@bedrock-rbx/core 0.1.0-beta.1

package/dist/cli/run.mjs

@@ -0,0 +1,1476 @@
+#!/usr/bin/env node
+import { T as serializeStateFile, a as buildStatePort, d as resolveStateConfig, f as flattenConfig, h as diff, i as loadConfig, l as validatePlan, n as serializeConfig, o as buildDesired, r as deploy, t as migrateMantleState, u as selectEnvironment } from "../migrate-mantle-state-DqbJ1TLq.mjs";
+import { PermissionError } from "@bedrock-rbx/ocale";
+import process from "node:process";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import sade from "sade";
+import { cancel, intro, isCancel, log, outro, path, select, text } from "@clack/prompts";
+//#region package.json
+var version = "0.1.0-beta.1";
+//#endregion
+//#region src/cli/parse-options.ts
+const RECOGNIZED_FLAGS$1 = new Set([
+	"api-key",
+	"apiKey",
+	"config",
+	"env",
+	"github-token",
+	"githubToken"
+]);
+const SADE_RESERVED$1 = new Set([
+	"--",
+	"_",
+	"h",
+	"help",
+	"v",
+	"version"
+]);
+/**
+* Translate the raw sade options POJO into a typed `CommonOptions`. Reads
+* `BEDROCK_ENVIRONMENT` from `process.env` as a fallback when `--env` is
+* absent; inject `getEnvironment` to redirect or isolate the lookup. No
+* clack, no sade types. Reused by `bedrock deploy` and `bedrock diff`.
+* @param rawOptions - The options object sade hands the action callback.
+* @param getEnvironment - Reads an environment variable; consulted as a
+*   fallback for `--env` when no flag was supplied. Defaults to a
+*   `process.env` reader.
+* @returns `Ok(CommonOptions)` on success, or `Err(ParseOptionsError)` when a
+*   required flag is missing or an unrecognized flag was supplied.
+*/
+function parseCommonOptions(rawOptions, getEnvironment = readProcessEnvironment$1) {
+	for (const key of Object.keys(rawOptions)) if (!RECOGNIZED_FLAGS$1.has(key) && !SADE_RESERVED$1.has(key)) return {
+		err: {
+			flag: key,
+			kind: "unknownFlag"
+		},
+		success: false
+	};
+	const environments = resolveEnvironments(rawOptions["env"], getEnvironment);
+	if (!environments.success) return environments;
+	const apiKey = pickString(rawOptions, "apiKey", "api-key");
+	const configFile = pickString(rawOptions, "config");
+	const githubToken = pickString(rawOptions, "githubToken", "github-token");
+	return {
+		data: {
+			environments: environments.data,
+			...apiKey === void 0 ? {} : { apiKey },
+			...configFile === void 0 ? {} : { configFile },
+			...githubToken === void 0 ? {} : { githubToken }
+		},
+		success: true
+	};
+}
+function resolveEnvironments(raw, getEnvironment) {
+	if (raw === void 0) {
+		const fallback = getEnvironment("BEDROCK_ENVIRONMENT");
+		if (fallback === void 0) return {
+			err: {
+				flag: "env",
+				kind: "missingRequired"
+			},
+			success: false
+		};
+		return {
+			data: [fallback],
+			success: true
+		};
+	}
+	const candidates = Array.isArray(raw) ? raw : [raw];
+	const environments = [];
+	for (const candidate of candidates) {
+		if (typeof candidate !== "string") return {
+			err: {
+				flag: "env",
+				kind: "invalidValue"
+			},
+			success: false
+		};
+		environments.push(candidate);
+	}
+	return {
+		data: environments,
+		success: true
+	};
+}
+function readProcessEnvironment$1(name) {
+	return process.env[name];
+}
+function pickString(rawOptions, ...keys) {
+	for (const key of keys) {
+		const value = rawOptions[key];
+		if (typeof value === "string") return value;
+	}
+}
+//#endregion
+//#region src/cli/render.ts
+/**
+* Render a `DeployError` to the supplied `ClackPort` as a single error line.
+* Each variant produces a distinct, terse diagnostic; wrapped variants
+* (`applyFailed`, `buildDesiredFailed`, `configLoadFailed`, `stateReadFailed`,
+* `stateWriteFailed`) surface the inner cause's actionable detail (file path,
+* resource key, parser message, HTTP failure, validator issue) so the reader
+* does not have to inspect the full cause to act.
+* @param err - The deploy error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderDeployError(err, port) {
+	port.logError(deployErrorMessage(err));
+}
+/**
+* Render a `ParseOptionsError` to the supplied `ClackPort` as a single
+* error line. Each variant names the offending flag so the diagnostic
+* pinpoints what the caller needs to change.
+* @param err - The parse error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderParseError(err, port) {
+	port.logError(parseErrorMessage(err));
+}
+/**
+* Construct a `ClackPort` whose methods delegate to `@clack/prompts`. The
+* resulting port writes to `process.stdout` via clack's defaults.
+* @returns A port whose six methods each invoke the matching clack helper.
+*/
+function createClackPort() {
+	return {
+		cancel: (message) => {
+			cancel(message);
+		},
+		intro: (message) => {
+			intro(message);
+		},
+		logError: (message) => {
+			log.error(message);
+		},
+		logMessage: (message) => {
+			log.message(message);
+		},
+		logSuccess: (message) => {
+			log.success(message);
+		},
+		outro: (message) => {
+			outro(message);
+		}
+	};
+}
+/**
+* Render a `ParseMigrateError` to the supplied `ClackPort`. Reuses
+* `parseErrorMessage` for the three flag-shape variants and adds a
+* dedicated message for `unknownSource` listing the supported sources.
+* @param err - The parse error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderMigrateParseError(err, port) {
+	port.logError(migrateParseErrorMessage(err));
+}
+/**
+* Render a `MigrateError` to the supplied `ClackPort` as a single error
+* line. Each variant points at the offending Mantle state file path,
+* primary-environment input, or wrapped `ConfigError` so the reader can
+* act without inspecting the raw error object.
+* @param err - The migrate error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderMigrateError(err, port) {
+	port.logError(migrateErrorMessage(err));
+}
+/**
+* Render a `MissingCredentialError` or `UnsupportedBackendError`
+* surfaced when the migrate command tried to default-construct the
+* configured `StatePort` and was missing its inputs.
+* @param err - The error returned by `buildStatePort`.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderBuildStatePortError(err, port) {
+	port.logError(buildStatePortErrorMessage(err));
+}
+/**
+* Render the post-migrate review prompt to the supplied `ClackPort`.
+* Three outcomes:
+*
+* - Any `ambiguous` warnings exist: emit a single error line directing
+*   the user to the report. The migration ran but there are decisions
+*   the user still needs to make before deploy will be meaningful.
+* - No `ambiguous` warnings but non-zero `blocked` / `deferred` /
+*   `interpretive`: emit a single success line pointing at the report
+*   for auditing.
+* - All counts zero: silent. The closing `outro("migrate succeeded")`
+*   already speaks for the run.
+* @param input - Counts plus the path of the Markdown report.
+* @param port - The output port the line is written to.
+*/
+function renderMigrationSummary(input, port) {
+	const { ambiguousCount, blockedCount, deferredCount, interpretiveCount } = input.summary;
+	if (ambiguousCount > 0) {
+		port.logError(`action required: ${String(ambiguousCount)} fields need your input. See ${input.reportPath}`);
+		return;
+	}
+	const reviewable = blockedCount + deferredCount + interpretiveCount;
+	if (reviewable > 0) port.logSuccess(`migration complete; see ${input.reportPath} for ${String(reviewable)} auto-mapped or skipped fields`);
+}
+/**
+* Render a `StateError` produced when the migrator wrote a per-environment
+* state through the `StatePort`. Names the environment alongside the
+* adapter's failure reason so the reader knows which write failed.
+* @param input - Environment + state-error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderStateWriteError(input, port) {
+	port.logError(`state write failed for '${input.environment}' (${input.err.file}): ${input.err.reason}`);
+}
+function permissionDetail(err) {
+	const isPlural = err.requiredScopes.length > 1;
+	const label = isPlural ? "scopes" : "scope";
+	const pronoun = isPlural ? "them" : "it";
+	const scopeList = err.requiredScopes.map((scope) => `'${scope}'`).join(", ");
+	return `${err.message} on ${err.operationKey}: missing required ${label} ${scopeList}. Grant ${pronoun} on the API key at https://create.roblox.com/credentials`;
+}
+function applyCauseDetail(cause) {
+	switch (cause.kind) {
+		case "driverFailure":
+			if (cause.cause instanceof PermissionError) return permissionDetail(cause.cause);
+			return cause.cause.message;
+		case "updateUnsupported": return "update not supported";
+	}
+}
+function buildDesiredDetail(cause) {
+	switch (cause.kind) {
+		case "fileReadFailed": return `(${cause.filePath}): ${cause.reason}`;
+		case "iconRemovalRejected": return `: ${cause.message}`;
+	}
+}
+function configErrorDetail(err) {
+	switch (err.kind) {
+		case "configFunctionFailed": return `${err.sourceFile}: config function threw: ${err.message}`;
+		case "fileNotFound": return `no bedrock config under ${err.searchedFrom}`;
+		case "luauRuntimeMissing": return `${err.sourceFile}: ${err.hint}`;
+		case "parseFailed": return `${err.sourceFile}: ${err.message}`;
+		case "validationFailed": {
+			const first = err.issues[0];
+			return first === void 0 ? `${err.sourceFile}: invalid` : `${err.sourceFile}: ${first.path.join(".")} ${first.message}`;
+		}
+	}
+}
+function stateErrorDetail(cause) {
+	return `(${cause.file}): ${cause.reason}`;
+}
+function deployErrorMessage(err) {
+	switch (err.kind) {
+		case "applyFailed": return `apply failed for '${err.cause.key}': ${applyCauseDetail(err.cause)}`;
+		case "buildDesiredFailed": return `build desired state failed for '${err.cause.key}' ${buildDesiredDetail(err.cause)}`;
+		case "configLoadFailed": return `config load failed: ${configErrorDetail(err.cause)}`;
+		case "incompletePlaceEntry": return `place '${err.key}' is missing '${err.missingField}' under environment '${err.environment}'`;
+		case "incompleteUniverseEntry": return `universe is missing '${err.missingField}' under environment '${err.environment}'`;
+		case "missingCredential": return `missing credential: environment variable ${err.variable} is not set`;
+		case "registryConfigMissing": return `registry config missing '${err.missing}' (${err.hint})`;
+		case "stateNotConfigured": return `state not configured for environment '${err.environment}'`;
+		case "stateReadFailed": return `state read failed ${stateErrorDetail(err.cause)}`;
+		case "stateWriteFailed": return `state write failed ${stateErrorDetail(err.cause)}`;
+		case "unknownEnvironment": return `unknown environment '${err.environment}' (declared: ${err.declared.join(", ")})`;
+		case "unsupportedBackend": return `unsupported state backend '${err.backend}' (${err.hint})`;
+	}
+}
+function parseErrorMessage(err) {
+	switch (err.kind) {
+		case "invalidValue": return `invalid value for flag '--${err.flag}' (expected a string)`;
+		case "missingRequired": return `missing required flag --${err.flag}`;
+		case "unknownFlag": return `unknown flag '--${err.flag}'`;
+	}
+}
+function migrateParseErrorMessage(err) {
+	if (err.kind === "unknownSource") return `unknown migration source '${err.received}' (supported: ${err.supported.join(", ")})`;
+	return parseErrorMessage(err);
+}
+function migrateErrorMessage(err) {
+	switch (err.kind) {
+		case "internalError": return `migrate internal error: ${err.reason} (${configErrorDetail(err.cause)})`;
+		case "primaryEnvironmentNotFound": return `primary environment '${err.primary}' not found (available: ${err.available.join(", ")})`;
+		case "primaryEnvironmentRequired": return `primary environment required (available: ${err.available.join(", ")})`;
+		case "stateFileNotFound": return `Mantle state file not found at '${err.path}'`;
+		case "stateParseFailed": return `Mantle state file at '${err.path}' could not be parsed: ${err.reason}`;
+		case "unsupportedMantleStateVersion": return `unsupported Mantle state version '${err.found}' (supported: ${err.supported.join(", ")})`;
+	}
+}
+function buildStatePortErrorMessage(err) {
+	switch (err.kind) {
+		case "missingCredential": return `missing credential: environment variable ${err.variable} is not set`;
+		case "unsupportedBackend": return `unsupported state backend '${err.backend}' (${err.hint})`;
+	}
+}
+//#endregion
+//#region src/cli/commands/deploy.ts
+/**
+* Build the sade action for `bedrock deploy`. The returned function consumes
+* the raw options object sade hands the action callback, parses it via
+* `parseCommonOptions`, loads the project config once, and dispatches
+* `deploy()` for each `--env` value in order. Per-env successes and failures
+* render through clack as a single line each; the aggregated exit code is
+* `EXIT_OK` only when every env succeeded.
+* @param deps - Dependency overrides; missing slots are default-constructed
+*   from real implementations.
+* @returns An async sade action that returns once `deps.exit` was invoked.
+*/
+function deployCommand(deps) {
+	const resolved = resolveDeploy(deps);
+	return async (rawOptions) => {
+		const code = await runDeploy(rawOptions, resolved);
+		resolved.exit(code);
+	};
+}
+function resolveDeploy(deps) {
+	return {
+		clack: deps.clack ?? createClackPort(),
+		deploy: deps.deploy ?? deploy,
+		exit: deps.exit ?? ((code) => process.exit(code)),
+		loadConfig: deps.loadConfig ?? loadConfig
+	};
+}
+function loadOptionsFor$1(parsed) {
+	return parsed.configFile === void 0 ? void 0 : { configFile: parsed.configFile };
+}
+async function dispatchEnvironments$1(inputs) {
+	const { config, environments, getEnv, resolved } = inputs;
+	const failed = [];
+	for (const environment of environments) {
+		const result = await resolved.deploy({
+			config,
+			environment,
+			getEnv
+		});
+		if (result.success) resolved.clack.logSuccess(`${environment}: ${result.data.resources.length} resources reconciled`);
+		else {
+			renderDeployError(result.err, resolved.clack);
+			failed.push(environment);
+		}
+	}
+	return failed;
+}
+function buildGetEnvironment$1(parsed) {
+	return (name) => {
+		if (name === "ROBLOX_API_KEY" && parsed.apiKey !== void 0) return parsed.apiKey;
+		if (name === "GITHUB_TOKEN" && parsed.githubToken !== void 0) return parsed.githubToken;
+		return process.env[name];
+	};
+}
+function cancelAsFailed$1(clack) {
+	clack.cancel("deploy failed");
+}
+async function runDeploy(rawOptions, resolved) {
+	resolved.clack.intro("bedrock deploy");
+	const parsed = parseCommonOptions(rawOptions);
+	if (!parsed.success) {
+		renderParseError(parsed.err, resolved.clack);
+		cancelAsFailed$1(resolved.clack);
+		return 1;
+	}
+	const loaded = await resolved.loadConfig(loadOptionsFor$1(parsed.data));
+	if (!loaded.success) {
+		renderDeployError({
+			cause: loaded.err,
+			kind: "configLoadFailed"
+		}, resolved.clack);
+		cancelAsFailed$1(resolved.clack);
+		return 1;
+	}
+	if ((await dispatchEnvironments$1({
+		config: loaded.data,
+		environments: parsed.data.environments,
+		getEnv: buildGetEnvironment$1(parsed.data),
+		resolved
+	})).length > 0) {
+		cancelAsFailed$1(resolved.clack);
+		return 1;
+	}
+	resolved.clack.outro("deploy succeeded");
+	return 0;
+}
+//#endregion
+//#region src/shell/preview-diff.ts
+/**
+* Compute the operations `deploy` would apply for a target environment
+* without writing state. Default-constructs missing deps from the project
+* config and `GITHUB_TOKEN`; never reads `process.env` when `statePort`
+* and `config` are both supplied explicitly.
+*
+* @param options - Target environment plus optional overrides.
+* @returns The computed operations on success, or a stage-tagged
+*   `PreviewDiffError` on failure.
+*/
+async function previewDiff(options) {
+	const resolved = await resolveDeps(options);
+	if (!resolved.success) return resolved;
+	return runPreview(options.environment, resolved.data);
+}
+async function pickConfig(options) {
+	if (options.config !== void 0) return {
+		data: options.config,
+		success: true
+	};
+	const loaded = await (options.loadConfig ?? loadConfig)();
+	if (!loaded.success) return {
+		err: {
+			cause: loaded.err,
+			kind: "configLoadFailed"
+		},
+		success: false
+	};
+	return {
+		data: loaded.data,
+		success: true
+	};
+}
+function readProcessEnvironment(name) {
+	return process.env[name];
+}
+function getEnvironmentOf(options) {
+	return options.getEnv ?? readProcessEnvironment;
+}
+function pickStatePort(options, config) {
+	if (options.statePort !== void 0) return {
+		data: options.statePort,
+		success: true
+	};
+	const stateConfig = resolveStateConfig(config, options.environment);
+	if (!stateConfig.success) return {
+		err: stateConfig.err,
+		success: false
+	};
+	return buildStatePort({
+		fetch: options.fetch,
+		getEnv: getEnvironmentOf(options),
+		stateConfig: stateConfig.data
+	});
+}
+async function resolveDeps(options) {
+	const config = await pickConfig(options);
+	if (!config.success) return config;
+	const selected = selectEnvironment(config.data, options.environment);
+	if (!selected.success) return {
+		err: selected.err,
+		success: false
+	};
+	const effective = selected.data;
+	const readFile$1 = options.readFile ?? readFile;
+	const statePort = pickStatePort(options, effective);
+	if (!statePort.success) return statePort;
+	return {
+		data: {
+			config: effective,
+			readFile: readFile$1,
+			statePort: statePort.data
+		},
+		success: true
+	};
+}
+async function runPreview(environment, deps) {
+	const desired = await buildDesired(flattenConfig(deps.config), deps.readFile);
+	if (!desired.success) return {
+		err: {
+			cause: desired.err,
+			kind: "buildDesiredFailed"
+		},
+		success: false
+	};
+	const prior = await deps.statePort.read(environment);
+	if (!prior.success) return {
+		err: {
+			cause: prior.err,
+			kind: "stateReadFailed"
+		},
+		success: false
+	};
+	const priorResources = prior.data?.resources ?? [];
+	const validated = validatePlan(desired.data, priorResources);
+	if (!validated.success) return {
+		err: {
+			cause: validated.err,
+			kind: "buildDesiredFailed"
+		},
+		success: false
+	};
+	return {
+		data: {
+			environment,
+			ops: diff(desired.data, priorResources)
+		},
+		success: true
+	};
+}
+//#endregion
+//#region src/cli/commands/diff.ts
+/**
+* Build the sade action for `bedrock diff`. The returned function consumes
+* the raw options object sade hands the action callback, parses it via
+* `parseCommonOptions`, loads the project config once, and dispatches
+* `previewDiff()` for each `--env` value in order. Per-env successes render
+* the operations list (or a `No drift` line when every op is a noop);
+* failures render via `renderDeployError`. The aggregated exit code is
+* `EXIT_OK` only when every env succeeded.
+* @param deps - Dependency overrides; missing slots are default-constructed
+*   from real implementations.
+* @returns An async sade action that returns once `deps.exit` was invoked.
+*/
+function diffCommand(deps) {
+	const resolved = resolveDiff(deps);
+	return async (rawOptions) => {
+		const code = await runDiff(rawOptions, resolved);
+		resolved.exit(code);
+	};
+}
+function resolveDiff(deps) {
+	return {
+		clack: deps.clack ?? createClackPort(),
+		exit: deps.exit ?? ((code) => process.exit(code)),
+		loadConfig: deps.loadConfig ?? loadConfig,
+		previewDiff: deps.previewDiff ?? previewDiff
+	};
+}
+function loadOptionsFor(parsed) {
+	return parsed.configFile === void 0 ? void 0 : { configFile: parsed.configFile };
+}
+function buildGetEnvironment(parsed) {
+	return (name) => {
+		if (name === "ROBLOX_API_KEY" && parsed.apiKey !== void 0) return parsed.apiKey;
+		if (name === "GITHUB_TOKEN" && parsed.githubToken !== void 0) return parsed.githubToken;
+		return process.env[name];
+	};
+}
+function cancelAsFailed(clack) {
+	clack.cancel("diff failed");
+}
+function describeOp(op) {
+	switch (op.type) {
+		case "create": return `+ ${op.desired.kind}:${op.key}`;
+		case "update": return `~ ${op.desired.kind}:${op.key}`;
+	}
+}
+function isDriftOp(op) {
+	return op.type !== "noop";
+}
+function renderPreview(preview, clack) {
+	const drift = preview.ops.filter(isDriftOp);
+	if (drift.length === 0) {
+		clack.logSuccess(`No drift for "${preview.environment}"`);
+		return false;
+	}
+	clack.logMessage(`Pending changes for "${preview.environment}":`);
+	for (const op of drift) clack.logMessage(describeOp(op));
+	return true;
+}
+async function dispatchEnvironments(inputs) {
+	const { config, environments, getEnv, resolved } = inputs;
+	const failed = [];
+	let hasDrift = false;
+	for (const environment of environments) {
+		const result = await resolved.previewDiff({
+			config,
+			environment,
+			getEnv
+		});
+		if (result.success) {
+			if (renderPreview(result.data, resolved.clack)) hasDrift = true;
+		} else {
+			renderDeployError(result.err, resolved.clack);
+			failed.push(environment);
+		}
+	}
+	return {
+		failed,
+		hasDrift
+	};
+}
+function outroFor(hasDrift) {
+	return hasDrift ? "run bedrock deploy to apply pending changes" : "all environments are up to date";
+}
+async function runDiff(rawOptions, resolved) {
+	resolved.clack.intro("bedrock diff");
+	const parsed = parseCommonOptions(rawOptions);
+	if (!parsed.success) {
+		renderParseError(parsed.err, resolved.clack);
+		cancelAsFailed(resolved.clack);
+		return 1;
+	}
+	const loaded = await resolved.loadConfig(loadOptionsFor(parsed.data));
+	if (!loaded.success) {
+		renderDeployError({
+			cause: loaded.err,
+			kind: "configLoadFailed"
+		}, resolved.clack);
+		cancelAsFailed(resolved.clack);
+		return 1;
+	}
+	const outcome = await dispatchEnvironments({
+		config: loaded.data,
+		environments: parsed.data.environments,
+		getEnv: buildGetEnvironment(parsed.data),
+		resolved
+	});
+	if (outcome.failed.length > 0) {
+		cancelAsFailed(resolved.clack);
+		return 1;
+	}
+	resolved.clack.outro(outroFor(outcome.hasDrift));
+	return 0;
+}
+//#endregion
+//#region src/cli/default-migrate-prompt-port.ts
+const FORMAT_OPTIONS = [{
+	hint: "recommended",
+	label: "TypeScript",
+	value: "typescript"
+}, {
+	label: "YAML",
+	value: "yaml"
+}];
+const BACKEND_OPTIONS = [{
+	label: "GitHub Gist",
+	value: "gist"
+}, {
+	hint: "writes .bedrock/state/<env>.json next to bedrock.config",
+	label: "Local files",
+	value: "local"
+}];
+const SOURCE_LABELS = { mantle: "Mantle" };
+const defaultHelpers = {
+	isCancel,
+	path,
+	select,
+	text
+};
+/**
+* Construct a `MigratePromptPort` whose methods delegate to
+* `@clack/prompts`. Each prompt translates clack's cancel sentinel into
+* a typed `Err({ kind: "cancelled" })` so the migrate command branches
+* on `Result` like every other shell call.
+*
+* @param helpers - Test-only seam for swapping the three clack
+*   primitives. Production callers omit this argument.
+* @returns A live `MigratePromptPort` ready to drive interactively.
+*/
+function createDefaultMigratePromptPort(helpers = defaultHelpers) {
+	return {
+		promptConfigFormat: async () => promptConfigFormatFrom(helpers),
+		promptGistId: async () => promptGistIdFrom(helpers),
+		promptMigrationSource: async (sources) => selectMigrationSource(helpers, sources),
+		promptPrimaryEnvironment: async (environments) => selectPrimaryEnvironment(helpers, environments),
+		promptStateBackend: async () => promptStateBackendFrom(helpers),
+		promptStateFilePath: async () => promptStateFilePathFrom(helpers)
+	};
+}
+async function fromSelect(helpers, inputs) {
+	const result = await helpers.select({
+		message: inputs.message,
+		options: inputs.options.map((option) => {
+			return {
+				...option.hint === void 0 ? {} : { hint: option.hint },
+				label: option.label,
+				value: option.value
+			};
+		}),
+		...inputs.initialValue === void 0 ? {} : { initialValue: inputs.initialValue }
+	});
+	if (helpers.isCancel(result)) return {
+		err: { kind: "cancelled" },
+		success: false
+	};
+	return {
+		data: result,
+		success: true
+	};
+}
+async function selectMigrationSource(helpers, sources) {
+	return fromSelect(helpers, {
+		initialValue: sources[0],
+		message: "Migrate from?",
+		options: sources.map((source) => ({
+			label: SOURCE_LABELS[source],
+			value: source
+		}))
+	});
+}
+async function promptConfigFormatFrom(helpers) {
+	return fromSelect(helpers, {
+		initialValue: "typescript",
+		message: "Output config format?",
+		options: FORMAT_OPTIONS
+	});
+}
+function validateNonEmpty(value) {
+	if (value === void 0 || value.trim() === "") return "Required";
+}
+async function fromText(helpers, options) {
+	const result = await helpers.text(options);
+	if (helpers.isCancel(result)) return {
+		err: { kind: "cancelled" },
+		success: false
+	};
+	return {
+		data: result,
+		success: true
+	};
+}
+async function promptGistIdFrom(helpers) {
+	return fromText(helpers, {
+		message: "Gist ID for state storage?",
+		placeholder: "abc123",
+		validate: validateNonEmpty
+	});
+}
+async function selectPrimaryEnvironment(helpers, environments) {
+	return fromSelect(helpers, {
+		message: "Which environment should be the primary?\nThe migrator uses it as the baseline for the generated config.",
+		options: environments.map((name) => ({
+			label: name,
+			value: name
+		}))
+	});
+}
+async function promptStateBackendFrom(helpers) {
+	return fromSelect(helpers, {
+		initialValue: "gist",
+		message: "State backend?",
+		options: BACKEND_OPTIONS
+	});
+}
+async function fromPath(helpers, options) {
+	const result = await helpers.path(options);
+	if (helpers.isCancel(result)) return {
+		err: { kind: "cancelled" },
+		success: false
+	};
+	return {
+		data: result,
+		success: true
+	};
+}
+async function promptStateFilePathFrom(helpers) {
+	return fromPath(helpers, {
+		initialValue: ".mantle-state.yml",
+		message: "Path to the Mantle state file?",
+		validate: validateNonEmpty
+	});
+}
+//#endregion
+//#region src/cli/parse-migrate-options.ts
+/**
+* Sources `bedrock migrate --from <source>` accepts. Today only `"mantle"`
+* is wired up; widening this tuple turns on additional sources without
+* touching the parser.
+*/
+const SUPPORTED_MIGRATION_SOURCES = ["mantle"];
+const RECOGNIZED_FLAGS = new Set(["from"]);
+const SADE_RESERVED = new Set([
+	"--",
+	"_",
+	"h",
+	"help",
+	"v",
+	"version"
+]);
+/**
+* Translate the raw sade options POJO into a typed `MigrateOptions`. The
+* positional `<stateFilePath>` argument is not handled here: sade hands
+* positional values to the action callback ahead of the options object,
+* and the migrate command falls back to an interactive prompt when it
+* is absent. This parser only covers the `--from` flag, which is also
+* optional and prompted for when omitted.
+*
+* @param rawOptions - The options object sade hands the action callback.
+* @returns `Ok(MigrateOptions)` on success, or `Err(ParseMigrateError)`
+*   describing the offending flag or value.
+*/
+function parseMigrateOptions(rawOptions) {
+	for (const key of Object.keys(rawOptions)) if (!RECOGNIZED_FLAGS.has(key) && !SADE_RESERVED.has(key)) return {
+		err: {
+			flag: key,
+			kind: "unknownFlag"
+		},
+		success: false
+	};
+	const fromRaw = rawOptions["from"];
+	if (fromRaw === void 0) return {
+		data: { from: void 0 },
+		success: true
+	};
+	if (typeof fromRaw !== "string") return {
+		err: {
+			flag: "from",
+			kind: "invalidValue"
+		},
+		success: false
+	};
+	if (!isMigrationSource(fromRaw)) return {
+		err: {
+			kind: "unknownSource",
+			received: fromRaw,
+			supported: SUPPORTED_MIGRATION_SOURCES
+		},
+		success: false
+	};
+	return {
+		data: { from: fromRaw },
+		success: true
+	};
+}
+function isMigrationSource(value) {
+	return SUPPORTED_MIGRATION_SOURCES.includes(value);
+}
+//#endregion
+//#region src/cli/commands/describe-unknown.ts
+/**
+* Format a thrown value as a human-readable string for clack diagnostic
+* lines. Native `Error` instances surface their `message`; everything
+* else is coerced via `String()` so non-Error throws (rejection of a
+* primitive, for example) still render legibly.
+*
+* @param value - The caught value to describe.
+* @returns A short string suitable for inlining into a CLI error line.
+*/
+function describeUnknown(value) {
+	return value instanceof Error ? value.message : String(value);
+}
+//#endregion
+//#region src/cli/commands/write-migrated-states.ts
+/**
+* Persist every per-environment state in the migration report to the
+* resolved target. Dispatches to the GitHub Gist `StatePort` adapter or
+* to a local-file dump under `target.outputDir`. On failure the writer
+* has already rendered the error to `deps.clack`; the caller only needs
+* to translate the Err into an exit code.
+*
+* @param inputs - Resolved deps, the migration report, and the target
+*   the writer should dispatch on.
+* @returns `Ok(void)` once every environment has been written; `Err(void)`
+*   on the first failure (already rendered to clack).
+*/
+async function writeMigratedStates(inputs) {
+	if (inputs.target.backend === "local") return writeStatesToLocal({
+		...inputs,
+		target: inputs.target
+	});
+	return writeStatesToGist({
+		...inputs,
+		target: inputs.target
+	});
+}
+async function writeStatesToGist(inputs) {
+	const { deps, report, target } = inputs;
+	const portResult = deps.buildStatePort({
+		getEnv: (name) => process.env[name],
+		stateConfig: target.stateConfig
+	});
+	if (!portResult.success) {
+		renderBuildStatePortError(portResult.err, deps.clack);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	for (const [environment, state] of Object.entries(report.statesByEnvironment)) {
+		const writeResult = await portResult.data.write(state);
+		if (!writeResult.success) {
+			renderStateWriteError({
+				environment,
+				err: writeResult.err
+			}, deps.clack);
+			return {
+				err: void 0,
+				success: false
+			};
+		}
+		deps.clack.logSuccess(`${environment}: ${state.resources.length} resources migrated`);
+	}
+	return {
+		data: void 0,
+		success: true
+	};
+}
+async function writeStatesToLocal(inputs) {
+	const { deps, report, target } = inputs;
+	try {
+		await deps.mkdir(target.outputDir);
+	} catch (err) {
+		deps.clack.logError(`local state directory create failed (${target.outputDir}): ${describeUnknown(err)}`);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	for (const [environment, state] of Object.entries(report.statesByEnvironment)) {
+		const filePath = join(target.outputDir, `${environment}.json`);
+		try {
+			await deps.writeFile(filePath, serializeStateFile(state));
+		} catch (err) {
+			deps.clack.logError(`local state write failed (${filePath}): ${describeUnknown(err)}`);
+			return {
+				err: void 0,
+				success: false
+			};
+		}
+		deps.clack.logSuccess(`${environment}: ${state.resources.length} resources migrated`);
+	}
+	return {
+		data: void 0,
+		success: true
+	};
+}
+//#endregion
+//#region src/core/migrate/render-migration-report-md.ts
+/**
+* Render a {@link MigrationReportFile} as the Markdown body written to
+* `.bedrock/migration-report.md`. Pure derivation: the same input shape
+* the JSON serializer consumes feeds this renderer, so the Markdown view
+* round-trips through the JSON file.
+*
+* Output structure:
+* - Header with the four counts.
+* - Sections in user-action priority order (Action required, Blocked,
+*   Deferred, Interpretive). Sections with no matching warnings are
+*   omitted entirely.
+* - Within each section, warnings are grouped by their non-path
+*   discriminator (`hint` for ambiguous, `reason` for blocked/deferred,
+*   `rule` for interpretive). First-appearance order is preserved.
+* - Interpretive entries render as `mantlePath -> bedrockPath` so the
+*   user can verify the auto-applied mapping at a glance.
+*
+* @param file - The summary plus warnings to render.
+* @returns Markdown source ending with a trailing newline.
+*/
+function renderMigrationReportMarkdown(file) {
+	const sections = [
+		renderActionRequired(file.warnings),
+		renderBlocked(file.warnings),
+		renderDeferred(file.warnings),
+		renderInterpretive(file.warnings)
+	].filter((section) => section !== "");
+	return [renderHeader(file), ...sections].join("\n");
+}
+function renderHeader(file) {
+	return [
+		"# Migration report",
+		"",
+		`ambiguous: ${String(file.summary.ambiguousCount)}`,
+		`blocked: ${String(file.summary.blockedCount)}`,
+		`deferred: ${String(file.summary.deferredCount)}`,
+		`interpretive: ${String(file.summary.interpretiveCount)}`,
+		""
+	].join("\n");
+}
+function suffixOf(mantlePath) {
+	return mantlePath.slice(mantlePath.indexOf(".") + 1);
+}
+function groupByKey(warnings, key) {
+	const orderedKeys = [...new Set(warnings.map(key))];
+	return new Map(orderedKeys.map((groupKey) => [groupKey, warnings.filter((warning) => key(warning) === groupKey)]));
+}
+function environmentOf(mantlePath) {
+	const dot = mantlePath.indexOf(".");
+	return dot === -1 ? void 0 : mantlePath.slice(0, dot);
+}
+function environmentsOf(members) {
+	const environments = members.map((warning) => environmentOf(warning.mantlePath)).filter((environment) => environment !== void 0);
+	return [...new Set(environments)];
+}
+function renderBullet(subject, members) {
+	const environments = environmentsOf(members);
+	return environments.length === 0 ? `- ${subject}` : `- ${subject} (${environments.join(", ")})`;
+}
+function renderSection(input) {
+	if (input.warnings.length === 0) return "";
+	const blocks = [...groupByKey(input.warnings, input.groupKey)].map(([heading, members]) => {
+		const lines = [...groupByKey(members, input.subject)].map(([key, subjectMembers]) => renderBullet(key, subjectMembers));
+		return [
+			`### ${heading}`,
+			"",
+			...lines,
+			""
+		].join("\n");
+	});
+	return [
+		`## ${input.title}`,
+		"",
+		...blocks
+	].join("\n");
+}
+function renderActionRequired(warnings) {
+	return renderSection({
+		groupKey: (warning) => warning.hint,
+		subject: (warning) => suffixOf(warning.mantlePath),
+		title: "Action required",
+		warnings: warnings.filter((warning) => {
+			return warning.kind === "ambiguous";
+		})
+	});
+}
+function renderBlocked(warnings) {
+	return renderSection({
+		groupKey: (warning) => warning.reason,
+		subject: (warning) => suffixOf(warning.mantlePath),
+		title: "Won't migrate (no Open Cloud equivalent)",
+		warnings: warnings.filter((warning) => {
+			return warning.kind === "blocked";
+		})
+	});
+}
+function renderDeferred(warnings) {
+	return renderSection({
+		groupKey: (warning) => warning.reason,
+		subject: (warning) => suffixOf(warning.mantlePath),
+		title: "Coming later (skipped for now)",
+		warnings: warnings.filter((warning) => {
+			return warning.kind === "deferred";
+		})
+	});
+}
+function renderInterpretive(warnings) {
+	return renderSection({
+		groupKey: (warning) => warning.rule,
+		subject: (warning) => `${suffixOf(warning.mantlePath)} -> ${warning.bedrockPath}`,
+		title: "Auto-mapped (please verify)",
+		warnings: warnings.filter((warning) => {
+			return warning.kind === "interpretive";
+		})
+	});
+}
+//#endregion
+//#region src/core/migrate/serialize-migration-report.ts
+/**
+* Serialize a {@link MigrationReportFile} as the bytes written to
+* `.bedrock/migration-report.json`. The output is canonical JSON:
+* pretty-printed with two-space indentation, terminated with a trailing newline.
+*
+* @param file - The summary plus warnings to serialize.
+* @returns A UTF-8 source string ending with a trailing newline.
+*/
+function serializeMigrationReport(file) {
+	return `${JSON.stringify(file, void 0, 2)}\n`;
+}
+//#endregion
+//#region src/cli/commands/write-migration-report.ts
+const REPORT_DIR_NAME = ".bedrock";
+const JSON_FILE_NAME = "migration-report.json";
+const MD_FILE_NAME = "migration-report.md";
+/**
+* Persist the migration report as `.bedrock/migration-report.json` and a
+* pure derivation `.bedrock/migration-report.md` next to the per-environment
+* state files. Always written so the user can compare runs even when no
+* warnings were emitted; the CLI summary line that points at the Markdown
+* file is gated on warning count separately.
+*
+* @param input - Resolved deps, the migration report, and the path of the
+*   Mantle state file the report describes.
+* @returns `Ok` with both file paths once both writes succeed; `Err` on the
+*   first failure (already rendered to clack).
+*/
+async function writeMigrationReport(input) {
+	const { deps, report, stateFilePath } = input;
+	const reportDirectory = join(dirname(stateFilePath), REPORT_DIR_NAME);
+	const jsonPath = join(reportDirectory, JSON_FILE_NAME);
+	const mdPath = join(reportDirectory, MD_FILE_NAME);
+	const file = {
+		summary: report.summary,
+		warnings: report.warnings
+	};
+	try {
+		await deps.mkdir(reportDirectory);
+	} catch (err) {
+		deps.clack.logError(`migration report directory create failed (${reportDirectory}): ${describeUnknown(err)}`);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	try {
+		await deps.writeFile(jsonPath, serializeMigrationReport(file));
+	} catch (err) {
+		deps.clack.logError(`migration report write failed (${jsonPath}): ${describeUnknown(err)}`);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	try {
+		await deps.writeFile(mdPath, renderMigrationReportMarkdown(file));
+	} catch (err) {
+		deps.clack.logError(`migration report write failed (${mdPath}): ${describeUnknown(err)}`);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	return {
+		data: {
+			jsonPath,
+			mdPath
+		},
+		success: true
+	};
+}
+//#endregion
+//#region src/cli/commands/finalize-migration.ts
+/**
+* Persist the migration's per-environment state, the bedrock config, and
+* the migration report (JSON + Markdown) in that order. Each failure
+* surface has already been rendered to clack by its respective writer; on
+* the first failure the function returns `Err` so the caller can exit
+* after a single shared `cancel("migrate failed")` line.
+*
+* @param inputs - Resolved deps, the migration report, and the resolved
+*   state-target plus paths the writers consume.
+* @returns `Ok` carrying the on-disk Markdown report path (used by the
+*   terminal summary line) once every writer succeeded; `Err(void)` once
+*   any writer reported failure.
+*/
+async function persistMigration(inputs) {
+	if (!(await persistStateAndConfig(inputs)).success) return {
+		err: void 0,
+		success: false
+	};
+	const reportPaths = await writeMigrationReport({
+		deps: {
+			clack: inputs.deps.clack,
+			mkdir: inputs.deps.mkdir,
+			writeFile: inputs.deps.writeFile
+		},
+		report: inputs.report,
+		stateFilePath: inputs.stateFilePath
+	});
+	return reportPaths.success ? {
+		data: reportPaths.data.mdPath,
+		success: true
+	} : {
+		err: void 0,
+		success: false
+	};
+}
+async function writeBedrockConfig(inputs) {
+	const { configFilePath, configFormat, deps, report, target } = inputs;
+	const { state: _ignoredState, ...configWithoutState } = report.config;
+	const bytes = serializeConfig({
+		config: target.backend === "gist" ? {
+			...configWithoutState,
+			state: target.stateConfig
+		} : configWithoutState,
+		configFormat
+	});
+	try {
+		await deps.writeFile(configFilePath, bytes);
+	} catch (err) {
+		deps.clack.logError(`config file write failed (${configFilePath}): ${describeUnknown(err)}`);
+		return {
+			err: void 0,
+			success: false
+		};
+	}
+	deps.clack.logSuccess(`wrote ${configFilePath}`);
+	return {
+		data: void 0,
+		success: true
+	};
+}
+async function persistStateAndConfig(inputs) {
+	if (!(await writeMigratedStates({
+		deps: inputs.deps,
+		report: inputs.report,
+		target: inputs.target
+	})).success) return {
+		err: void 0,
+		success: false
+	};
+	return (await writeBedrockConfig(inputs)).success ? {
+		data: void 0,
+		success: true
+	} : {
+		err: void 0,
+		success: false
+	};
+}
+//#endregion
+//#region src/cli/commands/resolve-migrate-inputs.ts
+/**
+* Resolve the path to the input Mantle state file. The positional CLI
+* argument wins; when it is absent the user is asked through the prompt
+* port. Cancelling the prompt surfaces as `Err("cancelled")`.
+*
+* @param pathArgument - The positional `<stateFilePath>` value sade
+*   handed the action callback, or `undefined` when omitted.
+* @param promptPort - The migrate prompt port whose `promptStateFilePath`
+*   is used as the interactive fallback.
+* @returns `Ok(path)` on success, or `Err("cancelled")` if the user
+*   aborted the prompt.
+*/
+async function resolveStateFilePath(pathArgument, promptPort) {
+	if (pathArgument !== void 0) return {
+		data: pathArgument,
+		success: true
+	};
+	const promptResult = await promptPort.promptStateFilePath();
+	if (!promptResult.success) return {
+		err: "cancelled",
+		success: false
+	};
+	return {
+		data: promptResult.data,
+		success: true
+	};
+}
+/**
+* Resolve which source format to migrate from. A validated `--from`
+* value wins; when it is absent the user picks from
+* {@link SUPPORTED_MIGRATION_SOURCES} through the prompt port.
+* Cancelling the prompt surfaces as `Err("cancelled")`.
+*
+* @param from - The validated `--from` value, or `undefined` when the
+*   flag was omitted.
+* @param promptPort - The migrate prompt port whose
+*   `promptMigrationSource` is used as the interactive fallback.
+* @returns `Ok(source)` on success, or `Err("cancelled")` if the user
+*   aborted the prompt.
+*/
+async function resolveMigrationSource(from, promptPort) {
+	if (from !== void 0) return {
+		data: from,
+		success: true
+	};
+	const promptResult = await promptPort.promptMigrationSource(SUPPORTED_MIGRATION_SOURCES);
+	if (!promptResult.success) return {
+		err: "cancelled",
+		success: false
+	};
+	return {
+		data: promptResult.data,
+		success: true
+	};
+}
+//#endregion
+//#region src/cli/commands/migrate.ts
+const FAILED_OUTRO = "migrate failed";
+const CANCELLED_OUTRO = "migrate cancelled";
+/**
+* Build the sade action for `bedrock migrate`. The returned function
+* consumes the optional positional path argument and the raw options
+* object sade hands the action callback. The command parses `--from`,
+* resolves the state file path (positional or interactive), prompts for
+* the output config format, runs the migrator, prompts for the state
+* backend coordinates, writes the per-environment states through the
+* configured `StatePort`, and emits an enriched bedrock config to disk.
+*
+* @param deps - Dependency overrides; missing slots are default-constructed
+*   from real implementations.
+* @returns An async sade action that returns once `deps.exit` was invoked.
+*/
+function migrateCommand(deps) {
+	const resolved = resolveMigrate(deps);
+	return async (pathArgument, rawOptions) => {
+		const code = await runMigrate({
+			pathArg: pathArgument,
+			rawOptions,
+			resolved
+		});
+		resolved.exit(code);
+	};
+}
+function resolveMigrate(deps) {
+	return {
+		buildStatePort: deps.buildStatePort ?? buildStatePort,
+		clack: deps.clack ?? createClackPort(),
+		exit: deps.exit ?? ((code) => process.exit(code)),
+		migrateMantleState: deps.migrateMantleState ?? migrateMantleState,
+		mkdir: deps.mkdir ?? (async (path) => void await mkdir(path, { recursive: true })),
+		promptPort: deps.migratePromptPort ?? createDefaultMigratePromptPort(),
+		writeFile: deps.writeFile ?? (async (path, contents) => writeFile(path, contents, "utf8"))
+	};
+}
+function cancel$1(resolved) {
+	resolved.clack.cancel(CANCELLED_OUTRO);
+	return 1;
+}
+function failAfterRender(resolved) {
+	resolved.clack.cancel(FAILED_OUTRO);
+	return 1;
+}
+function renderedFailure(err, resolved) {
+	renderMigrateError(err, resolved.clack);
+	resolved.clack.cancel(FAILED_OUTRO);
+	return {
+		err: "rendered",
+		success: false
+	};
+}
+async function callMigrator(inputs) {
+	const callDeps = {
+		configFormat: inputs.configFormat,
+		stateFilePath: inputs.stateFilePath,
+		...inputs.primaryEnvironment === void 0 ? {} : { primaryEnvironment: inputs.primaryEnvironment }
+	};
+	try {
+		return await inputs.resolved.migrateMantleState(callDeps);
+	} catch (err) {
+		return {
+			err: {
+				cause: err,
+				kind: "ioError",
+				path: inputs.stateFilePath
+			},
+			success: false
+		};
+	}
+}
+function renderIoFailure(err, resolved) {
+	resolved.clack.logError(`failed to read Mantle state file '${err.path}': ${describeUnknown(err.cause)}`);
+	resolved.clack.cancel(FAILED_OUTRO);
+	return {
+		err: "rendered",
+		success: false
+	};
+}
+async function runMigratorWithPrompt(inputs) {
+	const first = await callMigrator(inputs);
+	if (first.success) return {
+		data: first.data,
+		success: true
+	};
+	if (first.err.kind === "ioError") return renderIoFailure(first.err, inputs.resolved);
+	if (first.err.kind !== "primaryEnvironmentRequired") return renderedFailure(first.err, inputs.resolved);
+	const primary = await inputs.resolved.promptPort.promptPrimaryEnvironment(first.err.available);
+	if (!primary.success) return {
+		err: "cancelled",
+		success: false
+	};
+	const second = await callMigrator({
+		...inputs,
+		primaryEnvironment: primary.data
+	});
+	if (second.success) return {
+		data: second.data,
+		success: true
+	};
+	if (second.err.kind === "ioError") return renderIoFailure(second.err, inputs.resolved);
+	return renderedFailure(second.err, inputs.resolved);
+}
+async function finalize(inputs) {
+	const persisted = await persistMigration(inputs);
+	if (!persisted.success) {
+		inputs.deps.clack.cancel(FAILED_OUTRO);
+		return 1;
+	}
+	renderMigrationSummary({
+		reportPath: persisted.data,
+		summary: inputs.report.summary
+	}, inputs.deps.clack);
+	inputs.deps.clack.outro("migrate succeeded");
+	return 0;
+}
+function configFileFor(stateFilePath, format) {
+	const extension = format === "typescript" ? "ts" : "yaml";
+	return join(dirname(stateFilePath), `bedrock.config.${extension}`);
+}
+async function promptForStateTarget(resolved, stateFilePath) {
+	const backend = await resolved.promptPort.promptStateBackend();
+	if (!backend.success) return {
+		err: "cancelled",
+		success: false
+	};
+	if (backend.data === "local") return {
+		data: {
+			backend: "local",
+			outputDir: join(dirname(stateFilePath), ".bedrock", "state")
+		},
+		success: true
+	};
+	const gistId = await resolved.promptPort.promptGistId();
+	if (!gistId.success) return {
+		err: "cancelled",
+		success: false
+	};
+	return {
+		data: {
+			backend: "gist",
+			stateConfig: {
+				backend: "gist",
+				gistId: gistId.data
+			}
+		},
+		success: true
+	};
+}
+function finalizeDeps(resolved) {
+	return {
+		buildStatePort: resolved.buildStatePort,
+		clack: resolved.clack,
+		mkdir: resolved.mkdir,
+		writeFile: resolved.writeFile
+	};
+}
+async function runWithStateFilePath(stateFilePath, resolved) {
+	const formatResult = await resolved.promptPort.promptConfigFormat();
+	if (!formatResult.success) return cancel$1(resolved);
+	const reportResult = await runMigratorWithPrompt({
+		configFormat: formatResult.data,
+		resolved,
+		stateFilePath
+	});
+	if (!reportResult.success) return reportResult.err === "cancelled" ? cancel$1(resolved) : 1;
+	const targetResult = await promptForStateTarget(resolved, stateFilePath);
+	if (!targetResult.success) return cancel$1(resolved);
+	return finalize({
+		configFilePath: configFileFor(stateFilePath, formatResult.data),
+		configFormat: formatResult.data,
+		deps: finalizeDeps(resolved),
+		report: reportResult.data,
+		stateFilePath,
+		target: targetResult.data
+	});
+}
+async function dispatchBySource(inputs) {
+	const { resolved, source, stateFilePath } = inputs;
+	const handler = { mantle: async () => runWithStateFilePath(stateFilePath, resolved) }[source];
+	return handler();
+}
+async function runMigrate(inputs) {
+	const { pathArg, rawOptions, resolved } = inputs;
+	resolved.clack.intro("bedrock migrate");
+	const parsed = parseMigrateOptions(rawOptions);
+	if (!parsed.success) {
+		renderMigrateParseError(parsed.err, resolved.clack);
+		return failAfterRender(resolved);
+	}
+	const source = await resolveMigrationSource(parsed.data.from, resolved.promptPort);
+	if (!source.success) return cancel$1(resolved);
+	const stateFilePath = await resolveStateFilePath(pathArg, resolved.promptPort);
+	if (!stateFilePath.success) return cancel$1(resolved);
+	return dispatchBySource({
+		resolved,
+		source: source.data,
+		stateFilePath: stateFilePath.data
+	});
+}
+//#endregion
+//#region src/cli/index.ts
+const PROGRAM_NAME = "bedrock";
+const PROGRAM_DESCRIBE = "Infrastructure-as-Code deployment tool for Roblox";
+/**
+* Construct the bedrock CLI program. Pure factory: no `process.argv` parsing,
+* no clack output, no exits. Callers (the `run.ts` shim, integration tests)
+* call `.parse()` on the returned sade instance.
+* @param deps - Dependency overrides for command actions. Each command
+*   resolves its own defaults from any omitted slots.
+* @returns A configured sade program with the bedrock name, description, and
+*   the currently installed `@bedrock-rbx/core` version, plus the registered
+*   `deploy`, `diff`, and `migrate` commands.
+*/
+function createProg(deps = {}) {
+	const prog = sade(PROGRAM_NAME).describe(PROGRAM_DESCRIBE).version(version);
+	prog.command("deploy").describe("Reconcile a project's resources against the configured environment(s)").option("--env", "Target environment (repeat for multiple)").option("--config", "Config file path (overrides discovery)").option("--api-key", "Override the ROBLOX_API_KEY environment variable").option("--github-token", "Override the GITHUB_TOKEN environment variable").action(deployCommand(deps));
+	prog.command("diff").describe("Preview the operations a deploy would apply, without writing state").option("--env", "Target environment (repeat for multiple)").option("--config", "Config file path (overrides discovery)").option("--api-key", "Override the ROBLOX_API_KEY environment variable").option("--github-token", "Override the GITHUB_TOKEN environment variable").action(diffCommand(deps));
+	prog.command("migrate [stateFilePath]").describe("Translate a state file from another tool into a bedrock project").option("--from", "Source format to migrate from (mantle; prompted if omitted)").action(migrateCommand(deps));
+	return prog;
+}
+//#endregion
+//#region src/cli/run.ts
+createProg().parse(process.argv);
+//#endregion
+export {};
+
+//# sourceMappingURL=run.mjs.map