@bedrock-rbx/core 0.1.0-beta.11 → 0.1.0-beta.13

package/dist/{migrate-mantle-state-DjAU-I39.mjs → migrate-mantle-state-CQjWBZwT.mjs}

@@ -1,5 +1,6 @@
+import { ApiError, PermissionError } from "@bedrock-rbx/ocale";
 import { ArkErrors, type } from "arktype";
-import { ApiError } from "@bedrock-rbx/ocale";
+import { cancel, intro, log, outro } from "@clack/prompts";
 import process from "node:process";
 import { defu } from "defu";
 import { DeveloperProductsClient } from "@bedrock-rbx/ocale/developer-products";
@@ -13,6 +14,220 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile } from "node:child_process";
 import { tmpdir } from "node:os";
 import { parseYAML, stringifyYAML } from "confbox";
+//#region src/cli/render.ts
+/**
+* Render a `DeployError` to the supplied `ClackPort` as a single error line.
+* Each variant produces a distinct, terse diagnostic; wrapped variants
+* (`applyFailed`, `buildDesiredFailed`, `configLoadFailed`, `stateReadFailed`,
+* `stateWriteFailed`) surface the inner cause's actionable detail (file path,
+* resource key, parser message, HTTP failure, validator issue) so the reader
+* does not have to inspect the full cause to act.
+* @param err - The deploy error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderDeployError(err, port) {
+	port.logError(deployErrorMessage(err));
+}
+/**
+* Render a `ParseOptionsError` to the supplied `ClackPort` as a single
+* error line. Each variant names the offending flag so the diagnostic
+* pinpoints what the caller needs to change.
+* @param err - The parse error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderParseError(err, port) {
+	port.logError(parseErrorMessage(err));
+}
+/**
+* Render a `ParseMigrateError` to the supplied `ClackPort`. Reuses
+* `parseErrorMessage` for the three flag-shape variants and adds a
+* dedicated message for `unknownSource` listing the supported sources.
+* @param err - The parse error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderMigrateParseError(err, port) {
+	port.logError(migrateParseErrorMessage(err));
+}
+/**
+* Render a `MigrateError` to the supplied `ClackPort` as a single error
+* line. Each variant points at the offending Mantle state file path,
+* primary-environment input, or wrapped `ConfigError` so the reader can
+* act without inspecting the raw error object.
+* @param err - The migrate error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderMigrateError(err, port) {
+	port.logError(migrateErrorMessage(err));
+}
+/**
+* Render a `MissingCredentialError` or `UnsupportedBackendError`
+* surfaced when the migrate command tried to default-construct the
+* configured `StatePort` and was missing its inputs.
+* @param err - The error returned by `buildStatePort`.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderBuildStatePortError(err, port) {
+	port.logError(buildStatePortErrorMessage(err));
+}
+/**
+* Render the post-migrate review prompt to the supplied `ClackPort`.
+* Three outcomes:
+*
+* - Any `ambiguous` warnings exist: emit a single error line directing
+*   the user to the report. The migration ran but there are decisions
+*   the user still needs to make before deploy will be meaningful.
+* - No `ambiguous` warnings but non-zero `blocked` / `deferred` /
+*   `interpretive`: emit a single success line pointing at the report
+*   for auditing.
+* - All counts zero: silent. The closing `outro("migrate succeeded")`
+*   already speaks for the run.
+* @param input - Counts plus the path of the Markdown report.
+* @param port - The output port the line is written to.
+*/
+function renderMigrationSummary(input, port) {
+	const { ambiguousCount, blockedCount, deferredCount, interpretiveCount } = input.summary;
+	if (ambiguousCount > 0) {
+		port.logError(`action required: ${String(ambiguousCount)} fields need your input. See ${input.reportPath}`);
+		return;
+	}
+	const reviewable = blockedCount + deferredCount + interpretiveCount;
+	if (reviewable > 0) port.logSuccess(`migration complete; see ${input.reportPath} for ${String(reviewable)} auto-mapped or skipped fields`);
+}
+/**
+* Render a `StateError` produced when the migrator wrote a per-environment
+* state through the `StatePort`. Names the environment alongside the
+* adapter's failure reason so the reader knows which write failed.
+* @param input - Environment + state-error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderStateWriteError(input, port) {
+	port.logError(`state write failed for '${input.environment}' (${input.err.file}): ${input.err.reason}`);
+}
+function permissionDetail(err) {
+	const isPlural = err.requiredScopes.length > 1;
+	const label = isPlural ? "scopes" : "scope";
+	const pronoun = isPlural ? "them" : "it";
+	const scopeList = err.requiredScopes.map((scope) => `'${scope}'`).join(", ");
+	return `${err.message} on ${err.operationKey}: missing required ${label} ${scopeList}. Grant ${pronoun} on the API key at https://create.roblox.com/credentials`;
+}
+function applyCauseDetail(cause) {
+	switch (cause.kind) {
+		case "driverFailure":
+			if (cause.cause instanceof PermissionError) return permissionDetail(cause.cause);
+			return cause.cause.message;
+		case "updateUnsupported": return "update not supported";
+	}
+}
+function buildDesiredDetail(cause) {
+	switch (cause.kind) {
+		case "fileReadFailed": return `(${cause.filePath}): ${cause.reason}`;
+		case "iconRemovalRejected": return `: ${cause.message}`;
+	}
+}
+function configErrorDetail(err) {
+	switch (err.kind) {
+		case "configFunctionFailed": return `${err.sourceFile}: config function threw: ${err.message}`;
+		case "fileNotFound": return `no bedrock config under ${err.searchedFrom}`;
+		case "luauRuntimeMissing": return `${err.sourceFile}: ${err.hint}`;
+		case "parseFailed": return `${err.sourceFile}: ${err.message}`;
+		case "validationFailed": {
+			const first = err.issues[0];
+			return first === void 0 ? `${err.sourceFile}: invalid` : `${err.sourceFile}: ${first.path.join(".")} ${first.message}`;
+		}
+	}
+}
+function stateErrorDetail(cause) {
+	return `(${cause.file}): ${cause.reason}`;
+}
+function deployErrorMessage(err) {
+	switch (err.kind) {
+		case "applyFailed": return `apply failed for '${err.cause.key}': ${applyCauseDetail(err.cause)}`;
+		case "buildDesiredFailed": return `build desired state failed for '${err.cause.key}' ${buildDesiredDetail(err.cause)}`;
+		case "configLoadFailed": return `config load failed: ${configErrorDetail(err.cause)}`;
+		case "incompletePassEntry": return `pass '${err.key}' is missing '${err.missingField}' under environment '${err.environment}'`;
+		case "incompletePlaceEntry": return `place '${err.key}' is missing '${err.missingField}' under environment '${err.environment}'`;
+		case "incompleteUniverseEntry": return `universe is missing '${err.missingField}' under environment '${err.environment}'`;
+		case "missingCredential": return `missing credential: environment variable ${err.variable} is not set`;
+		case "registryConfigMissing": return `registry config missing '${err.missing}' (${err.hint})`;
+		case "stateNotConfigured": return `state not configured for environment '${err.environment}'`;
+		case "stateReadFailed": return `state read failed ${stateErrorDetail(err.cause)}`;
+		case "stateWriteFailed": return `state write failed ${stateErrorDetail(err.cause)}`;
+		case "unknownEnvironment": return `unknown environment '${err.environment}' (declared: ${err.declared.join(", ")})`;
+		case "unsupportedBackend": return `unsupported state backend '${err.backend}' (${err.hint})`;
+	}
+}
+function parseErrorMessage(err) {
+	switch (err.kind) {
+		case "invalidValue": return `invalid value for flag '--${err.flag}' (expected a string)`;
+		case "missingRequired": return `missing required flag --${err.flag}`;
+		case "unknownFlag": return `unknown flag '--${err.flag}'`;
+	}
+}
+function migrateParseErrorMessage(err) {
+	if (err.kind === "unknownSource") return `unknown migration source '${err.received}' (supported: ${err.supported.join(", ")})`;
+	return parseErrorMessage(err);
+}
+function migrateErrorMessage(err) {
+	switch (err.kind) {
+		case "internalError": return `migrate internal error: ${err.reason} (${configErrorDetail(err.cause)})`;
+		case "primaryEnvironmentNotFound": return `primary environment '${err.primary}' not found (available: ${err.available.join(", ")})`;
+		case "primaryEnvironmentRequired": return `primary environment required (available: ${err.available.join(", ")})`;
+		case "stateFileNotFound": return `Mantle state file not found at '${err.path}'`;
+		case "stateParseFailed": return `Mantle state file at '${err.path}' could not be parsed: ${err.reason}`;
+		case "unsupportedMantleStateVersion": return `unsupported Mantle state version '${err.found}' (supported: ${err.supported.join(", ")})`;
+	}
+}
+function buildStatePortErrorMessage(err) {
+	switch (err.kind) {
+		case "missingCredential": return `missing credential: environment variable ${err.variable} is not set`;
+		case "unsupportedBackend": return `unsupported state backend '${err.backend}' (${err.hint})`;
+	}
+}
+//#endregion
+//#region src/adapters/clack-progress-adapter.ts
+/**
+* Build a {@link ProgressPort} that renders events through a `ClackPort`.
+* Pattern-matches on the event `kind`: `deploySuccess` becomes a single
+* success line and `deployFailure` delegates to the package's deploy-error
+* rendering helper.
+*
+* @example
+*
+* ```ts
+* import { createClackProgressAdapter, type ClackPort } from "@bedrock-rbx/core";
+*
+* const lines: Array<string> = [];
+* const clack: ClackPort = {
+*     cancel: (message) => lines.push(`cancel: ${message}`),
+*     intro: (message) => lines.push(`intro: ${message}`),
+*     logError: (message) => lines.push(`error: ${message}`),
+*     logMessage: (message) => lines.push(`log: ${message}`),
+*     logSuccess: (message) => lines.push(`ok: ${message}`),
+*     outro: (message) => lines.push(`outro: ${message}`),
+* };
+*
+* const port = createClackProgressAdapter({ clack });
+*
+* port.emit({ environment: "production", kind: "deploySuccess", resourceCount: 3 });
+*
+* expect(lines).toEqual(["ok: production: 3 resources reconciled"]);
+* ```
+*
+* @param deps - The clack port the adapter renders through.
+* @returns A `ProgressPort` that renders via clack.
+*/
+function createClackProgressAdapter(deps) {
+	const { clack } = deps;
+	return { emit(event) {
+		switch (event.kind) {
+			case "deployFailure":
+				renderDeployError(event.error, clack);
+				return;
+			case "deploySuccess": clack.logSuccess(`${event.environment}: ${event.resourceCount} resources reconciled`);
+		}
+	} };
+}
+//#endregion
 //#region src/core/derive-price-fields.ts
 /**
 * Translate a Mantle-style optional price into the Open Cloud wire shape.
@@ -240,17 +455,255 @@ async function sha256Hex(bytes) {
 	return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 //#endregion
+//#region src/core/redacted-icon.ts
+const REDACTED_ICON_BYTES = new Uint8Array([
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10,
+	0,
+	0,
+	0,
+	13,
+	73,
+	72,
+	68,
+	82,
+	0,
+	0,
+	0,
+	64,
+	0,
+	0,
+	0,
+	64,
+	8,
+	0,
+	0,
+	0,
+	0,
+	143,
+	2,
+	46,
+	2,
+	0,
+	0,
+	0,
+	137,
+	73,
+	68,
+	65,
+	84,
+	120,
+	156,
+	237,
+	86,
+	209,
+	14,
+	128,
+	32,
+	8,
+	244,
+	83,
+	252,
+	148,
+	254,
+	255,
+	167,
+	174,
+	37,
+	98,
+	130,
+	189,
+	20,
+	110,
+	57,
+	119,
+	108,
+	26,
+	194,
+	188,
+	64,
+	15,
+	42,
+	229,
+	160,
+	164,
+	13,
+	0,
+	142,
+	160,
+	44,
+	144,
+	2,
+	1,
+	200,
+	3,
+	242,
+	96,
+	82,
+	45,
+	176,
+	31,
+	176,
+	161,
+	244,
+	60,
+	0,
+	0,
+	153,
+	81,
+	245,
+	235,
+	161,
+	142,
+	219,
+	222,
+	188,
+	254,
+	187,
+	128,
+	50,
+	224,
+	116,
+	181,
+	168,
+	205,
+	106,
+	134,
+	202,
+	113,
+	0,
+	0,
+	109,
+	150,
+	173,
+	101,
+	97,
+	0,
+	58,
+	239,
+	67,
+	4,
+	254,
+	29,
+	239,
+	83,
+	168,
+	232,
+	177,
+	51,
+	144,
+	176,
+	251,
+	80,
+	101,
+	209,
+	82,
+	80,
+	239,
+	0,
+	240,
+	85,
+	216,
+	15,
+	216,
+	15,
+	200,
+	131,
+	89,
+	197,
+	180,
+	1,
+	0,
+	255,
+	15,
+	86,
+	184,
+	5,
+	2,
+	228,
+	255,
+	207,
+	224,
+	4,
+	233,
+	243,
+	166,
+	219,
+	234,
+	149,
+	21,
+	116,
+	0,
+	0,
+	0,
+	0,
+	73,
+	69,
+	78,
+	68,
+	174,
+	66,
+	96,
+	130
+]);
+/**
+* Sentinel path written into a resource's `icon["en-us"]` field when
+* redaction substitutes the bedrock-supplied placeholder image. Callers
+* route this path through {@link withRedactedIcon} or through the
+* `readBytes` short-circuit; neither touches the filesystem.
+*/
+const REDACTED_ICON_PATH = "<bedrock:redacted-icon.png>";
+/**
+* `true` when `path` is the redacted-icon sentinel. `readBytes` and
+* {@link withRedactedIcon} both use this predicate to decide whether to
+* bypass the injected file reader.
+*
+* @param path - Icon path supplied by a flattened or normalized resource entry.
+* @returns `true` for {@link REDACTED_ICON_PATH}; otherwise `false`.
+*/
+function isRedactedIconPath(path) {
+	return path === REDACTED_ICON_PATH;
+}
+/**
+* Wrap a `readFile` so the sentinel resolves to {@link REDACTED_ICON_BYTES}
+* without touching the inner reader. Applied once at the shell deploy /
+* preview boundary; the wrapped reader flows to every consumer (normalize,
+* registry drivers) unchanged.
+*
+* @param readFile - Inner reader that handles every non-sentinel path.
+* @returns Sentinel-aware reader with the same callable shape as `readFile`.
+*/
+function withRedactedIcon(readFile) {
+	return async (path) => {
+		if (isRedactedIconPath(path)) return new Uint8Array(REDACTED_ICON_BYTES);
+		return readFile(path);
+	};
+}
+//#endregion
 //#region src/core/kinds/read-bytes.ts
 /**
 * Read file bytes via the injected reader, translating rejections into a
 * `fileReadFailed` `BuildDesiredError`. Shared by kind modules whose
-* pre-I/O normalization hashes a file the user declared by path.
+* pre-I/O normalization hashes a file the user declared by path. The
+* redacted-icon sentinel short-circuits to the embedded placeholder
+* bytes without invoking the injected reader, so a redaction-substituted
+* icon path produces a deterministic hash on every deploy.
 *
 * @param target - Path to read plus the resource key blamed on failure.
 * @param io - I/O surface carrying the injected `readFile` function.
 * @returns `Ok` with the bytes, or `Err` with a `fileReadFailed` error.
 */
 async function readBytes(target, io) {
+	if (isRedactedIconPath(target.filePath)) return {
+		data: new Uint8Array(REDACTED_ICON_BYTES),
+		success: true
+	};
 	try {
 		return {
 			data: await io.readFile(target.filePath),
@@ -482,12 +935,16 @@ function planFollowUpPatch(desired, createResponse) {
 * ```
 */
 function createDeveloperProductDriver(deps) {
+	const effective = {
+		...deps,
+		readFile: withRedactedIcon(deps.readFile)
+	};
 	return {
 		async create(desired) {
-			return createOne(deps, desired);
+			return createOne(effective, desired);
 		},
 		async update(current, desired) {
-			return updateOne(deps, {
+			return updateOne(effective, {
 				current,
 				desired
 			});
@@ -639,18 +1096,21 @@ async function updateOne(deps, { current, desired }) {
 * ```
 */
 function createGamePassDriver(deps) {
-	return { async create(desired) {
-		const imageFile = await deps.readFile(desired.icon["en-us"]);
-		const result = await deps.client.create({
-			name: desired.name,
-			description: desired.description,
-			imageFile,
-			universeId: deps.universeId,
-			...desired.price !== void 0 ? { price: desired.price } : {}
-		});
-		if (!result.success) return result;
-		return toCurrentState$1(desired, result.data);
-	} };
+	const effective = {
+		...deps,
+		readFile: withRedactedIcon(deps.readFile)
+	};
+	return {
+		async create(desired) {
+			return createGamePass(effective, desired);
+		},
+		async update(current, desired) {
+			return updateGamePass(effective, {
+				current,
+				desired
+			});
+		}
+	};
 }
 function toCurrentState$1(desired, data) {
 	const { id, iconAssetId } = data;
@@ -669,6 +1129,53 @@ function toCurrentState$1(desired, data) {
 		success: true
 	};
 }
+async function createGamePass(deps, desired) {
+	const imageFile = await deps.readFile(desired.icon["en-us"]);
+	const result = await deps.client.create({
+		name: desired.name,
+		description: desired.description,
+		imageFile,
+		universeId: deps.universeId,
+		...desired.price !== void 0 ? { price: desired.price } : {}
+	});
+	if (!result.success) return result;
+	return toCurrentState$1(desired, result.data);
+}
+async function resolveUpdatedState(deps, context) {
+	const { current, desired, hasIconChanged } = context;
+	if (!hasIconChanged) return {
+		data: {
+			...desired,
+			outputs: current.outputs
+		},
+		success: true
+	};
+	const fetched = await deps.client.get({
+		gamePassId: current.outputs.assetId,
+		universeId: deps.universeId
+	});
+	if (!fetched.success) return fetched;
+	return toCurrentState$1(desired, fetched.data);
+}
+async function updateGamePass(deps, states) {
+	const { current, desired } = states;
+	const hasIconChanged = shouldReuploadIcon(current.iconFileHashes, desired.iconFileHashes);
+	const imageFile = hasIconChanged ? await deps.readFile(desired.icon["en-us"]) : void 0;
+	const result = await deps.client.update({
+		name: desired.name,
+		description: desired.description,
+		gamePassId: current.outputs.assetId,
+		universeId: deps.universeId,
+		...derivePriceFields(desired),
+		...imageFile !== void 0 ? { imageFile } : {}
+	});
+	if (!result.success) return result;
+	return resolveUpdatedState(deps, {
+		current,
+		desired,
+		hasIconChanged
+	});
+}
 //#endregion
 //#region src/core/environment.ts
 /**
@@ -1510,6 +2017,49 @@ async function reconcileUniverse(inputs) {
 	};
 }
 //#endregion
+//#region src/cli/clack-port.ts
+/**
+* Construct a `ClackPort` whose methods delegate to `@clack/prompts`. The
+* resulting port writes to `process.stdout` via clack's defaults. Kept in
+* its own module so consumers that never need the clack-backed rendering
+* (programmatic deploys, custom adapters) do not pull `@clack/prompts`
+* into their bundle.
+*
+* @example
+*
+* ```ts
+* import { createClackPort } from "@bedrock-rbx/core";
+*
+* const port = createClackPort();
+*
+* expect(typeof port.logSuccess).toBe("function");
+* ```
+*
+* @returns A port whose six methods each invoke the matching clack helper.
+*/
+function createClackPort() {
+	return {
+		cancel: (message) => {
+			cancel(message);
+		},
+		intro: (message) => {
+			intro(message);
+		},
+		logError: (message) => {
+			log.error(message);
+		},
+		logMessage: (message) => {
+			log.message(message);
+		},
+		logSuccess: (message) => {
+			log.success(message);
+		},
+		outro: (message) => {
+			outro(message);
+		}
+	};
+}
+//#endregion
 //#region src/core/validate-universe-xor.ts
 /**
 * Walk the loose authored-shape and surface every place the
@@ -1588,6 +2138,8 @@ function isGistStateConfig(config) {
 }
 const OPTIONAL_BOOLEAN$2 = "boolean | undefined";
 const OPTIONAL_STRING = "string | undefined";
+const REDACTED_KEY = "redacted?";
+const NON_EMPTY_OVERRIDE_MESSAGE = "a non-empty override object; use `redacted: true` for default placeholders";
 /**
 * Shared arktype constraint for any optional positive-integer field.
 * Reused by per-kind entry schemas so positive-integer fields validate
@@ -1604,11 +2156,35 @@ const OPTIONAL_POSITIVE_INTEGER = "(number.integer >= 1) | undefined";
 * identically.
 */
 const OPTIONAL_ROBUX_PRICE = "number.integer >= 0 | undefined";
+const gamePassRedacted = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"name?": "string"
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const placeRedacted = type({
+	"description?": "string",
+	"displayName?": "string"
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const productRedacted = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"name?": "string"
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
 const gamePassEntry = type({
 	"name": "string",
 	"description": "string",
 	"icon": iconMap,
-	"price?": OPTIONAL_ROBUX_PRICE
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: gamePassRedacted
 });
 const passesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassEntry }).onUndeclaredKey("reject");
 const developerProductEntry = type({
@@ -1617,6 +2193,7 @@ const developerProductEntry = type({
 	"icon?": iconMap,
 	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
 	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: productRedacted,
 	"storePageEnabled?": OPTIONAL_BOOLEAN$2
 }).onUndeclaredKey("reject");
 const productsCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductEntry }).onUndeclaredKey("reject");
@@ -1625,6 +2202,7 @@ const placeEntry = type({
 	"description?": OPTIONAL_STRING,
 	"displayName?": OPTIONAL_STRING,
 	"filePath": "string",
+	[REDACTED_KEY]: placeRedacted,
 	"serverSize?": OPTIONAL_POSITIVE_INTEGER
 }).onUndeclaredKey("reject");
 const placesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeEntry }).onUndeclaredKey("reject");
@@ -1658,7 +2236,8 @@ const gamePassOverlay = type({
 	"description?": "string",
 	"icon?": iconMap,
 	"name?": "string",
-	"price?": OPTIONAL_ROBUX_PRICE
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2
 }).onUndeclaredKey("reject");
 const passesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassOverlay }).onUndeclaredKey("reject");
 const developerProductOverlay = type({
@@ -1667,6 +2246,7 @@ const developerProductOverlay = type({
 	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
 	"name?": "string",
 	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
 	"storePageEnabled?": OPTIONAL_BOOLEAN$2
 }).onUndeclaredKey("reject");
 const productsOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductOverlay }).onUndeclaredKey("reject");
@@ -1675,15 +2255,19 @@ const placeOverlay = type({
 	"displayName?": OPTIONAL_STRING,
 	"filePath?": "string",
 	"placeId": ROBLOX_ID_DIGITS,
+	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
 	"serverSize?": OPTIONAL_POSITIVE_INTEGER
 }).onUndeclaredKey("reject");
+const placesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeOverlay }).onUndeclaredKey("reject");
+const universeOverlay = universeEntry;
 const environmentEntry = type({
 	"label?": OPTIONAL_STRING,
 	"passes?": passesOverlayCollection,
-	"places?": type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeOverlay }).onUndeclaredKey("reject"),
+	"places?": placesOverlayCollection,
 	"products?": productsOverlayCollection,
+	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
 	"state?": stateConfig,
-	"universe?": universeEntry
+	"universe?": universeOverlay
 }).onUndeclaredKey("reject");
 const rootSchema = type({
 	"displayNamePrefix?": type({
@@ -1780,6 +2364,7 @@ const entrySchema$3 = type({
 	"icon?": iconMap,
 	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$1,
 	"price?": OPTIONAL_ROBUX_PRICE,
+	"redacted?": "boolean | undefined",
 	"storePageEnabled?": OPTIONAL_BOOLEAN$1
 });
 function flatten$3(config) {
@@ -1863,7 +2448,8 @@ const entrySchema$2 = type({
 	"name": "string",
 	"description": "string",
 	"icon": iconMap,
-	"price?": OPTIONAL_ROBUX_PRICE
+	"price?": OPTIONAL_ROBUX_PRICE,
+	"redacted?": "boolean | undefined"
 });
 function flatten$2(config) {
 	return Object.entries(config.passes ?? {}).map(([key, entry]) => {
@@ -2344,9 +2930,172 @@ function resolveStateConfig(config, environment) {
 		success: false
 	};
 }
+/**
+* Pure transform that substitutes bedrock-supplied placeholder content for
+* every resource whose effective `redacted` flag is truthy. The effective
+* flag is the per-resource `redacted` value when set, otherwise the
+* `environmentRedacted` fallback. A `redacted` object form replaces
+* matching fields with the supplied values and falls back to the bedrock
+* defaults for the rest. Runs between env-overlay merge and display-name
+* prefix render so the rest of the pipeline (flatten, normalize, diff,
+* apply) operates on already-redacted values and needs no special-case
+* redaction logic.
+*
+* @param config - Post-merge `ResolvedConfig` produced by `selectEnvironment`.
+* @param environmentRedacted - Environment-level redaction toggle. Resources
+*   that omit a per-resource `redacted` flag inherit this value.
+* @returns A `ResolvedConfig` whose redacted entries carry placeholder
+*   values; non-redacted entries pass through verbatim, and the input is
+*   not mutated.
+*/
+function applyRedaction(config, environmentRedacted = false) {
+	const passes = redactPasses(config.passes, environmentRedacted);
+	const places = redactPlaces(config.places, environmentRedacted);
+	const products = redactProducts(config.products, environmentRedacted);
+	if (passes === config.passes && places === config.places && products === config.products) return config;
+	return {
+		...config,
+		...passes === void 0 ? {} : { passes },
+		...places === void 0 ? {} : { places },
+		...products === void 0 ? {} : { products }
+	};
+}
+/**
+* Inspect the pre-redaction merged config and produce one annotation per
+* resource flagged `redacted: true`. Callers thread the result into plan
+* output so authors can see which resources are redacted in the active
+* environment and whether their real-value edits are being suppressed.
+*
+* Operates on the pre-redaction view because the post-redaction config no
+* longer carries the real `name`/`description`/`icon` values needed to
+* detect divergence from the placeholder defaults.
+*
+* @param merged - `ResolvedConfig` produced by environment overlay merge,
+*   before `applyRedaction` has substituted placeholders.
+* @returns Zero or more annotations, one per redacted resource. Empty when
+*   the config declares no redacted resources.
+*/
+function collectRedactionAnnotations(merged) {
+	const passes = Object.entries(merged.passes ?? {}).filter(([, entry]) => entry.redacted === true).map(([key, entry]) => {
+		return {
+			key: asResourceKey(key),
+			hasRealValueEdits: passHasRealValueEdits(entry),
+			kind: "gamePass"
+		};
+	});
+	const products = Object.entries(merged.products ?? {}).filter(([, entry]) => entry.redacted === true).map(([key, entry]) => {
+		return {
+			key: asResourceKey(key),
+			hasRealValueEdits: productHasRealValueEdits(entry),
+			kind: "developerProduct"
+		};
+	});
+	return [...passes, ...products];
+}
+function redactPass(entry, override) {
+	return {
+		...entry,
+		name: override.name ?? "Redacted Pass",
+		description: override.description ?? "",
+		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" }
+	};
+}
+function redactPasses(passes, environmentRedacted) {
+	if (passes === void 0) return;
+	if (!Object.values(passes).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return passes;
+	return Object.fromEntries(Object.entries(passes).map(([key, entry]) => {
+		const effective = entry.redacted ?? environmentRedacted;
+		if (effective === false) return [key, entry];
+		return [key, redactPass(entry, typeof effective === "object" ? effective : {})];
+	}));
+}
+function redactPlace(entry, override) {
+	return {
+		...entry,
+		description: override.description ?? "",
+		displayName: override.displayName ?? entry.displayName
+	};
+}
+function redactPlaces(places, environmentRedacted) {
+	if (places === void 0) return;
+	if (!Object.values(places).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return places;
+	return Object.fromEntries(Object.entries(places).map(([key, entry]) => {
+		const effective = entry.redacted ?? environmentRedacted;
+		if (effective === false) return [key, entry];
+		return [key, redactPlace(entry, typeof effective === "object" ? effective : {})];
+	}));
+}
+function redactProduct(entry, override) {
+	return {
+		...entry,
+		name: override.name ?? "Redacted Product",
+		description: override.description ?? "",
+		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" }
+	};
+}
+function redactProducts(products, environmentRedacted) {
+	if (products === void 0) return;
+	if (!Object.values(products).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return products;
+	return Object.fromEntries(Object.entries(products).map(([key, entry]) => {
+		const effective = entry.redacted ?? environmentRedacted;
+		if (effective === false) return [key, entry];
+		return [key, redactProduct(entry, typeof effective === "object" ? effective : {})];
+	}));
+}
+function passHasRealValueEdits(entry) {
+	return entry.name !== "Redacted Pass" || entry.description !== "" || entry.icon["en-us"] !== "<bedrock:redacted-icon.png>";
+}
+function productHasRealValueEdits(entry) {
+	return entry.name !== "Redacted Product" || entry.description !== "" || entry.icon !== void 0 && entry.icon["en-us"] !== "<bedrock:redacted-icon.png>";
+}
 //#endregion
 //#region src/core/select-environment.ts
 /**
+* Project a `Config` onto a single environment up to the pre-redaction
+* merge boundary. Looks up the env entry, deep-merges its resource overlay
+* over the root config, and runs the same pass, place, and universe
+* completeness checks {@link selectEnvironment} runs, so the returned
+* `merged` config honours the full `ResolvedConfig` contract. Real
+* `name`, `description`, and `icon` values on redacted resources stay
+* intact, letting callers inspect divergence from placeholder defaults
+* before {@link selectEnvironment} substitutes them.
+*
+* @param config - Validated project config.
+* @param environment - Environment name to project onto.
+* @returns The matched env entry plus the merged config, or any of the
+*   `SelectEnvironmentError` failure modes.
+*/
+function selectMergedEnvironment(config, environment) {
+	const entry = config.environments[environment];
+	if (entry === void 0) return {
+		err: unknownEnvironment(config, environment),
+		success: false
+	};
+	const merged = mergeOverlays(config, entry);
+	const incompletePass = findIncompletePass(merged, environment);
+	if (incompletePass !== void 0) return {
+		err: incompletePass,
+		success: false
+	};
+	const incompletePlace = findIncompletePlace(merged, environment);
+	if (incompletePlace !== void 0) return {
+		err: incompletePlace,
+		success: false
+	};
+	const incompleteUniverse = findIncompleteUniverse(merged, environment);
+	if (incompleteUniverse !== void 0) return {
+		err: incompleteUniverse,
+		success: false
+	};
+	return {
+		data: {
+			entry,
+			merged
+		},
+		success: true
+	};
+}
+/**
 * Project a validated `Config` onto a single environment. Looks up the
 * matching `environments[environment]` entry, deep-merges its resource
 * overlay (`passes`, `places`, `universe`) over the root config via defu,
@@ -2424,28 +3173,80 @@ function resolveStateConfig(config, environment) {
 * projection failed.
 */
 function selectEnvironment(config, environment) {
-	const entry = config.environments[environment];
-	if (entry === void 0) return {
-		err: unknownEnvironment(config, environment),
-		success: false
+	const mergedResult = selectMergedEnvironment(config, environment);
+	if (!mergedResult.success) return mergedResult;
+	const { entry, merged } = mergedResult.data;
+	return {
+		data: redactAndPrefix({
+			config,
+			entry,
+			merged
+		}),
+		success: true
 	};
-	const projected = projectConfig({
-		config,
-		entry
-	});
-	const incompletePlace = findIncompletePlace(projected, environment);
-	if (incompletePlace !== void 0) return {
-		err: incompletePlace,
-		success: false
+}
+function findIncompletePass(merged, environment) {
+	const { passes } = merged;
+	if (passes === void 0) return;
+	const candidates = passes;
+	for (const [key, entry] of Object.entries(candidates)) {
+		if (entry.name === void 0) return {
+			key,
+			environment,
+			kind: "incompletePassEntry",
+			missingField: "name"
+		};
+		if (entry.description === void 0) return {
+			key,
+			environment,
+			kind: "incompletePassEntry",
+			missingField: "description"
+		};
+		if (entry.icon === void 0) return {
+			key,
+			environment,
+			kind: "incompletePassEntry",
+			missingField: "icon"
+		};
+	}
+}
+function mergeEntry(overlay, base) {
+	return defu(overlay, base ?? {});
+}
+function mergeKeyedRecord(overlay, base) {
+	if (overlay === void 0) return base;
+	return {
+		...base ?? {},
+		...Object.fromEntries(Object.entries(overlay).map(([key, partial]) => {
+			return [key, mergeEntry(partial, base?.[key])];
+		}))
 	};
-	const incompleteUniverse = findIncompleteUniverse(projected, environment);
-	if (incompleteUniverse !== void 0) return {
-		err: incompleteUniverse,
-		success: false
+}
+function mergeUniverse(overlay, base) {
+	if (overlay === void 0 && base === void 0) return;
+	return defu(overlay ?? {}, base ?? {});
+}
+function mergeOverlays(config, entry) {
+	const passes = mergeKeyedRecord(entry.passes, config.passes);
+	const places = mergeKeyedRecord(entry.places, config.places);
+	const products = mergeKeyedRecord(entry.products, config.products);
+	const universe = mergeUniverse(entry.universe, config.universe);
+	const state = entry.state ?? config.state;
+	const { places: _placesRoot, products: _productsRoot, universe: _universeRoot, ...rest } = config;
+	return {
+		...rest,
+		...passes === void 0 ? {} : { passes },
+		...places === void 0 ? {} : { places },
+		...products === void 0 ? {} : { products },
+		...state === void 0 ? {} : { state },
+		...universe === void 0 ? {} : { universe }
 	};
+}
+function unknownEnvironment(config, environment) {
 	return {
-		data: projected,
-		success: true
+		declared: Object.keys(config.environments),
+		environment,
+		kind: "unknownEnvironment"
 	};
 }
 function findIncompleteUniverse(projected, environment) {
@@ -2476,22 +3277,6 @@ function findIncompletePlace(projected, environment) {
 		};
 	}
 }
-function mergeEntry(overlay, base) {
-	return defu(overlay, base ?? {});
-}
-function mergeKeyedRecord(overlay, base) {
-	if (overlay === void 0) return base;
-	return {
-		...base ?? {},
-		...Object.fromEntries(Object.entries(overlay).map(([key, partial]) => {
-			return [key, mergeEntry(partial, base?.[key])];
-		}))
-	};
-}
-function mergeUniverse(overlay, base) {
-	if (overlay === void 0 && base === void 0) return;
-	return defu(overlay ?? {}, base ?? {});
-}
 function resolvePrefix(config, entry) {
 	if (config.displayNamePrefix?.enabled === false) return;
 	const { label } = entry;
@@ -2515,33 +3300,18 @@ function applyPlacesPrefix(places, prefix) {
 		}];
 	}));
 }
-function projectConfig(inputs) {
-	const { config, entry } = inputs;
-	const passes = mergeKeyedRecord(entry.passes, config.passes);
-	const mergedPlaces = mergeKeyedRecord(entry.places, config.places);
-	const products = mergeKeyedRecord(entry.products, config.products);
-	const merged = mergeUniverse(entry.universe, config.universe);
+function redactAndPrefix(inputs) {
+	const { config, entry, merged } = inputs;
+	const redacted = applyRedaction(merged, entry.redacted);
 	const prefix = resolvePrefix(config, entry);
-	const universe = applyUniversePrefix(merged, prefix);
-	const places = applyPlacesPrefix(mergedPlaces, prefix);
-	const state = entry.state ?? config.state;
-	const { places: _placesRoot, products: _productsRoot, universe: _universeRoot, ...rest } = config;
+	const places = applyPlacesPrefix(redacted.places, prefix);
+	const universe = applyUniversePrefix(redacted.universe, prefix);
 	return {
-		...rest,
-		...passes === void 0 ? {} : { passes },
+		...redacted,
 		...places === void 0 ? {} : { places },
-		...products === void 0 ? {} : { products },
-		...state === void 0 ? {} : { state },
 		...universe === void 0 ? {} : { universe }
 	};
 }
-function unknownEnvironment(config, environment) {
-	return {
-		declared: Object.keys(config.environments),
-		environment,
-		kind: "unknownEnvironment"
-	};
-}
 //#endregion
 //#region src/core/validate-plan.ts
 /**
@@ -4159,6 +4929,14 @@ function buildRootPasses(primaryFold) {
 	if (primaryFold.passes.length === 0) return;
 	return Object.fromEntries(primaryFold.passes.map(({ key, entry }) => [key, entry]));
 }
+function buildFullPassOverlay(entry) {
+	return {
+		name: entry.name,
+		description: entry.description,
+		icon: entry.icon,
+		...entry.price !== void 0 && { price: entry.price }
+	};
+}
 function buildPassOverlayEntry(entry, primary) {
 	const overlay = {};
 	if (!Object.is(primary.name, entry.name)) overlay.name = entry.name;
@@ -4172,7 +4950,7 @@ function buildPassesOverlay(fold, primary) {
 	const overlay = {};
 	for (const { key, entry } of fold.passes) {
 		const primaryEntry = primaryByKey.get(key);
-		const passOverlay = primaryEntry === void 0 ? { ...entry } : buildPassOverlayEntry(entry, primaryEntry);
+		const passOverlay = primaryEntry === void 0 ? buildFullPassOverlay(entry) : buildPassOverlayEntry(entry, primaryEntry);
 		if (passOverlay !== void 0) overlay[key] = passOverlay;
 	}
 	return Object.keys(overlay).length === 0 ? void 0 : overlay;
@@ -5735,6 +6513,6 @@ function isFileMissing(err) {
 	return typeof err === "object" && err !== null && "code" in err && typeof err.code === "string" && FILE_MISSING_CODES.has(err.code);
 }
 //#endregion
-export { asResourceKey as A, createGistStateAdapter as C, createGamePassDriver as D, validateEnvironmentName as E, isSha256Hex as F, derivePriceFields as I, asSha256Hex as M, isResourceKey as N, createDeveloperProductDriver as O, isRobloxAssetId as P, UNIVERSE_SINGLETON_KEY as S, serializeStateFile as T, isGistStateConfig as _, buildStatePort as a, createPlaceDriver as b, applyOps as c, resolveStateConfig as d, flattenConfig as f, defaultKindRegistry as g, diff as h, loadConfig$1 as i, asRobloxAssetId as j, shouldReuploadIcon as k, validatePlan as l, renderDisplayNamePrefix as m, serializeConfig as n, buildDesired as o, DEFAULT_PREFIX_FORMAT as p, deploy as r, buildDefaultRegistry as s, migrateMantleState as t, selectEnvironment as u, validateConfig as v, parseStateFile as w, SOCIAL_LINK_FIELDS as x, createUniverseDriver as y };
+export { createGamePassDriver as A, createClackProgressAdapter as B, createPlaceDriver as C, parseStateFile as D, createGistStateAdapter as E, asSha256Hex as F, renderMigrationSummary as G, renderDeployError as H, isResourceKey as I, renderParseError as K, isRobloxAssetId as L, shouldReuploadIcon as M, asResourceKey as N, serializeStateFile as O, asRobloxAssetId as P, isSha256Hex as R, createUniverseDriver as S, UNIVERSE_SINGLETON_KEY as T, renderMigrateError as U, renderBuildStatePortError as V, renderMigrateParseError as W, diff as _, buildStatePort as a, validateConfig as b, applyOps as c, selectMergedEnvironment as d, collectRedactionAnnotations as f, renderDisplayNamePrefix as g, DEFAULT_PREFIX_FORMAT as h, loadConfig$1 as i, createDeveloperProductDriver as j, validateEnvironmentName as k, validatePlan as l, flattenConfig as m, serializeConfig as n, buildDesired as o, resolveStateConfig as p, renderStateWriteError as q, deploy as r, buildDefaultRegistry as s, migrateMantleState as t, selectEnvironment as u, defaultKindRegistry as v, SOCIAL_LINK_FIELDS as w, createClackPort as x, isGistStateConfig as y, derivePriceFields as z };
 
-//# sourceMappingURL=migrate-mantle-state-DjAU-I39.mjs.map
+//# sourceMappingURL=migrate-mantle-state-CQjWBZwT.mjs.map