@xano/sdk 1.0.0

package/dist/chunk-WZDJ2LLX.js

@@ -0,0 +1,2385 @@
+import {
+  isAwaited,
+  microserviceLine,
+  readyRatio,
+  waitForMicroservices
+} from "./chunk-FXRQOWTE.js";
+import {
+  passwordHashesWarning,
+  passwordOrigin
+} from "./chunk-AWEIIR2U.js";
+import {
+  openBrowser
+} from "./chunk-FQOF7E2E.js";
+import {
+  EXIT_STATIC_FAILED,
+  assertStaticHostExists,
+  noteStaticTakenDown,
+  readFrontendsAfterFailure,
+  readStaticTeardown,
+  recheckDoubtedFrontend,
+  refuseStaticHostAReplaceClears,
+  staticAfterFailedReplace,
+  staticRemovedField,
+  staticRetryCommand,
+  staticRetryHint,
+  unknownStaticOutcome,
+  warnStaticTeardown
+} from "./chunk-FQJ2TTHP.js";
+import {
+  HostedFilesUnresolvedError,
+  ImportNotSentError,
+  XanoSdkImportRefusal,
+  xanosdkImport
+} from "./chunk-WQFNASK4.js";
+import {
+  archiveHostedFiles,
+  decodeWorkspaceArchive,
+  encodeWorkspaceArchive
+} from "./chunk-3DRXWLJ5.js";
+import {
+  DOC_TOKEN_REMEDY,
+  assertBundleFile,
+  assertBundleInput,
+  assertEntryFile,
+  assertValueFiles,
+  compileValueFlagKinds,
+  loadBundleText,
+  missingLockDir,
+  refuseCompileValueFlags,
+  refuseValueFlagsBesideBundle
+} from "./chunk-ETO6LGLD.js";
+import {
+  recordDeployed
+} from "./chunk-LPECSJ2J.js";
+import {
+  lookupEphemeral
+} from "./chunk-QCNYHBL7.js";
+import {
+  getAccessToken
+} from "./chunk-ET4Y4XCB.js";
+import {
+  otherCredentialRefusal
+} from "./chunk-SWBF2LTK.js";
+import {
+  engineNameForProject,
+  getEngineRecord
+} from "./chunk-3M4LFYNQ.js";
+import {
+  environmentKey,
+  ephemeralLandedOn,
+  ephemeralLandingKey,
+  ephemeralStatePath,
+  getEnvironment,
+  markEnvironmentFilled,
+  readEphemeralState,
+  recordStaticUrl,
+  setEnvironment
+} from "./chunk-5QU2P5CA.js";
+import {
+  selectDeployArm
+} from "./chunk-ZYJP6BOO.js";
+import {
+  createEphemeral,
+  getEphemeral,
+  isEphemeralDisabled,
+  isExpired,
+  isUnansweredPoll,
+  listEphemeral,
+  namedEphemeral,
+  renameEphemeral,
+  waitUntilReady
+} from "./chunk-7G3CTU7I.js";
+import {
+  pipedYes,
+  retryCommand,
+  withheldNote,
+  yesRerun
+} from "./chunk-T5KELPAR.js";
+import {
+  andList
+} from "./chunk-622HUCZT.js";
+import {
+  contextFlags,
+  credentialFileOf
+} from "./chunk-NAQDMEHV.js";
+import {
+  describeWrite,
+  noteLanded
+} from "./chunk-4KHEMC32.js";
+import {
+  readLockFile
+} from "./chunk-P2HAGF6H.js";
+import {
+  storedColumnsOf,
+  withStoredColumns
+} from "./chunk-TLQE7ZN3.js";
+import {
+  SENT_AFTERMATH,
+  TransportError,
+  certificateFailureCode,
+  closeSentence,
+  withoutReadAftermath
+} from "./chunk-YLDALTWZ.js";
+import {
+  DEFAULT_PROFILE
+} from "./chunk-QXTKSOFI.js";
+import {
+  CliError,
+  EXIT_OUTCOME_UNKNOWN,
+  LocalFileNotFoundError,
+  UsageError,
+  activeOperation,
+  backendDestinationPayload,
+  blank,
+  credentialWriteTarget,
+  detail,
+  discloseWriteTarget,
+  displayPath,
+  elapsedSuffix,
+  formatExpiration,
+  info,
+  isMachineOutput,
+  link,
+  pastePath,
+  registerOperation,
+  spinner,
+  statesOutcomeUnknown,
+  step,
+  success,
+  warn,
+  withSpinner,
+  writeJson,
+  writeTargetPayload
+} from "./chunk-PTHVMXZI.js";
+import {
+  codePinnedTables
+} from "./chunk-6MR5TI5V.js";
+import {
+  shellQuote
+} from "./chunk-5ZSO4T2G.js";
+import {
+  withArticle
+} from "./chunk-36JUQZVQ.js";
+
+// src/emit/deploy-command.ts
+import { existsSync, realpathSync } from "fs";
+import { basename, isAbsolute, join, relative, resolve, sep } from "path";
+var EXIT_MICROSERVICE_NOT_READY = 4;
+var EXIT_TESTS_UNREACHABLE = 6;
+function microserviceCheck(args) {
+  return { skip: args.skipLiveness, requireReady: args.requireMicroservices };
+}
+function buildStaticEnv(baseUrl, staticEnv) {
+  const env = {};
+  if (baseUrl) env.XANO_HOST = baseUrl;
+  Object.assign(env, staticEnv);
+  return env;
+}
+var PUBLISHABLE_KEY_VALUE = /^pk_(test|live)_/;
+var SECRET_KEY_VALUE = /^(sk|rk)_(test|live)_/;
+function warnSecretLookingStaticEnv(staticEnv) {
+  const flagged = Object.entries(staticEnv).filter(([key, value]) => {
+    if (SECRET_KEY_VALUE.test(value)) return true;
+    if (PUBLISHABLE_KEY_VALUE.test(value) || /PUBLIC|PUBLISHABLE/i.test(key)) return false;
+    return /SECRET|TOKEN|KEY|PASSWORD|PRIVATE/i.test(key);
+  }).map(([key]) => key);
+  if (flagged.length === 0) return flagged;
+  const one = flagged.length === 1;
+  const message = `--static-env ${flagged.join(", ")} ${one ? "looks" : "look"} like ${one ? "a secret" : "secrets"}. Every --static-env value is published in the static site's config, readable by anyone who loads it \u2014 keep secrets in the backend's environment variables instead.`;
+  warn(message, "static-env.secret-like");
+  return flagged;
+}
+function deriveDisplay(bundleText, cwd, source) {
+  if (source !== void 0 && source.startsWith("release:") && source.length > "release:".length) {
+    return source.slice("release:".length);
+  }
+  try {
+    const parsed = JSON.parse(bundleText);
+    const w = parsed.payload?.workspace;
+    const name = Array.isArray(w) ? w[0]?.name : w?.name;
+    if (typeof name === "string" && name.trim() !== "") return name;
+  } catch {
+  }
+  return basename(cwd) || "xanosdk-app";
+}
+async function assertNoSeedLeaks(dir, values, opts = {}) {
+  const { assertStaticDir, findSeedLeaks, StaticDirError } = await import("./static-host-B2Y6AG3W.js");
+  try {
+    assertStaticDir(dir, "--static", void 0, opts);
+  } catch (err) {
+    if (err instanceof StaticDirError) {
+      throw new (existsSync(dir) ? UsageError : LocalFileNotFoundError)(`${err.message} Nothing was deployed.`, {
+        hintFor: { command: "deploy" }
+      });
+    }
+    throw err;
+  }
+  if (values.length === 0) return;
+  const unscannable = [
+    ...new Set(values.filter((v) => v.scannable === false).map((v) => `${v.table}.${v.column}`))
+  ];
+  if (unscannable.length > 0) {
+    warn(
+      `${unscannable.length} non-public seed column${unscannable.length === 1 ? " holds a value" : "s hold values"} the static scan cannot search for \u2014 too short to match on, or not text at all \u2014 so they were NOT checked. Being unsearchable is not being safe: if any of these is a real credential, shorten the exposure rather than the value.`,
+      "static-env.unscannable-seed",
+      unscannable
+    );
+  }
+  const leaks = findSeedLeaks(dir, values);
+  if (leaks.length === 0) return;
+  const columnsByTable = /* @__PURE__ */ new Map();
+  for (const l of leaks) columnsByTable.set(l.table, (columnsByTable.get(l.table) ?? /* @__PURE__ */ new Set()).add(l.column));
+  const sourceOf = new Map(values.map((v) => [v.table, v.source]));
+  const causes = [...columnsByTable.keys()].map((t) => seedLeakCause(t, sourceOf.get(t) ?? "inline"));
+  const declarations = [...columnsByTable].map(
+    ([t, cols]) => `  table "${t}": publicSeed: [${[...cols].map((c) => JSON.stringify(c)).join(", ")}]`
+  );
+  throw new CliError(
+    "SDK_SEED_IN_STATIC",
+    `Refusing to publish: the static build in "${dir}" contains seed values from columns your schema marks non-public. These would be served at a public URL.
+${leaks.map((l) => `  ${l.file} \u2014 ${l.table}.${l.column}`).join("\n")}
+
+${causes.join("\n")}
+
+If these values are deliberately public (a demo login the frontend shows), declare them on the table:
+` + declarations.join("\n"),
+    { details: { leaks } }
+  );
+}
+function seedLeakCause(table, source) {
+  switch (source) {
+    case "thunk":
+      return `"${table}" seeds with \`() => import(...)\`, and a bundler follows that import into the frontend build. Use \`seedFile("./seed.json", import.meta.url)\` instead, then rebuild the frontend.`;
+    case "inline":
+      return `"${table}" writes its seed rows inline, so a frontend that imports the table definition bundles them. Move them to \`seedFile("./seed.json", import.meta.url)\`, then rebuild the frontend.`;
+    case "file":
+      return `"${table}" reads its seed with \`seedFile\`, which no bundler follows: the value is in the frontend's own source or something it imports. Remove it there, then rebuild the frontend.`;
+  }
+}
+function ephemeralParent(auth) {
+  return credentialWriteTarget(auth);
+}
+async function runDeployedTests(auth, summary, args) {
+  const settled = [];
+  const notRun = [];
+  try {
+    return await runTestsOrThrow(auth, summary, args, settled, notRun);
+  } catch (err) {
+    const { isSuiteUnreachable, suiteUnreachableCheck } = await import("./test-command-TIKZMDPZ.js");
+    const message = err instanceof Error ? err.message : String(err);
+    const reason = isSuiteUnreachable(err) ? `${message.split("\n")[0] ?? message}
+${suiteUnreachableCheck(
+      summary.localEngine !== void 0 ? { kind: "local-engine", env: summary.localEngine.name } : { kind: "ephemeral", env: summary.ephemeral?.name ?? null },
+      args
+    )}.` : withoutReadAftermath(message);
+    const again = testRunAllCommand(summary, args);
+    warn("The deploy stands, but its tests could not be run:", "deploy.tests-not-run", [
+      reason,
+      ...again !== void 0 ? [`Run them again once it is reachable with \`${again}\` \u2014 the deploy itself does not need repeating.`] : []
+    ]);
+    process.exitCode = EXIT_TESTS_UNREACHABLE;
+    return { ...await testSummaryOf(settled, notRun), error: reason, ...again !== void 0 ? { retry: again } : {} };
+  }
+}
+function testRunAllCommand(summary, args) {
+  const on = summary.localEngine !== void 0 ? `local-engine:${shellQuote(summary.localEngine.name)}` : summary.ephemeral?.name !== void 0 ? `ephemeral:${shellQuote(summary.ephemeral.name)}` : void 0;
+  if (on === void 0) return void 0;
+  const kind = args.kind !== void 0 ? ` --kind ${args.kind}` : "";
+  const concurrency = args.concurrency !== void 0 ? ` --concurrency ${args.concurrency}` : "";
+  const flags = summary.localEngine !== void 0 ? "" : contextFlags(args);
+  return `xanosdk test run-all --on ${on}${kind}${concurrency}${flags}`;
+}
+async function testSummaryOf(outcomes, notRun = []) {
+  const { suiteCounts, testRow } = await import("./test-command-TIKZMDPZ.js");
+  return { ...suiteCounts(outcomes, notRun), tests: outcomes.map(testRow) };
+}
+async function runTestsOrThrow(auth, summary, args, settled, notRun) {
+  const { runSuite, printTally, noTestsFound, EXIT_TESTS_FAILED } = await import("./test-command-TIKZMDPZ.js");
+  const { qualifiedName } = await import("./tests-BGGIOK3L.js");
+  if (summary.url === void 0) {
+    warn("Skipped --test: the ephemeral reported no base URL to run against.", "deploy.tests-not-run");
+    return void 0;
+  }
+  const local = summary.localEngine;
+  const name = summary.ephemeral?.name;
+  const target = local ? { base: summary.url, workspaceId: local.workspaceId, label: `local engine "${local.name}"` } : {
+    base: summary.url,
+    workspaceId: 1,
+    // Named as `test run-all` names it: `ephemeral "x" ("Display")`.
+    label: name ? namedEphemeral({ name, display: summary.ephemeral?.display }) : "the ephemeral",
+    env: name
+  };
+  let stopped;
+  const outcomes = await runSuite(auth, target, {
+    kind: args.kind,
+    concurrency: args.concurrency,
+    onOutcome: (o) => settled.push(o),
+    onUnreachable: (handle, err) => {
+      stopped ??= err;
+      notRun.push(qualifiedName(handle));
+    }
+  });
+  if (stopped !== void 0) {
+    if (outcomes.length > 0) {
+      blank();
+      const read = await testSummaryOf(outcomes, notRun);
+      printTally(read.passed, read.failed, read.notRun);
+    }
+    throw stopped;
+  }
+  const run = await testSummaryOf(outcomes);
+  blank();
+  if (outcomes.length === 0) detail(await noTestsFound(auth, target, args.kind, " in the deployed environment"));
+  else printTally(run.passed, run.failed);
+  if (run.failed > 0) process.exitCode = EXIT_TESTS_FAILED;
+  return run;
+}
+async function ignoreBackendSecretFilesRead(args) {
+  if (args.bundle !== void 0 || args.file === void 0) return;
+  const paths = [];
+  if (args.envFile === void 0) {
+    const { defaultWorkspaceEnvPath } = await import("./workspace-env-F2RFMSC5.js");
+    paths.push(defaultWorkspaceEnvPath(args.file));
+  }
+  if (args.secretsFile === void 0) {
+    const { defaultWorkspaceSecretsPath } = await import("./secrets-file-LVZD6IIM.js");
+    paths.push(defaultWorkspaceSecretsPath(args.file));
+  }
+  const { gitSaysIgnored } = await import("./store-ARM6VMO5.js");
+  const { ensureSecretPathGitignored, refuseIfTracked, secretPathLabel } = await import("./gitignore-3SJ3WNRG.js");
+  for (const path of paths) {
+    if (!existsSync(path)) continue;
+    if (gitSaysIgnored(path) !== false) continue;
+    const label = secretPathLabel(path);
+    let tracked = false;
+    try {
+      refuseIfTracked(path, label);
+    } catch {
+      tracked = true;
+    }
+    if (tracked) {
+      warn(
+        `${label} holds secrets and is tracked by git \u2014 an ignore rule cannot untrack it. Run \`git rm --cached ${label}\` (it stays on disk) and commit that.`,
+        "secrets.tracked-by-git"
+      );
+      continue;
+    }
+    warn(`${label} holds secrets and git was not ignoring it.`, "secrets.not-ignored");
+    ensureSecretPathGitignored(path);
+  }
+}
+function recordedLanding(dest, isEphemeral, flags = "") {
+  if (dest.kind === "workspace") return `\`xanosdk promote <name>${flags}\``;
+  if (isEphemeral) return `\`xanosdk deploy release:<name>${flags}\``;
+  return `\`xanosdk tenant deploy ${shellQuote(dest.name)} <name>${flags}\``;
+}
+function storeAsReleaseHint(dest, isEphemeral, typed, flags = "", yes = false, shipsFiles = false) {
+  if (shipsFiles) {
+    return "A release cannot keep this landing: the source ships stored files (`hostedFile()`), and a release copies no file bytes, so `release create` refuses it. Re-run this deploy to land it again.";
+  }
+  const landed = "can be listed, exported and landed again";
+  const land = recordedLanding(dest, false, `${yes || process.stdin.isTTY !== true ? " --yes" : ""}${flags}`);
+  const against = typed.bundle !== void 0 ? ` --bundle ${shellQuote(typed.bundle)}` : typed.file !== void 0 ? ` --entry ${shellQuote(typed.file)}` : "";
+  if (dest.kind === "workspace") {
+    const branch = dest.branch !== void 0 && dest.branch !== "" ? ` --branch ${shellQuote(dest.branch)}` : "";
+    return `\`xanosdk release create <name> --from workspace${branch}${against}${flags}\` stores what the workspace now runs as a release that ${landed} (${land}).`;
+  }
+  if (isEphemeral) {
+    return `\`xanosdk release create <name> --from ephemeral:${shellQuote(dest.name)}${against}${flags}\` stores what it now runs as a release that ${landed}.`;
+  }
+  const source = typed.bundle !== void 0 ? ` --bundle ${shellQuote(typed.bundle)}` : typed.file !== void 0 ? ` ${shellQuote(typed.file)}` : "";
+  return `A release is cut from a backend that ran on the instance, and a standard tenant cannot be cut from. To keep this source as one that ${landed}: \`xanosdk deploy${source}${flags}\` (to this project's ephemeral), then \`xanosdk release create <name>${against}${flags}\`, then ${land} lands it here \u2014 it REPLACES what the tenant runs with that release, so anything else merged onto it (another project's objects) is dropped.`;
+}
+function tenantWithoutWorkspace(tenant, named, typed, args) {
+  const flags = contextFlags(args);
+  const yes = pipedYes(args);
+  const t = shellQuote(tenant);
+  const source = typed.bundle !== void 0 ? ` --bundle ${shellQuote(typed.bundle)}` : typed.file !== void 0 ? ` ${shellQuote(typed.file)}` : "";
+  const against = typed.bundle !== void 0 ? ` --bundle ${shellQuote(typed.bundle)}` : typed.file !== void 0 ? ` --entry ${shellQuote(typed.file)}` : "";
+  const land = (release) => `\`xanosdk tenant deploy ${t} ${release}${yes}${flags}\``;
+  const seed = args.seed ? " --seed" : "";
+  const rerun = retryCommand(args, {
+    add: args.dryRun || yes === "" ? [] : ["--yes"],
+    command: `deploy --to ${shellQuote(`tenant:${tenant}`)}`
+  });
+  return new CliError(
+    "SDK_USAGE",
+    `${named} has no workspace yet, so there is nothing for \`deploy --to\` to merge into or preview against \u2014 a tenant on its own domain gets its workspace when its first release lands. Nothing was written.
+Land a release on it first: ${land("<release>")} (\`xanosdk release list${flags}\` names them). To land this source, deploy it to this project's ephemeral (\`xanosdk deploy${source}${flags}\`), cut it (\`xanosdk release create <name>${against}${seed}${flags}\`), and land that: ${land("<name>")}.
+After that, \`${rerun.command}\` ${args.dryRun ? "previews merging" : "merges"} onto it.${withheldNote(rerun.withheld)}`,
+    { details: { reason: "tenant-has-no-workspace", tenant } }
+  );
+}
+function shipsStoredFiles(bundle) {
+  const payload = bundle?.payload;
+  return Array.isArray(payload?.vault) && payload.vault.length > 0;
+}
+async function soleTrackedEphemeral() {
+  const { readEphemeralState: readEphemeralState2 } = await import("./ephemeral-state-PYCBSOGX.js");
+  const names = new Set(Object.values(readEphemeralState2(process.cwd()).environments).map((r) => r.name));
+  return names.size === 1 ? [...names][0] : void 0;
+}
+async function runDeployToDestination(args, to) {
+  const { requireBackendSlot, parseSlot } = await import("./backend-slot-7QXW2QYC.js");
+  const { resolveSource, describeBackend } = await import("./source-resolve-S2XA3XZF.js");
+  const { looksLikeSource, resolveProjectEntry } = await import("./deploy-source-3W45CXMP.js");
+  const dest = parseSlot(requireBackendSlot("deploy", void 0, "to"), to, to.trim() === "ephemeral" ? await soleTrackedEphemeral() : void 0);
+  if (dest.kind !== "workspace" && dest.kind !== "tenant") {
+    throw new Error(`Internal: \`deploy --to\` parsed ${withArticle(dest.kind)}, which its slot does not accept.`);
+  }
+  if (args.file !== void 0 && looksLikeSource(args.file)) {
+    const flags = contextFlags(args);
+    const release = /^release:(.*)$/.exec(args.file)?.[1];
+    const releaseWord = release === void 0 || release === "" ? "<name>" : shellQuote(release);
+    const { pipedYes: pipedYes2 } = await import("./retry-command-AS5EVREX.js");
+    const yes = args.dryRun === true ? "" : pipedYes2(args);
+    const tenantLanding = `\`xanosdk tenant deploy ${dest.kind === "tenant" ? shellQuote(dest.name) : "<tenant>"} ${releaseWord}${yes}${flags}\``;
+    const landing = `${args.branch === void 0 ? "" : ` --branch ${shellQuote(args.branch)}`}${args.setLive === true ? " --set-live" : ""}`;
+    const promote = `\`xanosdk promote ${releaseWord}${landing}${yes}${flags}\``;
+    const advice = /^release:/.test(args.file) ? `A release already has a home on the server, so landing it is ` + (dest.kind === "tenant" ? `${tenantLanding} (or ${promote} for your workspace)` : `${promote} (or ${tenantLanding})`) + ` \u2014 not a deploy. \`--to\` is for code that has no release yet.` + (args.dryRun === true ? ` Neither takes \`--dry-run\`: without \`--yes\`, each shows what it would land and asks first.` : ``) : `\`--to\` merges a build compiled HERE, and "${args.file}" already exists on a server. Pull it into this project first (\`xanosdk pull ${shellQuote(args.file)}${flags}\`) and deploy that, or cut a release from it and promote that.`;
+    throw new UsageError(advice, { hintFor: { command: "deploy" } });
+  }
+  refuseValueFlagsBesideBundle(args, { command: "deploy" });
+  const typed = { file: args.file, bundle: args.bundle };
+  if (args.file === void 0 && args.bundle === void 0) {
+    const entry = resolveProjectEntry(process.cwd());
+    if (entry !== void 0) args = { ...args, file: entry };
+  }
+  assertBundleFile(args, { command: "deploy" });
+  assertEntryFile(args);
+  assertValueFiles(args, { command: "deploy" });
+  refuseMissingLockDir(args);
+  refuseMissingStaticDir(args);
+  const resolved = await resolveSource(dest, async () => {
+    const auth = await getAccessToken(args);
+    await noteRunScopeFor(auth);
+    return auth;
+  }, { workspaceless: "any" });
+  const isEphemeral = dest.kind === "tenant" && resolved.target.tenantType === "ephemeral";
+  const noun = isEphemeral ? "ephemeral" : "tenant";
+  if (dest.kind === "tenant") {
+    const branchy = [
+      args.branch !== void 0 ? "--branch" : void 0,
+      args.setLive ? "--set-live" : void 0,
+      args.backupBranch !== void 0 ? "--backup-branch" : void 0
+    ].filter((f) => f !== void 0);
+    if (branchy.length > 0) {
+      throw new UsageError(
+        `${andList(branchy)} ${branchy.length === 1 ? "scopes" : "scope"} a branch, and ${isEphemeral ? "an ephemeral" : "a tenant"} has none. \`--to workspace\` is the destination that has them.`,
+        { hintFor: { command: "deploy" } }
+      );
+    }
+  }
+  const named = describeBackend(resolved);
+  if (dest.kind === "tenant" && !isEphemeral && resolved.backend.kind === "hosted") {
+    const { tenantHasWorkspace } = await import("./tenant-IIHPOHGP.js");
+    if (!await tenantHasWorkspace(resolved.backend.auth, resolved.target.base)) {
+      throw tenantWithoutWorkspace(dest.name, named, typed, args);
+    }
+  }
+  if (!args.dryRun) {
+    warn(`Writing to ${named}${isEphemeral ? "" : " \u2014 this is not an ephemeral"}.`, isEphemeral ? "deploy.ephemeral-write" : "deploy.tenant-write");
+  }
+  const afterLanding = (landedBundle) => {
+    const recorded = isEphemeral || !args.noLock;
+    const nothing = args.backupBranch !== void 0 && args.backupBranch !== false && dest.kind === "workspace" ? "no release to list, export, or land again \u2014 the backup branch above is what rolls its logic back" : "nothing to list, export, or roll back to";
+    detail(
+      recorded ? `No release is stored: this run records only what it landed (in ${isEphemeral ? ".xano/ephemeral.json" : "xano.lock"}, for \`--prune\`), so there is ${nothing}.` : `No release is stored, and under \`--no-lock\` nothing records what this run landed, so there is ${nothing}, and a later \`--prune\` has no record to scope it.`
+    );
+    detail(
+      storeAsReleaseHint(
+        dest.kind === "workspace" ? { kind: "workspace", ...args.branch !== void 0 ? { branch: args.branch } : {} } : dest,
+        isEphemeral,
+        typed,
+        contextFlags(args),
+        args.yes,
+        shipsStoredFiles(landedBundle)
+      )
+    );
+  };
+  const { runReleaseCommand } = await import("./release-command-N4ZPKMHR.js");
+  return runReleaseCommand(args, {
+    base: resolved.target.base,
+    workspaceId: resolved.target.workspaceId,
+    // Carried so the release knows whether this destination HAS branches: the
+    // `--replace` branch-deletion guard is a workspace-only question.
+    kind: dest.kind,
+    // Only a tenant carries a label into the step line. For `--to workspace` the
+    // resolved label is "your workspace", which the disclosure would render as
+    // "your workspace — host · workspace 42": the same word twice, and no new fact.
+    ...dest.kind === "tenant" ? { label: named } : {},
+    // The machine destination's `kind` and bare `label`: the target's ACTUAL type.
+    ...dest.kind === "tenant" ? { type: noun, name: resolved.target.label } : {},
+    // What people call it, for the headline and the machine destination.
+    ...dest.kind === "tenant" && resolved.target.display !== void 0 && resolved.target.display !== "" ? { display: resolved.target.display } : {}
+    // The credential resolved above, so it is resolved (and its profile notice printed) once.
+  }, {
+    ...resolved.backend.kind === "hosted" ? { auth: resolved.backend.auth } : {},
+    afterLanding,
+    // A merge whose outcome is unknown is previewed again with this run's own command.
+    stateCheck: toStateCheck(args, named)
+  });
+}
+var DESTINATION_ONLY = [
+  { key: "dryRun", flag: "--dry-run", why: "a refresh has no plan to preview \u2014 it replaces the environment, or merges into it with `--keep-data`" },
+  { key: "prune", flag: "--prune", why: "a refresh leaves nothing behind to prune \u2014 a replace rewrites the whole environment" },
+  { key: "replace", flag: "--replace", why: "a refresh already replaces unless `--keep-data` says to merge" },
+  { key: "resetData", flag: "--reset-data", why: "a refresh already replaces the rows unless `--keep-data` keeps them (`--reset` overrides that)" },
+  { key: "seed", flag: "--seed", why: "a refresh already seeds when it replaces and never when `--keep-data` keeps the rows" },
+  { key: "allowSharedSchemaChanges", flag: "--allow-shared-schema-changes", why: "the environment is this project's own, with no shared schema to gate" },
+  { key: "allowBranchDeletion", flag: "--allow-branch-deletion", why: "an ephemeral or local engine has no branches to delete" },
+  { key: "branch", flag: "--branch", why: "an ephemeral or local engine has no branch to name" },
+  { key: "setLive", flag: "--set-live", why: "an ephemeral or local engine has no branch to make live" },
+  { key: "backupBranch", flag: "--backup-branch", why: "an ephemeral or local engine has no branch to back up" }
+];
+function assertNoDestinationFlags(args) {
+  const passed = DESTINATION_ONLY.filter((f) => args[f.key] !== void 0 && args[f.key] !== false);
+  if (passed.length === 0) return;
+  const names = passed.map((f) => f.flag);
+  const one = names.length === 1;
+  const why = passed.map((f) => one ? f.why : `\`${f.flag}\`: ${f.why}`).join("; ");
+  throw new UsageError(
+    `${andList(names)} ${one ? "needs" : "need"} a destination, and this deploy names none \u2014 it refreshes this project's own ephemeral or local engine, and ${why}. Add \`--to workspace\` (or \`--to tenant:<name>\`) to reach a real destination, or drop ${one ? "the flag" : "the flags"}.` + (args.keepData ? ` \`--keep-data\` still keeps this environment's rows without them.` : "") + (args.dryRun ? ` ${previewOwnEphemeral(args)}` : ""),
+    { hintFor: { command: "deploy" } }
+  );
+}
+function previewOwnEphemeral(args) {
+  let names = [];
+  try {
+    names = [...new Set(Object.values(readEphemeralState(process.cwd()).environments).map((r) => r.name))];
+  } catch {
+  }
+  const target = names.length === 1 ? `tenant:${names[0]}` : "tenant:<ephemeral>";
+  const entry = args.file === void 0 ? "" : ` ${shellQuote(pastePath(args.file))}`;
+  return `To preview a merge into this project's ephemeral, run \`xanosdk deploy${entry} --to ${target} --dry-run${contextFlags(args)}\`` + (names.length === 1 ? "." : " (`xanosdk ephemeral list` names it).");
+}
+var EPHEMERAL_ONLY = [
+  { flag: "--name", passed: (a) => a.name !== void 0 },
+  { flag: "--expires-hours", passed: (a) => a.expiresHours !== void 0 },
+  { flag: "--reset", passed: (a) => a.reset },
+  { flag: "--test", passed: (a) => a.test },
+  { flag: "--kind", passed: (a) => a.kind !== void 0 },
+  { flag: "--concurrency", passed: (a) => a.concurrency !== void 0 },
+  { flag: "--no-dev-env", passed: (a) => a.noDevEnv },
+  { flag: "--require-microservices", passed: (a) => a.requireMicroservices },
+  { flag: "--open", passed: (a) => a.open }
+];
+var TEST_FLAGS = /* @__PURE__ */ new Set(["--test", "--kind", "--concurrency"]);
+function assertNoEphemeralFlags(args) {
+  if (args.to === void 0) return;
+  const names = EPHEMERAL_ONLY.filter((f) => f.passed(args)).map((f) => f.flag);
+  if (names.length > 0) {
+    const one = names.length === 1;
+    const testing = names.filter((n) => TEST_FLAGS.has(n));
+    const describing = names.filter((n) => !TEST_FLAGS.has(n));
+    const what = [
+      ...describing.length > 0 ? [`${andList(describing)} ${describing.length === 1 ? "describes" : "describe"} the ephemeral a deploy with no \`--to\` refreshes`] : [],
+      ...testing.length > 0 ? [
+        testing.includes("--test") ? `${andList(testing)} ${testing.length === 1 ? "runs" : "run"} the ephemeral's tests after a deploy with no \`--to\`` : `${andList(testing)} ${testing.length === 1 ? "shapes" : "shape"} the test run \`--test\` makes on the ephemeral after a deploy with no \`--to\``
+      ] : []
+    ].join(", and ");
+    const kind = args.kind !== void 0 ? ` --kind ${args.kind}` : "";
+    const concurrency = args.concurrency !== void 0 ? ` --concurrency ${args.concurrency}` : "";
+    const testThere = testing.length > 0 ? ` To test ${args.to === "workspace" ? "the workspace" : args.to}, run \`xanosdk test run-all --on ${shellQuote(args.to)}${kind}${concurrency}${contextFlags(args)}\` once the deploy has landed.` : "";
+    throw new UsageError(
+      `${what}; \`--to\` ${args.replace ? "replaces" : "merges into"} a backend that already exists \u2014 so ${one ? "it is" : "they are"} refused rather than quietly skipped. Nothing was deployed. Drop ${one ? "it" : "them"}, or drop \`--to\` to deploy to this project's ephemeral.${testThere}`,
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  if (args.static !== void 0 && args.dryRun) {
+    throw new UsageError(
+      `\`--static\` publishes a frontend, and \`--dry-run\` writes nothing \u2014 so the preview would say nothing about it. Drop \`--static\` to preview the ${args.replace ? "replace" : "merge"}, or \`--dry-run\` to publish.`,
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  if (args.skipLiveness && args.static === void 0) {
+    throw new UsageError(
+      "`--skip-liveness` skips `--static`'s rollout check under `--to`, and this deploy publishes no frontend \u2014 so it would change nothing. Drop it, or add `--static <dir>`.",
+      { hintFor: { command: "deploy" } }
+    );
+  }
+}
+function resolveDeployDestination(args) {
+  return args.localEngine ? { kind: "local-engine", downloadUrl: args.localEngineUrl } : { kind: "ephemeral" };
+}
+async function assertLocalEngineUsable(args, dest) {
+  if (dest.kind !== "local-engine") return;
+  if (args.to !== void 0) {
+    throw new UsageError(
+      "`--local-engine` and `--to` are two destinations, and a deploy has one. Drop whichever is not meant: `--local-engine` runs this workspace on an engine on this machine, `--to` merges it into a backend that already exists. Either one alone still works exactly as it did.",
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  const ephemeralOnly = [
+    ...args.name !== void 0 ? ["--name"] : [],
+    ...args.expiresHours !== void 0 ? ["--expires-hours"] : []
+  ];
+  if (ephemeralOnly.length > 0) {
+    const one = ephemeralOnly.length === 1;
+    throw new UsageError(
+      `${andList(ephemeralOnly)} ${one ? "describes" : "describe"} an ephemeral, and a local engine has no display name or expiry, so ${one ? "it is" : "they are"} refused rather than quietly skipped. Drop ${one ? "it" : "them"}, or drop \`--local-engine\` to deploy to an ephemeral.`,
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  const { engineSourceRefusal, MISSING_ARCHIVE, resolveEnginePlatform, SUPPORTED_PLATFORMS } = await import("./local-engine-config-5U3SC434.js");
+  const sourceRefusal = engineSourceRefusal(dest.downloadUrl);
+  if (sourceRefusal !== void 0) {
+    const Refusal = sourceRefusal.startsWith(MISSING_ARCHIVE) ? LocalFileNotFoundError : UsageError;
+    throw new Refusal(sourceRefusal, { hintFor: { command: "deploy" } });
+  }
+  if (resolveEnginePlatform() === void 0) {
+    throw new Error(
+      `There is no local engine build for ${process.platform} ${process.arch} \u2014 it runs on ${SUPPORTED_PLATFORMS.join(", ")} and nothing else, so there is nothing for \`--local-engine\` to run here. Deploy from one of those machines, or drop the flag: \`xanosdk deploy\` reaches an ephemeral from anywhere.`
+    );
+  }
+}
+async function deployToLocalEngine(args, dest, sourceCredential, ctx) {
+  const { startedAt } = ctx;
+  const dir = process.cwd();
+  const fetchedSource = sourceCredential !== void 0 && args.file !== void 0 ? { credential: sourceCredential, spec: args.file } : void 0;
+  const { discoverToolchainPlugins } = await import("./toolchain-modules-5EAZUONB.js");
+  const toolchain = await discoverToolchainPlugins(dir, { frozen: args.frozenLock === true });
+  const { archive, shownSource, bundleObject, bundleText, content, passwordColumns, classifiedLock, commitLock, nonPublicSeedValues } = fetchedSource ? await import("./deploy-source-3W45CXMP.js").then(async (m) => {
+    const f = await m.fetchSourceArchive(fetchedSource.credential, fetchedSource.spec, dir);
+    const decoded = decodeWorkspaceArchive(f.archive);
+    noteReleaseCarriesNoEnv(fetchedSource.spec, m.gatedApiGroups(decoded));
+    return {
+      archive: f.archive,
+      source: f.provenance,
+      // The headline's name for it: the handle, and beside it what people call it.
+      shownSource: shownSourceOf(f),
+      bundleObject: decoded,
+      // Only a merge reads the text, so it is serialized there, on demand.
+      bundleText: void 0,
+      // The seed rows a release carries, read only to name what a merge leaves unwritten.
+      content: m.archiveSeedContent(f.archive),
+      passwordColumns: m.passwordSeedColumns(f.archive),
+      classifiedLock: void 0,
+      commitLock: void 0,
+      // A fetched backend carries no seed values to look for in a frontend.
+      nonPublicSeedValues: []
+    };
+  }) : (
+    // The lock write waits for the import to land (a rename the lock was
+    // not told about, an engine that cannot apply the merge, …): a refused or
+    // failed deploy leaves `xano.lock` as it found it (E2E passes 26, 28).
+    await loadBundleText(args, { command: "deploy" }, { withSeed: true, deferLockWrite: true }).then((l) => ({
+      archive: encodeWorkspaceArchive(l.bundle, [...l.content, ...l.files]),
+      source: l.source,
+      shownSource: shownInput(l.source),
+      bundleObject: l.bundleObject ?? JSON.parse(l.bundle),
+      bundleText: l.bundle,
+      content: l.content,
+      passwordColumns: [],
+      classifiedLock: l.classifiedLock,
+      commitLock: l.commitLock,
+      nonPublicSeedValues: l.nonPublicSeedValues
+    }))
+  );
+  if (fetchedSource === void 0) await ignoreBackendSecretFilesRead(args);
+  if (args.static !== void 0) {
+    await assertNoSeedLeaks(args.static, nonPublicSeedValues, { serverRendered: true });
+  }
+  step(`Deploying ${shownSource} \u2192 local engine`);
+  {
+    const { runBundleHooks } = await import("./toolchain-hooks-GHKLUJOH.js");
+    const { readVersion } = await import("./cli.js");
+    await runBundleHooks(
+      toolchain.loaded,
+      {
+        bundle: bundleObject,
+        // Absent on the fetched-source branch, which is the documented signal
+        // for "the project did not compile this" — it lets a plugin decline
+        // rather than render a remote backend over this repo's own tree.
+        entry: fetchedSource ? void 0 : args.file,
+        cwd: dir,
+        command: "deploy",
+        frozen: args.frozenLock === true,
+        sdkVersion: readVersion()
+      },
+      "; nothing was deployed"
+    );
+  }
+  const { chooseLocalEngine, explainOverrideFailure, pinAfterAcquire } = await import("./local-engine-choice-CH5X3W7E.js");
+  const choice = await chooseLocalEngine(dest.downloadUrl, dir, isMachineOutput(args));
+  const { ensureProjectEngine } = await import("./local-engine-deploy-PCQ4SNPB.js");
+  const pin = pinAfterAcquire(choice, dir);
+  const flags = { keepData: args.keepData, reset: args.reset };
+  const { engine, reused, previousUrl, hadRecord, priorFilled, engineVersion, replaced, sweptOrphans } = await withSpinner(
+    "Preparing the local engine\u2026",
+    () => ensureProjectEngine({
+      dir,
+      source: choice.source,
+      rerun: rerunOf(args).command,
+      rerunNote: rerunOf(args).note,
+      onAcquired: pin.onAcquired,
+      carryFilled: (ctx2) => ctx2.reused && ctx2.priorFilled !== void 0 && ctx2.priorFilled.url === ctx2.url
+    }).catch((err) => explainOverrideFailure(choice, err))
+  );
+  pin.announce();
+  if (sweptOrphans !== void 0) {
+    info(
+      `Stopped ${sweptOrphans.length === 1 ? "a process" : `${sweptOrphans.length} processes`} a crashed local engine left running (pid ${sweptOrphans.join(", ")}).`
+    );
+  }
+  if (replaced !== void 0) {
+    info(
+      `Replaced local engine ${replaced.name} (${replaced.from ?? "an unrecorded version"} \u2192 ${replaced.to ?? "the resolved engine"}). It starts empty, so this deploy seeds it.`
+    );
+  }
+  const arm = selectDeployArm({
+    ...flags,
+    created: !reused,
+    hadRecord,
+    priorFilled,
+    url: engine.url
+  });
+  await refuseEnvClearedByFallbackReplace(arm);
+  const target = {
+    kind: "local-engine",
+    url: engine.url,
+    workspaceId: engine.workspaceId
+  };
+  discloseWriteTarget(target);
+  announceArm(arm, "local-engine");
+  const bearer = { access_token: engine.token, instance: engine.url };
+  let merged;
+  let sent = false;
+  const sending = () => {
+    sent = true;
+    if (reused) recordDeployed(dir, "local-engine");
+  };
+  try {
+    if (arm.arm === "merge") {
+      const { mergeKeepingData } = await import("./keep-data-merge-7MPLVAVI.js");
+      merged = await mergeKeepingData({
+        auth: bearer,
+        baseUrl: engine.url,
+        workspaceId: engine.workspaceId,
+        label: `local engine ${engine.name}`,
+        bundle: bundleText ?? JSON.stringify(bundleObject),
+        content,
+        files: archiveHostedFiles(archive),
+        // No credential flags: a local engine refuses them.
+        stateCheck: `Check what local engine ${engine.name} now holds with \`xanosdk tables local-engine:${shellQuote(engine.name)}\` before retrying.`,
+        envSetTo: ` --to ${shellQuote(`local-engine:${engine.name}`)}`,
+        kind: "local-engine",
+        rerun: rerunOf(args),
+        // The lock waits for the import itself, not only its refusals: an
+        // engine that cannot apply this merge (a 501) wrote nothing, and a lock
+        // rewritten for it would be a diff to commit for a deploy that never
+        // landed (E2E pass 28). The identities it would record derive from
+        // names, so a lost write re-derives the same ones next run.
+        beforeWrite: sending,
+        ...await mergeGuards(args, classifiedLock, {
+          bundle: bundleText ?? JSON.stringify(bundleObject),
+          compiled: fetchedSource === void 0 && args.bundle === void 0
+        })
+      });
+    } else {
+      sending();
+      await withSpinner(
+        IMPORTING_LABEL,
+        () => xanosdkImport(bearer, {
+          baseUrl: engine.url,
+          workspaceId: engine.workspaceId,
+          archive,
+          mode: "replace",
+          dryRun: false,
+          preserveGuids: true,
+          label: `local engine ${engine.name}`
+        })
+      );
+    }
+  } catch (err) {
+    if (err instanceof XanoSdkImportRefusal && err.retryable) {
+      const { importInProgressError } = await import("./keep-data-merge-7MPLVAVI.js");
+      throw importInProgressError(`local engine ${engine.name}`, rerunOf(args), err);
+    }
+    const { explainUnsupportedEngineImport } = await import("./local-engine-deploy-PCQ4SNPB.js");
+    const unsupported = explainUnsupportedEngineImport(err, engineVersion, {
+      latest: await latestEngineRelease(err),
+      resetRerun: arm.arm === "merge" ? `${rerunOf(args).command} --reset` : void 0
+    });
+    if (sent) {
+      const rerun = rerunOf(args);
+      warn(
+        "The import failed \u2014 the engine is still running, so nothing needs restarting:",
+        "local-engine.import-failed",
+        [
+          unsupported !== void 0 ? `It is serving at ${engine.url}, holding what it held \u2014 this engine cannot run this import; the error below names what can.` : `It is serving at ${engine.url}. Fix what the error below names, then run \`${rerun.command}\` again.${rerun.note}`,
+          `Stop it with \`xanosdk local-engine stop ${engine.name}\`.`
+        ]
+      );
+    }
+    throw unsupported ?? err;
+  }
+  commitLock?.();
+  const { markEngineFilled } = await import("./local-engine-state-A4FTRFAF.js");
+  markEngineFilled(dir, engine.url);
+  const urlChanged = !reused || previousUrl !== engine.url;
+  if (urlChanged) {
+    success(`Local engine ${engine.name} deployed${elapsedSuffix(startedAt)}`);
+    info("New local engine URL:");
+    link(engine.url);
+  } else {
+    const kept = arm.arm === "merge" ? ", keeping its data" : "";
+    success(`Redeployed to ${engine.name}${kept}${urlsNote(merged)}${elapsedSuffix(startedAt)}`);
+    link(engine.url);
+  }
+  detail(`Open the builder: ${engine.signInUrl}`);
+  detail(`Meta API bearer (the local XANO_META_TOKEN): \`xanosdk local-engine token\``);
+  detail(`Stop it with \`xanosdk local-engine stop ${engine.name}\``);
+  let staticSummary;
+  if (args.static !== void 0) {
+    staticSummary = await publishStaticToLocalEngine(args, args.static, engine, engineVersion);
+  } else {
+    detail(
+      "No static site was published. Run your frontend locally against the URL above, or pass `--static <dir>` to have the engine serve a built one."
+    );
+  }
+  const summary = {
+    kind: "local-engine",
+    destination: { ...writeTargetPayload(target), label: engine.name, url: engine.url },
+    // Nothing chose a credential for this run, so there is no profile to name.
+    // Null rather than omitted: the field is non-optional, and a wrapper that
+    // reads it everywhere must not have to branch on the destination first.
+    profile: null,
+    url: engine.url,
+    localEngine: {
+      name: engine.name,
+      workspaceId: engine.workspaceId,
+      logPath: engine.logPath,
+      ...engineVersion === void 0 ? {} : { engineVersion },
+      pin: pin.outcome(),
+      ...choice.override === void 0 ? {} : { override: choice.override }
+    },
+    created: !reused,
+    ...dataFields(arm),
+    ...mergeLossFields(merged),
+    ...staticSummary === void 0 ? {} : { static: staticSummary }
+  };
+  if (fetchedSource !== void 0 && summary.data === "replaced") {
+    const unverifiable = await notePasswordHashesDoNotTravel(
+      fetchedSource.credential,
+      fetchedSource.spec,
+      passwordColumns,
+      void 0
+    );
+    if (unverifiable !== void 0) summary.passwordHashesUnverifiable = unverifiable;
+  }
+  noteUnconfigured(summary, toolchain.unconfigured);
+  await syncDevEnvAfterDeploy(args, summary, dir);
+  if (args.test) summary.testRun = await runDeployedTests(bearer, summary, args);
+  if (args.open) openDeployed(summary);
+  if (isMachineOutput(args)) writeJson(summary);
+}
+async function publishStaticToLocalEngine(args, dir, engine, engineVersion) {
+  const retry = rerunOf(args).command;
+  try {
+    const summary = await deployStaticTo(
+      dir,
+      { access_token: engine.token },
+      { baseUrl: engine.url, workspaceId: engine.workspaceId, label: `local engine ${engine.name}` },
+      buildStaticEnv(engine.url, args.staticEnv),
+      Object.keys(args.staticEnv).length > 0,
+      args.staticHost,
+      // Nothing to wait for: the engine serves the build once the upload returns.
+      true,
+      args.staticRouting,
+      "--static",
+      { serverRendered: true }
+    );
+    if (summary.serverBundle === "uploaded") {
+      detail("Server half uploaded: the engine renders the site's dynamic routes.");
+    }
+    return summary;
+  } catch (err) {
+    const unknown = err instanceof Error && statesOutcomeUnknown(err.message);
+    const tooOld = err.status === 501;
+    const which = engineVersion === void 0 ? "This local engine" : `Local engine ${engineVersion}`;
+    const message = tooOld ? `${which} cannot host a static site (HTTP 501): static hosting on a local engine came in a later release. \`xanosdk local-engine update\` moves this project to the newest one.` : unknownStaticOutcome(err instanceof Error ? err.message : String(err), unknown);
+    warn("The static-host upload failed \u2014 the backend deploy stands:", "static.upload-failed", [
+      message,
+      `Retry with \`${retry}\` (it re-imports the backend, which is quick on a local engine).`
+    ]);
+    process.exitCode = unknown ? EXIT_OUTCOME_UNKNOWN : EXIT_STATIC_FAILED;
+    return { url: void 0, error: message, retry, completed: unknown ? "unknown" : "no" };
+  }
+}
+async function parseDeploySource(raw) {
+  const { requireBackendSlot, parseSlot } = await import("./backend-slot-7QXW2QYC.js");
+  const source = parseSlot(requireBackendSlot("deploy", void 0, "subject"), raw);
+  if (source.kind === "file") throw new Error(`Internal: "${raw}" parsed as a bundle path on the fetch arm.`);
+  return source;
+}
+function refuseValueFlagsForSource(args, raw, source) {
+  const kinds = compileValueFlagKinds(args);
+  const remedy = [
+    kinds.env ? `Set an env var on the deployed backend afterwards with \`xanosdk env set NAME${contextFlags(args)}\`.` : void 0,
+    kinds.docs ? DOC_TOKEN_REMEDY : void 0
+  ].filter((r) => r !== void 0).join(" ");
+  refuseCompileValueFlags(
+    args,
+    raw,
+    source.kind === "release" ? `a release is already built \u2014 it carries no env vars, and its API groups' documentation tokens are the ones it was cut with \u2014 so there is nothing for them to fill. ${remedy}` : `it is fetched, not compiled, and arrives with the env values and documentation settings it already holds. ${remedy}`,
+    { command: "deploy" }
+  );
+}
+function mergeLossFields(merged) {
+  if (merged === void 0) return {};
+  return {
+    ...merged.droppedTables.length > 0 ? { droppedTables: merged.droppedTables } : {},
+    ...merged.droppedColumns.length > 0 ? { droppedColumns: merged.droppedColumns } : {},
+    ...merged.pairedColumns.length > 0 ? { pairedColumns: merged.pairedColumns } : {},
+    ...merged.retypedColumns.length > 0 ? { retypedColumns: merged.retypedColumns } : {},
+    ...merged.notNullKept.length > 0 ? { notNullKept: merged.notNullKept } : {},
+    ...merged.narrowedEnums.length > 0 ? { narrowedEnums: merged.narrowedEnums } : {},
+    ...merged.retargetedRefs.length > 0 ? { retargetedRefs: merged.retargetedRefs } : {},
+    ...merged.indexChanges.length > 0 ? { indexChanges: merged.indexChanges } : {},
+    ...merged.notNullTightened.length > 0 ? { notNullTightened: merged.notNullTightened } : {},
+    ...merged.removed.length > 0 ? { removed: merged.removed } : {},
+    ...merged.notLanded.length > 0 ? { notLanded: merged.notLanded } : {},
+    ...merged.unseededTables.length > 0 ? { unseededTables: merged.unseededTables } : {},
+    ...merged.renamedTables.length > 0 ? { renamedTables: merged.renamedTables } : {},
+    ...merged.unappliedDocumentation.length > 0 ? { unappliedDocumentation: merged.unappliedDocumentation } : {},
+    ...merged.keptEnv.length > 0 ? { unchangedEnv: merged.keptEnv } : {},
+    ...merged.canonicalChanges.length > 0 ? { canonicalChanges: merged.canonicalChanges } : {}
+  };
+}
+function urlsNote(merged) {
+  const moved = merged?.canonicalChanges ?? [];
+  if (moved.length === 0) return " (URL unchanged)";
+  return ` (base URL unchanged; ${moved.map((m) => `${m.kind} "${m.name}" moved ${m.from} \u2192 ${m.to}`).join(", ")})`;
+}
+function noteReleaseCarriesNoEnv(raw, gatedGroups, landing, flags = "") {
+  if (!raw.startsWith("release:")) return;
+  const release = `Release "${raw.slice("release:".length)}" carries no env vars and no workspace documentation settings`;
+  if (landing !== void 0 && !landing.created) {
+    detail(
+      `${release}; ephemeral ${landing.ephemeral} kept the ones it already had. Change an env var with \`xanosdk env set NAME${flags}\`.`
+    );
+  } else {
+    warn(
+      `${release}.`,
+      "release.no-env",
+      [
+        (landing !== void 0 ? "The new environment has every env var unset and the workspace documentation gate off." : "A new environment stood up from it has every env var unset and the workspace documentation gate off; one it refreshes keeps the ones it had.") + ` Set env vars afterwards with \`xanosdk env set NAME${flags}\`.`
+      ]
+    );
+  }
+  if (gatedGroups.length === 0) return;
+  const one = gatedGroups.length === 1;
+  detail(
+    `API group${one ? "" : "s"} ${gatedGroups.map((g) => `"${g}"`).join(", ")} keep${one ? "s" : ""} ${one ? "its" : "their"} own documentation gate: it travels with the group, token included \u2014 the token of the backend the release was cut from, which is not necessarily the one \`xanosdk secrets fill\` put in this project. ` + (landing !== void 0 ? `\`xanosdk ephemeral export ${landing.ephemeral}${flags}\` writes it out (owner-only).` : "The landed backend's export carries it.")
+  );
+}
+function shownSourceOf(f) {
+  return f.display === void 0 ? f.provenance : `${f.provenance} (${JSON.stringify(f.display)})`;
+}
+function noteLiveCopyCarriesNoRows(raw, display, flags = "") {
+  if (raw.startsWith("release:")) return;
+  info(
+    `Its tables are empty: a copy of "${raw}"${display === void 0 ? "" : ` (${JSON.stringify(display)})`} carries its schema, not its rows. \`xanosdk release create <name> --from ${shellQuote(raw)} --seed${flags}\` cuts a release from it that carries rows.`
+  );
+}
+async function notePasswordHashesDoNotTravel(credential, raw, columns, landedOn) {
+  if (!raw.startsWith("release:") || columns.length === 0) return void 0;
+  const release = raw.slice("release:".length);
+  const origin = await passwordOrigin(await credential(), release);
+  if (landedOn !== void 0 && origin?.name === landedOn) return void 0;
+  const where = landedOn === void 0 ? "the local engine" : `ephemeral "${landedOn}"`;
+  warn(passwordHashesWarning(release, columns, where, "the deploy", origin?.phrase), "seed.password-hashes");
+  return [...columns];
+}
+function carriesTables(bundle) {
+  try {
+    const dbo = JSON.parse(bundle)?.payload?.dbo;
+    return Array.isArray(dbo) && dbo.length > 0;
+  } catch {
+    return true;
+  }
+}
+function noteBundleFileCarriesNoRows(path, reset) {
+  info(
+    `Its tables are empty: the bundle file "${path}" carries the schema, not seed rows. ` + (reset ? "Deploy the entry file to seed them." : "Deploy the entry file to seed them, or pass `--keep-data` to keep the rows an environment already has.")
+  );
+}
+function refuseSameEngine(source, dir) {
+  if (source?.kind !== "local-engine") return;
+  const own = getEngineRecord(dir)?.name ?? engineNameForProject(dir);
+  if (source.name !== void 0 && source.name !== own) return;
+  throw new UsageError(
+    `"${source.name === void 0 ? "local-engine" : `local-engine:${source.name}`}" is this project's own engine (${own}), which is also where \`--local-engine\` deploys \u2014 the same engine as source and destination. Nothing was downloaded or stopped. \`xanosdk deploy local-engine\` stands its export up as an ephemeral; \`xanosdk deploy local-engine:<name> --local-engine\` copies another engine into this one.`,
+    { hintFor: { command: "deploy" } }
+  );
+}
+function refuseSameEphemeral(source, auth, dir, flags = "", keepsData = false) {
+  if (source?.kind !== "ephemeral" && source?.kind !== "tenant") return;
+  const record = getEnvironment(readEphemeralState(dir), auth);
+  if (record === void 0) return;
+  const own = record.name;
+  const named = source.name === void 0 || source.name === own || source.name === record.display;
+  if (!named) return;
+  const typed = source.name === void 0 ? source.kind : `${source.kind}:${source.name}`;
+  throw new UsageError(
+    `"${typed}" is this project's own ephemeral (${own}), which is also where \`xanosdk deploy\` lands \u2014 the same environment as source and destination. ` + (keepsData ? `Merging it into itself would land its own export back onto it, so there is nothing to change. ` : `A redeploy of it from itself would replace it with an export that carries no rows, so every table would come back empty. `) + `Nothing was fetched or changed.
+` + (keepsData ? `Redeploy the project with \`xanosdk deploy --keep-data${flags}\`, or merge another environment in with \`xanosdk deploy ephemeral:<other> --keep-data${flags}\`.` : `Redeploy the project with \`xanosdk deploy${flags}\` (add \`--keep-data\` to keep the rows), or copy another environment in with \`xanosdk deploy ephemeral:<other>${flags}\`.`),
+    { hintFor: { command: "deploy" } }
+  );
+}
+var DEPENDENT_FLAGS = [
+  {
+    parent: "--test",
+    present: (a) => a.test,
+    flags: [
+      { flag: "--kind", passed: (a) => a.kind !== void 0 },
+      { flag: "--concurrency", passed: (a) => a.concurrency !== void 0 }
+    ]
+  },
+  {
+    parent: "--static",
+    present: (a) => a.static !== void 0,
+    flags: [
+      { flag: "--static-host", passed: (a) => a.staticHost !== void 0 },
+      { flag: "--static-routing", passed: (a) => a.staticRouting !== void 0 },
+      { flag: "--static-env", passed: (a) => Object.keys(a.staticEnv).length > 0 }
+    ]
+  }
+];
+function assertNoOrphanFlags(args) {
+  for (const group of DEPENDENT_FLAGS) {
+    if (group.present(args)) continue;
+    const names = group.flags.filter((f) => f.passed(args)).map((f) => f.flag);
+    if (names.length === 0) continue;
+    const one = names.length === 1;
+    throw new UsageError(
+      `${andList(names)} ${one ? "applies" : "apply"} only with ${group.parent}, and this deploy has none \u2014 nothing was deployed. Add ${group.parent}, or drop ${one ? "the flag" : "the flags"}.`,
+      { hintFor: { command: "deploy" } }
+    );
+  }
+}
+function refuseMissingLockDir(args) {
+  const noDir = missingLockDir(args);
+  if (noDir !== void 0) {
+    throw new LocalFileNotFoundError(`${noDir} Nothing was deployed.`, { hintFor: { command: "deploy" } });
+  }
+}
+function refuseMissingStaticDir(args) {
+  if (args.static === void 0 || existsSync(args.static)) return;
+  throw new LocalFileNotFoundError(`--static ${args.static}: directory not found. Nothing was deployed.`, {
+    hintFor: { command: "deploy" }
+  });
+}
+async function runDeployCommand(args) {
+  try {
+    await runDeploy(args);
+  } catch (err) {
+    if (err instanceof Error && err.name === "KeepDataDeclined") {
+      info(err.message);
+      return;
+    }
+    throw err;
+  }
+}
+async function runDeploy(args) {
+  if (args.name !== void 0 && args.name.trim() === "") {
+    throw new UsageError(
+      "--name needs a display name with at least one visible character. Drop it to keep the current name (a new ephemeral takes the release's or workspace's name).",
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  if (args.name !== void 0) args = { ...args, name: args.name.trim() };
+  const destination = resolveDeployDestination(args);
+  await assertLocalEngineUsable(args, destination);
+  if (args.keepData && args.to !== void 0) {
+    throw new UsageError(
+      "`--keep-data` keeps an ephemeral's or a local engine's rows across a redeploy, and `--to` already merges \u2014 it empties tables only when `--replace` or `--reset-data` asks. Drop `--keep-data`; `--to` without those keeps the destination's data as it always has.",
+      { hintFor: { command: "deploy" } }
+    );
+  }
+  assertNoEphemeralFlags(args);
+  refuseStaticHostAReplaceClears(args, args.to !== void 0 ? args.replace : !args.keepData || args.reset);
+  assertNoOrphanFlags(args);
+  warnSecretLookingStaticEnv(args.staticEnv);
+  if (args.to !== void 0) return runDeployToDestination(args, args.to);
+  assertNoDestinationFlags(args);
+  const startedAt = Date.now();
+  if (args.reset && !args.keepData) {
+    info("`--reset` changes nothing here: it only overrides `--keep-data`, and without it a deploy already replaces the environment.");
+  }
+  const { looksLikeSource, resolveProjectEntry, fetchSourceArchive, passwordSeedColumns, archiveSeedContent, gatedApiGroups } = await import("./deploy-source-3W45CXMP.js");
+  const fetching = args.file !== void 0 && looksLikeSource(args.file);
+  const sourceSpec = fetching ? await parseDeploySource(args.file) : void 0;
+  if (sourceSpec !== void 0) refuseValueFlagsForSource(args, args.file, sourceSpec);
+  if (destination.kind === "local-engine") {
+    refuseSameEngine(sourceSpec, process.cwd());
+    const { refuseProfileForLocal } = await import("./tracked-backend-EIBUMDZA.js");
+    refuseProfileForLocal(args.profile, sourceSpec === void 0 ? ["local-engine"] : ["local-engine", sourceSpec.kind], void 0, {});
+    const { refuseCredentialFlagsForLocal } = await import("./local-engine-choice-CH5X3W7E.js");
+    refuseCredentialFlagsForLocal(args, sourceSpec === void 0 ? ["local-engine"] : ["local-engine", sourceSpec.kind]);
+  }
+  if (!fetching) {
+    if (args.file === void 0 && args.bundle === void 0) {
+      const entry = resolveProjectEntry(process.cwd());
+      if (entry !== void 0) args = { ...args, file: entry };
+    }
+    assertBundleInput(args, { command: "deploy" });
+    refuseValueFlagsBesideBundle(args, { command: "deploy" });
+    assertBundleFile(args, { command: "deploy" });
+    assertValueFiles(args, { command: "deploy" });
+    refuseMissingLockDir(args);
+  }
+  refuseMissingStaticDir(args);
+  if (destination.kind === "local-engine") {
+    const { memoCredential } = await import("./tracked-backend-EIBUMDZA.js");
+    return deployToLocalEngine(
+      args,
+      destination,
+      fetching ? memoCredential(() => getAccessToken(args)) : void 0,
+      { startedAt }
+    );
+  }
+  if (!fetching) assertEntryFile(args);
+  const auth = await getAccessToken(args);
+  refuseSameEphemeral(sourceSpec, auth, process.cwd(), contextFlags(args), args.keepData && !args.reset);
+  await noteRunScopeFor(auth);
+  const { discoverToolchainPlugins } = await import("./toolchain-modules-5EAZUONB.js");
+  const toolchain = await discoverToolchainPlugins(process.cwd(), {
+    frozen: args.frozenLock === true
+  });
+  const loaded = fetching ? await fetchSourceArchive(async () => auth, args.file, process.cwd()).then((f) => ({
+    // Decoded back out of the archive rather than carried alongside it: the
+    // downstream steps want the workspace text, and reading it from the
+    // bytes about to be uploaded proves they are well-formed first.
+    bundle: JSON.stringify(decodeWorkspaceArchive(f.archive)),
+    bundleObject: void 0,
+    source: f.provenance,
+    // The headline's name for it: the handle, and beside it what people call it.
+    shownSource: shownSourceOf(f),
+    sourceDisplay: f.display,
+    // Read only by a merge, to name the new tables whose rows it does not write.
+    content: archiveSeedContent(f.archive),
+    nonPublicSeedValues: [],
+    archive: f.archive
+  })) : (
+    // The lock write waits for the pre-import refusals (a `--static-host`
+    // the environment does not hold, a seed leak): a refused deploy leaves
+    // `xano.lock` as it found it. `deployEphemeral` commits it before its
+    // first write.
+    await loadBundleText(args, { command: "deploy" }, { withSeed: true, deferLockWrite: true }).then((l) => ({
+      ...l,
+      archive: void 0,
+      shownSource: shownInput(l.source),
+      sourceDisplay: void 0
+    }))
+  );
+  const { bundle, source, content, nonPublicSeedValues } = loaded;
+  const passwordColumns = fetching && loaded.archive !== void 0 ? passwordSeedColumns(loaded.archive) : [];
+  if (!fetching) await ignoreBackendSecretFilesRead(args);
+  if (args.static !== void 0) {
+    await assertNoSeedLeaks(args.static, nonPublicSeedValues);
+  }
+  if (content.length > 0 && !fetching) {
+    const hosted = "files" in loaded ? loaded.files.length : 0;
+    const rows = (content.length === 1 ? "1 seed content file" : `${content.length} seed content files`) + (hosted === 0 ? "" : ` and ${hosted === 1 ? "1 hosted file" : `${hosted} hosted files`}`);
+    detail(
+      args.keepData && !args.reset ? `Bundling ${rows} (sent only if this deploy replaces the environment).` : `Bundling ${rows} (full replace re-seeds cleanly).`
+    );
+  }
+  {
+    const { runBundleHooks } = await import("./toolchain-hooks-GHKLUJOH.js");
+    const { readVersion } = await import("./cli.js");
+    await runBundleHooks(
+      toolchain.loaded,
+      {
+        // The compile already produced this object; only the `--bundle <path>`
+        // branch has nothing but text, and it pays the parse alone.
+        bundle: loaded.bundleObject ?? JSON.parse(bundle),
+        // NOT `args.file` when fetching: on that branch it is a source
+        // spec (`release:main`), not a path, and nothing local was compiled.
+        // `entry` absent is the documented signal for "the project did not
+        // compile this" — the same signal `--bundle <path>` sends — and it is
+        // what lets a plugin decline rather than render a remote backend over
+        // the tree describing this repo's source.
+        entry: fetching ? void 0 : args.file,
+        cwd: process.cwd(),
+        command: "deploy",
+        frozen: args.frozenLock === true,
+        sdkVersion: readVersion()
+      },
+      "; nothing was deployed"
+    );
+  }
+  const archive = loaded.archive ?? encodeWorkspaceArchive(bundle, [...content, ..."files" in loaded ? loaded.files : []]);
+  let staticSummary;
+  const staticDir = args.static;
+  const publishStatic = staticDir === void 0 ? void 0 : async (env) => {
+    const staticEnv = buildStaticEnv(env.baseUrl, args.staticEnv);
+    const explicit = Object.keys(args.staticEnv).length > 0;
+    try {
+      const target = { baseUrl: env.baseUrl, workspaceId: 1, label: env.label };
+      staticSummary = await deployStaticTo(
+        staticDir,
+        auth,
+        target,
+        staticEnv,
+        explicit,
+        args.staticHost,
+        args.skipLiveness,
+        args.staticRouting,
+        "--static",
+        { rerun: staticRetryCommand(staticDir, `ephemeral:${env.name}`, args, void 0) }
+      );
+    } catch (err) {
+      const unknown = err instanceof Error && statesOutcomeUnknown(err.message);
+      const message = unknownStaticOutcome(err instanceof Error ? err.message : String(err), unknown);
+      staticSummary = {
+        url: void 0,
+        error: message,
+        retry: staticRetryCommand(staticDir, `ephemeral:${env.name}`, args, err),
+        completed: unknown ? "unknown" : "no"
+      };
+      if (env.republish === true) return staticSummary;
+      warn(
+        "The static-host upload failed \u2014 the backend deploy stands:",
+        "static.upload-failed",
+        [
+          message,
+          // `publish`, not `deploy --static`: a redeploy would re-import the
+          // backend that just landed to retry an upload that has nothing to do with it.
+          // `--static-routing` must be carried too — dropping it lets the retry
+          // silently re-infer routing the caller had explicitly overridden, and
+          // it would then 200 the wrong document instead of failing loudly.
+          staticRetryHint(staticDir, `ephemeral:${env.name}`, args, err)
+        ]
+      );
+      process.exitCode = unknown ? EXIT_OUTCOME_UNKNOWN : EXIT_STATIC_FAILED;
+    }
+    return staticSummary;
+  };
+  const removedOut = {};
+  const summary = await deployEphemeral(auth, {
+    archive,
+    bundle,
+    content,
+    source,
+    args,
+    startedAt,
+    publishStatic,
+    commitLock: "commitLock" in loaded ? loaded.commitLock : void 0,
+    warnOrphansUncommitted: "warnOrphansUncommitted" in loaded ? loaded.warnOrphansUncommitted : void 0,
+    lock: "classifiedLock" in loaded ? loaded.classifiedLock : void 0,
+    shownSource: loaded.shownSource,
+    ..."commitLock" in loaded && loaded.commitLock !== void 0 && args.file !== void 0 ? { lockPath: (await import("./cli.js")).resolveLockPath(args, args.file) } : {},
+    removedOut,
+    ...!fetching && args.bundle === void 0 && args.file !== void 0 ? recordedEntry(args.file) : {},
+    compiled: !fetching && args.bundle === void 0
+  }).finally(() => noteLanded(void 0));
+  if (staticSummary !== void 0) summary.static = staticSummary;
+  if (summary.ephemeral !== void 0) {
+    const { landingLockPath, recordLanding, recordForeignLanding } = await import("./landing-record-SU52SKXU.js");
+    const dest = { kind: "ephemeral", name: summary.ephemeral.name };
+    const { storedColumnsAfter } = await import("./live-diff-YONW2VI3.js");
+    const sent = JSON.parse(bundle);
+    const stored = summary.data === "kept" ? removedOut.storedColumns : storedColumnsAfter(sent, void 0, /* @__PURE__ */ new Map(), "rebuild");
+    if (fetching || args.bundle !== void 0) {
+      summary.landingRecord = recordForeignLanding({
+        lockPath: landingLockPath(args),
+        instance: auth.instance,
+        dest,
+        bundle: sent,
+        mode: "replace",
+        ...stored !== void 0 ? { stored } : {},
+        // What the merge deleted leaves the lock as an entry merge's does.
+        ...removedOut.removedGuids !== void 0 ? { removedGuids: removedOut.removedGuids, removedBy: "merge" } : {}
+      });
+    } else {
+      const { landedIdentities } = await import("./landed-753YLJ5H.js");
+      summary.landingRecord = recordLanding({
+        lockPath: landingLockPath(args, { ...args.file !== void 0 ? { entryFile: args.file } : {}, fromProject: false }),
+        instance: auth.instance,
+        dest,
+        update: {
+          mode: "replace",
+          identities: withStoredColumns(landedIdentities(sent), stored),
+          ...removedOut.removed !== void 0 ? { removed: removedOut.removed } : {}
+        },
+        removedBy: "merge"
+      });
+    }
+  } else {
+    summary.landingRecord = null;
+  }
+  if (fetching) {
+    noteReleaseCarriesNoEnv(
+      args.file,
+      gatedApiGroups(JSON.parse(bundle)),
+      summary.ephemeral === void 0 ? void 0 : { ephemeral: summary.ephemeral.name, created: summary.created !== false },
+      contextFlags(args)
+    );
+    if (summary.data === "replaced" && carriesTables(bundle)) noteLiveCopyCarriesNoRows(args.file, loaded.sourceDisplay, contextFlags(args));
+    if (summary.data === "replaced") {
+      const unverifiable = await notePasswordHashesDoNotTravel(
+        async () => auth,
+        args.file,
+        passwordColumns,
+        summary.ephemeral?.name
+      );
+      if (unverifiable !== void 0) summary.passwordHashesUnverifiable = unverifiable;
+    }
+  } else if (args.bundle !== void 0 && summary.data === "replaced" && carriesTables(bundle)) {
+    noteBundleFileCarriesNoRows(args.bundle, args.reset === true);
+  }
+  noteUnconfigured(summary, toolchain.unconfigured);
+  const tracked = getEnvironment(readEphemeralState(process.cwd()), auth);
+  const staticServing = tracked?.static_url !== void 0 && tracked.static_down !== true;
+  await syncDevEnvAfterDeploy(args, summary, process.cwd(), { staticServing });
+  if (args.test) summary.testRun = await runDeployedTests(auth, summary, args);
+  if (args.open) openDeployed(summary);
+  if (isMachineOutput(args)) writeJson(summary);
+}
+async function syncDevEnvAfterDeploy(args, summary, cwd = process.cwd(), opts = {}) {
+  if (args.noDevEnv || summary.url === void 0) return;
+  if (opts.staticServing === true || summary.static !== void 0 && summary.static.error === void 0) {
+    const { staleDevEnv } = await import("./dev-env-sync-HN44K4D5.js");
+    let stale;
+    try {
+      stale = staleDevEnv(cwd, summary.url);
+    } catch {
+      stale = void 0;
+    }
+    if (stale !== void 0) {
+      detail(
+        `${stale.label} still points your dev server at ${stale.url}; set ${stale.variable}=${summary.url} there to use this deploy.`
+      );
+    }
+    return;
+  }
+  const { syncDevEnv } = await import("./dev-env-sync-HN44K4D5.js");
+  try {
+    const written = syncDevEnv(cwd, summary.url);
+    if (written === void 0) return;
+    detail(
+      `Pointed ${written.label} at this deploy (${written.variable}) \u2014 restart your dev server to pick it up. \`--no-dev-env\` skips this.`
+    );
+  } catch (err) {
+    warn(err instanceof Error ? err.message : String(err), "dev-env.sync-failed");
+  }
+}
+function noteUnconfigured(summary, unconfigured) {
+  if (unconfigured.length > 0) summary.unconfigured = [...unconfigured];
+  return summary;
+}
+function openDeployed(summary) {
+  const url = summary.static?.url ?? summary.url;
+  if (url === void 0) {
+    warn("--open had no URL to open \u2014 the deploy reported none.", "deploy.open-no-url");
+    return;
+  }
+  detail(`Opening ${url}`);
+  openBrowser(url);
+}
+var WAITING_LABEL = "Waiting for microservices\u2026";
+var IMPORTING_LABEL = "Uploading and importing the workspace\u2026";
+function noteStaticUrlChange(previous, current, arm, downBefore) {
+  if (previous === void 0) {
+    if (downBefore !== void 0 && downBefore !== current) {
+      detail(`This frontend URL is new \u2014 the previous one (${downBefore}) stopped serving at an earlier replace.`);
+    }
+    return;
+  }
+  if (previous === current) return;
+  detail(
+    arm.arm === "replace" ? `This frontend URL is new \u2014 a replacing deploy clears the environment's static hosting, so the previous one (${previous}) no longer serves, and the rows were re-seeded. \`--keep-data\` merges instead, which leaves both standing.` : `This frontend URL is new \u2014 the previous one (${previous}) no longer serves.`
+  );
+}
+function announceArm(arm, kind, landedBefore = false, seeded = true) {
+  if (arm.arm !== "replace" || arm.skipped === void 0) return;
+  const why = {
+    new: "Nothing to keep yet \u2014 this environment is new, so it is replaced and seeded. Later deploys with `--keep-data` keep its rows.",
+    // An ephemeral expires or is deleted; a local engine's rows go when its
+    // process restarts. Each told its own reason.
+    recreated: kind === "ephemeral" ? "Nothing to keep \u2014 the ephemeral recorded for this project is gone (it expired, or was deleted), so a new one is created, replaced and seeded." : "Nothing to keep \u2014 the environment recorded for this project is gone (the engine restarted), so this one is replaced and seeded.",
+    // Two different stories behind the same missing marker, each told as it
+    // is: the landing record is written only by a completed deploy, so when it
+    // names objects here, a deploy did land and only the marker is gone.
+    "never-filled": landedBefore ? "Nothing to keep that can be vouched for \u2014 an earlier deploy from this project landed here, but the marker that its rows are this project's is missing from `.xano/ephemeral.json`, so it is replaced and seeded. Later deploys with `--keep-data` keep its rows." : "Nothing to keep \u2014 no deploy from this project into this environment has completed yet, so it is replaced and seeded.",
+    reset: seeded ? "`--reset` wins over `--keep-data` \u2014 replacing the environment and re-seeding it." : "`--reset` wins over `--keep-data` \u2014 replacing the environment. This deploy carries no seed rows, so its tables come back EMPTY."
+  };
+  info(why[arm.skipped]);
+}
+var KEEP_DATA_REPLACES = {
+  new: "`--keep-data` has nothing to keep \u2014 this deploy creates the environment",
+  recreated: "`--keep-data` has nothing to keep \u2014 the environment this project recorded is gone, and this deploy creates another",
+  "never-filled": "`--keep-data` cannot keep this environment's data \u2014 nothing records that its rows are this project's",
+  reset: "`--reset` wins over `--keep-data`"
+};
+async function refuseEnvClearedByFallbackReplace(arm) {
+  if (arm.arm !== "replace") return;
+  const { envRefusalIfReplaced, docTokenRefusalIfReplaced } = await import("./cli.js");
+  const docs = docTokenRefusalIfReplaced(KEEP_DATA_REPLACES[arm.skipped ?? "never-filled"]);
+  if (docs !== void 0) throw new Error(docs);
+  if (arm.skipped !== "never-filled") return;
+  const refusal = envRefusalIfReplaced(KEEP_DATA_REPLACES["never-filled"]);
+  if (refusal !== void 0) throw new Error(refusal);
+}
+function republishNote(republished, unknown, frontends) {
+  if (republished.url === void 0) return failedRepublishNote(republished, unknown, frontends);
+  const checked = republished.verified === true ? ", verified live" : republished.verified === false ? ", not yet confirmed live" : "";
+  const published = `The frontend was republished at ${republished.url}${checked} \u2014 a replace clears it`;
+  return unknown ? `${published}. It runs against whichever backend the environment now holds: its previous one, or this deploy's if the import landed after all.` : `${published} \u2014 and runs against this environment's PREVIOUS backend until a deploy imports cleanly.`;
+}
+function failedRepublishNote(republished, unknown, frontends) {
+  const head = unknown ? "The import's outcome is unknown" : "The import was refused";
+  const failure = ((republished.error ?? "no URL was returned").trim().split("\n")[0] ?? "").trim().replace(/\.+$/, "");
+  const retry = republished.retry !== void 0 ? ` Run \`${republished.retry}\` to publish it again.` : "";
+  const warned = frontends?.warned ?? [];
+  const by = (s) => warned.filter((u) => (frontends?.states[u] ?? "unknown") === s);
+  const down = by("down");
+  const serving = by("serving");
+  const unasked = by("unknown");
+  const unaskedText = unasked.length === 0 ? "" : ` The frontend at ${unasked.join(", ")} could not be reached to check \u2014 the replace's clear may have taken it down.`;
+  if (down.length > 0) {
+    return `${head}, the replace had cleared the frontend, and republishing it failed: ${failure} \u2014 nothing serves at ${down.join(", ")}.${unaskedText}${retry}`;
+  }
+  if (serving.length > 0 && unasked.length === 0) {
+    return `${head}, and republishing the frontend failed: ${failure} \u2014 the frontend at ${serving.join(", ")} still serves its previous build. Deploy again once the import goes through; that publishes this build with it.`;
+  }
+  return `${head}, and republishing the frontend failed: ${failure}.${unaskedText}${retry}`;
+}
+function isUnknownImportOutcome(err) {
+  return err instanceof Error && statesOutcomeUnknown(err.message);
+}
+function rerunOf(args) {
+  const retry = retryCommand(args);
+  return { command: retry.command, note: withheldNote(retry.withheld) };
+}
+async function latestEngineRelease(err) {
+  const { ImportHttpError } = await import("./import-EQSFU6JC.js");
+  if (!(err instanceof ImportHttpError) || err.status !== 501) return void 0;
+  const { resolveEnginePlatform } = await import("./local-engine-config-5U3SC434.js");
+  const platform = resolveEnginePlatform();
+  if (platform === void 0) return void 0;
+  const { latestKnownVersion } = await import("./local-engine-update-check-6L645VBL.js");
+  return latestKnownVersion({ platform });
+}
+async function mergeGuards(args, lock, outgoing) {
+  const interactive = process.stdin.isTTY === true && !isMachineOutput(args);
+  const pinned = outgoing === void 0 ? [] : (await import("./release-command-N4ZPKMHR.js")).pinnedCanonicalGuids(outgoing.bundle, lock, outgoing.compiled);
+  const guards = {
+    ...pinned.length > 0 ? { pinned } : {},
+    allowForeignDeletes: args.yes === true,
+    ...interactive ? {
+      confirm: async (q) => (await import("./prompt-II3F3LND.js")).confirm(q, {
+        flag: "--yes",
+        refusal: { details: { deployed: false }, ...yesRerun(args, "deploy") }
+      })
+    } : {}
+  };
+  const entry = args.file;
+  if (lock === void 0 || entry === void 0) return guards;
+  const tables = /* @__PURE__ */ new Map();
+  const replaced = /* @__PURE__ */ new Map();
+  for (const [key, e] of Object.entries(lock.objects)) {
+    if (!key.startsWith("dbo:")) continue;
+    if (typeof e.guid === "string") tables.set(e.guid, key.slice("dbo:".length));
+    for (const guid of e.replaced ?? []) replaced.set(guid, key.slice("dbo:".length));
+  }
+  const { orphanFixUps, resolveLockPath, composedChildren } = await import("./cli.js");
+  const { clearReplacedCommand } = await import("./keep-data-merge-7MPLVAVI.js");
+  const lockPath = resolveLockPath(args, entry);
+  const run = (line) => (line ?? "").replace(/^(renamed|deleted)\? run: /, "");
+  const keys = Object.keys(lock.objects);
+  const codePinned = outgoing === void 0 ? void 0 : codePinnedAgainstDisk(outgoing.bundle, lockPath, lock);
+  return {
+    ...guards,
+    lockPins: {
+      tables,
+      ...codePinned !== void 0 ? { codePinned } : {},
+      clearReplaced: (name) => clearReplacedCommand(name, lockPath),
+      ...replaced.size > 0 ? { replaced } : {},
+      fixUps: (name, newName) => {
+        const [rename, prune] = orphanFixUps(`dbo:${name}`, entry, lockPath, void 0, [], newName);
+        return { rename: run(rename), prune: run(prune) };
+      },
+      keyFixUps: (key, newName) => {
+        if (!(key in lock.objects)) return void 0;
+        const [rename, prune] = orphanFixUps(key, entry, lockPath, void 0, composedChildren(key, keys), newName);
+        return { rename: run(rename).replace(/ \(it moves .*\)$/, ""), prune: run(prune) };
+      },
+      entries: new Map(
+        Object.entries(lock.objects).flatMap(([key, e]) => typeof e.guid === "string" ? [[key, e.guid]] : [])
+      )
+    }
+  };
+}
+function codePinnedAgainstDisk(bundle, lockPath, classified) {
+  try {
+    return codePinnedTables(JSON.parse(bundle), readLockFile(lockPath), classified);
+  } catch {
+    return void 0;
+  }
+}
+function offTerminalYes() {
+  return process.stdin.isTTY === true ? "" : " --yes";
+}
+function createdButFailedNote(name, unknown, args, landedUnresolved = false, opts = {}) {
+  if (opts.untracked === true) {
+    return `Created ephemeral ${name}, but could not record it in .xano/ephemeral.json, so nothing here tracks it. Delete it with \`xanosdk ephemeral delete ${shellQuote(name)}${contextFlags(args)} --yes\`, then make .xano/ writable and redeploy.`;
+  }
+  const remove = `\`xanosdk ephemeral delete ${shellQuote(name)}${contextFlags(args)}${offTerminalYes()}\``;
+  if (opts.futile === true) {
+    return `Created ephemeral ${name} (tracked in .xano/ephemeral.json); it holds nothing yet, and redeploying from this source fails the same way \u2014 delete it with ${remove}.`;
+  }
+  const retry = retryCommand(args);
+  const holds = landedUnresolved ? "it holds this deploy, but its hostedFile() fields point at nothing" : unknown ? "whether it holds this deploy is unknown" : "it holds nothing yet";
+  return `Created ephemeral ${name} (tracked in .xano/ephemeral.json); ${holds} \u2014 redeploy with \`${retry.command}\`, or ${remove}.${withheldNote(retry.withheld)}`;
+}
+function noteReplaceRerun(err, args) {
+  if (!(err instanceof Error) || !isUnknownImportOutcome(err) && !(err instanceof ImportNotSentError)) return err;
+  const retry = retryCommand(args);
+  const when = certificateFailureCode(err) !== void 0 ? "Once the certificate is trusted" : "Once it is reachable";
+  err.message = `${err.message}
+${when}, run \`${retry.command}\`.${withheldNote(retry.withheld)}`;
+  return err;
+}
+function noteKeptFilledMarker(err, filled, args) {
+  if (!filled || !(err instanceof Error) || !isUnknownImportOutcome(err)) return err;
+  const retry = retryCommand(args, { add: ["--keep-data"], drop: ["--reset"] });
+  const again = retryCommand(args);
+  const replace = again.command === retry.command ? "" : `Once it is reachable, \`${again.command}\` replaces it again. `;
+  err.message = `${err.message}
+${replace}Whichever way it went, the environment's rows are still recorded as this project's, so \`${retry.command}\` merges into them rather than replacing them.${withheldNote(retry.withheld)}`;
+  return err;
+}
+var DUPLICATE_GUID = /Duplicate (\S+) guid: (\S+?)\./;
+function fetchedSourceOf(file) {
+  if (file === void 0) return void 0;
+  const colon = file.indexOf(":");
+  const kind = colon < 0 ? file : file.slice(0, colon);
+  const name = colon < 0 ? void 0 : file.slice(colon + 1).trim();
+  if (kind === "release" || kind === "tenant") return name ? { kind, name } : void 0;
+  if (kind === "ephemeral" || kind === "local-engine") return name ? { kind, name } : { kind };
+  if (kind === "workspace" && colon < 0) return { kind };
+  return void 0;
+}
+function isFetchedDuplicateGuid(err, file) {
+  return err instanceof Error && fetchedSourceOf(file) !== void 0 && DUPLICATE_GUID.test(err.message);
+}
+function explainDuplicateArchiveGuid(err, file, flags = "") {
+  if (!(err instanceof Error)) return err;
+  const dup = DUPLICATE_GUID.exec(err.message);
+  if (dup === null) return err;
+  const [, section, guid] = dup;
+  const keeps = `A deploy keeps an archive's identities, and the instance refuses one that two objects share`;
+  const source = fetchedSourceOf(file);
+  let why;
+  if (source === void 0) {
+    why = `The archive carries two ${section} objects under guid ${guid}. ${keeps} \u2014 give one of them its own guid and deploy again.`;
+  } else if (source.kind === "release") {
+    why = `Release "${source.name}" was stored with two ${section} objects under guid ${guid}. ${keeps}; \`xanosdk tenant deploy\` gives every object a new identity, which is why it can land the same release. Re-cut the release from a backend that holds one ${section} per guid to deploy it here.`;
+  } else {
+    const label = source.kind === "workspace" ? "The workspace" : source.name === void 0 ? `The ${source.kind}` : `${source.kind === "tenant" ? "Tenant" : source.kind === "ephemeral" ? "Ephemeral" : "Local engine"} ${source.name}`;
+    const reland = source.kind === "tenant" ? `, land it there again with \`xanosdk deploy --to ${shellQuote(`tenant:${source.name}`)}${flags}\`` : source.kind === "workspace" ? `, land it there again with \`xanosdk deploy --to workspace${flags}\`` : source.kind === "ephemeral" ? `, deploy it there again from the project that tracks it` : `, land it there again`;
+    why = `${label} holds two ${section} objects under guid ${guid}. ${keeps}, so redeploying from it fails the same way until the duplicate is fixed where it is authored: give one of them its own guid${reland}, then run this deploy again.`;
+  }
+  err.message = `${err.message}
+${why}`;
+  return err;
+}
+function dataFields(arm) {
+  if (arm.arm === "merge") return { data: "kept" };
+  return { data: "replaced", ...arm.skipped === void 0 ? {} : { keepDataSkipped: arm.skipped } };
+}
+function waitingLabel(microservices) {
+  const { ready, startable } = readyRatio(microservices);
+  return startable === 0 ? WAITING_LABEL : `${WAITING_LABEL} (${ready}/${startable} ready)`;
+}
+async function verifyMicroservices(auth, baseUrl, opts, waitOpts = {}) {
+  if (opts.skip) return void 0;
+  let spin;
+  let result;
+  try {
+    result = await waitForMicroservices(auth, { baseUrl, workspaceId: 1 }, {
+      ...waitOpts,
+      onPoll: (rows) => {
+        if (spin === void 0 && rows.some(isAwaited)) spin = spinner(WAITING_LABEL);
+        spin?.update(waitingLabel(rows));
+        waitOpts.onPoll?.(rows);
+      }
+    });
+  } catch (err) {
+    const message = withoutReadAftermath(err instanceof Error ? err.message : String(err));
+    const remedy = `xanosdk ephemeral get ${opts.name !== void 0 ? shellQuote(opts.name) : "<env>"}${opts.flags ?? ""}`;
+    warn("Could not read microservice status (the backend deployed fine):", "microservice.status-unreadable", [
+      message,
+      `Check them with \`${remedy}\`.`
+    ]);
+    opts.onReadError?.({ message, remedy });
+    return void 0;
+  } finally {
+    spin?.stop();
+  }
+  const { microservices, timedOut, hadFailure } = result;
+  if (microservices.length === 0) return void 0;
+  const { ready, startable } = readyRatio(microservices);
+  const lines = microservices.map(microserviceLine);
+  let listed = false;
+  if (hadFailure) {
+    warn("Some microservices failed to start:", "microservice.failed", lines);
+    listed = true;
+    failDeploy();
+  } else if (timedOut) {
+    warn(`Microservices are still starting (${ready}/${startable} ready) \u2014 they should come up shortly:`, "microservice.starting", lines);
+    listed = true;
+    if (opts.requireReady) failDeploy();
+  } else if (startable === 0) {
+    info("No microservices to start:");
+  } else {
+    success(`Microservices ready (${ready}/${startable})`);
+  }
+  if (!listed) for (const line of lines) detail(line);
+  if (timedOut && !hadFailure) {
+    detail(
+      `Re-check with \`xanosdk ephemeral get ${opts.name ?? "<env>"}${opts.flags ?? ""}\`, or skip this wait next time with --skip-liveness.`
+    );
+    if (!opts.requireReady) {
+      detail("Fail the deploy on this instead of warning: --require-microservices.");
+    }
+  }
+  return microservices;
+}
+function failDeploy() {
+  if (!process.exitCode) process.exitCode = EXIT_MICROSERVICE_NOT_READY;
+}
+function ephemeralDisabledError(source) {
+  return new Error(
+    `Ephemeral environments are not enabled on this instance, so there is nothing for \`xanosdk deploy ${source}\` to create \u2014 they are the only environment it writes to.
+Ask whoever administers the instance to enable them.
+Until then \`xanosdk export\` still writes the bundle, and \`xanosdk preflight\` still checks the round-trip, without needing one.`
+  );
+}
+function notReadyError(err, name, flags, created, retry) {
+  const head = closeSentence((err instanceof Error ? err.message : String(err)).split("\n")[0]);
+  const unanswered = isUnansweredPoll(err);
+  const failure = new Error(
+    `${head}
+${created ? `Ephemeral "${name}" was created and is` : `Ephemeral "${name}" is`} recorded in .xano/ephemeral.json, but ${unanswered ? "whether it is ready could not be read" : "it is not ready yet"}, so nothing was imported. \`${retry?.command ?? `xanosdk deploy${flags}`}\` retries onto it; \`xanosdk ephemeral delete ${name}${flags}${offTerminalYes()}\` removes it.${withheldNote(retry?.withheld ?? [])}${unanswered ? " The poll got no answer (a server error or a network failure), so this run exits 8." : ""}`,
+    { cause: err }
+  );
+  return unanswered ? Object.assign(failure, { exitCode: 8 }) : failure;
+}
+function ephemeralStateCheck(display, name, flags) {
+  return `Check whether it landed in what ${display} now defines \u2014 \`xanosdk ephemeral export ${shellQuote(name)} --format multidoc --path -${flags}\` prints its backend \u2014 before retrying.`;
+}
+function toStateCheck(args, display) {
+  const retry = retryCommand(args, { add: ["--dry-run"] });
+  return `Preview it again with \`${retry.command}\` to see ${display}'s current state before retrying.${withheldNote(retry.withheld)}`;
+}
+async function warnSameDisplayName(auth, parentWorkspaceId, created, recorded, flags) {
+  const display = created.display;
+  if (display === void 0 || display === created.name) return;
+  let same;
+  try {
+    same = (await listEphemeral(auth, { parentWorkspaceId })).filter(
+      (e) => e.display === display && e.name !== created.name && e.name !== recorded && !isExpired(e.expiresAt)
+    );
+  } catch {
+    return;
+  }
+  if (same.length === 0) return;
+  const handles = same.map((e) => e.name);
+  const one = handles.length === 1;
+  warn(
+    `${one ? "Another ephemeral is" : `${handles.length} other ephemerals are`} also named "${display}" (${handles.join(", ")}) \u2014 this deploy created ${created.name} beside ${one ? "it" : "them"}.`,
+    "ephemeral.duplicate-name",
+    [
+      `If ${one ? "it is" : "they are"} left over (a create whose answer was lost), delete ${one ? "it" : "them"} with ${handles.map((h) => `\`xanosdk ephemeral delete ${shellQuote(h)}${flags}${offTerminalYes()}\``).join(", ")}.`
+    ]
+  );
+}
+function unknownCreateOutcome(err, display, flags, retry) {
+  if (!(err instanceof Error) || !/may or may not have taken effect/.test(err.message)) return err;
+  const head = closeSentence(err.message.split("\n")[0]);
+  const again = retry?.command ?? `xanosdk deploy${flags}`;
+  const message = `${head}
+The request was sent, so ephemeral "${display}" may or may not have been created \u2014 check with \`xanosdk ephemeral list${flags}\` before retrying. If it is listed, it exists and this project does not track it: delete it with \`xanosdk ephemeral delete <handle>${flags}${offTerminalYes()}\` and run \`${again}\`, or keep it and merge into it with \`xanosdk deploy --to tenant:<handle>${flags}\` (a retry as it is creates a second one beside it). If it is not listed, run \`${again}\` again.${withheldNote(retry?.withheld ?? [])}`;
+  return err instanceof TransportError ? new TransportError(message, err.timeout, { cause: err.cause }) : new Error(message, { cause: err });
+}
+function shownInput(source) {
+  return source === "-" ? source : displayPath(source);
+}
+async function gateEntrySwap(args, label, previous, entry, arm) {
+  if (previous === void 0 || entry === void 0 || previous === entry) return;
+  const what = arm === "replace" ? `this deploy of ${entry} replaces that backend with this one` : `this merge of ${entry} removes what that backend declared and this one does not`;
+  warn(`${label} was last deployed from ${previous}; ${what}.`, "ephemeral.entry-changed");
+  if (args.yes === true) return;
+  const question = `Deploy ${entry} over the backend from ${previous} on ${label}?`;
+  const { rerun, note } = yesRerun(args, "deploy");
+  const details = { deployed: false, previousEntry: previous, entry };
+  if (process.stdin.isTTY !== true || isMachineOutput(args)) {
+    throw new CliError(
+      "SDK_USAGE",
+      `${label} was not deployed: it would have asked: ${question}
+Re-run as \`${rerun}\` to answer yes without being asked.${note}`,
+      { exitCode: 1, details: { reason: "needs-confirmation", ...details } }
+    );
+  }
+  const { confirm } = await import("./prompt-II3F3LND.js");
+  if (await confirm(question, { flag: "--yes", refusal: { details, rerun, note } })) return;
+  const { KeepDataDeclined } = await import("./keep-data-merge-7MPLVAVI.js");
+  throw new KeepDataDeclined(label, "deployed");
+}
+function recordedEntry(file) {
+  const real = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return p;
+    }
+  };
+  const rel = relative(real(process.cwd()), real(resolve(file))).split(sep).join("/");
+  if (rel === "") return {};
+  return { entry: rel.startsWith("../") || isAbsolute(rel) ? rel : `./${rel}` };
+}
+function keepDataRemovedEntries(merged, lock) {
+  if (merged === void 0 || lock === void 0 || merged.removedGuids.length === 0) return {};
+  const gone = new Set(merged.removedGuids);
+  const out = {};
+  for (const [key, entry] of Object.entries(lock.objects)) {
+    if (entry.guid !== void 0 && gone.has(entry.guid)) out[key] = { guid: entry.guid };
+  }
+  return out;
+}
+async function refuseOtherProfileEphemeral(state, auth) {
+  const current = auth.profile?.name ?? DEFAULT_PROFILE;
+  const underOther = Object.keys(state.environments).some((k) => k.includes("/") && k.slice(0, k.indexOf("/")) !== current);
+  if (!underOther) return;
+  const refusal = otherCredentialRefusal(
+    state,
+    auth,
+    `or pass \`--name <display>\` to create a separate ephemeral under this one. Nothing was created`,
+    { hintFor: { command: "deploy" } }
+  );
+  if (refusal === void 0) return;
+  const { reachableFirst } = await import("./env-target-O4HRKTGZ.js");
+  throw await reachableFirst(refusal, auth);
+}
+async function refuseKeepDataElsewhere(state, auth) {
+  const mine = environmentKey(auth);
+  const sameHost = mine.slice(0, mine.lastIndexOf("/") + 1);
+  if (!Object.keys(state.environments).some((k) => k !== mine && k.startsWith(sameHost))) return;
+  const refusal = otherCredentialRefusal(
+    state,
+    auth,
+    `or run without \`--keep-data\` to create a separate, freshly seeded ephemeral in workspace ${auth.workspaceId}. Nothing was created`,
+    { hintFor: { command: "deploy" } }
+  );
+  if (refusal === void 0) return;
+  const { reachableFirst } = await import("./env-target-O4HRKTGZ.js");
+  throw await reachableFirst(refusal, auth);
+}
+async function reconcileRename(err, auth, name, display) {
+  if (!(err instanceof Error) || !statesOutcomeUnknown(err.message)) return { renamed: false, unknown: false };
+  try {
+    const now = await getEphemeral(auth, { parentWorkspaceId: auth.workspaceId, name });
+    if (now === null) return { renamed: false, unknown: true };
+    return { renamed: now.display === display, unknown: false };
+  } catch {
+    return { renamed: false, unknown: true };
+  }
+}
+var CREATE_GUARD_STALE_MS = 15 * 6e4;
+async function takeCreateGuard(dir, args) {
+  const { tryLock } = await import("./file-lock-PT74GWYW.js");
+  const lockPath = join(dir, ".xano", "deploy.lock");
+  const lock = tryLock(lockPath, { staleMs: CREATE_GUARD_STALE_MS });
+  if ("release" in lock) return lock;
+  const shown = displayPath(lockPath);
+  const retry = retryCommand(args, { creates: true });
+  const holder = lock.heldBy;
+  const { hostname } = await import("os");
+  const where = holder?.host !== void 0 && holder.host !== hostname() ? ` on ${holder.host}` : "";
+  const pid = holder === void 0 ? "" : ` (pid ${holder.pid}${where})`;
+  throw new CliError(
+    "SDK_ERROR",
+    `Another deploy in this project${pid} is deciding which ephemeral to deploy to, so this one did not start.
+Nothing was created. Once it has finished, run \`${retry.command}\` again.${withheldNote(retry.withheld)}
+If no deploy is running in this project, its guard was left behind: remove \`${shown}\` and run it again.`,
+    { exitCode: 8, details: { reason: "deploy-in-progress", rerun: retry.command, lockFile: shown } }
+  );
+}
+async function deployEphemeral(auth, ctx) {
+  const dir = process.cwd();
+  const { assertReadWritable } = await import("./writable-VA7OISSK.js");
+  assertReadWritable(ephemeralStatePath(dir));
+  const guard = await takeCreateGuard(dir, ctx.args);
+  try {
+    return await deployEphemeralGuarded(auth, ctx, guard);
+  } finally {
+    guard.release();
+  }
+}
+async function deployEphemeralGuarded(auth, ctx, createGuard) {
+  const { archive, bundle, content, source, args, startedAt, publishStatic } = ctx;
+  let lockCommitted = false;
+  const commitLock = (pruned) => {
+    if (lockCommitted) return;
+    lockCommitted = true;
+    ctx.commitLock?.(pruned === void 0 ? void 0 : { pruned });
+  };
+  const parentWorkspaceId = auth.workspaceId;
+  const dir = process.cwd();
+  const { assertReadWritable, assertWritable } = await import("./writable-VA7OISSK.js");
+  assertReadWritable(ephemeralStatePath(dir));
+  if (ctx.lockPath !== void 0) assertWritable(ctx.lockPath, "build without a lock with `--no-lock`");
+  const state = readEphemeralState(dir);
+  const stored = getEnvironment(state, auth);
+  if (stored === void 0 && args.name === void 0) {
+    await refuseOtherProfileEphemeral(state, auth);
+    if (args.keepData && !args.reset) await refuseKeepDataElsewhere(state, auth);
+  }
+  let target = null;
+  if (stored) {
+    const existing = await lookupEphemeral(auth, stored.name);
+    if (existing && !isExpired(existing.expiresAt)) target = existing;
+  }
+  const created = target === null;
+  if (!created) createGuard.release();
+  const flags = contextFlags(args);
+  if (target !== null && target.state !== "ok") {
+    const pending = target;
+    target = await withSpinner(
+      `Waiting for ${pending.name} to become ready\u2026`,
+      () => waitUntilReady(auth, { parentWorkspaceId, name: pending.name })
+    ).catch((err) => {
+      throw notReadyError(err, pending.name, flags, false, retryCommand(args));
+    });
+  }
+  const notApplied = [];
+  if (target === null) {
+    refuseStaticHostAReplaceClears(args, true);
+    const { docTokenRefusalIfReplaced } = await import("./cli.js");
+    const docs = docTokenRefusalIfReplaced(KEEP_DATA_REPLACES[stored !== void 0 ? "recreated" : "new"]);
+    if (docs !== void 0) throw new Error(docs);
+    const recorded = stored?.display !== void 0 && stored.display !== stored.name ? stored.display : void 0;
+    const display = args.name ?? recorded ?? deriveDisplay(bundle, dir, source);
+    step(`Deploying ${ctx.shownSource ?? source} \u2192 new ephemeral "${display}"`);
+    discloseWriteTarget(ephemeralParent(auth));
+    announceArm(
+      selectDeployArm({ keepData: args.keepData, reset: args.reset, created: true, hadRecord: stored !== void 0, priorFilled: void 0, url: "" }),
+      "ephemeral",
+      false,
+      content.length > 0
+    );
+    const machine = isMachineOutput(args);
+    const listCommand = `xanosdk ephemeral list${flags}${machine ? " --json" : ""}`;
+    const creating = activeOperation() === void 0 ? registerOperation({
+      machine,
+      resolveWith: listCommand,
+      what: `the create of ephemeral "${display}"`,
+      snapshot: () => ({ ok: false, outcome: "unknown", ephemeral: { display }, resolveWith: listCommand })
+    }) : void 0;
+    creating?.markWriteSent();
+    const fresh = await createEphemeral(auth, {
+      parentWorkspaceId,
+      display,
+      expiresHours: args.expiresHours
+    }).finally(() => creating?.clear()).catch(async (err) => {
+      if (isEphemeralDisabled(err)) throw ephemeralDisabledError(source);
+      if (err.status === 404) {
+        const { refuseUnreachableWorkspace } = await import("./workspace-binding-56PIIPCP.js");
+        await refuseUnreachableWorkspace(auth);
+      }
+      throw unknownCreateOutcome(err, display, flags, retryCommand(args, { creates: true }));
+    });
+    try {
+      setEnvironment(dir, auth, {
+        name: fresh.name,
+        display: fresh.display ?? display,
+        url: fresh.url ?? "",
+        expires_at: fresh.expiresAt,
+        ...auth.profile !== void 0 && credentialFileOf(args) !== void 0 ? { credential_file: credentialFileOf(args) } : {}
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new Error(`${reason}
+${createdButFailedNote(fresh.name, false, args, false, { untracked: true })}`);
+    }
+    noteLanded({
+      said: `Created ephemeral ${fresh.name} (tracked in .xano/ephemeral.json).`,
+      ifCancelled: createdButFailedNote(fresh.name, false, args),
+      fields: { ephemeral: { name: fresh.name, display: fresh.display ?? display }, created: true }
+    });
+    createGuard.release();
+    target = await withSpinner(
+      `Waiting for ${fresh.name} to become ready\u2026`,
+      () => waitUntilReady(auth, { parentWorkspaceId, name: fresh.name })
+    ).catch((err) => {
+      throw notReadyError(err, fresh.name, flags, true, retryCommand(args));
+    });
+  }
+  const baseUrl = target.url;
+  if (baseUrl === void 0) {
+    const retry = retryCommand(args);
+    throw new Error(`Ephemeral "${target.name}" has no base URL yet \u2014 try \`${retry.command}\` again.${withheldNote(retry.withheld)}`);
+  }
+  const renaming = { name: target.name, display: target.display };
+  const renameIfAsked = async () => {
+    const display = args.name;
+    if (display === void 0 || display === renaming.display) return void 0;
+    await describeWrite(
+      { what: `the rename of ephemeral "${renaming.name}"`, resolveWith: `xanosdk ephemeral get ${shellQuote(renaming.name)}${flags}` },
+      () => renameEphemeral(auth, { parentWorkspaceId, name: renaming.name, display })
+    );
+    const rec = getEnvironment(readEphemeralState(dir), auth);
+    if (rec !== void 0 && rec.name === renaming.name) setEnvironment(dir, auth, { ...rec, display });
+    detail(`Renamed to "${display}".`);
+    return display;
+  };
+  let renamedTo;
+  const arm = selectDeployArm({
+    keepData: args.keepData,
+    reset: args.reset,
+    created,
+    hadRecord: stored !== void 0,
+    priorFilled: stored?.filled,
+    url: baseUrl
+  });
+  await refuseEnvClearedByFallbackReplace(arm);
+  if (!created) {
+    step(
+      `Deploying ${ctx.shownSource ?? source} \u2192 ${namedEphemeral(target)} (refresh, ${arm.arm === "merge" ? "keeping data" : "full replace"})`
+    );
+    discloseWriteTarget(ephemeralParent(auth));
+    await gateEntrySwap(args, namedEphemeral(target), stored?.entry, ctx.entry, arm.arm);
+    if (arm.arm === "replace") refuseStaticHostAReplaceClears(args, true);
+    else await assertStaticHostExists(args, auth, { baseUrl, workspaceId: 1 });
+    if (arm.arm === "replace") {
+      const { gateForeignReplace } = await import("./keep-data-merge-7MPLVAVI.js");
+      const { allowForeignDeletes, confirm } = await mergeGuards(args, void 0);
+      await gateForeignReplace({
+        auth,
+        baseUrl,
+        workspaceId: 1,
+        label: namedEphemeral(target),
+        bundle,
+        kind: "ephemeral",
+        rerun: rerunOf(args),
+        ...allowForeignDeletes === void 0 ? {} : { allowForeignDeletes },
+        ...confirm === void 0 ? {} : { confirm },
+        landedGuids: new Set(
+          Object.values(ephemeralLandedOn(dir, ephemeralLandingKey(auth.instance, target.name)) ?? {}).map((e) => e.guid)
+        )
+      });
+    }
+    if (args.expiresHours !== void 0) {
+      notApplied.push("--expires-hours");
+      warn(
+        `--expires-hours ${args.expiresHours} was not applied: ${target.name} already exists, and an ephemeral's lifetime is set only when it is created` + (target.expiresAt !== void 0 ? ` (this one expires ${String(target.expiresAt)})` : "") + `. To start a new one with that lifetime, run \`xanosdk ephemeral delete ${target.name}${contextFlags(args)}${offTerminalYes()}\` and deploy again.`,
+        "ephemeral.expires-not-applied"
+      );
+    }
+  }
+  if (!created) announceArm(
+    arm,
+    "ephemeral",
+    arm.arm === "replace" && arm.skipped === "never-filled" && Object.keys(ephemeralLandedOn(dir, ephemeralLandingKey(auth.instance, target.name)) ?? {}).length > 0,
+    content.length > 0
+  );
+  const doubted = stored?.static_down === true || stored?.static_unchecked === true ? stored.static_url : void 0;
+  const rechecked = !created && arm.arm === "replace" ? await recheckDoubtedFrontend(
+    await readStaticTeardown(auth, { baseUrl, workspaceId: 1 }, stored?.static_down === true ? void 0 : stored?.static_url),
+    doubted
+  ) : void 0;
+  const teardownRead = rechecked?.read;
+  const staticTeardown = teardownRead?.teardown;
+  const previousStaticUrl = created ? void 0 : teardownRead?.live?.[0] ?? stored?.static_url;
+  const servingBefore = created ? void 0 : teardownRead?.live !== void 0 ? teardownRead.live[0] : stored?.static_down === true ? void 0 : stored?.static_url;
+  const staticDown = servingBefore === void 0;
+  setEnvironment(dir, auth, {
+    name: target.name,
+    display: target.display ?? args.name ?? target.name,
+    url: baseUrl,
+    expires_at: target.expiresAt,
+    ...!created && stored?.filled !== void 0 && stored.filled.url === baseUrl ? { filled: stored.filled } : {},
+    ...previousStaticUrl !== void 0 ? { static_url: previousStaticUrl } : {},
+    ...previousStaticUrl !== void 0 && staticDown ? { static_down: true } : {},
+    ...previousStaticUrl !== void 0 && rechecked?.unchecked === true ? { static_unchecked: true } : {},
+    // Which credential file reaches it, for the other-profile remedy.
+    ...auth.profile !== void 0 && credentialFileOf(args) !== void 0 ? { credential_file: credentialFileOf(args) } : {},
+    // Which entry's backend stands here, for a remedy that redeploys it
+    // (`env set`'s) and the entry-swap gate. Kept as it was until this import
+    // lands — a refused one changed nothing — and rewritten once it has.
+    ...created ? ctx.entry !== void 0 ? { entry: ctx.entry } : {} : stored?.entry !== void 0 ? { entry: stored.entry } : {}
+  });
+  if (teardownRead !== void 0 && publishStatic === void 0) {
+    warnStaticTeardown(teardownRead, namedEphemeral(target), {
+      publishing: false,
+      // The way to merge from THIS command line: `--keep-data` when it was not
+      // passed, dropping `--reset` when that is what overrode it. When neither
+      // can merge (nothing proves the environment holds an earlier deploy),
+      // the only way back is a publish afterwards.
+      keepHint: !args.keepData ? "pass `--keep-data` to merge, which leaves it serving" : arm.arm === "replace" && arm.skipped === "reset" ? "drop `--reset` to merge, which leaves it serving" : `publish it again afterwards with \`xanosdk publish <dir> --to ephemeral:${shellQuote(target.name)}${contextFlags(args)}\``
+    });
+  }
+  recordDeployed(dir, "ephemeral");
+  let importFailure;
+  let merged;
+  try {
+    if (arm.arm === "merge") {
+      const { mergeKeepingData } = await import("./keep-data-merge-7MPLVAVI.js");
+      merged = await mergeKeepingData({
+        auth,
+        baseUrl,
+        workspaceId: 1,
+        label: namedEphemeral(target),
+        bundle,
+        content,
+        files: archiveHostedFiles(archive),
+        // An ephemeral has no `--dry-run` to preview again: what it holds is read.
+        stateCheck: ephemeralStateCheck(namedEphemeral(target), target.name, flags),
+        envSetTo: ` --to ${shellQuote(`ephemeral:${target.name}`)}${flags}`,
+        kind: "ephemeral",
+        rerun: rerunOf(args),
+        // A rename here changes what the merge's own failure lines call it.
+        beforeWrite: async () => {
+          renamedTo = await renameIfAsked();
+          if (renamedTo === void 0) return void 0;
+          const label = namedEphemeral({ name: renaming.name, display: renamedTo });
+          return { label, stateCheck: ephemeralStateCheck(label, renaming.name, flags) };
+        },
+        ...await mergeGuards(args, ctx.lock, { bundle, compiled: ctx.compiled === true }),
+        // Provenance for the removal lines: what this project landed here.
+        landedGuids: new Set(
+          Object.values(ephemeralLandedOn(process.cwd(), ephemeralLandingKey(auth.instance, target.name)) ?? {}).map(
+            (e) => e.guid
+          )
+        ),
+        storedColumns: storedColumnsOf(ephemeralLandedOn(process.cwd(), ephemeralLandingKey(auth.instance, target.name)))
+      });
+    } else {
+      const label = namedEphemeral(target);
+      const stateCheck = ephemeralStateCheck(label, target.name, flags);
+      await withSpinner(
+        IMPORTING_LABEL,
+        () => (
+          // An env's own internal workspace id is always 1.
+          xanosdkImport(auth, {
+            baseUrl,
+            workspaceId: 1,
+            label,
+            archive,
+            mode: "replace",
+            dryRun: false,
+            preserveGuids: true,
+            stateCheck
+          })
+        )
+      );
+    }
+  } catch (err) {
+    if (!lockCommitted) ctx.warnOrphansUncommitted?.();
+    if (err instanceof Error && err.name === "KeepDataDeclined") throw err;
+    if (err instanceof XanoSdkImportRefusal && err.retryable) {
+      const { importInProgressError } = await import("./keep-data-merge-7MPLVAVI.js");
+      const retry = retryCommand(args);
+      throw importInProgressError(namedEphemeral(target), { command: retry.command, note: withheldNote(retry.withheld) }, err);
+    }
+    const { withSignatureHint } = await import("./release-command-N4ZPKMHR.js");
+    importFailure = withSignatureHint(err, args.bundle);
+  }
+  if (arm.arm === "merge" && renamedTo !== void 0) target = { ...target, display: renamedTo };
+  if (importFailure !== void 0) {
+    const unknown = isUnknownImportOutcome(importFailure);
+    const nothingSent = importFailure instanceof ImportNotSentError;
+    const filledHere = stored?.filled !== void 0 && !created && stored.filled.url === baseUrl;
+    importFailure = noteKeptFilledMarker(importFailure, filledHere, args);
+    if (!created && !filledHere) importFailure = noteReplaceRerun(importFailure, args);
+    const warnedDown = staticTeardown !== void 0 && staticTeardown.urls.length > 0 ? staticTeardown.urls : servingBefore !== void 0 ? [servingBefore] : [];
+    if (arm.arm === "replace" && !nothingSent && publishStatic === void 0 && warnedDown.length > 0) {
+      const states = await withSpinner(
+        "Checking the frontend\u2026",
+        () => readFrontendsAfterFailure(auth, { baseUrl, workspaceId: 1 }, warnedDown)
+      );
+      const note = staticAfterFailedReplace(warnedDown, states, {
+        unknown,
+        publish: `xanosdk publish <dir> --to ephemeral:${shellQuote(target.name)}${contextFlags(args)}`
+      });
+      const rec = getEnvironment(readEphemeralState(dir), auth);
+      if (rec?.static_url !== void 0 && note.down.includes(rec.static_url)) {
+        setEnvironment(dir, auth, { ...rec, static_down: true });
+      } else if (rec?.static_url !== void 0 && states[rec.static_url] === "unknown") {
+        setEnvironment(dir, auth, { ...rec, static_unchecked: true });
+      }
+      if (importFailure instanceof Error) importFailure.message = `${importFailure.message}
+${note.text}`;
+      else warn(note.text, "static.teardown");
+    }
+    if (publishStatic !== void 0 && arm.arm === "replace" && !nothingSent) {
+      warn("The import failed \u2014 republishing the frontend so the static host keeps serving.", "static.republish");
+      const republished = await publishStatic({
+        baseUrl,
+        label: namedEphemeral(target),
+        name: target.name,
+        republish: true
+      });
+      if (republished.url !== void 0) recordStaticUrl(dir, auth, republished.url);
+      let frontends;
+      if (republished.url === void 0 && warnedDown.length > 0) {
+        const states = await withSpinner(
+          "Checking the frontend\u2026",
+          () => readFrontendsAfterFailure(auth, { baseUrl, workspaceId: 1 }, warnedDown)
+        );
+        frontends = { warned: warnedDown, states };
+        const rec = getEnvironment(readEphemeralState(dir), auth);
+        if (rec?.static_url !== void 0 && states[rec.static_url] === "down") {
+          setEnvironment(dir, auth, { ...rec, static_down: true });
+        } else if (rec?.static_url !== void 0 && states[rec.static_url] === "unknown") {
+          setEnvironment(dir, auth, { ...rec, static_unchecked: true });
+        }
+      }
+      const note = republishNote(republished, unknown, frontends);
+      if (importFailure instanceof Error) importFailure.message = `${importFailure.message}
+${note}`;
+      else warn(note, "static.republish");
+    }
+    importFailure = explainDuplicateArchiveGuid(importFailure, args.file, contextFlags(args));
+    if (created && importFailure instanceof Error) {
+      const landedUnresolved = importFailure instanceof HostedFilesUnresolvedError && importFailure.applied;
+      const futile = isFetchedDuplicateGuid(importFailure, args.file);
+      importFailure.message += `
+${createdButFailedNote(target.name, unknown, args, landedUnresolved, { futile })}`;
+    }
+    throw importFailure;
+  }
+  const removedEntries = keepDataRemovedEntries(merged, ctx.lock);
+  if (ctx.removedOut !== void 0 && Object.keys(removedEntries).length > 0) ctx.removedOut.removed = removedEntries;
+  if (ctx.removedOut !== void 0 && merged?.storedColumns !== void 0) ctx.removedOut.storedColumns = merged.storedColumns;
+  if (ctx.removedOut !== void 0 && merged !== void 0 && merged.removedGuids.length > 0) ctx.removedOut.removedGuids = merged.removedGuids;
+  commitLock(Object.keys(removedEntries).length > 0 ? new Set(Object.keys(removedEntries)) : void 0);
+  const landedRelease = /^release:(.+)$/.exec(ctx.compiled === true ? "" : args.file ?? "")?.[1];
+  markEnvironmentFilled(dir, auth, baseUrl, {
+    ...landedRelease === void 0 ? {} : { release: landedRelease },
+    ...ctx.entry === void 0 ? {} : { entry: ctx.entry }
+  });
+  if (arm.arm === "replace" && previousStaticUrl !== void 0) {
+    const landed = getEnvironment(readEphemeralState(dir), auth);
+    if (landed !== void 0) setEnvironment(dir, auth, { ...landed, static_down: true });
+  }
+  const noteDeployed = (landedOn) => noteLanded({
+    said: `Deployed ${namedEphemeral(landedOn)} (${arm.arm === "merge" ? "keeping its data" : "full replace"}).`,
+    fields: { ephemeral: { name: landedOn.name, display: landedOn.display }, url: baseUrl, created }
+  });
+  noteDeployed(target);
+  if (arm.arm === "replace" && !created) {
+    try {
+      const renamed = await renameIfAsked();
+      if (renamed !== void 0) target = { ...target, display: renamed };
+      noteDeployed(target);
+    } catch (err) {
+      const reconciled = await reconcileRename(err, auth, target.name, args.name ?? "");
+      if (reconciled.renamed) {
+        const rec = getEnvironment(readEphemeralState(dir), auth);
+        if (rec !== void 0 && rec.name === target.name) setEnvironment(dir, auth, { ...rec, display: args.name });
+        target = { ...target, display: args.name };
+        detail(`Renamed to "${args.name}" (its answer was lost; read back from the ephemeral).`);
+      } else {
+        const retry = retryCommand(args);
+        const reason = (err instanceof Error ? err.message : String(err)).replace(SENT_AFTERMATH, "").trim().replace(/[.\s]+$/, "");
+        const state2 = reconciled.unknown ? `Whether it took effect is unknown \u2014 \`xanosdk ephemeral get ${target.name}${contextFlags(args)}\` shows its name; if it is not "${args.name ?? ""}", \`${retry.command}\`` : `Its name is unchanged; \`${retry.command}\``;
+        warn(
+          `The deploy landed, but renaming ${target.name} to "${args.name ?? ""}" failed: ${reason}. ${state2} deploys again and renames it.${withheldNote(retry.withheld)}`,
+          "ephemeral.rename-failed"
+        );
+      }
+    }
+  }
+  const urlChanged = created || stored !== void 0 && stored.url !== baseUrl;
+  if (urlChanged) {
+    success(`E${namedEphemeral(target).slice(1)} deployed${elapsedSuffix(startedAt)}`);
+    info("New ephemeral URL:");
+    link(baseUrl);
+  } else {
+    const kept = arm.arm === "merge" ? ", keeping its data" : "";
+    success(`Refreshed ${namedEphemeral(target)}${kept}${urlsNote(merged)}${elapsedSuffix(startedAt)}`);
+    link(baseUrl);
+  }
+  detail(`Expires ${formatExpiration(target.expiresAt)}`);
+  detail(`Manage with \`xanosdk ephemeral get ${target.name}${contextFlags(args)}\``);
+  detail(`Open the builder with \`xanosdk impersonate ephemeral:${target.name}${contextFlags(args)}\``);
+  const published = await publishStatic?.({ baseUrl, label: namedEphemeral(target), name: target.name });
+  if (published?.url !== void 0) {
+    noteStaticUrlChange(
+      servingBefore,
+      published.url,
+      arm,
+      servingBefore === void 0 && !created && stored?.static_down === true ? stored.static_url : void 0
+    );
+    recordStaticUrl(dir, auth, published.url);
+  }
+  if (published?.error !== void 0) noteStaticTakenDown(staticTeardown, published.completed === "unknown");
+  let microservicesError;
+  const microservices = await verifyMicroservices(auth, baseUrl, {
+    ...microserviceCheck(args),
+    name: target.name,
+    flags: contextFlags(args),
+    onReadError: (e) => microservicesError = e
+  });
+  if (created) await warnSameDisplayName(auth, parentWorkspaceId, target, stored?.name, contextFlags(args));
+  return {
+    kind: "ephemeral",
+    destination: backendDestinationPayload(auth, {
+      kind: "ephemeral",
+      name: target.name,
+      url: baseUrl,
+      ...target.display !== void 0 && target.display !== target.name ? { display: target.display } : {}
+    }),
+    profile: auth.profile ?? null,
+    url: baseUrl,
+    ephemeral: { name: target.name, display: target.display, expiresAt: target.expiresAt },
+    created,
+    ...dataFields(arm),
+    ...mergeLossFields(merged),
+    // Beside `--static` too: the new frontend may be at a new URL, and the one a
+    // bookmark or a shared link holds is what this names.
+    ...staticRemovedField(staticTeardown, published?.url),
+    ...notApplied.length > 0 ? { notApplied } : {},
+    ...microservices ? { microservices } : {},
+    ...microservicesError !== void 0 ? { microservicesError } : {}
+  };
+}
+async function deployStaticTo(dir, auth, target, env, explicit, host, skipLiveness, routing, dirLabel, opts = {}) {
+  const { deployStaticHost } = await import("./static-host-B2Y6AG3W.js");
+  const where = target.label && target.label !== "" ? target.label : `workspace #${target.workspaceId}`;
+  if (target.announced !== true) step(`Deploying static frontend ${dir} \u2192 ${where}${host ? ` (host: ${host})` : ""}`);
+  const sh = await describeWrite(
+    {
+      what: `the static publish to ${where}`,
+      check: opts.rerun === void 0 ? `Open ${where}'s frontend to see which build it serves before retrying.` : `A publish replaces the host's build, so running it again settles it either way: \`${opts.rerun}\`.`
+    },
+    () => deployStaticHost({
+      host,
+      dir,
+      workspaceId: target.workspaceId,
+      baseUrl: target.baseUrl,
+      accessToken: auth.access_token,
+      env,
+      routing,
+      ...dirLabel === void 0 ? {} : { label: dirLabel },
+      ...opts.serverRendered === true ? { serverRendered: true } : {}
+    })
+  );
+  if (sh.serverBundle === "omitted") {
+    detail(
+      "Server half (.xano-ssr/) not uploaded: this host serves files only. `xanosdk deploy --local-engine --static` renders it."
+    );
+  }
+  if (sh.hiddenUnserved !== void 0) {
+    const shown = sh.hiddenUnserved.slice(0, 5).join(", ") + (sh.hiddenUnserved.length > 5 ? `, and ${sh.hiddenUnserved.length - 5} more` : "");
+    const wellKnown = sh.hiddenUnserved.some((p) => p.split("/").includes(".well-known"));
+    warn(
+      `Not served: ${shown} \u2014 the static host serves no path with a dot segment, so ${sh.hiddenUnserved.length === 1 ? "it answers" : "they answer"} with the fallback page${wellKnown ? " (a `.well-known/` file such as assetlinks.json or apple-app-site-association cannot be hosted here; serve it from the backend or another host)" : ""}.`,
+      "static.hidden-unserved"
+    );
+  }
+  if (sh.skippedLinks !== void 0) {
+    const named = sh.skippedLinks.map((l) => `${l.path} (${l.reason === "outside" ? "points outside the build" : "points to nothing"})`).join(", ");
+    warn(`Not uploaded: ${named}. A symlink is followed only to a file or directory inside the build; copy the target in instead.`, "static.link-skipped");
+  }
+  detail(
+    sh.routing === "multipage" ? "Routing: multipage \u2014 routes resolve to their own documents." : "Routing: spa \u2014 every path serves index.html."
+  );
+  if (sh.routingSuspect === true) {
+    const suspectPages = sh.routingSuspectPages !== void 0 && sh.routingSuspectPages.length > 0 ? sh.routingSuspectPages : ["404.html"];
+    warn(
+      `Routing was inferred as multipage only because the build ships ${suspectPages.join(" and ")} beside index.html \u2014 the shape of a single-page app with its own ${suspectPages.length === 1 && suspectPages[0].toLowerCase() === "200.html" ? "fallback" : "not-found"} page. If a client router serves its routes, its deep links never reach index.html.`,
+      "static.routing-inferred-multipage",
+      ["Pass `--static-routing spa` to serve index.html for every route the build has no file for."]
+    );
+  }
+  const globals = Object.keys(env).map((k) => `window.${k}`);
+  let staticEnv;
+  if (globals.length > 0) {
+    staticEnv = { injected: sh.envInjected, keys: Object.keys(env), documents: sh.envDocuments };
+    const docs = sh.envDocuments === 1 ? "1 document" : `${sh.envDocuments} documents`;
+    if (sh.envInjected) success(`Config injected into ${docs}: ${globals.join(", ")}`);
+    if (sh.envSkipped.length > 0) {
+      const reason = `Config not injected into ${sh.envSkipped.join(", ")} \u2014 no <head> to anchor to; those routes run with ${globals.join(", ")} unset.`;
+      staticEnv = { ...staticEnv, skipped: [...sh.envSkipped], reason };
+      warn(reason, "static-env.not-injected");
+    } else if (!sh.envInjected) {
+      const reason = explicit ? `Config not injected \u2014 the build has no HTML document. ${globals.join(", ")} unset.` : `No HTML document to inject window.XANO_HOST into \u2014 skipped.`;
+      staticEnv = { ...staticEnv, reason };
+      if (explicit) warn(reason, "static-env.not-injected");
+      else detail(reason);
+    }
+  }
+  success("Static host deployed");
+  if (sh.url) link(sh.url);
+  const published = {
+    url: sh.url,
+    routing: sh.routing,
+    ...staticEnv !== void 0 ? { staticEnv } : {},
+    ...sh.canonical !== void 0 ? { canonical: sh.canonical } : {},
+    ...sh.serverBundle !== void 0 ? { serverBundle: sh.serverBundle } : {}
+  };
+  if (skipLiveness || sh.url === void 0 || sh.canonical === void 0) {
+    return published;
+  }
+  const { verifyRollout } = await import("./verify-rollout-DRCK5TDD.js");
+  const { url, canonical } = sh;
+  const { live } = await withSpinner("Verifying the frontend is live\u2026", () => verifyRollout(url, canonical));
+  if (live) {
+    success("Frontend is live");
+  } else {
+    warn(
+      "Could not confirm the frontend is live within the wait window \u2014 the build uploaded and should come online shortly.",
+      "static.unconfirmed-live",
+      [`Re-check by opening ${sh.url}, or skip this wait next time with --skip-liveness.`]
+    );
+  }
+  return { ...published, verified: live };
+}
+async function noteRunScopeFor(auth) {
+  const { noteRunScope } = await import("./cli.js");
+  noteRunScope(auth);
+}
+
+export {
+  buildStaticEnv,
+  warnSecretLookingStaticEnv,
+  deriveDisplay,
+  assertNoSeedLeaks,
+  runDeployedTests,
+  testRunAllCommand,
+  ignoreBackendSecretFilesRead,
+  recordedLanding,
+  storeAsReleaseHint,
+  tenantWithoutWorkspace,
+  DESTINATION_ONLY,
+  EPHEMERAL_ONLY,
+  assertNoEphemeralFlags,
+  resolveDeployDestination,
+  refuseSameEphemeral,
+  runDeployCommand,
+  syncDevEnvAfterDeploy,
+  noteUnconfigured,
+  noteStaticUrlChange,
+  republishNote,
+  createdButFailedNote,
+  noteReplaceRerun,
+  noteKeptFilledMarker,
+  isFetchedDuplicateGuid,
+  explainDuplicateArchiveGuid,
+  verifyMicroservices,
+  ephemeralDisabledError,
+  notReadyError,
+  ephemeralStateCheck,
+  toStateCheck,
+  unknownCreateOutcome,
+  deployStaticTo
+};
+//# sourceMappingURL=chunk-WZDJ2LLX.js.map