This reference is generated from `cli-spec.json`, the machine-readable specification the `rendlio` build emits, so it cannot drift from the binary. It is a compatibility promise from first public release: flags are never repurposed, removals go through one minor version of deprecation warnings, and exit-code meanings never change. ## Invocation ``` rendlio [arguments] [options] ``` - Binary/command name: `rendlio`. Distributed as a .NET global tool (`Rendlio.Tool`), self-contained archives per platform, and a container image — see [Downloads](/downloads). - An unknown command prints usage on stderr and exits 3. - **Stream discipline:** all human and diagnostic text goes to **stderr**. **stdout** carries only document bytes, and only when `-o -` is used. Report JSON goes to the `--report` path (or stays a stderr summary). ## Commands | Command | Summary | |---|---| | [`rendlio convert`](/docs/cli/convert) | Convert a workbook to PDF, PDF/A-2b or PNG. | | [`rendlio diagnose`](/docs/cli/diagnose) | Analyse a workbook and report what a conversion would do — never writes documents, never exposes cell contents. | | [`rendlio license`](/docs/cli/license) | Inspect or verify the licence Rendlio would use. | | [`rendlio fonts`](/docs/cli/fonts) | Print the resolved font table. | | [`rendlio version`](/docs/cli/version) | Print the version banner. | ## Global options These apply to every command. | Option | Value | Default | Env var | Milestone | Meaning | |---|---|---|---|---|---| | `--license` | `PATH\|community` | — | `RENDLIO_LICENSE` | M1 | Licence file to use — the first step of [licence resolution](/docs/cli#licence-resolution). `community` asserts the Community tier when a community licence file is present. | ## Environment variables Precedence: **flag > environment variable > default.** The effective values are echoed into `report.options`, so a [report](/docs/compat-report) always shows what actually applied. | Variable | Meaning | |---|---| | `RENDLIO_LICENSE` | Licence file path or inline licence text (step 2 of [licence resolution](/docs/cli#licence-resolution)). | | `RENDLIO_FONTS_DIR` | Path list of user font directories. The environment form of `--fonts-dir`. | | `RENDLIO_CULTURE` | Same as `--culture`. | | `RENDLIO_RECALCULATE` | Same as `--recalculate` (`strict-v1` planned, M4). | | `RENDLIO_TIMEOUT` | Wall-clock timeout, whole seconds. The environment form of `--timeout`. | | `RENDLIO_MAX_MEMORY` | Memory soft cap, in **bytes** — note that the `--max-memory` flag takes **MB**. | | `RENDLIO_MAX_*` | Every quantitative resource-limit override — the [full registry](/docs/deployment#resource-limits) (file size, ZIP entries, XML depth, cell counts, …). | | `RENDLIO_SANDBOX` | `=1` enables sandbox hardening for untrusted-upload hosts: user font directories and system fonts are hard-disabled (bundled fonts only), `--recalculate=strict-v1` is refused, the default timeout tightens to 60 s, and any option the sandbox forbids fails with `W8112`, exit 3 — rather than being silently ignored. | | `NO_COLOR` | Disables colored stderr output. | ## Exit codes Normative — the meanings never change. | Code | Meaning | |---|---| | 0 | clean | | 1 | rendered with warnings | | 2 | unsupported content present | | 3 | invalid input | | 4 | resource limit hit | | 5 | internal error | Scripting contract: `exit <= 2` means the document exists and is complete per the report. The one exception is a `--recalculate=strict-v1` refusal, which produces no document — scripts using strict-v1 must check `result.status`. Above that nothing is written: on **3** the message says exactly what was invalid and the remedy; on **4** partial outputs are **deleted** and the message names the limit and its override; **5** is a bug, never silently swallowed — it asks you to file an issue with a `--verbose` log. CI users typically treat `<= 1` as pass and `2` as review; see [the exit-code contract](/docs/deployment#the-exit-code-contract) for ready-made pipeline shapes. ## Licence resolution The engine resolves at most one licence source — first match wins, no merging: 1. `--license ` 2. `RENDLIO_LICENSE` (a file path **or** an inline licence text) 3. `./Rendlio.license` (current working directory) 4. `~/.rendlio/Rendlio.license` 5. None ⇒ **watermark mode** + `W9001` `--license community` asserts the Community tier when a community licence file is present; bare `community` without a minted file is invalid (exit 3) — the free tier still requires the self-serve-minted file. Details: [Licensing guide](/docs/licensing). ## The stderr summary At the end of every `convert` and `diagnose`, a one-screen summary derived only from the report: ```text Rendlio 0.3.1 → invoice.pdf (7 pages, 262 ms) ~ 1 approximated: timePeriod conditional format (evaluated at 2026-08-19) ✘ 2 unsupported: stacked bar chart — Summary!chart2 (see report) ⚠ fonts: 'Aptos Narrow' missing → 'Carlito' substituted (layout may shift) exit 2 · full report: report.json · docs: rendlio.com/docs/report ``` Convert-mode reports carry deviations only, so no "features rendered" line is printed. Plain ASCII fallback when the console lacks Unicode. `--quiet` suppresses all but errors. ## Stability promise From first public release: flags are never repurposed; removals go through one minor version of deprecation warnings; exit-code meanings never change; the report and IR schemas are versioned independently (see [compatibility report](/docs/compat-report#schema-and-versioning)).