args.frozenLock === true });
+  const loaded = await loadBundleText(
+    args.dryRun ? { ...args, lockReadOnly: true } : args,
+    { command: "deploy" },
+    // A `--prune` preview says its orphan warning once the prune is planned,
+    // without the entries that prune deletes — the real run leaves them out at
+    // its lock commit, and the preview told the reader to `lock prune` by hand
+    // what the prune was about to drop (E2E pass 25).
+    { withSeed, deferLockWrite: !args.dryRun, deferOrphanWarning: args.dryRun === true && args.prune === true }
+  );
+  const { source, content, nonPublicSeedValues } = loaded;
+  let bundle = loaded.bundle;
+  let lockCommitted = false;
+  let resolvedTo;
+  let nothingToAdopt = false;
+  const commitLock = (opts2) => {
+    if (lockCommitted) return;
+    lockCommitted = true;
+    loaded.commitLock?.({
+      ...opts2,
+      ...resolvedTo === void 0 ? {} : { to: resolvedTo },
+      ...nothingToAdopt ? { nothingToAdopt } : {}
+    });
+  };
+  if (!args.dryRun && args.file !== void 0) {
+    const { ignoreBackendSecretFilesRead } = await import("./deploy-command-JVZPWHMK.js");
+    await ignoreBackendSecretFilesRead(args);
+  }
+  if (args.static !== void 0) {
+    const { assertNoSeedLeaks } = await import("./deploy-command-JVZPWHMK.js");
+    await assertNoSeedLeaks(args.static, nonPublicSeedValues);
+  }
+  {
+    const { runBundleHooks } = await import("./toolchain-hooks-GHKLUJOH.js");
+    const { readVersion } = await import("./cli.js");
+    await runBundleHooks(
+      toolchain.loaded,
+      {
+        bundle: loaded.bundleObject ?? JSON.parse(bundle),
+        // Absent on the `--bundle <path>` branch: the project did not compile it.
+        entry: args.file,
+        cwd: process.cwd(),
+        command: "deploy",
+        frozen: args.frozenLock === true || args.dryRun === true,
+        sdkVersion: readVersion()
+      },
+      args.dryRun === true ? "" : "; nothing was deployed"
+    );
+  }
+  const { base: destBase, workspaceId, label: destLabel } = dest ?? {
+    base: auth.instance,
+    workspaceId: auth.workspaceId
+  };
+  const resolvedDest = { base: destBase, workspaceId, label: destLabel };
+  const destTenantLabel = dest?.kind === "tenant" ? destLabel : void 0;
+  const destNoun = destTenantLabel ?? `workspace #${workspaceId}`;
+  const destShownLabel = destLabel !== void 0 && dest?.display !== void 0 && dest.display !== dest.name && !destLabel.includes(`(${JSON.stringify(dest.display)})`) ? `${destLabel} (${JSON.stringify(dest.display)})` : destLabel;
+  const refusalFrame = {
+    workspaceId,
+    noun: destTenantLabel !== void 0 ? destShownLabel ?? destTenantLabel : destNoun,
+    tenant: dest?.kind === "tenant",
+    destination: destinationPayload(resolvedDest, dest, auth),
+    mode: req.mode,
+    prune: req.prune === true,
+    dryRun: args.dryRun === true,
+    adopt: adoptRemedy(args, dest),
+    lockRename: lockRenameRemedy(args),
+    pinnedInCode: codePinnedGuid(args)
+  };
+  const landingDest = dest?.kind === "tenant" ? dest.name !== void 0 && dest.name !== "" ? { kind: dest.type === "ephemeral" ? "ephemeral" : "tenant", name: dest.name } : void 0 : { kind: "workspace", workspaceId };
+  const landingKey = landingDest === void 0 ? void 0 : destinationKey(auth.instance, landingDest);
+  let tenantLive;
+  let tenantRead;
+  if (dest?.kind === "tenant") {
+    tenantRead = await readLive(auth, { base: destBase, workspaceId, label: destLabel });
+    tenantLive = tenantRead.live;
+    bundle = keepWorkspaceName(bundle, tenantLive);
+  }
+  let branchLive;
+  let withheldSettings = [];
+  if (req.branch !== void 0 && dest?.kind !== "tenant") {
+    const branchRead = await readLive(auth, resolvedDest);
+    branchLive = { read: branchRead.live, failure: branchRead.failure };
+    const withheld = withholdWorkspaceSettings(bundle, branchLive.read);
+    bundle = withheld.bundle;
+    withheldSettings = withheld.withheld;
+  }
+  const archive = encodeWorkspaceArchive(bundle, [...content, ...loaded.files]);
+  if (req.records === true && content.length === 0) {
+    warn("`--seed` was passed, but no table in this project declares seed rows \u2014 no rows will be written.", "seed.none-declared");
+  }
+  const target = {
+    baseUrl: destBase,
+    archive,
+    workspaceId,
+    ...req,
+    ...opts.stateCheck !== void 0 ? { stateCheck: opts.stateCheck } : {}
+  };
+  const destHasBranches = dest?.kind !== "tenant";
+  let branchReadError;
+  let listing = { branches: [], unaddressable: [] };
+  if (req.branch !== void 0 || args.backupBranch !== void 0 || req.mode === "replace" && destHasBranches) {
+    try {
+      listing = await listBranchListing(auth, { baseUrl: destBase, workspaceId });
+    } catch (err) {
+      if (req.mode !== "replace") throw err;
+      branchReadError = err;
+    }
+  }
+  const branches = listing.branches;
+  if (destHasBranches) {
+    assertBranchDeletionAcknowledged(args, req, listing, branchReadError, workspaceId);
+  }
+  if (req.branch !== void 0) assertBranchAbsent(branches, req.branch);
+  const plannedBackup = args.backupBranch !== void 0 && destHasBranches ? plannedBackupLabel(args.backupBranch, branches) : void 0;
+  if (args.static !== void 0 && !args.dryRun) {
+    refuseStaticHostAReplaceClears(args, req.mode === "replace", dest === void 0 ? "release" : "deploy");
+    await assertStaticHostExists(args, auth, { baseUrl: destBase, workspaceId });
+  }
+  step(
+    `${args.dryRun ? "Planning" : "Deploying"} ${source} \u2192 ${describeWriteTarget({
+      base: destBase,
+      // A tenant by the workspace it lives under, as its `destination` names
+      // it — its own internal workspace is always #1 (E2E pass 36).
+      workspaceId: dest?.kind === "tenant" ? auth.workspaceId : workspaceId,
+      label: destShownLabel
+    })}` + (req.branch !== void 0 ? ` branch "${req.branch}"` : "") + (req.mode === "replace" ? " (full replace)" : " (merge)")
+  );
+  const pinned = codePinnedCanonicals(
+    bundle,
+    releaseCanonicalLock(args, loaded.classifiedLock),
+    args.file !== void 0
+  );
+  const preview = await xanosdkImport(auth, {
+    ...target,
+    dryRun: true,
+    pinned: pinned.map((p) => p.guid).filter((g) => g !== void 0)
+  }).catch(async (err) => {
+    if (err instanceof XanoSdkImportRefusal && err.retryable) {
+      const { importInProgressError } = await import("./keep-data-merge-7MPLVAVI.js");
+      const { retryCommand: retryCommand2, withheldNote: withheldNote2 } = await import("./retry-command-AS5EVREX.js");
+      const retry = retryCommand2(args);
+      throw importInProgressError(
+        describeWriteTarget({ base: destBase, workspaceId, label: destShownLabel }),
+        { command: retry.command, note: withheldNote2(retry.withheld) },
+        err
+      );
+    }
+    if (isUnansweredLookup(err)) {
+      const head = (err instanceof Error ? err.message : String(err)).split("\n")[0].trim().replace(/[.:]$/, "");
+      const failed = new LookupFailedError(
+        `${head}. ${unansweredCause(err)} \u2014 nothing was written`,
+        "unreachable",
+        dest?.kind === "tenant" ? dest.type === "ephemeral" ? "ephemeral" : "tenant" : "workspace"
+      );
+      failed.cause = err;
+      throw failed;
+    }
+    throw withSignatureHint(err, args.bundle);
+  });
+  const destIsTenant = dest?.kind === "tenant";
+  const destKindNoun = destIsTenant ? dest?.type ?? "tenant" : "workspace";
+  if (destKindNoun === "ephemeral" && args.to?.startsWith("tenant:") === true) {
+    resolvedTo = `ephemeral:${args.to.slice("tenant:".length)}`;
+  }
+  const otherBranches = req.mode === "replace" && destHasBranches && branchReadError === void 0 ? doomedBranches(listing).total : void 0;
+  const plan = planFromRoute(preview, destIsTenant, otherBranches);
+  nothingToAdopt = preview.conflicts.length === 0 && plan.operations.every((op) => op.action === "create" || IDENTITY_EXEMPT_TYPES.has(op.type));
+  const heldHere = preview.conflicts.filter((c) => ownerIsDestination(c.owner, refusalFrame));
+  const toolsetHeld = heldHere.some((c) => c.kind === "toolset" || c.kind === "agent" || c.kind === "mcpServer");
+  const conflictLive = heldHere.length === 0 ? void 0 : dest?.kind === "tenant" ? tenantLive : refusalFrame.adopt !== void 0 ? await readLiveWorkspace(auth, resolvedDest) : toolsetHeld ? await readLiveWorkspace(auth, resolvedDest).catch(() => void 0) : void 0;
+  const conflictFrame = refusalFrame.adopt !== void 0 && heldHere.length > 0 ? { ...refusalFrame, adoptAddsNothing: adoptionAddsNothing(args, conflictLive) } : refusalFrame;
+  assertNoImportConflicts(preview, conflictFrame, {
+    bundle: parsedOrUndefined(bundle),
+    live: conflictLive,
+    tenant: destIsTenant,
+    noun: destKindNoun
+  });
+  const scopeBranch = collisionBranch(branches, req.branch);
+  const liveRead = dest?.kind === "tenant" ? tenantRead ?? { live: void 0 } : branchLive !== void 0 && scopeBranch === void 0 ? { live: branchLive.read, failure: branchLive.failure } : await readLive(auth, resolvedDest, scopeBranch);
+  const live = liveRead.live;
+  const liveKind = dest?.kind === "tenant" ? dest.type === "ephemeral" ? "ephemeral" : "tenant" : "workspace";
+  if (req.mode === "merge") {
+    const lockPath = args.lockPath ?? (args.file !== void 0 ? resolveLockPath(args, args.file) : void 0);
+    const lockFile = releaseCanonicalLock(args);
+    assertNoKindSwap(
+      parsedOrUndefined(bundle),
+      live,
+      refusalFrame,
+      preview.branch,
+      lockPath !== void 0 && lockFile !== void 0 ? { file: lockFile, path: lockPath } : void 0
+    );
+  }
+  const converged = await convergedWithLive(live, req, bundle, pinned);
+  const planContext = {
+    bundle: parsedOrUndefined(bundle),
+    live,
+    tenant: destIsTenant,
+    noun: destKindNoun,
+    rows: { source: args.file !== void 0 ? "project" : "bundle", carried: plan.hasRecords },
+    ...req.prune === true ? { provenance: pruneProvenance(args, landingKey, live) } : {}
+  };
+  const presented = markUnchanged(
+    presentOperations(plan.operations, planContext),
+    converged ? void 0 : await unchangedWithLive(live, req, bundle, pinned),
+    destKindNoun
+  );
+  const seeded = req.mode === "merge" && req.records === true && req.truncate !== true && plan.hasRecords ? await seedWrites(auth, target.archive, parsedOrUndefined(bundle), { base: destBase, workspaceId }) : [];
+  renderPlan(
+    plan,
+    req,
+    workspaceId,
+    targetIsEmpty(live),
+    converged,
+    listing,
+    branchReadError !== void 0,
+    destTenantLabel,
+    presented,
+    destKindNoun,
+    sameNamedCreates(plan, presented, live),
+    envCarriedBy(parsedOrUndefined(bundle), live),
+    args.dryRun === true,
+    tableRenames(parsedOrUndefined(bundle), live),
+    seeded
+  );
+  const branchDeletion = branchDeletionReport(
+    req,
+    listing,
+    branchReadError !== void 0,
+    destHasBranches
+  );
+  const priorStored = landingDest?.kind === "ephemeral" && landingKey !== void 0 ? storedColumnsOf(ephemeralLandedOn(process.cwd(), landingKey)) : void 0;
+  const losses = await warnAboutLiveLosses(
+    live,
+    req,
+    bundle,
+    dest?.kind === "tenant" ? `tenant:${dest.name ?? "<name>"}` : "workspace",
+    args.bundle !== void 0,
+    await replaceCommandHint(args),
+    destKindNoun,
+    liveRead.failure,
+    priorStored
+  );
+  if (req.branch !== void 0) reportWithheldSettings(req.branch, withheldSettings);
+  const unnamedPublicUrls = warnAboutUnnamedPublicUrls(
+    bundle,
+    releaseCanonicalLock(args, loaded.classifiedLock) !== void 0
+  );
+  const sharedChanges = req.branch === void 0 ? [] : assertSharedSchemaAcknowledged(args, live, bundle, req.branch);
+  const pruned = req.prune === true ? assertPruneStaysInScope(args, plan, { key: landingKey, noun: destNoun }, planContext, presented, {
+    frame: refusalFrame,
+    branch: preview.branch
+  }) : {};
+  loaded.warnLockOrphans?.(new Set(Object.keys(pruned)));
+  if (req.mode === "merge") {
+    const pending = await unrecordedTableRenames(args, bundle, live, plan, loaded.classifiedLock);
+    if (pending.length > 0) throw await pendingRenameRefusal(refusalFrame, pending, req.prune === true, preview.branch);
+  }
+  const dryRunUpToDate = req.branch === void 0 && (plan.operations.length === 0 || converged);
+  if (req.mode === "merge" && destIsTenant && live !== void 0 && !dryRunUpToDate) {
+    const { liveTableTriggers, tableTriggerMergeError } = await import("./keep-data-merge-7MPLVAVI.js");
+    const triggers = liveTableTriggers(live);
+    if (triggers.length > 0) {
+      const { retryCommand: retryCommand2, withheldNote: withheldNote2 } = await import("./retry-command-AS5EVREX.js");
+      const replace = retryCommand2(args, { add: ["--replace"], drop: ["--prune", "--yes", "-y"] });
+      throw tableTriggerMergeError(destNoun, triggers, {
+        command: replace.command,
+        note: withheldNote2(replace.withheld)
+      });
+    }
+  }
+  if (req.mode === "merge" && live !== void 0 && !dryRunUpToDate && losses.storageChanges.length > 0) {
+    const { retryCommand: retryCommand2, withheldNote: withheldNote2 } = await import("./retry-command-AS5EVREX.js");
+    const replace = retryCommand2(args, { add: ["--replace"], drop: ["--prune", "--yes", "-y"] });
+    await assertStorageModesKept(losses.storageChanges, tableRowCounter(auth, { workspaceId, base: destBase }), {
+      target: destNoun,
+      subject: "the deploy",
+      remedy: `rebuild the ${destKindNoun} with \`${replace.command}\` (that replaces every table's rows).${withheldNote2(replace.withheld)}`
+    });
+  }
+  const staticRead = req.mode === "replace" && !dryRunUpToDate ? await readStaticTeardown(auth, { baseUrl: destBase, workspaceId }, void 0) : void 0;
+  if (staticRead !== void 0 && warnStaticTeardown(staticRead, destNoun, {
+    publishing: args.static !== void 0,
+    keepHint: "drop `--replace` to merge, which leaves it serving"
+  })) {
+    blank();
+  }
+  const canonicalMoves = plannedCanonicalMoves(preview.canonicals, planContext);
+  const movesWhen = req.branch === void 0 || args.setLive ? void 0 : "once the branch is made live";
+  if (args.dryRun) {
+    reportCanonicalDifferences(canonicalDifferences(preview.canonicals), planContext, true);
+    reportPlannedCanonicalMoves(canonicalMoves, "would", movesWhen);
+    if (plannedBackup !== void 0) {
+      info(`A real run snapshots the live branch as "${plannedBackup}" before importing.`);
+    }
+    info("Dry run \u2014 the archive was sent for planning only, and nothing was written.");
+    if (isMachineOutput(args)) {
+      writeJson({
+        landed: false,
+        dryRun: true,
+        declined: false,
+        // Always present; a dry run records nothing — what it would land is
+        // not landed, and the record is what a prune deletes by.
+        landingRecord: null,
+        workspaceId,
+        destination: destinationPayload(resolvedDest, dest, auth),
+        // The verdict the real run would reach, said up front: a wrapper
+        // deciding whether a deploy is needed reads one key.
+        upToDate: dryRunUpToDate,
+        // The real run's keys, so a wrapper reads one document shape either
+        // way. `records` is whether the real run writes rows — the plan's
+        // answer, which the "rows would be written" warning states too.
+        mode: req.mode,
+        prune: req.prune === true,
+        records: !dryRunUpToDate && plan.hasRecords,
+        ...seeded.length > 0 ? { seedRows: seeded } : {},
+        truncate: req.truncate === true,
+        operations: dryRunUpToDate ? 0 : plan.operations.length,
+        plan: planForOutput(plan, presented, destIsTenant, converged, destKindNoun),
+        // A tenant has no branches, so it is planned against none — the route's
+        // echo of its internal default describes nothing the reader chose.
+        branch: destIsTenant ? null : preview.branch ?? null,
+        conflicts: conflictsForOutput(preview.conflicts, planContext),
+        canonicals: plannedCanonicalsForOutput(preview.canonicals, planContext),
+        ...branchDeletion !== void 0 ? { branchDeletion } : {},
+        // What the plan cannot say, under the keys the real run's summary uses:
+        // the text dry run warns about each, and this is where a wrapper decides.
+        ...landingTableFields(losses),
+        unchangedEnv: losses.unchangedEnv,
+        droppedEnv: losses.droppedEnv,
+        unappliedDocumentation: losses.unappliedDocumentation,
+        workspaceRename: losses.workspaceRename ?? null,
+        workspaceSettingsNotApplied: withheldSettings,
+        // The real run's key: how many shared-schema changes a branch landing
+        // carries (`null` when they could not be read) — above zero without
+        // `--allow-shared-schema-changes`, the real run refuses.
+        ...req.branch !== void 0 ? { sharedSchemaChanges: sharedChanges?.length ?? null } : {},
+        ...unnamedPublicUrls.length > 0 ? { unnamedPublicUrls: [...unnamedPublicUrls] } : {},
+        ...staticRemovedField(staticRead?.teardown, void 0)
+      });
+    }
+    return;
+  }
+  let backupLabel;
+  let applyResponse;
+  let promoted = args.setLive;
+  let liveRestored;
+  const upToDate = dryRunUpToDate;
+  if (upToDate) {
+    commitLock();
+    success(`${destNoun.charAt(0).toUpperCase()}${destNoun.slice(1)} is already up to date \u2014 no import sent.`);
+  } else {
+    assertLiveWorkspaceWasRead(live, destNoun, scopeBranch, liveRead.failure, liveKind);
+    reportPlannedCanonicalMoves(canonicalMoves, "will", movesWhen);
+    if (req.branch !== void 0 && args.setLive && !args.yes && process.stdin.isTTY !== true) {
+      const { yesRerun } = await import("./retry-command-AS5EVREX.js");
+      const { rerun, note } = yesRerun(args, "deploy");
+      throw needsConfirmation(
+        `Make "${req.branch}" the live branch?${movesClause(canonicalMoves)} (or drop --set-live to stage it)`,
+        { details: { landed: false, setLive: false, branch: req.branch }, rerun, note },
+        `Nothing was written: the \`--set-live\` cutover asks after landing, and stdin is not a terminal.`
+      );
+    }
+    if ((isDestructive(req) || losses.droppedColumns.length > 0 || losses.retypedColumns.length > 0 || losses.narrowedEnums.length > 0 || losses.droppedEnv.length > 0 || // A public URL this run moves — not a staged branch's, which moves
+    // only at its set-live, and that asks then.
+    movesWhen === void 0 && canonicalMoves.length > 0) && !args.yes && destKindNoun !== "ephemeral") {
+      const unsent = () => ({
+        landed: false,
+        dryRun: false,
+        declined: false,
+        workspaceId,
+        destination: destinationPayload(resolvedDest, dest, auth),
+        upToDate: false,
+        mode: req.mode,
+        prune: req.prune === true,
+        records: false,
+        truncate: req.truncate === true,
+        // The PLANNED count, as the dry run's document gives it for the same
+        // plan (E2E pass 29: 0 here, 7 there); `landed: false` says none went.
+        operations: plan.operations.length,
+        plan: planForOutput(plan, presented, destIsTenant, converged, destKindNoun),
+        branch: destIsTenant ? null : preview.branch ?? null,
+        conflicts: conflictsForOutput(preview.conflicts, planContext),
+        canonicals: plannedCanonicalsForOutput(preview.canonicals, planContext),
+        ...branchDeletion !== void 0 ? { branchDeletion } : {},
+        ...landingTableFields(losses),
+        unchangedEnv: losses.unchangedEnv,
+        droppedEnv: losses.droppedEnv,
+        unappliedDocumentation: losses.unappliedDocumentation,
+        workspaceRename: losses.workspaceRename ?? null,
+        workspaceSettingsNotApplied: withheldSettings,
+        landingRecord: null,
+        ...seeded.length > 0 ? { seedRows: seeded } : {}
+      });
+      const { yesRerun } = await import("./retry-command-AS5EVREX.js");
+      const { rerun, note } = yesRerun(args, "deploy");
+      const ok = await confirm(`Apply this plan to ${destNoun}?${seedOverwriteClause(seeded)}${movesClause(canonicalMoves, movesWhen === void 0 ? "It" : "Once live, it")}`, {
+        flag: "--yes",
+        refusal: { details: unsent(), rerun, note }
+      });
+      if (!ok) {
+        info("Deploy cancelled \u2014 nothing was written.");
+        if (isMachineOutput(args)) writeJson({ ...unsent(), declined: true });
+        return;
+      }
+    }
+    commitLock({ pruned: new Set(Object.keys(pruned)) });
+    if (args.backupBranch !== void 0) {
+      const sourceLabel = liveBranchLabel(branches);
+      const label = plannedBackup ?? plannedBackupLabel(args.backupBranch, branches);
+      step(`Snapshotting the live branch as "${label}" before importing\u2026`);
+      try {
+        await createBranch(auth, {
+          baseUrl: destBase,
+          workspaceId,
+          label,
+          ...sourceLabel !== void 0 ? { sourceBranch: sourceLabel } : {},
+          description: `Pre-deploy snapshot taken by xanosdk from ${source}`
+        });
+      } catch (err) {
+        throw new Error(
+          `The pre-deploy backup branch could not be created, so the deploy was not sent.
+Nothing has changed in workspace #${workspaceId}.
+Retry, or drop \`--backup-branch\` to deploy without one.`,
+          { cause: err }
+        );
+      }
+      backupLabel = label;
+      success(`Live branch snapshotted as "${label}".`);
+    }
+    try {
+      applyResponse = await describeWrite(
+        { what: `the ${req.mode === "replace" ? "replace" : "merge"} into ${destShownLabel ?? `workspace #${workspaceId}`}` },
+        () => xanosdkImport(auth, {
+          ...target,
+          dryRun: false,
+          pinned: pinned.map((p) => p.guid).filter((g) => g !== void 0)
+        })
+      );
+    } catch (err) {
+      if (err instanceof XanoSdkImportRefusal) {
+        const { retryCommand: retryCommand2, withheldNote: withheldNote2 } = await import("./retry-command-AS5EVREX.js");
+        const retry = retryCommand2(args);
+        reportApplyRefusal(
+          err,
+          refusalFrame,
+          preview.branch,
+          backupLabel,
+          { command: retry.command, note: withheldNote2(retry.withheld) },
+          losses.indexChanges,
+          req.records === true ? seededUniqueIndexes(bundle, content) : []
+        );
+      }
+      if (backupLabel !== void 0) {
+        blank();
+        warn(
+          `The import failed. Your pre-deploy snapshot is on branch "${backupLabel}".`,
+          "deploy.import-failed-backup",
+          [
+            `Restore it with \`xanosdk workspace branch set-live ${backupLabel}${pipedYes(args)}${contextFlags()}\` \u2014 that restores logic, not tables: every branch shares them, so whatever the import did to tables and rows stays.`
+          ]
+        );
+      }
+      throw err;
+    }
+    const landed = req.mode === "replace" ? DEFAULT_BRANCH_LABEL : applyResponse?.branch ?? req.branch;
+    success(
+      req.branch !== void 0 ? `Deployed to workspace #${workspaceId} on branch "${landed}"` : destTenantLabel !== void 0 ? `Deployed to ${destTenantLabel}` : (
+        // Named even without `--branch`: a merge lands on whichever branch
+        // is live, and when that is not the default this is where a reader
+        // learns it.
+        `Deployed to instance workspace #${workspaceId}${landed === void 0 ? "" : ` on branch "${landed}"`}`
+      )
+    );
+    if (req.branch !== void 0) {
+      if (args.setLive) {
+        const previous = liveBranchLabel(branches);
+        blank();
+        if (previous !== void 0) {
+          warn(
+            `Promoting "${req.branch}" is a production cutover for workspace #${workspaceId}.`,
+            "branch.production-cutover",
+            [`The runtime stops serving "${previous}" and starts serving "${req.branch}".`]
+          );
+        } else {
+          warn(
+            `No branch is live in workspace #${workspaceId} \u2014 promoting "${req.branch}" makes it the branch the runtime serves.`,
+            "branch.none-live"
+          );
+        }
+        if (!args.yes && !await confirm(`Make "${req.branch}" the live branch?${movesClause(canonicalMoves)}`, {
+          flag: "--yes",
+          refusal: {
+            details: { landed: true, setLive: false, branch: req.branch },
+            rerun: `xanosdk workspace branch set-live ${shellWord(req.branch)} --yes${contextFlags(args)}`
+          }
+        })) {
+          info(`Set-live cancelled \u2014 nothing was switched: the deploy is staged on "${req.branch}" and nothing serves it yet.`);
+          detail(`Promote it later with \`xanosdk workspace branch set-live ${req.branch}${pipedYes(args)}${contextFlags()}\`.`);
+          promoted = false;
+        } else {
+          await setLiveBranch(auth, { baseUrl: destBase, workspaceId, label: req.branch });
+          success(`Branch "${req.branch}" is now live.`);
+          if (previous !== void 0) {
+            detail(setLiveRollback(previous, args));
+          }
+        }
+      }
+      reportBranchCaveats(
+        req.branch,
+        promoted,
+        sharedChanges?.length,
+        ungatedSchemaChanges(sharedSchemaChanges(JSON.parse(bundle), live, { prune: args.prune })),
+        pipedYes(args)
+      );
+    } else if (backupLabel !== void 0) {
+      blank();
+      detail(
+        `Roll back this deploy's logic with \`xanosdk workspace branch set-live ${backupLabel}${pipedYes(args)}${contextFlags()}\` \u2014 it restores logic, not tables: every branch shares them, so what this deploy did to tables and rows stays.`
+      );
+    }
+    if (req.mode === "replace" && destHasBranches) {
+      liveRestored = await restoreLiveAfterReplace(auth, { baseUrl: destBase, workspaceId }, DEFAULT_BRANCH_LABEL);
+    }
+  }
+  const landingMode = req.mode === "replace" ? "replace" : "merge";
+  const storedAfter = priorStored === void 0 ? void 0 : storedColumnsAfter(
+    parsedOrUndefined(bundle),
+    req.mode === "replace" ? void 0 : live,
+    priorStored,
+    req.mode === "replace" ? "rebuild" : "merge"
+  );
+  const landingRecord = landingDest === void 0 ? null : args.file === void 0 && args.lockPath === void 0 ? recordForeignLanding({
+    lockPath: landingLockPath(args),
+    instance: auth.instance,
+    dest: landingDest,
+    bundle: parsedOrUndefined(bundle),
+    mode: landingMode,
+    removed: pruned,
+    ...storedAfter !== void 0 ? { stored: storedAfter } : {}
+  }) : recordLanding({
+    lockPath: landingLockPath(args, { entryFile: args.file, fromProject: false }),
+    instance: auth.instance,
+    dest: landingDest,
+    update: {
+      mode: landingMode,
+      identities: withStoredColumns(landedIdentities(parsedOrUndefined(bundle)), storedAfter),
+      removed: pruned
+    }
+  });
+  const servedDifferences = canonicalDifferences((applyResponse ?? preview).canonicals);
+  reportCanonicalDifferences(servedDifferences, planContext);
+  if (!args.dryRun) opts.afterLanding?.(parsedOrUndefined(bundle));
+  link(destBase);
+  const summary = {
+    // `landed: false` with `upToDate: true` is a SUCCESS, not a failure — the
+    // workspace already matches. A wrapper gating on `landed` alone would read
+    // a converged release as a broken one, so both fields are always present.
+    landed: !upToDate,
+    // The dry run's keys, so a wrapper reads one document shape either way.
+    dryRun: false,
+    declined: false,
+    landingRecord,
+    workspaceId,
+    plan: planForOutput(plan, presented, destIsTenant, converged),
+    conflicts: conflictsForOutput((applyResponse ?? preview).conflicts, planContext),
+    upToDate,
+    mode: req.mode,
+    prune: req.prune === true,
+    // What HAPPENED, not the flag that was asked for. This is the one field
+    // someone checks to confirm a seed landed, and echoing the input into it
+    // reported success over a write that never occurred. Rows go
+    // out only when the archive actually carried some AND the import ran —
+    // which covers both ways rows get written: `--seed` on a merge, and a
+    // replace, where the rows ride along with no flag at all. `content` is only
+    // ever populated when one of those asked for it (see `withSeed` above), so
+    // a merge without `--seed` still reports false, and so does a replace of a
+    // project that declares no seed rows.
+    records: content.length > 0 && !upToDate,
+    truncate: req.truncate === true,
+    destination: destinationPayload(resolvedDest, dest, auth),
+    // What this release will DO, not what the plan enumerated: a converged
+    // release sends nothing, and reporting the server's matched-identity count
+    // beside `upToDate: true` would contradict it.
+    operations: upToDate ? 0 : plan.operations.length,
+    ...landingTableFields(losses),
+    unchangedEnv: losses.unchangedEnv,
+    droppedEnv: losses.droppedEnv,
+    unappliedDocumentation: losses.unappliedDocumentation,
+    // Always present, `null` when nothing is renamed — the dry run's key too,
+    // so a wrapper reads one field on both.
+    workspaceRename: losses.workspaceRename ?? null,
+    workspaceSettingsNotApplied: withheldSettings,
+    ...unnamedPublicUrls.length > 0 ? { unnamedPublicUrls: [...unnamedPublicUrls] } : {},
+    // The label the instance says it planned or landed against — the same rule
+    // as the success line above, and the dry run's `branch`, so a converged
+    // run carries it too. `assertXanoSdkBranchHonored` has already refused any
+    // disagreement, so this can only ever restate it.
+    branch: destIsTenant ? null : applyResponse?.branch ?? preview.branch ?? null,
+    // Present only with `--branch`: a plain release promotes nothing.
+    ...req.branch !== void 0 ? {
+      setLive: promoted,
+      sharedSchemaChanges: sharedChanges?.length
+    } : {},
+    ...backupLabel !== void 0 ? { backupBranch: backupLabel } : {},
+    // Present only when the replace left nothing live and this run set it.
+    ...liveRestored !== void 0 ? { liveRestored } : {},
+    // Reported on the APPLY as well as the dry run: a tool reconciling what a
+    // release actually did needs the loss in the same shape it was shown the
+    // loss it authorized.
+    ...branchDeletion !== void 0 ? { branchDeletion } : {},
+    // What the instance actually served: the applied response when an import
+    // ran, and the preview's own read when the release was already converged.
+    canonicals: canonicalsForOutput((applyResponse ?? preview).canonicals, planContext)
+  };
+  if (args.static !== void 0) {
+    if (servedDifferences.length > 0) {
+      if (isMachineOutput(args)) writeJson(summary);
+      assertStaticMatchesServedUrls(servedDifferences, planContext);
+    }
+    const { buildStaticEnv, deployStaticTo } = await import("./deploy-command-JVZPWHMK.js");
+    const env = buildStaticEnv(destBase, args.staticEnv);
+    const explicit = Object.keys(args.staticEnv).length > 0;
+    const to = dest?.kind === "tenant" ? `${dest.type === "ephemeral" ? "ephemeral" : "tenant"}:${dest.name ?? ""}` : "workspace";
+    const { noteLanded } = await import("./sent-writes-N7X4OVXT.js");
+    const backendLabel = destNoun;
+    noteLanded({ said: upToDate ? `The backend on ${backendLabel} was already up to date.` : `Deployed to ${backendLabel}.` });
+    try {
+      summary.static = await deployStaticTo(
+        args.static,
+        auth,
+        // Named as the step line named the destination: a tenant's internal
+        // workspace is #1, which names nothing the reader typed.
+        { baseUrl: destBase, workspaceId, label: destTenantLabel },
+        env,
+        explicit,
+        args.staticHost,
+        args.skipLiveness,
+        args.staticRouting,
+        void 0,
+        { rerun: staticRetryCommand(args.static, to, args, void 0) }
+      );
+    } catch (err) {
+      const unknown = err instanceof Error && statesOutcomeUnknown(err.message);
+      const message = unknownStaticOutcome(err instanceof Error ? err.message : String(err), unknown);
+      summary.static = {
+        url: void 0,
+        error: message,
+        retry: staticRetryCommand(args.static, to, args, err),
+        completed: unknown ? "unknown" : "no"
+      };
+      warn(
+        `The static-host upload failed \u2014 the backend ${upToDate ? "is unchanged" : "deploy stands"}:`,
+        "static.upload-failed",
+        [message]
+      );
+      if (!upToDate) noteStaticTakenDown(staticRead?.teardown, unknown);
+      detail(staticRetryHint(args.static, to, args, err));
+      process.exitCode = unknown ? EXIT_OUTCOME_UNKNOWN : EXIT_STATIC_FAILED;
+    } finally {
+      noteLanded(void 0);
+    }
+  }
+  if (!upToDate) Object.assign(summary, staticRemovedField(staticRead?.teardown, summary.static?.url));
+  if (isMachineOutput(args)) writeJson(summary);
+}
+function setLiveRollback(previous, args) {
+  return `Roll back with \`xanosdk workspace branch set-live ${shellWord(previous)}${pipedYes(args)}${contextFlags(args)}\`.`;
+}
+async function assertReleaseIdentitiesFree(args, auth, opts) {
+  const tenant = opts.tenant;
+  const target = tenant === void 0 ? { baseUrl: auth.instance, workspaceId: auth.workspaceId } : { baseUrl: tenant.base, workspaceId: tenant.workspaceId };
+  const { detectXanoSdkImportRoute } = await import("./xanosdk-import-GN42TO2B.js");
+  let capable;
+  try {
+    capable = await detectXanoSdkImportRoute(auth, target);
+  } catch (err) {
+    if (err?.status === 501) capable = false;
+    else {
+      const { unreachableProbeError } = await import("./keep-data-merge-7MPLVAVI.js");
+      const retry = retryCommand(args, {
+        add: pipedYes(args) === "" ? [] : ["--yes"],
+        command: [opts.verb, ...args.positionals.map(shellWord)].join(" ")
+      });
+      throw await unreachableProbeError(err, {
+        label: tenant === void 0 ? `workspace #${auth.workspaceId}` : `${tenant.type} "${tenant.name}"`,
+        kind: tenant === void 0 ? "workspace" : tenant.type,
+        rerun: { command: retry.command, note: withheldNote(retry.withheld) }
+      });
+    }
+  }
+  if (!capable) {
+    return { checked: false, reason: "this instance has no route to plan the landing through" };
+  }
+  const lockArgs = { ...args, ...opts.lockPath === void 0 ? {} : { lockPath: opts.lockPath } };
+  const lock = opts.lockPath !== void 0 && existsSync(opts.lockPath) ? readLockFile(opts.lockPath) : void 0;
+  const pinned = pinnedCanonicalGuids(JSON.stringify(opts.bundle), lock, false);
+  const res = await xanosdkImport(auth, {
+    ...target,
+    archive: opts.archive,
+    dryRun: true,
+    mode: "merge",
+    records: false,
+    ...opts.branch === void 0 ? {} : { branch: opts.branch },
+    pinned
+  });
+  const resolved = { base: target.baseUrl, workspaceId: target.workspaceId };
+  const dest = tenant === void 0 ? void 0 : {
+    ...resolved,
+    kind: "tenant",
+    type: tenant.type,
+    name: tenant.name,
+    ...tenant.display === void 0 ? {} : { display: tenant.display }
+  };
+  const frame = {
+    workspaceId: target.workspaceId,
+    noun: tenant === void 0 ? `workspace #${auth.workspaceId}` : `${tenant.type} "${tenant.name}"${tenant.display === void 0 ? "" : ` ("${tenant.display}")`}`,
+    tenant: tenant !== void 0,
+    verb: opts.verb,
+    destination: destinationPayload(resolved, dest, auth),
+    mode: "merge",
+    prune: false,
+    dryRun: false,
+    adopt: adoptRemedy(lockArgs, dest),
+    lockRename: lockRenameRemedy(lockArgs),
+    pinnedInCode: codePinnedGuid(lockArgs)
+  };
+  try {
+    const heldHere = res.conflicts.some((c) => ownerIsDestination(c.owner, frame));
+    assertNoImportConflicts(
+      res,
+      heldHere ? { ...frame, adoptAddsNothing: adoptionAddsNothing(lockArgs, opts.live) } : frame,
+      { bundle: opts.bundle, live: opts.live, tenant: tenant !== void 0, noun: tenant === void 0 ? "workspace" : tenant.type }
+    );
+    assertNoKindSwap(
+      opts.bundle,
+      opts.live,
+      frame,
+      res.branch,
+      lock === void 0 || opts.lockPath === void 0 ? void 0 : { file: lock, path: opts.lockPath }
+    );
+  } catch (err) {
+    if (err instanceof CliError) {
+      err.message = `${err.message.replace(/^Refusing to deploy into /, `Refusing to ${opts.subject} into `)}
+${opts.remedySuffix}`;
+    }
+    throw err;
+  }
+  return { checked: true, pinned, canonicals: res.canonicals };
+}
+
+export {
+  keepWorkspaceName,
+  withholdWorkspaceSettings,
+  collisionBranch,
+  ungatedSchemaChanges,
+  gatedSchemaChanges,
+  releaseCanonicalLock,
+  codePinnedCanonicals,
+  pinnedCanonicalGuids,
+  presentableNotes,
+  REFUSAL_CODES,
+  withSignatureHint,
+  bundleOrigin,
+  runReleaseCommand,
+  setLiveRollback,
+  assertReleaseIdentitiesFree
+};
+//# sourceMappingURL=chunk-WKQLGKCL.js.map