@xano/sdk 1.0.0

package/dist/cli.d.ts

@@ -0,0 +1,1111 @@
+import { B as Bundle, L as LockFile, X as Xano, c9 as emit } from './emit-CyhBDxli.js';
+import './response-HlXahv4K.js';
+import './xdo-CxDr2Q1C.js';
+
+/**
+ * `UsageError` — a failure the user can fix by typing something different.
+ *
+ * The distinction that matters at the process boundary: a UsageError means the
+ * CLI never got far enough to try, so printing the relevant help block is
+ * useful. Every other error means the command ran and failed, where a wall of
+ * usage text is noise. `bin.ts` renders the two differently on that basis.
+ *
+ * Thrown (not printed) so `run()` stays a library function — the exported entry
+ * that tests drive directly — with rendering and exit codes owned by the bin.
+ * The renderer lives here too ({@link reportFailure}) rather than in `bin.ts`,
+ * which is unimportable from a test: it calls `run()` at module scope.
+ */
+
+/**
+ * Which help block belongs with this failure. An empty object means the global
+ * command reference; omitting `helpFor` entirely means no block at all, for the
+ * failures whose message already says everything useful.
+ */
+interface HelpTarget {
+    command?: string;
+    subcommand?: string;
+}
+declare class UsageError extends Error {
+    readonly name = "UsageError";
+    /** The help block to print under the message. */
+    readonly helpFor: HelpTarget | undefined;
+    /**
+     * A one-line pointer to this help page, in place of the block. For a conflict
+     * between flags that each parsed fine: the message already names which to
+     * drop, and a full usage block under it buries that sentence. {@link helpFor}
+     * is for a mistake in the command's SHAPE, where the block lists what works.
+     */
+    readonly hintFor: HelpTarget | undefined;
+    /** A closest-match hint (`Did you mean: details`), when one is close enough. */
+    readonly suggestion: string | undefined;
+    constructor(message: string, opts?: {
+        helpFor?: HelpTarget;
+        hintFor?: HelpTarget;
+        suggestion?: string;
+    });
+}
+
+/**
+ * One archive member (structurally an `ArchiveEntry`): its in-archive path and
+ * the serialized signed `type:"content"` envelope written there.
+ */
+interface SeedContentFile {
+    /** `content/<table-guid>-<page>.json` (page 1-based, contiguous). */
+    name: string;
+    /** The serialized signed `type:"content"` envelope. */
+    content: string;
+}
+/** A seed value the schema says is not public, and where it came from. */
+interface NonPublicSeedValue {
+    table: string;
+    column: string;
+    value: string;
+    /**
+     * Whether a static build can actually be searched for this value.
+     *
+     * `false` for a value below {@link MIN_SCANNABLE_LENGTH}, and for a non-string
+     * one. Those are collected rather than dropped: being too short to
+     * search for is not the same as being safe, and the author is the only one who
+     * can judge which it is. The scanner skips them; the deploy path reports them.
+     */
+    scannable: boolean;
+    /**
+     * How the table supplies its seed, which decides how a value can have reached
+     * a frontend build — and so what the refusal tells the author to change.
+     */
+    source: SeedSourceKind;
+}
+/**
+ * `inline` rows ride with the table def into any bundle that imports it; a
+ * `thunk`'s `import()` is one a bundler follows; a `file` (`seedFile`) is a
+ * plain path no bundler reads, so a match there came from the frontend itself.
+ */
+type SeedSourceKind = "inline" | "file" | "thunk";
+
+/** One archive member: its in-archive path and the UTF-8 text stored at it. */
+interface ArchiveEntry {
+    name: string;
+    /** Text members (the bundle, seed pages) are UTF-8; a hosted file's bytes ride as-is. */
+    content: string | Uint8Array;
+}
+
+/**
+ * Whose environment this is. Structurally satisfied by `ResolvedAuth`, so every
+ * caller passes the `auth` it already holds.
+ */
+interface EnvScope {
+    workspaceId: number | string;
+    /** Instance origin the credential addresses. Part of the key — see the header. */
+    instance: string;
+    /**
+     * `undefined` on the two environment-credential paths, which have no profile
+     * map behind them. They key as `default`, which is where they landed before
+     * profiles existed: an env credential and a stored `default` profile pointed
+     * at the same `(instance, workspace)` ARE the same tenant target, so sharing
+     * the key changes nothing and keeps every existing CI record findable.
+     */
+    profile?: {
+        name: string;
+    };
+}
+
+interface ParsedArgs {
+    command: string | undefined;
+    /**
+     * The verb of a noun-verb command (`workspace export`, `profile me`): here
+     * `command` is the noun and `subcommand` is the verb.
+     * Undefined for the single-token verbs (`compile`/`export`/`lock`/…).
+     */
+    subcommand: string | undefined;
+    file: string | undefined;
+    out: string | undefined;
+    /**
+     * The command line as parsed (global flags typed in front already moved
+     * behind the command), for a hint that re-says the WHOLE command — a retry
+     * that dropped the run's own flags would refuse, or do something else.
+     * Absent on args built by hand (tests).
+     */
+    argv?: readonly string[];
+    /** All non-flag arguments after the command (file is positionals[0]). */
+    positionals: string[];
+    /**
+     * Where in {@link argv} each positional was typed, by the parser's own
+     * reading: a rerun that leaves one out (`env set`'s secret value) removes it
+     * by position — a search by value found an equal flag value first.
+     */
+    positionalArgv?: readonly number[];
+    /**
+     * `--lock` / `--lock=<path>`.
+     *
+     * The lock is maintained by DEFAULT, so the bare form no longer opts into
+     * anything — it is accepted and redundant, because scaffolded trees and
+     * examples still pass it and erroring on them buys nothing. The flag survives
+     * for `--lock=<path>`, which is the real remaining job: naming the lock file
+     * when the default (beside the entry) is not the one you mean.
+     */
+    lock: boolean;
+    /** The `--lock=<path>` override (default: `xano.lock` beside the entry). */
+    lockPath: string | undefined;
+    /**
+     * `--no-lock`: build with NO lock at all — nothing read, nothing written,
+     * identities derived from names.
+     *
+     * The escape hatch for a throwaway run and for a tree with no lock that
+     * cannot be written. It is REFUSED over a parseable lock (see
+     * `compileBundle`): honoring it there would emit name-derived guids that
+     * disagree with the pinned ones, which is a delete-and-recreate against
+     * whatever the bundle is released to, reported as success.
+     */
+    noLock: boolean;
+    /**
+     * `--entry=<path>`: the workspace entry the lock sits beside, for the `lock`
+     * subcommands that take no entry file of their own (`rename`/`adopt`).
+     *
+     * Distinct from `--lock`, which names the lock FILE directly. This names the
+     * entry and lets the default be DERIVED the way `export` and `prune` derive
+     * it — so the caller still supplied the anchor and nothing is guessed.
+     */
+    entryPath: string | undefined;
+    /** `--frozen-lock`: hard-fail if the export would change the lock (CI). */
+    frozenLock: boolean;
+    /**
+     * `--allow-lock-orphans`: keep `--frozen-lock` from failing over entries no
+     * exported object matches. For a workspace adopted with `lock import` and
+     * ported to TypeScript a piece at a time, where the unported objects are
+     * live and their pinned identities must NOT be pruned away.
+     */
+    allowLockOrphans: boolean;
+    /**
+     * Not a flag: set by a command whose compile only answers a question — the
+     * drift comparison of `release create`, a `reset-tables` dry run. The build
+     * reads the lock exactly as a real one does, so its identities are the ones a
+     * release would send, and writes nothing: no lock, no "commit it" notice.
+     */
+    lockReadOnly?: boolean;
+    /**
+     * `--strict`: promote every export/deploy WARNING to a hard failure — the
+     * build diagnostics (a `bulk.update` that zero-fills omitted columns, an
+     * `ignoreEmpty` that drops its predicate) as well as the CLI's own
+     * preflights (unresolvable filter names; a stale `--emit`
+     * manifest). Warnings print either way; `--strict` decides whether a printed
+     * one still ships.
+     */
+    strict: boolean;
+    /** `--yes`/`-y`: confirm destructive lock maintenance non-interactively. */
+    yes: boolean;
+    /**
+     * `--check`: the reporting half of a command whose default is to act.
+     * `upgrade --check` reports whether a newer `@xano/sdk` is published and
+     * exits non-zero when one is, instead of installing it. `export --check` runs
+     * every check an export runs and fails instead of changing the lock, but
+     * writes nothing — no bundle, no lock — and so needs no secrets.
+     */
+    check: boolean;
+    /** `push --bundle <path>`: upload an already-exported bundle instead of a file entry. */
+    bundle: string | undefined;
+    /** True when `bundle` came from the positional `<file>` (a `.json`), not `--bundle`: a refusal names what was typed. */
+    bundlePositional?: boolean;
+    /**
+     * `deploy --reset`: replace the environment and re-seed it. Only changes
+     * anything alongside {@link keepData}, which it overrides.
+     */
+    reset: boolean;
+    /**
+     * `deploy --keep-data`: merge into the environment an earlier deploy filled,
+     * keeping its table rows, instead of replacing it. Falls back to a seeded
+     * replace when there is nothing to keep. Refused with `--to`, which merges
+     * already.
+     */
+    keepData: boolean;
+    /**
+     * `test --on <backend>`: which backend a suite runs on. Kept as the raw
+     * string; the command parses it against the slot the registry declares.
+     * Refused on every other command as undeclared.
+     */
+    on: string | undefined;
+    /** `test --kind unit|workflow`: narrow to one test family (default: both). */
+    kind: "unit" | "workflow" | undefined;
+    /** `test run-all --concurrency <n>`: how many tests to run at once (default 1). */
+    concurrency: number | undefined;
+    /** `deploy --test`: run the environment's tests after the deploy lands. */
+    test: boolean;
+    /** `deploy --expires-hours <n>`: ephemeral create-time TTL (1–24, default 1 server-side). */
+    expiresHours: number | undefined;
+    /**
+     * `routes --emit <path>`: write the generated route module there instead of
+     * printing the table. Plain data + one interpolator, importing nothing, so a
+     * frontend gets the typed path/verb contract without the SDK runtime.
+     */
+    /** `compile --export <name>`: which named export of a several-def module to compile. */
+    exportName: string | undefined;
+    emit: string | undefined;
+    /** `deploy --static <dir>`: archive this directory and deploy it to the environment's static host. */
+    static: string | undefined;
+    /**
+     * `deploy --static-env KEY=VALUE` (repeatable): public config baked into EVERY
+     * html document of the static build as `window.<KEY>` globals. The backend URL is
+     * wired in automatically as `window.XANO_HOST`; these override/extend it.
+     * Served to the browser verbatim — public values only, never secrets.
+     */
+    staticEnv: Record<string, string>;
+    /**
+     * `--env-var KEY=VALUE` (repeatable): one BACKEND workspace environment
+     * variable, merged over `workspaceConfig({ env })` for this run.
+     *
+     * The opposite of `--static-env` in every way that matters, and NOT the same
+     * thing as a backend selector (`--to`/`--from`/`--on`). `--static-env`
+     * bakes PUBLIC config into the html a browser downloads; this sets a workspace
+     * secret the engine reads server-side with `env("NAME")`, and the value exists
+     * only in this process — never written to disk, never in the repo, never
+     * printed back. Highest precedence: it beats both files.
+     */
+    envVars: Record<string, string>;
+    /**
+     * `--backend-env-file <path>`: backend env values read from a dotenv-style
+     * `KEY=VALUE` file INSTEAD of the default `xano/.env`.
+     *
+     * It REPLACES the default rather than layering over it: pointing at a CI
+     * secret mount must not also ship whatever is in a developer's local file.
+     */
+    envFile: string | undefined;
+    /**
+     * `--allow-empty-env=NAME[,NAME]`: declared names this run may send empty.
+     *
+     * Per-name on purpose. A global opt-out would be found by exactly the person
+     * under time pressure whose pipeline just refused, and would then silently
+     * clear any name added upstream afterwards — re-enabling the corruption the
+     * refusal exists to prevent, while reporting it as expected.
+     */
+    allowEmptyEnv: readonly string[];
+    /**
+     * `--allow-empty-doc-token=<scope>`: scopes this run may send empty, clearing
+     * that doc site's gate on the target. Repeat the flag for more than one.
+     *
+     * Separate from {@link ParsedArgs.allowEmptyEnv} on purpose: excusing a
+     * backend env var and opening a doc site are different decisions, and one flag
+     * covering both would let a user who meant the first do the second.
+     *
+     * The scope is `workspace` or an API group's NAME — what a user can type from
+     * what they can see. Not comma-split, unlike `--allow-empty-env`: a group name
+     * is a remote string and may contain a comma, and a name nobody can address is
+     * a gate nobody can open.
+     */
+    allowEmptyDocToken: readonly string[];
+    /**
+     * `--doc-token <scope>=<value>`: one documentation token, inline.
+     *
+     * For CI, which has no `xano/.secrets.json` because that file is gitignored.
+     * Wins over whichever file supplied the same scope, exactly as `--env-var`
+     * does. Prefer `--secrets-file` where possible: a value on the command line
+     * lands in shell history, in the process argument list, and in any CI log that
+     * echoes the command.
+     *
+     * Keyed by the same scope label the opt-out takes, and split on the FIRST `=`
+     * so the TOKEN may contain one — base64 values end in `=` padding, and any
+     * other split would truncate exactly the values most likely to be passed here.
+     * A group NAME containing `=` cannot be addressed by this flag as a result;
+     * the sidecar reaches it by guid, which has no such problem.
+     */
+    docTokens: Record<string, string>;
+    /**
+     * `--secrets-file <path>`: read documentation tokens from here instead of the
+     * default `xano/.secrets.json`.
+     *
+     * REPLACES the default rather than layering over it, the rule `--backend-env-file`
+     * already sets: pointing at a CI secret mount must not also ship a developer's
+     * local file.
+     */
+    secretsFile: string | undefined;
+    /** `--backend-dir <path>`: the directory a `pull` replaces, when discovery cannot name it. */
+    backendDir: string | undefined;
+    /**
+     * `pull --no-secrets`: find the documentation tokens, report them, write none.
+     *
+     * For a machine where a secret on disk is not wanted — a shared box, a CI
+     * checkout that only needs the source. The tree is unaffected: it declares the
+     * gates either way, and a later deploy refuses rather than clearing one.
+     */
+    noSecrets: boolean;
+    /**
+     * `deploy --static-host <name>`: the static-host NAME to deploy the frontend
+     * to (default `default`). Give each app a distinct host so deploys don't share
+     * and overwrite one `default` host — the shared host is why a first post-deploy
+     * load can serve a *previous* app's cached `index.html`.
+     */
+    staticHost: string | undefined;
+    /**
+     * `deploy --static-routing spa|multipage`: override how the host resolves URLs
+     * within the build. Normally unset — the shape is inferred from the bundle.
+     * Set it for a single-document site that wants real 404s, or a bundle carrying
+     * a stray `.html` that should still route entirely client-side.
+     */
+    staticRouting: "spa" | "multipage" | undefined;
+    /** `--origin <origin>`: Xano control-plane OAuth host. Default: $XANO_ORIGIN, then https://app.xano.com. */
+    authHost: string | undefined;
+    /** `--config <path>`: explicit credential file. Default: $XANO_CONFIG, then ./.xano/auth.json. */
+    authFile: string | undefined;
+    /**
+     * `--local`: use the project-local `./.xano/auth.json` cache instead of the
+     * shared `~/.xanosdk/auth.json` one (the default). `login --local` writes
+     * there; other commands read it. Without `--local`, reads still prefer an
+     * existing project-local cache before falling back to the global one, so a
+     * `--local` project keeps working without repeating the flag.
+     */
+    local: boolean;
+    /** `logout --all`: clear every stored profile, not just the active one. */
+    all: boolean;
+    /**
+     * `profile add --workspace-id <n>`: the numeric workspace a stored meta API
+     * token acts on. Kept as the raw STRING so the validator can quote what was
+     * actually typed rather than `NaN` — the same reason the env triple does.
+     */
+    workspaceId: string | undefined;
+    /**
+     * `--profile <name>` / `-p <name>`: which stored credential profile to act as.
+     *
+     * `undefined` means the flag was not given — deliberately NOT collapsed into
+     * the name `default`, because the rungs below it (the project's
+     * `xano.profile.json`, `$XANO_PROFILE`, the credential file's own `default`
+     * key) each need to know that nobody typed one. Resolved in exactly one
+     * place, `getAccessToken`.
+     *
+     * This is the ONE rung above the project's pin, and the only way to act as a
+     * profile the pinned project did not choose — which is why it discloses the
+     * override rather than being refused.
+     */
+    profile: string | undefined;
+    /**
+     * `ephemeral list --all-workspaces`: enumerate ephemeral tenants across every
+     * workspace on the instance, not just the token's parent workspace.
+     */
+    allWorkspaces: boolean;
+    /** `impersonate --guest`/`-g`: mint a read-only guest session (browse only). */
+    guest: boolean;
+    /** `impersonate --url-only`/`-u`: print the dashboard URL instead of opening a browser. */
+    urlOnly: boolean;
+    /** `marketplace details --prompt`: print the add-on's agent prompt alone, for piping. */
+    prompt: boolean;
+    /** `login --port <n>`: loopback callback port (default: `DEFAULT_PORT`, 47100). */
+    port: number | undefined;
+    /**
+     * `login --paste`: skip the loopback callback server and read the redirect back
+     * from the user, for a host whose 127.0.0.1 the browser cannot reach (remote
+     * shell, container, Codespace). Distinct from `XANO_NO_BROWSER`, which only
+     * suppresses the browser launch and still needs the redirect to arrive.
+     */
+    paste: boolean;
+    /** `login --scope "<space list>"`: OAuth scopes to request (default: the built-in xano-cli set). */
+    scope: string | undefined;
+    /** `preflight --runtime`: after import + round-trip, run each deployed function and report. */
+    runtime: boolean;
+    /** `preflight --capture`: write each round-tripped function's fetched JSON (candidate fixtures). */
+    capture: boolean;
+    /** `local-engine cache clear --legacy-runtime`: remove the runtime copies earlier builds left in the user's own cache directory. */
+    legacyRuntime: boolean;
+    /** `preflight --verbose`: print full diffs / raw engine detail instead of a projected summary. */
+    verbose: boolean;
+    /** `preflight --instance <url>`: override XANO_VALIDATE_INSTANCE for this run. */
+    instance: string | undefined;
+    /**
+     * `--format <json|multidoc>`: which artifact to emit (validated at parse
+     * time). `multidoc` asks the engine to render the environment it already has
+     * (`ephemeral export` only).
+     */
+    format: "json" | "multidoc" | undefined;
+    /** `<env> export --path <p>`: output location (`-` for stdout; a dir or a full file path). */
+    path: string | undefined;
+    /** `<env> export --name <n>`: output basename override. Also the `init` app name (default: target dir basename). */
+    name: string | undefined;
+    /** `init` `--no-agents-md`: do not write the `AGENTS.md` agent brief. */
+    noAgentsMd: boolean;
+    /**
+     * `init` `--marketplace <pkg>` (repeatable, comma-separated): marketplace
+     * add-ons to install into the new project and register in `xano/index.ts`.
+     *
+     * One flag rather than a follow-up command so that the whole project is one
+     * reproducible line — which is the promise onboarding makes when it prints
+     * the command it ran. Validated in `init-modules.ts`, not at parse time.
+     */
+    marketplace: string[];
+    /**
+     * `init --from <source>`: where `xano/` comes from — `workspace`,
+     * `ephemeral:<name>`, or a path to a bundle JSON already on disk. Undefined
+     * writes the empty-but-valid starter backend instead.
+     *
+     * Kept as the raw string here and resolved in `init-command.ts`, so the one
+     * place that knows the spellings is the one that reports a bad one.
+     */
+    from: string | undefined;
+    /**
+     * `init` `--framework <id>`: which frontend to scaffold
+     * (`react`/`svelte`). Undefined = prompt in a TTY, else the default.
+     * Validated in `frontend-presets.ts`, not at parse time.
+     */
+    framework: string | undefined;
+    /**
+     * `init` `--theme <id>`: the shadcn/ui palette to render into the
+     * scaffold's stylesheet — a `<base>` or `<base>-<accent>` pair, a registry
+     * theme URL, or a path to a registry item JSON file. Undefined = plain
+     * shadcn. Validated in `theme-presets.ts`, not at parse time.
+     */
+    theme: string | undefined;
+    /** `init` `--radius <len>`: corner radius override, bare number = rem. */
+    radius: string | undefined;
+    /**
+     * `init` `--dark <mode>`: what switches the scaffold into its dark
+     * palette — `system` (default), `toggle`, or `off`.
+     */
+    dark: string | undefined;
+    /** `init` `--font <id>`: the body typeface (Tailwind's `--font-sans`). */
+    font: string | undefined;
+    /** `init` `--font-mono <id>`: the code typeface. */
+    fontMono: string | undefined;
+    /** `init` `--font-heading <id>`: the heading typeface; absent inherits the body face. */
+    fontHeading: string | undefined;
+    /** `init` `--icons <id>`: the icon set (`lucide` default, `tabler`, `phosphor`). */
+    icons: string | undefined;
+    /** `init` `--force`: scaffold into a non-empty target directory (overwrite our own files). */
+    force: boolean;
+    /** `init` `--no-install`: skip the post-scaffold `npm install`. Under `--from` this also means the round trip cannot be verified, since loading the tree needs its dependencies. */
+    noInstall: boolean;
+    /**
+     * `deploy --skip-liveness`: skip the post-deploy liveness checks. Everything
+     * is still deployed; Xano SDK just doesn't wait to confirm it came up — neither
+     * that the edge is serving *this* static build (via `X-Xano-Canonical`) nor
+     * that the workspace's microservices reached a ready state. Useful for fast
+     * iterative deploys or when the deployed URL isn't reachable from the CLI host.
+     */
+    skipLiveness: boolean;
+    /**
+     * `init --from … --skip-roundtrip`: skip the offline check that the tree just
+     * written re-exports as the bundle it was decoded from. Entirely local — no
+     * network, no deploy, no workspace mutation — which is why it is not the same
+     * flag as {@link skipLiveness} despite both once being spelled `--no-verify`.
+     */
+    skipRoundtrip: boolean;
+    /**
+     * `lock prune --identity-only`: drop the named entries without loading the
+     * entry file. Separate from the other two flags, and the least related to
+     * them: nothing is verified either way, the question is
+     * whether the workspace is evaluated at all.
+     */
+    identityOnly: boolean;
+    /**
+     * `deploy --require-microservices`: fail the deploy when a microservice has
+     * not reported ready by the end of the wait, not just when the engine says it
+     * is broken. A microservice the engine reports as FAILED already exits
+     * non-zero without this — the flag is what turns "still starting" into a
+     * failure too, which is the reading CI wants.
+     */
+    requireMicroservices: boolean;
+    /**
+     * `init --from … --report <grouped|full|json>`: how the findings are rendered.
+     *
+     * `grouped` (the default) prints one line per distinct root cause with a count
+     * and a collapsed object list; `full` prints every site; `json` prints the
+     * findings as data for a CI gate to read. The findings themselves are the same
+     * set in all three — this chooses the rendering, never what is reported.
+     */
+    report: string | undefined;
+    /**
+     * `deploy --no-dev-env`: do not point the project's dev env file
+     * (`.env.local`) at the backend this deploy made. The write is a managed
+     * block that leaves the rest of the file alone, so the opt-out is for the
+     * developer who wants that variable to stay exactly where they put it —
+     * pinned at a colleague's environment, say, or at a local engine.
+     */
+    noDevEnv: boolean;
+    /**
+     * `deploy --to … --dry-run`: print what the deploy WOULD change and exit without
+     * sending it. A destructive deploy previews anyway; this is how you preview
+     * one that isn't, or preview without being prompted.
+     */
+    dryRun: boolean;
+    /**
+     * `deploy --to … --prune`: also delete objects this project landed on the target and
+     * no longer defines. Without it a merge only adds and updates, so
+     * something deleted from your code lingers in the workspace.
+     */
+    prune: boolean;
+    /**
+     * `deploy --to … --reset-data`: empty every table the bundle carries before
+     * importing. Pair with `--seed` to reload the bundle's rows afterwards;
+     * alone it leaves the tables empty.
+     */
+    resetData: boolean;
+    /**
+     * `deploy --to … --seed`: write the bundle's table rows into the workspace. Off by
+     * default, so a deploy cannot overwrite live data you did not ask it to.
+     */
+    seed: boolean;
+    /**
+     * `workspace reset-tables --table <guid>`: which tables to reset, by guid.
+     *
+     * Repeatable, and a LIST rather than a comma-joined string: a table name may
+     * contain a comma and a guid is the only safe key, so nothing here is ever
+     * split on a separator. Absent rather than empty when the flag was not given,
+     * so "named no tables" and "named zero tables" stay the same refusal.
+     */
+    table?: string[];
+    /**
+     * `workspace reset-tables --write`: actually perform the reset.
+     *
+     * The INVERSE of the usual `--dry-run`, and deliberately so: this empties a
+     * table on a real workspace, so the outcome of forgetting the flag has to be
+     * the harmless one. Every other destructive command in this CLI is guarded by
+     * a confirmation the user answers; this one is guarded by a flag they have to
+     * type, and then the confirmation as well.
+     */
+    write: boolean;
+    /**
+     * `release create --seed=<guids>`: which tables' rows to carry, by guid.
+     *
+     * A SEPARATE field from {@link seed} rather than widening it, because `seed`
+     * is a single global boolean the deploy path reads as `records`. Widening it
+     * would make `xanosdk deploy --seed=<guid>` parse as a bare true with the value
+     * silently dropped — the failure the parser refuses for `--format`.
+     *
+     * Guids, not ids and not names. A stale id almost always EXISTS on the next
+     * backend and resolves to a real but different table; a stale guid is absent
+     * from the listing and refuses. See `TableSummary.guid`. Raw here; validated
+     * and resolved to that host's ids against the SOURCE's own table listing by
+     * the command.
+     */
+    seedTableGuids: string | undefined;
+    /**
+     * `deploy --to … --replace`: wipe the workspace (objects, table data and history)
+     * and import the bundle in its place, instead of merging.
+     * Named rather than implicit so it can never be reached by accident.
+     */
+    replace: boolean;
+    /**
+     * `deploy --to … --branch <label>`: land on this branch instead of the live one.
+     *
+     * The staging boundary for a workspace that has no second workspace. Branches
+     * scope LOGIC only — see {@link allowSharedSchemaChanges}.
+     */
+    branch: string | undefined;
+    /**
+     * `deploy --to … --branch <label> --set-live`: promote the branch the moment the
+     * import lands, in the same call.
+     */
+    setLive: boolean;
+    /**
+     * `promote --set-live --expect-live <label>`: refuse unless `<label>` is the
+     * live branch — before landing, and again immediately before switching.
+     */
+    expectLive: string | undefined;
+    /**
+     * `release transfer --to-profile <name>`: the stored credential profile whose
+     * instance and workspace receive the release. Resolved on its own, beside the
+     * credential the command runs as, which stays the source.
+     */
+    toProfile: string | undefined;
+    /**
+     * `deploy --to … --branch <label> --allow-shared-schema-changes`: proceed even
+     * though the bundle changes tables or microservices.
+     *
+     * Those carry no branch dimension, so they reach PRODUCTION whichever branch
+     * is targeted. A separate flag rather than a prompt, because the failure mode
+     * is not knowing — and `--yes` in CI answers a prompt without reading it.
+     */
+    allowSharedSchemaChanges: boolean;
+    /**
+     * `deploy --to … --replace --allow-branch-deletion`: proceed even though the clear
+     * will permanently delete the workspace's non-live branches.
+     *
+     * The engine's clear deletes by WORKSPACE, so every branch goes, and nothing
+     * brings one back — the same statement clears the saved versions that would
+     * otherwise be the way back. A separate flag rather than a prompt, for the
+     * same reason as {@link allowSharedSchemaChanges}: the failure mode is not
+     * knowing, and `--yes` in CI answers a prompt without reading it.
+     */
+    allowBranchDeletion: boolean;
+    /**
+     * `deploy --to … --backup-branch[=<label>]`: clone the live branch before importing,
+     * so a bad promote is one `set-live` away from being undone.
+     */
+    backupBranch: string | boolean | undefined;
+    /**
+     * `deploy --to <destination>`: reach a REAL destination — `workspace`, or
+     * `tenant:<name>` — instead of the throwaway environment a deploy defaults to.
+     *
+     * The documented escape hatch from the release flow, and deliberately a flag
+     * rather than a default: the recommended paths to a real destination are
+     * `promote` and `tenant deploy`, which go through a release. Absent, a deploy
+     * writes to an ephemeral and cannot reach anything else.
+     */
+    to: string | undefined;
+    /**
+     * `deploy --local-engine`: send this deploy to a Xano engine running on THIS
+     * machine instead of to an ephemeral.
+     *
+     * A DESTINATION, not a modifier — mutually exclusive with {@link to}, and
+     * refused alongside `--static`, which has no host to publish to here.
+     */
+    localEngine: boolean;
+    /**
+     * `deploy --local-engine=<version|url|path>`: an OVERRIDE engine — a
+     * published version (`v0.1.8`, the `v` optional), an `http(s)` URL to fetch it
+     * from, or the path to an engine archive already on disk (`~` and relative
+     * paths both resolve). An override never reads or writes the project's pin
+     * and skips the update check. XANOSDK_LOCAL_ENGINE_OVERRIDE supplies the same
+     * value from the environment when the flag carries none.
+     *
+     * Absent (a bare `--local-engine`), the run uses the project's pinned engine
+     * version from `package.json` (`"xanosdk": { "@xano/sdk": { "localEngine" } }`),
+     * or on the first run the latest published engine, which it then pins. A
+     * newer published engine is offered on a terminal and never applied without
+     * an explicit yes.
+     */
+    localEngineUrl: string | undefined;
+    /**
+     * `local-engine update --version <v>` / `local-engine cache clear --version <v>`:
+     * the engine version to move the pin to, or the cached one to remove. Taken as
+     * typed; the command normalizes it (`0.1.5` → `v0.1.5`). Only the first token
+     * spells the CLI's own version (`xanosdk --version`), so this cannot collide.
+     */
+    engineVersion: string | undefined;
+    /** `release create --description <text>`: what this release is for. */
+    description: string | undefined;
+    /**
+     * `publish --release <name>`: the release whose frontend this is. Context, not
+     * content — a release carries no frontend, so this only names what the
+     * publish is checked and reported against.
+     */
+    release: string | undefined;
+    /**
+     * `--json`: force the machine-readable JSON on stdout even at a terminal.
+     * Absent, the format is inferred from stdout being a TTY. Read through
+     * `isMachineOutput` (output.ts) — never by re-checking `isTTY` at a call site.
+     */
+    json: boolean;
+    /**
+     * `--no-refresh`: skip the agent-guidance refresh a compile runs as a
+     * courtesy. Global, because that courtesy rides on `export`, `deploy`,
+     * `release`, and `preflight` alike — and it writes to the user's tree, so
+     * "build without touching my files" has to be sayable on any of them.
+     */
+    noRefresh: boolean;
+    /**
+     * `deploy --open`: open the deployed URL in the default browser once it lands.
+     * Honors `XANO_NO_BROWSER` like every other launch, since it shares the same
+     * helper.
+     */
+    open: boolean;
+    /**
+     * Leading-dash tokens the parser doesn't recognize. They are collected HERE
+     * rather than falling into {@link positionals} so an unknown flag can never be
+     * resolved as the entry `<file>`: otherwise `xanosdk deploy --help` is
+     * imported as a module path and dies in Node's loader with a message about a
+     * missing file named `--help`.
+     */
+    unknownFlags: string[];
+}
+/**
+ * `-p=beta` → `--profile=beta`: the attached form of a VALUE-taking short flag,
+ * spelled as its long flag so the loop's `--x=` branch reads it. Read off the
+ * registry spec (`--profile, -p <name>`), so every such short is covered; a
+ * boolean short (`-y=…`) is left alone and refused as the unknown token it is.
+ */
+declare function expandShortAttached(arg: string): string;
+/**
+ * What an env var name may be — the shape the backend's own editor accepts
+ * (letters, digits and `_`, not starting with a digit), which is also the only
+ * shape `xano/.env` can hold. Said wherever a name is refused, so the rule
+ * reads the same from `--env-var`, `workspaceConfig({ env })` and the file.
+ */
+declare function envNameRule(): string;
+declare function parseArgs(argv: string[]): ParsedArgs;
+/**
+ * A resolved help request: the deepest command path present, or the topic word
+ * that `xanosdk help <topic>` named and the registry does not know.
+ */
+interface HelpRequest {
+    command?: string;
+    subcommand?: string;
+    /** Set only for `xanosdk help <unknown>` — see {@link resolveHelpRequest}. */
+    unknownTopic?: string;
+    /** Set only for `xanosdk <unknown> --help` with a command-shaped word. */
+    unknownCommand?: string;
+    /** Set only for `xanosdk <family> <not-a-verb> --help`, beside `command`. */
+    unknownSubcommand?: string;
+    /** The words after {@link unknownSubcommand}, for a moved verb's rename hint. */
+    positionals?: string[];
+}
+/**
+ * Resolve a help request straight from the RAW argv, before any flag parsing.
+ *
+ * Deliberately pre-parse: `parseArgs` throws on removed flags and malformed
+ * values, so resolving help afterwards would mean `xanosdk deploy --profile x
+ * --help` died on the flag error instead of printing the help the user asked
+ * for. Returns the deepest command path present (`{}` for global help), or
+ * undefined when no help was requested.
+ */
+declare function resolveHelpRequest(argv: string[]): HelpRequest | undefined;
+declare function loadDefault(file: string): Promise<unknown>;
+/**
+ * How to get `tsx` for the project around `file`: a project whose package.json
+ * already declares it has only not installed its dependencies (a fresh clone),
+ * so the step is its own install — from where the command was typed. Exported for the tests.
+ */
+declare function tsxRemedy(file: string): Promise<string>;
+/**
+ * Refuse an entry file that is not there — `SDK_USAGE`, exit 1, as every
+ * missing local input. Exported so a command that reads a credential
+ * (`preflight`, `workspace diff`) answers a typo before "not signed in".
+ */
+declare function assertEntryExists(file: string): void;
+/**
+ * Load an entry file with the CLI's loader, returning its whole module
+ * namespace. A throw from the author's own code closes with the line that
+ * threw — a factory validates before its owning def exists ({@link withAuthoringSite}).
+ */
+declare function loadModule(file: string): Promise<Record<string, unknown>>;
+/**
+ * Resolve this package's version for `xanosdk version`. Walks up from the running
+ * module to the package root's `package.json` (`dist/cli.js` → `../`, the
+ * `src/emit/cli.ts` source → `../../`), matching on the package NAME so a stray
+ * ancestor `package.json` can't shadow it. Best-effort: returns `"unknown"` rather
+ * than throwing when it can't be located, since a version print must never fail.
+ *
+ * MEMOIZED, because this stopped being a once-per-command question. The version
+ * is read by the update notice, by the scaffold's templates, by the bundle
+ * and preflight hooks, and by the toolchain loader's peer-range check — several
+ * of them in the same run — and the answer cannot change while the process
+ * lives: it is this installation's own manifest. Without the cache a single
+ * `deploy` walks up to six directories, reading and parsing at each, more than
+ * once for a fact it already had. `"unknown"` is cached too; a version that
+ * could not be located once will not be located a moment later, and re-walking
+ * on every call is precisely the cost this removes.
+ */
+declare function readVersion(): string;
+/**
+ * The `emit` of the `@xano/sdk` copy the ENTRY resolves, when that is not
+ * this CLI's own copy.
+ *
+ * A def is built by the SDK its module imports, and its statements are
+ * registered in THAT copy's statement registry. A global or repo-checkout
+ * `xanosdk` compiling a project with its own install is two copies: encoding
+ * the project's def with this CLI's `emit` looks every statement up in a
+ * registry that never saw them. `export` never hits this because it calls the
+ * workspace's own `export()` method; `compile` takes a lone def, which has no
+ * method to call, so the project's `emit` is imported instead. The same copy
+ * (or none resolvable, e.g. an entry outside any project) keeps this CLI's.
+ */
+declare function emitterFor(file: string): Promise<typeof emit>;
+/**
+ * Write the grouped command reference to STDOUT — help is requested output, not
+ * an error. The reference itself comes from the command registry via
+ * `help.ts`; nothing about the command surface is written down here.
+ */
+declare function printHelp(): void;
+/**
+ * The two fix-up commands for one orphan, spelled so they RUN as printed.
+ *
+ * Neither resolves the lock the way `export` just did. `lock rename` takes no
+ * entry file at all, so it looks for `xano.lock` in the current directory —
+ * which in the scaffolded layout (`xano/xano.lock`, CI at the repo root, where
+ * this text prints) is the one place it is not. `lock prune` takes the entry
+ * file and derives the lock from it, so it needs the entry named. A remedy a
+ * reader pastes and gets an error from is worse than no remedy: it reads as the
+ * tool being broken rather than as the command being incomplete.
+ */
+declare function orphanFixUps(key: string, entryFile: string, lockPath: string, kinds?: ReadonlyMap<string, string>, 
+/** Orphaned entries whose keys compose this one's name: its rename moves them, its prune drops them too. */
+children?: readonly string[], 
+/** The one candidate for the new name, when there is exactly one: printed in place of the placeholder. */
+only?: string): string[];
+/** The keys among `keys` whose names compose `key`'s (an api group's queries): a `lock rename` of it moves them. */
+declare function composedChildren(key: string, keys: readonly string[]): string[];
+/**
+ * {@link renameCandidates} for every orphan of one run. A new name filled in
+ * for two orphans at once is a guess between them — following it for the
+ * wrong one moves that object's guid onto the other — so it is listed under
+ * each instead, and the reader picks.
+ */
+/** An orphan's likely new name, as {@link renameCandidates} reads it. */
+interface RenameCandidates {
+    hint: string;
+    /** The one candidate, filled into the printed `lock rename`. */
+    only?: string;
+    /** The one candidate, shared with other orphans (an adopted one's). */
+    shared?: string;
+    /** The newcomers {@link hint} names when it names more than one, or one no rename is filled in for. */
+    candidates?: {
+        noun: string;
+        names: readonly string[];
+    };
+    /**
+     * The one candidate pins its own guid in its def: no `lock rename` carries
+     * the identity onto it, so the def is pointed at the orphan's `guid` instead.
+     */
+    inCode?: {
+        name: string;
+        guid: string;
+        pins: string;
+    };
+}
+/** The rename fix-up for {@link RenameCandidates.inCode}: set the def's guid, not the lock's. */
+declare function setGuidFixUp(inCode: NonNullable<RenameCandidates["inCode"]>): string;
+declare function renameCandidatesFor(orphans: readonly string[], previous: LockFile, observed: Record<string, unknown>, kinds?: ReadonlyMap<string, string>): Map<string, RenameCandidates>;
+declare function run(argv: string[]): Promise<void>;
+/**
+ * Every `NAME=value` word on the command line, shown as `NAME=…` in a refusal.
+ *
+ * `deploy STRIPE=sk_live_…` is a positional, and the refusal quoted it whole —
+ * `Cannot find entry file "STRIPE=sk_live_…"`, `No release named …` — in every
+ * command that reads its first positional as a path or a name. The value is
+ * the one part that may be a secret, and nothing a refusal says needs it. Where
+ * the command takes `--env-var`, the flag the reader most likely meant is named.
+ */
+declare function maskAssignments(err: unknown, argv: readonly string[]): unknown;
+/**
+ * A failure's `--json` document carries the run's warnings too, as
+ * `error.details.warnings` — where `publish` already put its own. An export's
+ * failed checks arrive as a list (`DiagnosticError`); the document names it
+ * `details.diagnostics`, so the warnings have an object to sit in beside it —
+ * a `--strict` refusal otherwise dropped every warning the run had printed.
+ * A failure whose details are some other non-object is left as it is.
+ */
+declare function carryRunWarnings(err: unknown): unknown;
+/**
+ * `env set NAME VALUE` with VALUE removed from the command line by the
+ * position the parser read it at — never by searching for the value, which
+ * found an equal `-p`/`--to` value (or the name) first and reprinted the
+ * secret. A value piped on stdin was never on it. Exported for the tests.
+ */
+declare function withoutSecretValue(args: ParsedArgs): ParsedArgs;
+/** Whether this run prints no path relative to the project root — see {@link PATHLESS_VERBS}. */
+declare function isPathlessRun(args: Pick<ParsedArgs, "command" | "subcommand">): boolean;
+/**
+ * `--version`/`-v` written after a command that has no `--version` of its own:
+ * the global flag help and completion list, so it prints the CLI's version.
+ * `whoami --version` said "--version expects an engine version", and
+ * `status -v` "Unknown flag -v". Not when a value follows (`deploy --version
+ * v0.1.5` is an engine version on the wrong command, refused as such), not on
+ * a verb that DOES take one (`local-engine update --version v0.1.5`), not past
+ * `--`, and never on `env set`, whose value may be `-v`.
+ */
+declare function globalVersionAsked(argv: readonly string[]): boolean;
+/**
+ * `status -v extra`, `tables --version local-engine`: the global version flag
+ * followed by a positional. Neither reading is safe to guess — the run the
+ * reader wanted, or the version — so it is one usage error naming both ways
+ * out, never "Unknown flag -v. Did you mean: --version". An engine-version-
+ * shaped value (`whoami --version v0.1.5`) keeps its own refusal: that is an
+ * engine version on a command that takes none.
+ */
+declare function globalVersionMisuse(argv: readonly string[]): UsageError | undefined;
+/**
+ * Bring a project's agent guidance back in line with the installed version.
+ *
+ * Called from {@link compileBundle}, which is the workspace compile behind
+ * `export`, `deploy`, `release`, and `preflight` — `deploy` being the one an
+ * agent's loop actually runs. An earlier version hung this off the `export`
+ * tail alone, so an agent running `npm run xano:deploy` never got a refresh.
+ *
+ * `compile` and `paths`/`routes` do NOT route through here: they answer narrow
+ * questions about a single def or a route table rather than building a
+ * workspace, and neither is a loop worth writing to a user's tree from.
+ *
+ * It only ever updates a managed block that already exists, is silent in CI and
+ * when no coding agent is detected, and never fails the compile — see
+ * `agent-file-refresh.ts` for the gates. `--no-refresh` turns it off outright,
+ * because this is still a write to the user's tree from a command they ran to
+ * BUILD something. Lazily imported so the browser-safe bundle never pulls in fs.
+ */
+declare function refreshAgentGuidance(args: ParsedArgs): Promise<void>;
+/**
+ * Resolve the lock path for an entry file: `--lock=<path>` wins, else
+ * `xano.lock` beside the entry (matching `export`/`compile` defaults).
+ */
+/**
+ * The nearest `xano.lock` at or above a file's directory, falling back to the
+ * beside-the-file location `export` would write. `compile` seeds names and
+ * guids from it, and a single def lives a directory or two below the workspace
+ * entry the lock sits beside.
+ */
+declare function nearestLockPath(file: string): string;
+/**
+ * The refusal for a `--lock=<path>` whose directory is not there, or undefined
+ * when it is (or no `--lock` was named). The lock is written through a temp
+ * file beside it, so a missing directory failed as a raw ENOENT on that temp
+ * path, with "make the directory writable" for a remedy.
+ */
+declare function missingLockDir(args: Pick<ParsedArgs, "lockPath">): string | undefined;
+declare function resolveLockPath(args: ParsedArgs, file: string): string;
+declare function noteLockCreated(lockPath: string, args?: Pick<ParsedArgs, "command" | "to" | "localEngine">, opts?: {
+    adopt?: boolean;
+}): void;
+/**
+ * Bring an existing route manifest up to date with the workspace, quietly —
+ * for a command that changed the workspace as a side effect (`marketplace
+ * remove` taking a module's endpoints with it) and must not leave the committed
+ * file listing routes that are gone. The same reading `routes --emit` makes,
+ * without its output. Also counts the lock entries the workspace no longer
+ * exports, which the same change orphans.
+ *
+ * "skipped" when the manifest cannot be brought up to date here (an api group
+ * whose canonical resolves nowhere), which the caller reports with the command.
+ */
+declare function refreshRouteManifest(entry: string, emit: string): Promise<{
+    manifest: "written" | "unchanged" | "skipped" | "absent";
+    lockOrphans: number;
+}>;
+/** A compiled bundle plus any seed `content/` entries (empty unless requested). */
+interface CompiledBundle {
+    bundle: string;
+    /** The same bundle before serialization, for a consumer that renders rather than writes it. */
+    bundleObject: Bundle;
+    content: SeedContentFile[];
+    /**
+     * The bytes of every `hostedFile(...)` the bundle references, as `vault/`
+     * archive members. Always built: the bundle's file library lists them, so an
+     * archive without them cannot land.
+     */
+    files: ArchiveEntry[];
+    /**
+     * Names of tables that declared `seed` but whose rows were NOT built into
+     * `content` (i.e. `opts.seed` was false). Empty when `opts.seed` is true. Lets
+     * the `export` command warn that its artifact omits seed — so the CI pattern
+     * `export --out bundle.json` then `deploy --bundle bundle.json` doesn't drop
+     * seed silently (a `--bundle` deploy has no registry to resolve seed from).
+     */
+    omittedSeedTables: string[];
+    /**
+     * Seed values drawn from columns the schema declares non-public, for the
+     * `--static` publication guard. Empty unless seed was resolved.
+     */
+    nonPublicSeedValues: NonPublicSeedValue[];
+    /**
+     * The lock this compile maintained — its path as the CLI names it, and whether
+     * this run changed it on disk — or null for a `--no-lock` build.
+     */
+    lock: {
+        path: string;
+        changed: boolean;
+    } | null;
+    /** The build warnings this compile printed, for a `--json` document to carry. */
+    warnings: Array<{
+        code: string;
+        message: string;
+    }>;
+    /**
+     * The env names the SOURCE declares (`workspaceConfig({ env })`) — not the
+     * bundle's, which also carries names `--env-var` or `--backend-env-file`
+     * added for this one build. What a committed `.env.example` lists.
+     */
+    declaredEnvNames: string[];
+    /**
+     * The lock as THIS compile classified it — the merged model, whether or not
+     * it has been written yet. Absent for a `--no-lock` build.
+     *
+     * What a release pins is read from here, not from the file: a deferred write
+     * (`deferLockWrite`) or a read-only run (`lockReadOnly`, a dry run) leaves
+     * the file one export behind, and a `canonical` the code names on an object
+     * new to it would otherwise ride the first release as a preference.
+     */
+    classifiedLock?: LockFile;
+    /**
+     * Present only when the compile was asked to defer its lock write
+     * (`deferLockWrite`) and there is one to make: writes the lock and says so.
+     * The caller runs it once its own pre-write refusals have passed, so a
+     * refused run leaves `xano.lock` untouched.
+     */
+    commitLock?: (opts?: CommitLockOptions) => void;
+    /**
+     * Present only when the compile was asked to defer its orphan warning
+     * (`deferOrphanWarning`): says it, once, leaving out the keys a `--prune` the
+     * caller has since planned deletes. A dry run writes no lock, so this is how
+     * its preview drops the "renamed? / deleted?" fix-ups for them (E2E pass 25).
+     */
+    warnLockOrphans?: (pruned?: ReadonlySet<string>) => void;
+    /**
+     * Present beside {@link commitLock}: says the orphan warning the deferred
+     * write would have said, for a run refused before it — the "renamed? / deleted?"
+     * fix-ups are as true of a refused deploy as of an export. Once: the write
+     * that follows does not repeat it.
+     */
+    warnOrphansUncommitted?: () => void;
+}
+/** What a deferring caller knows by the time it commits the lock. */
+interface CommitLockOptions {
+    /**
+     * Lock keys a confirmed `--prune` is about to delete. Their entries match no
+     * exported object BECAUSE the project deleted them, so the orphan warning's
+     * "renamed? / deleted?" fix-ups are not said for them.
+     */
+    readonly pruned?: ReadonlySet<string>;
+    /**
+     * The destination as it resolved, when that says more than `--to` did: a
+     * `tenant:<handle>` that is an ephemeral is `ephemeral:<handle>`, so a new
+     * lock's adopt pointer names the export that reads one (E2E pass 26).
+     */
+    readonly to?: string;
+    /**
+     * The run's plan only created, and met no conflict: the destination held
+     * nothing of this project's to adopt, so a new lock says no adopt pointer
+     * (E2E pass 28: a first `--to` deploy that only created still said it).
+     */
+    readonly nothingToAdopt?: boolean;
+}
+/**
+ * Thin wrapper over {@link compileBundle} for the many callers that only need the
+ * bundle text (export, preflight). Seed content is not built here.
+ *
+ * Exported from `@xano/sdk/node`, so this is a PUBLIC surface and it inherits
+ * the default: calling it writes and maintains `xano.lock` beside the entry
+ * file, and it can fail for the reasons a locked build fails (an unwritable
+ * directory, a lock that does not parse). That is deliberate — the default is
+ * about what compiling an entry file means, not about which process asked — but
+ * a programmatic caller that wants bytes and nothing else should pass
+ * `--no-lock` through its `ParsedArgs`.
+ */
+declare function exportBundleJson(args: ParsedArgs): Promise<string>;
+/**
+ * Compile an entry file to its `packageExport` bundle, running the full lock
+ * pipeline (seed → export → write). With `opts.seed`, also resolve + validate the
+ * tables' seed rows into signed `content/` archive entries — done HERE, inside the
+ * same lock-seeded context as the export, so a seed file's `dbo` guid matches the
+ * table's guid in `workspace.json`. Only the deploy path passes `seed:true`, so a
+ * plain `export`/`validate` never resolves seed sources.
+ */
+declare function compileBundle(args: ParsedArgs, opts?: {
+    seed?: boolean;
+    deferLockWrite?: boolean;
+    deferOrphanWarning?: boolean;
+}): Promise<CompiledBundle>;
+/**
+ * A stand-in token for every declared documentation scope, for a compile whose
+ * bytes are never signed for anyone: `routes`, and `export --check`.
+ *
+ * A stand-in, not an opt-out to empty: an emptied gate reads to the export's
+ * guards as docs about to go PUBLIC — a warning `--strict` promotes into a
+ * failure over a bundle nobody ships. With a value in place a gate reads as the
+ * gate it is, and every other finding still stands. No secrets file is read,
+ * because a fresh clone and a CI checkout have none. The value never leaves the
+ * process that made it.
+ */
+declare function checkStandInTokens(def: Xano): {
+    values: Record<string, string>;
+    allowEmpty: ReadonlySet<string>;
+};
+/** Record the credential scope this run acts as. `undefined` forgets it. */
+declare function noteRunScope(scope: EnvScope | undefined): void;
+/**
+ * The workspace documentation-gate refusal a `--keep-data` compile deferred,
+ * for a deploy whose arm is a REPLACE after all — new, recreated or
+ * unvouched-for: a replace writes the workspace's documentation block, and
+ * without the token the gate is gone. Undefined when nothing was deferred.
+ */
+declare function docTokenRefusalIfReplaced(replaceWhy: string): string | undefined;
+/**
+ * The refusal a `--keep-data` compile deferred, for a deploy whose arm turned
+ * out to be a REPLACE of an environment that holds data (`--keep-data` had
+ * nothing it could vouch for): there, an empty value does clear the live one.
+ * Undefined when nothing was deferred.
+ */
+declare function envRefusalIfReplaced(replaceWhy: string): string | undefined;
+
+export { type CommitLockOptions, type CompiledBundle, type HelpRequest, type ParsedArgs, assertEntryExists, carryRunWarnings, checkStandInTokens, compileBundle, composedChildren, docTokenRefusalIfReplaced, emitterFor, envNameRule, envRefusalIfReplaced, expandShortAttached, exportBundleJson, globalVersionAsked, globalVersionMisuse, isPathlessRun, loadDefault, loadModule, maskAssignments, missingLockDir, nearestLockPath, noteLockCreated, noteRunScope, orphanFixUps, parseArgs, printHelp, readVersion, refreshAgentGuidance, refreshRouteManifest, renameCandidatesFor, resolveHelpRequest, resolveLockPath, run, setGuidFixUp, tsxRemedy, withoutSecretValue };