@bedrock-rbx/core 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/{migrate-mantle-state-CQjWBZwT.mjs → migrate-mantle-state-ClQ40EFD.mjs}

@@ -1,8 +1,10 @@
+import { cancel, intro, log, outro } from "@clack/prompts";
 import { ApiError, PermissionError } from "@bedrock-rbx/ocale";
 import { ArkErrors, type } from "arktype";
-import { cancel, intro, log, outro } from "@clack/prompts";
+import { execFile, spawn } from "node:child_process";
 import process from "node:process";
 import { defu } from "defu";
+import { createHash } from "node:crypto";
 import { DeveloperProductsClient } from "@bedrock-rbx/ocale/developer-products";
 import { GamePassesClient } from "@bedrock-rbx/ocale/game-passes";
 import { PlacesClient } from "@bedrock-rbx/ocale/places";
@@ -11,21 +13,69 @@ import { readFile } from "node:fs/promises";
 import { loadConfig } from "c12";
 import { existsSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { execFile } from "node:child_process";
 import { tmpdir } from "node:os";
 import { parseYAML, stringifyYAML } from "confbox";
+//#region src/cli/clack-port.ts
+/**
+* Construct a `ClackPort` whose methods delegate to `@clack/prompts`. The
+* resulting port writes to `process.stdout` via clack's defaults. Kept in
+* its own module so consumers that never need the clack-backed rendering
+* (programmatic deploys, custom adapters) do not pull `@clack/prompts`
+* into their bundle.
+*
+* @example
+*
+* ```ts
+* import { createClackPort } from "@bedrock-rbx/core";
+*
+* const port = createClackPort();
+*
+* expect(typeof port.logSuccess).toBe("function");
+* ```
+*
+* @returns A port whose six methods each invoke the matching clack helper.
+*/
+function createClackPort() {
+	return {
+		cancel: (message) => {
+			cancel(message);
+		},
+		intro: (message) => {
+			intro(message);
+		},
+		logError: (message) => {
+			log.error(message);
+		},
+		logMessage: (message) => {
+			log.message(message);
+		},
+		logSuccess: (message) => {
+			log.success(message);
+		},
+		outro: (message) => {
+			outro(message);
+		}
+	};
+}
+//#endregion
 //#region src/cli/render.ts
 /**
-* Render a `DeployError` to the supplied `ClackPort` as a single error line.
-* Each variant produces a distinct, terse diagnostic; wrapped variants
-* (`applyFailed`, `buildDesiredFailed`, `configLoadFailed`, `stateReadFailed`,
-* `stateWriteFailed`) surface the inner cause's actionable detail (file path,
-* resource key, parser message, HTTP failure, validator issue) so the reader
-* does not have to inspect the full cause to act.
+* Render a `DeployError` to the supplied `ClackPort`. Most variants emit a
+* single error line; `applyFailed` emits one line per failing op in the
+* aggregate (in Phase 1 then Phase 2 input order). Wrapped variants
+* (`applyFailed`, `buildDesiredFailed`, `configLoadFailed`,
+* `stateReadFailed`, `stateWriteFailed`) surface the inner cause's
+* actionable detail (file path, resource key, parser message, HTTP failure,
+* validator issue) so the reader does not have to inspect the full cause to
+* act.
 * @param err - The deploy error to describe.
 * @param port - The output port the diagnostic is written to.
 */
 function renderDeployError(err, port) {
+	if (err.kind === "applyFailed") {
+		for (const failure of err.cause.failures) port.logError(`apply failed for '${failure.key}': ${applyCauseDetail(failure)}`);
+		return;
+	}
 	port.logError(deployErrorMessage(err));
 }
 /**
@@ -39,6 +89,30 @@ function renderParseError(err, port) {
 	port.logError(parseErrorMessage(err));
 }
 /**
+* Render a `SpawnOverrideError` to the supplied `ClackPort` as a single
+* error line that names the environment alongside the failure mode. On
+* `launchFailed` the child never produced output of its own, so the parent
+* carries the diagnostic; on `nonZeroExit` the parent's line attributes the
+* exit code to a specific environment when several spawns are running.
+* @param input - Environment + spawn-override error to describe.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderOverrideError(input, port) {
+	port.logError(overrideErrorMessage(input));
+}
+/**
+* Render the failure surfaced when override discovery throws a non-absence
+* filesystem error (for example `EACCES` on a `.bedrock/<command>.ts` that
+* exists but cannot be read). Discovery refuses to fall through to the
+* built-in path in that case, so the CLI reports the cause and exits rather
+* than crashing on the unhandled throw.
+* @param error - The value thrown during override discovery.
+* @param port - The output port the diagnostic is written to.
+*/
+function renderOverrideDiscoveryError(error, port) {
+	port.logError(`override discovery failed: ${safeStringify(error)}`);
+}
+/**
 * Render a `ParseMigrateError` to the supplied `ClackPort`. Reuses
 * `parseErrorMessage` for the three flag-shape variants and adds a
 * dedicated message for `unknownSource` listing the supported sources.
@@ -110,18 +184,31 @@ function permissionDetail(err) {
 	const scopeList = err.requiredScopes.map((scope) => `'${scope}'`).join(", ");
 	return `${err.message} on ${err.operationKey}: missing required ${label} ${scopeList}. Grant ${pronoun} on the API key at https://create.roblox.com/credentials`;
 }
+function safeStringify(value) {
+	if (value instanceof Error) return value.message;
+	try {
+		return String(value);
+	} catch {
+		return "<unprintable cause>";
+	}
+}
 function applyCauseDetail(cause) {
 	switch (cause.kind) {
 		case "driverFailure":
 			if (cause.cause instanceof PermissionError) return permissionDetail(cause.cause);
 			return cause.cause.message;
+		case "unexpectedThrow": return `unexpected error: ${safeStringify(cause.cause)}`;
 		case "updateUnsupported": return "update not supported";
 	}
 }
 function buildDesiredDetail(cause) {
 	switch (cause.kind) {
-		case "fileReadFailed": return `(${cause.filePath}): ${cause.reason}`;
-		case "iconRemovalRejected": return `: ${cause.message}`;
+		case "fileReadFailed": return `for '${cause.key}' (${cause.filePath}): ${cause.reason}`;
+		case "iconRemovalRejected": return `for '${cause.key}': ${cause.message}`;
+		case "redactedNameCollision": {
+			const [first, second] = cause.keys;
+			return `for '${first}' and '${second}': ${cause.message}`;
+		}
 	}
 }
 function configErrorDetail(err) {
@@ -141,8 +228,7 @@ function stateErrorDetail(cause) {
 }
 function deployErrorMessage(err) {
 	switch (err.kind) {
-		case "applyFailed": return `apply failed for '${err.cause.key}': ${applyCauseDetail(err.cause)}`;
-		case "buildDesiredFailed": return `build desired state failed for '${err.cause.key}' ${buildDesiredDetail(err.cause)}`;
+		case "buildDesiredFailed": return `build desired state failed ${buildDesiredDetail(err.cause)}`;
 		case "configLoadFailed": return `config load failed: ${configErrorDetail(err.cause)}`;
 		case "incompletePassEntry": return `pass '${err.key}' is missing '${err.missingField}' under environment '${err.environment}'`;
 		case "incompletePlaceEntry": return `place '${err.key}' is missing '${err.missingField}' under environment '${err.environment}'`;
@@ -163,6 +249,11 @@ function parseErrorMessage(err) {
 		case "unknownFlag": return `unknown flag '--${err.flag}'`;
 	}
 }
+function overrideErrorMessage(input) {
+	const { environment, err } = input;
+	if (err.kind === "launchFailed") return `${environment}: failed to launch override - ${err.cause.message}`;
+	return `${environment}: override exited with code ${String(err.exitCode)}`;
+}
 function migrateParseErrorMessage(err) {
 	if (err.kind === "unknownSource") return `unknown migration source '${err.received}' (supported: ${err.supported.join(", ")})`;
 	return parseErrorMessage(err);
@@ -184,77 +275,54 @@ function buildStatePortErrorMessage(err) {
 	}
 }
 //#endregion
-//#region src/adapters/clack-progress-adapter.ts
+//#region src/core/resolve-state-config.ts
 /**
-* Build a {@link ProgressPort} that renders events through a `ClackPort`.
-* Pattern-matches on the event `kind`: `deploySuccess` becomes a single
-* success line and `deployFailure` delegates to the package's deploy-error
-* rendering helper.
+* Pick the `StateConfig` that applies to `environment`. Per-environment
+* overrides win over the root block; if neither is present, returns
+* `Err(stateNotConfigured)` so the deploy boundary can surface a typed
+* error instead of silently falling back.
 *
+* @param config - Validated project config.
+* @param environment - Target environment name.
+* @returns The resolved `StateConfig`, or `Err(stateNotConfigured)` when
+* neither the environment override nor the root block is set.
 * @example
 *
 * ```ts
-* import { createClackProgressAdapter, type ClackPort } from "@bedrock-rbx/core";
-*
-* const lines: Array<string> = [];
-* const clack: ClackPort = {
-*     cancel: (message) => lines.push(`cancel: ${message}`),
-*     intro: (message) => lines.push(`intro: ${message}`),
-*     logError: (message) => lines.push(`error: ${message}`),
-*     logMessage: (message) => lines.push(`log: ${message}`),
-*     logSuccess: (message) => lines.push(`ok: ${message}`),
-*     outro: (message) => lines.push(`outro: ${message}`),
-* };
-*
-* const port = createClackProgressAdapter({ clack });
-*
-* port.emit({ environment: "production", kind: "deploySuccess", resourceCount: 3 });
-*
-* expect(lines).toEqual(["ok: production: 3 resources reconciled"]);
-* ```
-*
-* @param deps - The clack port the adapter renders through.
-* @returns A `ProgressPort` that renders via clack.
-*/
-function createClackProgressAdapter(deps) {
-	const { clack } = deps;
-	return { emit(event) {
-		switch (event.kind) {
-			case "deployFailure":
-				renderDeployError(event.error, clack);
-				return;
-			case "deploySuccess": clack.logSuccess(`${event.environment}: ${event.resourceCount} resources reconciled`);
-		}
-	} };
-}
-//#endregion
-//#region src/core/derive-price-fields.ts
-/**
-* Translate a Mantle-style optional price into the Open Cloud wire shape.
-*
-* `desired.price === undefined` (no price declared) becomes
-* `{ isForSale: false }` and the `price` key is omitted entirely. A defined
-* price (including `0`) becomes `{ isForSale: true, price }`. Both
-* `developerProduct` create and update paths share this helper so the
-* "absent ⇒ off-sale" semantics live in exactly one place.
-*
-* @param desired - Object carrying the user-declared `price`.
-* @returns The wire-shape `{ isForSale, price? }` fragment.
-*
-* @example
+* import { resolveStateConfig } from "@bedrock-rbx/core";
 *
-* ```ts
-* import { derivePriceFields } from "@bedrock-rbx/core";
+* const result = resolveStateConfig(
+*     {
+*         state: { backend: "gist", gistId: "root-gist" },
+*         environments: {
+*             production: { state: { backend: "gist", gistId: "prod-gist" } },
+*         },
+*     },
+*     "production",
+* );
 *
-* expect(derivePriceFields({ price: undefined })).toStrictEqual({ isForSale: false });
-* expect(derivePriceFields({ price: 250 })).toStrictEqual({ isForSale: true, price: 250 });
+* expect(result.success).toBeTrue();
+* if (result.success) {
+*     expect(result.data).toContainEntry(["gistId", "prod-gist"]);
+* }
 * ```
 */
-function derivePriceFields(desired) {
-	if (desired.price === void 0) return { isForSale: false };
+function resolveStateConfig(config, environment) {
+	const override = config.environments[environment]?.state;
+	if (override !== void 0) return {
+		data: override,
+		success: true
+	};
+	if (config.state !== void 0) return {
+		data: config.state,
+		success: true
+	};
 	return {
-		isForSale: true,
-		price: desired.price
+		err: {
+			environment,
+			kind: "stateNotConfigured"
+		},
+		success: false
 	};
 }
 //#endregion
@@ -442,6 +510,62 @@ function asSha256Hex(raw) {
 	return raw;
 }
 //#endregion
+//#region src/core/environment.ts
+/**
+* Source pattern for environment names, including `^` and `$` anchors.
+* Letters, digits, `-`, `_`, length 1-64.
+*
+* Exported so the config schema can validate `environments` keys against
+* the same alphabet and length cap that adapters enforce on storage
+* identifiers. Single source of truth: changing the alphabet here changes
+* both the runtime check and the schema-level key constraint.
+*
+* Anchors are embedded so callers do not have to re-add them, matching
+* the `RESOURCE_KEY_PATTERN_SOURCE` convention in `types/ids.ts`.
+*/
+const ENV_NAME_PATTERN_SOURCE = "^[A-Za-z0-9_-]{1,64}$";
+const ENVIRONMENT_NAME_PATTERN = new RegExp(ENV_NAME_PATTERN_SOURCE);
+/**
+* Validate an environment name at a state-adapter boundary.
+*
+* Adapters that map environment names onto filesystem-like identifiers
+* (gist filenames, S3 keys) must reject names that could collide or escape
+* their storage layout. This helper accepts letters, digits, `-`, and `_`
+* only, with length between 1 and 64, and returns a `StateError` for
+* anything outside that set so the adapter can fail loudly instead of
+* silently stripping characters.
+*
+* @example
+*
+* ```ts
+* import { validateEnvironmentName } from "@bedrock-rbx/core";
+*
+* const ok = validateEnvironmentName("production");
+* expect(ok.success).toBeTrue();
+*
+* const bad = validateEnvironmentName("prod/staging");
+* expect(bad.success).toBeFalse();
+* ```
+*
+* @param environment - Raw environment name supplied by a caller.
+* @returns `Ok(environment)` when the name is safe to use, or
+* `Err(StateError)` with a descriptive reason when it is not.
+*/
+function validateEnvironmentName(environment) {
+	if (!ENVIRONMENT_NAME_PATTERN.test(environment)) return {
+		err: {
+			file: environment,
+			kind: "stateError",
+			reason: `invalid environment name: must match ${String(ENVIRONMENT_NAME_PATTERN)}`
+		},
+		success: false
+	};
+	return {
+		data: environment,
+		success: true
+	};
+}
+//#endregion
 //#region src/core/kinds/hash.ts
 /**
 * Compute the SHA-256 hex digest of a byte sequence. Shared by kind modules
@@ -838,272 +962,736 @@ function shouldReuploadIcon(currentHashes, desiredHashes) {
 	return !iconHashesEqual(currentHashes, desiredHashes);
 }
 //#endregion
-//#region src/core/plan-follow-up-patch.ts
+//#region src/core/validate-universe-xor.ts
 /**
-* Plan the optional follow-up PATCH body needed after a developer-product
-* create POST. Returns `undefined` when no PATCH is required: either the
-* user did not declare `storePageEnabled`, or the create response already
-* matches the desired value.
+* Walk the loose authored-shape and surface every place the
+* universeId-XOR-between-root-and-env rule is violated. Pure: returns
+* the issue list; the caller hands it to arktype's `ctx.reject` so each
+* one lands at the offending config path. The schema's runtime narrow
+* uses this to enforce the rule at validation time before the validated
+* value is cast to the strict `Config` discriminated union.
 *
-* @param desired - Desired state for the developer product being created.
-* @param createResponse - The `storePageEnabled` value reported by the create POST response.
-* @returns The PATCH body to issue, or `undefined` when no follow-up is needed.
+* @param value - Parsed config the schema is validating.
+* @returns Zero or more issues. Empty when the config satisfies the rule.
 */
-function planFollowUpPatch(desired, createResponse) {
-	if (desired.storePageEnabled === void 0) return;
-	if (desired.storePageEnabled === createResponse.storePageEnabled) return;
-	return { storePageEnabled: desired.storePageEnabled };
+function collectUniverseIdIssues(value) {
+	const rootUniverseId = value.universe?.universeId;
+	const hasRootUniverseBlock = value.universe !== void 0;
+	const environmentEntries = Object.entries(value.environments);
+	const hasEnvironmentUniverseId = environmentEntries.some(([, environment]) => environment.universe?.universeId !== void 0);
+	const environmentIssues = collectEnvironmentIssues(rootUniverseId, environmentEntries);
+	const rootIssues = hasRootUniverseBlock && rootUniverseId === void 0 && !hasEnvironmentUniverseId ? [{
+		message: "universeId must be declared on the root universe block, or on every environment that declares its own universe overlay.",
+		path: ["universe", "universeId"]
+	}] : [];
+	return [...environmentIssues, ...rootIssues];
 }
-//#endregion
-//#region src/adapters/developer-product-driver.ts
-/**
-* Wraps {@link DeveloperProductsClient} as a `ResourceDriver<"developerProduct">`
-* that maps a desired-state entry to an ocale create or update call and the
-* response back to a `ResourceCurrentState<"developerProduct">`. The
-* `update` path consumes the upstream `204 No Content` response and
-* synthesizes the post-update `ResourceCurrentState` from `desired` plus
-* the existing `current.outputs`, carrying `iconImageAssetId` forward when
-* present.
-*
-* Upstream `OpenCloudError` results pass through as `Result` failures.
-*
-* @param deps - Injected ocale client and owning universe.
-* @returns A driver indexable by `"developerProduct"` in a `DriverRegistry`.
-*
-* @example
-*
-* ```ts
-* import type { HttpClient } from "@bedrock-rbx/ocale";
-* import { DeveloperProductsClient } from "@bedrock-rbx/ocale/developer-products";
-* import {
-*     asResourceKey,
-*     asRobloxAssetId,
-*     createDeveloperProductDriver,
-* } from "@bedrock-rbx/core";
-*
-* const httpClient: HttpClient = {
-*     async request() {
-*         return {
-*             data: {
-*                 body: {
-*                     createdTimestamp: "2024-01-15T10:30:00.000Z",
-*                     description: "Stocks the player up with 1,000 premium gems.",
-*                     iconImageAssetId: null,
-*                     isForSale: false,
-*                     isImmutable: false,
-*                     name: "Gem Pack",
-*                     priceInformation: null,
-*                     productId: 9_876_543_210,
-*                     storePageEnabled: false,
-*                     universeId: 1_234_567_890,
-*                     updatedTimestamp: "2024-01-15T10:30:00.000Z",
-*                 },
-*                 headers: {},
-*                 status: 200,
-*             },
-*             success: true,
-*         };
-*     },
-* };
-*
-* const driver = createDeveloperProductDriver({
-*     client: new DeveloperProductsClient({
-*         apiKey: "rbx-your-key",
-*         httpClient,
-*         sleep: async () => {},
-*     }),
-*     readFile: async () => new Uint8Array([0x89, 0x50, 0x4e, 0x47]),
-*     universeId: asRobloxAssetId("1234567890"),
-* });
-*
-* return driver
-*     .create({
-*         description: "Stocks the player up with 1,000 premium gems.",
-*         isRegionalPricingEnabled: undefined,
-*         key: asResourceKey("gem-pack"),
-*         kind: "developerProduct",
-*         name: "Gem Pack",
-*         price: undefined,
-*         storePageEnabled: undefined,
-*     })
-*     .then((result) => {
-*         expect(result.success).toBeTrue();
-*         if (result.success) {
-*             expect(result.data.outputs.productId).toBe("9876543210");
-*         }
-*     });
-* ```
-*/
-function createDeveloperProductDriver(deps) {
-	const effective = {
-		...deps,
-		readFile: withRedactedIcon(deps.readFile)
-	};
-	return {
-		async create(desired) {
-			return createOne(effective, desired);
-		},
-		async update(current, desired) {
-			return updateOne(effective, {
-				current,
-				desired
-			});
-		}
-	};
-}
-function toCurrentState$2(desired, data) {
-	const iconImageAssetId = data.iconImageAssetId === void 0 ? void 0 : asRobloxAssetId(data.iconImageAssetId);
-	return {
-		data: {
-			...desired,
-			outputs: {
-				productId: asRobloxAssetId(data.id),
-				...iconImageAssetId === void 0 ? {} : { iconImageAssetId }
-			}
-		},
-		success: true
-	};
-}
-async function applyFollowUpPatch(deps, { created, desired }) {
-	const followUp = planFollowUpPatch(desired, created);
-	if (followUp === void 0) return toCurrentState$2(desired, created);
-	if ((await deps.client.update({
-		productId: asRobloxAssetId(created.id),
-		universeId: deps.universeId,
-		...followUp
-	})).success) return toCurrentState$2(desired, created);
-	return toCurrentState$2({
-		...desired,
-		storePageEnabled: created.storePageEnabled
-	}, created);
-}
-async function createOne(deps, desired) {
-	const imageFile = desired.icon === void 0 ? void 0 : await deps.readFile(desired.icon["en-us"]);
-	const created = await deps.client.create({
-		name: desired.name,
-		description: desired.description,
-		universeId: deps.universeId,
-		...imageFile === void 0 ? {} : { imageFile },
-		...derivePriceFields(desired),
-		...desired.isRegionalPricingEnabled === void 0 ? {} : { isRegionalPricingEnabled: desired.isRegionalPricingEnabled }
-	});
-	if (!created.success) return created;
-	return applyFollowUpPatch(deps, {
-		created: created.data,
-		desired
-	});
-}
-async function updateOne(deps, { current, desired }) {
-	const imageFile = desired.icon !== void 0 && shouldReuploadIcon(current.iconFileHashes, desired.iconFileHashes) ? await deps.readFile(desired.icon["en-us"]) : void 0;
-	const result = await deps.client.update({
-		name: desired.name,
-		description: desired.description,
-		productId: current.outputs.productId,
-		universeId: deps.universeId,
-		...imageFile === void 0 ? {} : { imageFile },
-		...derivePriceFields(desired),
-		...desired.isRegionalPricingEnabled === void 0 ? {} : { isRegionalPricingEnabled: desired.isRegionalPricingEnabled },
-		...desired.storePageEnabled === void 0 ? {} : { storePageEnabled: desired.storePageEnabled }
+function collectEnvironmentIssues(rootUniverseId, environmentEntries) {
+	return environmentEntries.flatMap(([environmentName, environment]) => {
+		if (environment.universe === void 0) return [];
+		if (rootUniverseId !== void 0 && environment.universe.universeId !== void 0) return [{
+			message: "universeId is declared at the root universe block; remove it from this environment overlay (root is authoritative) or remove it from the root and declare it on every environment.",
+			path: [
+				"environments",
+				environmentName,
+				"universe",
+				"universeId"
+			]
+		}];
+		if (rootUniverseId === void 0 && environment.universe.universeId === void 0) return [{
+			message: "universeId must be declared on this environment overlay because the root universe block does not provide one.",
+			path: [
+				"environments",
+				environmentName,
+				"universe",
+				"universeId"
+			]
+		}];
+		return [];
 	});
-	if (!result.success) return result;
-	return {
-		data: {
-			...desired,
-			outputs: current.outputs
-		},
-		success: true
-	};
 }
 //#endregion
-//#region src/adapters/game-pass-driver.ts
+//#region src/core/schema.ts
 /**
-* Wraps {@link GamePassesClient} as a `ResourceDriver<"gamePass">` that maps
-* a desired-state entry to an ocale create call and the response back to a
-* `ResourceCurrentState<"gamePass">`.
-*
-* Upstream `OpenCloudError` results pass through as `Result` failures.
-* Filesystem errors from `deps.readFile` do not fit the `OpenCloudError`
-* shape and propagate as promise rejections; shell callers are expected to
-* translate them if a unified error surface is required.
-*
-* @param deps - Injected ocale client, file reader, and owning universe.
-* @returns A driver indexable by `"gamePass"` in a `DriverRegistry`.
-* @throws Whatever `deps.readFile` rejects with.
+* Narrow a `StateConfig` to the `GistStateConfig` arm. The `(string & {})`
+* autocomplete idiom prevents TypeScript from narrowing on
+* `backend === "gist"` alone, so dispatch sites use this guard to
+* preserve the `gistId` field shape.
 *
 * @example
 *
 * ```ts
-* import type { HttpClient } from "@bedrock-rbx/ocale";
-* import { GamePassesClient } from "@bedrock-rbx/ocale/game-passes";
-* import {
-*     asResourceKey,
-*     asRobloxAssetId,
-*     asSha256Hex,
-*     createGamePassDriver,
-* } from "@bedrock-rbx/core";
-*
-* const httpClient: HttpClient = {
-*     async request() {
-*         return {
-*             data: {
-*                 body: {
-*                     createdTimestamp: "2024-01-15T10:30:00.000Z",
-*                     description: "Grants VIP perks.",
-*                     gamePassId: 9_876_543_210,
-*                     iconAssetId: 1_122_334_455,
-*                     isForSale: true,
-*                     name: "VIP Pass",
-*                     updatedTimestamp: "2024-01-15T10:30:00.000Z",
-*                 },
-*                 headers: {},
-*                 status: 200,
-*             },
-*             success: true,
-*         };
-*     },
-* };
+* import { isGistStateConfig } from "@bedrock-rbx/core";
+* import type { StateConfig } from "@bedrock-rbx/core/config";
 *
-* const driver = createGamePassDriver({
-*     client: new GamePassesClient({
-*         apiKey: "rbx-your-key",
-*         httpClient,
-*         sleep: async () => {},
-*     }),
-*     readFile: async () => new Uint8Array([0x89, 0x50, 0x4e, 0x47]),
-*     universeId: asRobloxAssetId("1234567890"),
-* });
+* const config: StateConfig = { backend: "gist", gistId: "abc" };
 *
-* return driver
-*     .create({
-*         description: "Grants VIP perks.",
-*         icon: { "en-us": "assets/vip-icon.png" },
-*         iconFileHashes: {
-*             "en-us": asSha256Hex(
-*                 "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-*             ),
-*         },
-*         key: asResourceKey("vip-pass"),
-*         kind: "gamePass",
-*         name: "VIP Pass",
-*         price: 500,
-*     })
-*     .then((result) => {
-*         expect(result.success).toBeTrue();
-*         if (result.success) {
-*             expect(result.data.outputs.assetId).toBe("9876543210");
-*         }
-*     });
+* expect(isGistStateConfig(config)).toBeTrue();
+* if (isGistStateConfig(config)) {
+*     expect(config.gistId).toBe("abc");
+* }
 * ```
+*
+* @param config - Resolved state config to inspect.
+* @returns `true` when `config.backend === "gist"`; otherwise `false`.
 */
-function createGamePassDriver(deps) {
-	const effective = {
-		...deps,
-		readFile: withRedactedIcon(deps.readFile)
-	};
-	return {
-		async create(desired) {
-			return createGamePass(effective, desired);
-		},
+function isGistStateConfig(config) {
+	return config.backend === "gist";
+}
+const OPTIONAL_BOOLEAN$2 = "boolean | undefined";
+const OPTIONAL_STRING = "string | undefined";
+const REDACTED_KEY = "redacted?";
+const NON_EMPTY_OVERRIDE_MESSAGE = "a non-empty override object; use `redacted: true` for default placeholders";
+/**
+* Shared arktype constraint for any optional positive-integer field.
+* Reused by per-kind entry schemas so positive-integer fields validate
+* identically.
+*/
+const OPTIONAL_POSITIVE_INTEGER = "(number.integer >= 1) | undefined";
+/**
+* Shared arktype constraint for any optional Robux-price field. The schema
+* rejects negatives, fractional values, `NaN`, and `Infinity` at config
+* validation time so a malformed price surfaces with a path attributing the
+* failure to the offending field, rather than slipping through to the
+* Roblox API and surfacing as an opaque error at apply time. Per-kind entry
+* schemas reuse this constant so all Robux-price fields validate
+* identically.
+*/
+const OPTIONAL_ROBUX_PRICE = "number.integer >= 0 | undefined";
+const gamePassRedacted = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"name?": "string",
+	"price?": OPTIONAL_ROBUX_PRICE
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const placeRedacted = type({
+	"description?": "string",
+	"displayName?": "string"
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const productRedacted = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"name?": "string",
+	"price?": OPTIONAL_ROBUX_PRICE
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const environmentRedacted = type({
+	"description?": "string",
+	"displayName?": "string",
+	"icon?": iconMap,
+	"name?": "string",
+	"price?": OPTIONAL_ROBUX_PRICE
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
+	return true;
+}).or(OPTIONAL_BOOLEAN$2);
+const gamePassEntry = type({
+	"name": "string",
+	"description": "string",
+	"icon": iconMap,
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: gamePassRedacted
+});
+const passesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassEntry }).onUndeclaredKey("reject");
+const developerProductEntry = type({
+	"name": "string",
+	"description": "string",
+	"icon?": iconMap,
+	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: productRedacted,
+	"storePageEnabled?": OPTIONAL_BOOLEAN$2
+}).onUndeclaredKey("reject");
+const productsCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductEntry }).onUndeclaredKey("reject");
+const ROBLOX_ID_DIGITS = "string.digits";
+const placeEntry = type({
+	"description?": OPTIONAL_STRING,
+	"displayName?": OPTIONAL_STRING,
+	"filePath": "string",
+	[REDACTED_KEY]: placeRedacted,
+	"serverSize?": OPTIONAL_POSITIVE_INTEGER
+}).onUndeclaredKey("reject");
+const placesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeEntry }).onUndeclaredKey("reject");
+const socialLinkOrUndefined$1 = type({
+	title: "string",
+	uri: "string"
+}).onUndeclaredKey("reject").or("undefined");
+const universeEntry = type({
+	"consoleEnabled?": OPTIONAL_BOOLEAN$2,
+	"desktopEnabled?": OPTIONAL_BOOLEAN$2,
+	"discordSocialLink?": socialLinkOrUndefined$1,
+	"displayName?": OPTIONAL_STRING,
+	"facebookSocialLink?": socialLinkOrUndefined$1,
+	"guildedSocialLink?": socialLinkOrUndefined$1,
+	"mobileEnabled?": OPTIONAL_BOOLEAN$2,
+	"privateServerPriceRobux?": OPTIONAL_ROBUX_PRICE,
+	"robloxGroupSocialLink?": socialLinkOrUndefined$1,
+	"tabletEnabled?": OPTIONAL_BOOLEAN$2,
+	"twitchSocialLink?": socialLinkOrUndefined$1,
+	"twitterSocialLink?": socialLinkOrUndefined$1,
+	"universeId?": ROBLOX_ID_DIGITS,
+	"voiceChatEnabled?": OPTIONAL_BOOLEAN$2,
+	"vrEnabled?": OPTIONAL_BOOLEAN$2,
+	"youtubeSocialLink?": socialLinkOrUndefined$1
+}).onUndeclaredKey("reject");
+const stateConfig = type({
+	"backend": "string",
+	"gistId?": "string > 0"
+}).onUndeclaredKey("reject");
+const gamePassOverlay = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"name?": "string",
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: gamePassRedacted
+}).onUndeclaredKey("reject");
+const passesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassOverlay }).onUndeclaredKey("reject");
+const developerProductOverlay = type({
+	"description?": "string",
+	"icon?": iconMap,
+	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
+	"name?": "string",
+	"price?": OPTIONAL_ROBUX_PRICE,
+	[REDACTED_KEY]: productRedacted,
+	"storePageEnabled?": OPTIONAL_BOOLEAN$2
+}).onUndeclaredKey("reject");
+const productsOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductOverlay }).onUndeclaredKey("reject");
+const placeOverlay = type({
+	"description?": OPTIONAL_STRING,
+	"displayName?": OPTIONAL_STRING,
+	"filePath?": "string",
+	"placeId": ROBLOX_ID_DIGITS,
+	[REDACTED_KEY]: placeRedacted,
+	"serverSize?": OPTIONAL_POSITIVE_INTEGER
+}).onUndeclaredKey("reject");
+const placesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeOverlay }).onUndeclaredKey("reject");
+const universeOverlay = universeEntry;
+const environmentEntry = type({
+	"label?": OPTIONAL_STRING,
+	"passes?": passesOverlayCollection,
+	"places?": placesOverlayCollection,
+	"products?": productsOverlayCollection,
+	[REDACTED_KEY]: environmentRedacted,
+	"state?": stateConfig,
+	"universe?": universeOverlay
+}).onUndeclaredKey("reject");
+const rootSchema = type({
+	"displayNamePrefix?": type({
+		"enabled?": OPTIONAL_BOOLEAN$2,
+		"format?": OPTIONAL_STRING
+	}).onUndeclaredKey("reject"),
+	"environments": type({ [`[/${ENV_NAME_PATTERN_SOURCE}/]`]: environmentEntry }).onUndeclaredKey("reject").narrow((value, ctx) => {
+		if (Object.keys(value).length === 0) return ctx.mustBe("an environments record with at least one declared environment");
+		return true;
+	}),
+	"extends?": "unknown",
+	"passes?": passesCollection,
+	"places?": placesCollection,
+	"products?": productsCollection,
+	"state?": stateConfig,
+	"universe?": universeEntry
+}).onUndeclaredKey("reject").narrow((value, ctx) => {
+	return collectUniverseIdIssues(value).reduce((_accumulator, issue) => {
+		return ctx.reject({
+			message: issue.message,
+			path: [...issue.path]
+		});
+	}, true);
+});
+/**
+* Validate a parsed config value against the runtime schema. Returns the
+* validated `Config` on success or a `validationFailed` `ConfigError` with
+* one issue per problem, each attributed to a field path. `sourceFile`
+* appears in the error so callers can point a human at the offending file.
+*
+* @param input - Parsed value from a config source (object tree from a
+* config loader, or a hand-built literal). Shape is checked, not assumed.
+* @param sourceFile - Path or identifier of the source file, used in the
+* `validationFailed` error.
+* @returns `Ok` with the validated `Config`, or `Err` with a
+* `validationFailed` error carrying each issue's field path.
+* @example
+*
+* ```ts
+* import { validateConfig } from "@bedrock-rbx/core";
+*
+* const ok = validateConfig(
+*     {
+*         environments: { production: {} },
+*         passes: {
+*             "vip-pass": {
+*                 description: "VIP perks.",
+*                 icon: { "en-us": "assets/vip.png" },
+*                 name: "VIP Pass",
+*                 price: 500,
+*             },
+*         },
+*     },
+*     "bedrock.config.ts",
+* );
+* expect(ok.success).toBeTrue();
+*
+* const err = validateConfig(
+*     { environments: { production: {} }, passes: { "vip-pass": { name: "VIP" } } },
+*     "bedrock.config.ts",
+* );
+* expect(err.success).toBeFalse();
+* if (!err.success) {
+*     expect(err.err.kind).toBe("validationFailed");
+* }
+* ```
+*/
+function validateConfig(input, sourceFile) {
+	const validated = rootSchema(input);
+	if (validated instanceof ArkErrors) return {
+		err: {
+			issues: Array.from(validated, (issue) => {
+				return {
+					message: issue.message,
+					path: [...issue.path].map((segment) => String(segment))
+				};
+			}),
+			kind: "validationFailed",
+			sourceFile
+		},
+		success: false
+	};
+	return {
+		data: validated,
+		success: true
+	};
+}
+//#endregion
+//#region src/adapters/clack-progress-adapter.ts
+/**
+* Build a {@link ProgressPort} that renders events through a `ClackPort`.
+* Pattern-matches on the event `kind`: per-resource events render one line each,
+* the aggregate `applySummary` becomes the deploy footer, and `stateWritten`
+* names the persistence backend resolved from the loaded `Config`.
+*
+* @example
+*
+* ```ts
+* import { createClackProgressAdapter, type ClackPort } from "@bedrock-rbx/core";
+*
+* const lines: Array<string> = [];
+* const clack: ClackPort = {
+*     cancel: (message) => lines.push(`cancel: ${message}`),
+*     intro: (message) => lines.push(`intro: ${message}`),
+*     logError: (message) => lines.push(`error: ${message}`),
+*     logMessage: (message) => lines.push(`log: ${message}`),
+*     logSuccess: (message) => lines.push(`ok: ${message}`),
+*     outro: (message) => lines.push(`outro: ${message}`),
+* };
+*
+* const port = createClackProgressAdapter({ clack });
+*
+* port.emit({ environment: "production", kind: "stateWritten" });
+*
+* expect(lines).toEqual(["log: State written to state"]);
+* ```
+*
+* @param deps - The clack port and optional config the adapter renders through.
+* @returns A `ProgressPort` that renders via clack.
+*/
+function createClackProgressAdapter(deps) {
+	return { emit(event) {
+		renderEvent(event, deps);
+	} };
+}
+/**
+* Build a {@link ProgressPort} for the default CLI rendering path: wires a
+* fresh {@link createClackPort} into {@link createClackProgressAdapter}. The
+* `config` argument (raw `Config` or env-resolved `ResolvedConfig`) is
+* forwarded so `stateWritten` events can name the persistence backend; pass
+* `undefined` when the config has not yet loaded.
+*
+* Internal: used by `deploy()`'s default-port resolver when callers omit
+* `progress` and `BEDROCK_CLI` is set.
+*
+* @param config - Pre-loaded or env-resolved config used to format the
+*   state-backend label, or `undefined` to render the generic placeholder.
+* @returns A clack-backed `ProgressPort` that writes to `process.stdout`.
+*/
+function createDefaultProgressAdapter(config) {
+	const clack = createClackPort();
+	return config === void 0 ? createClackProgressAdapter({ clack }) : createClackProgressAdapter({
+		clack,
+		config
+	});
+}
+function applySummaryLine(event) {
+	return `Succeeded in ${(event.durationMs / 1e3).toFixed(1)}s: ${[
+		`${event.created} create`,
+		`${event.updated} update`,
+		`${event.noop} noop`,
+		`${event.failed} failed`
+	].join(", ")}`;
+}
+function stateConfigLabel(state) {
+	if (isGistStateConfig(state)) return `gist:${state.gistId}`;
+	return state.backend;
+}
+function formatStateLabel(config, environment) {
+	if (config === void 0) return "state";
+	const resolved = resolveStateConfig(config, environment);
+	if (!resolved.success) return "state";
+	return stateConfigLabel(resolved.data);
+}
+function extractResourceId(event) {
+	switch (event.resourceKind) {
+		case "developerProduct": return event.outputs.productId;
+		case "gamePass": return event.outputs.assetId;
+		case "place": return;
+		case "universe": return event.outputs.rootPlaceId;
+	}
+}
+function renderResourceOpSucceeded(event, clack) {
+	if (event.opType === "create") {
+		const id = extractResourceId(event);
+		const suffix = id === void 0 ? "" : ` (id ${id})`;
+		clack.logSuccess(`${event.resourceKind}.${event.key} created${suffix}`);
+		return;
+	}
+	clack.logSuccess(`${event.resourceKind}.${event.key} ${event.changedFields.join(", ")} updated`);
+}
+function describeApplyError(error) {
+	switch (error.kind) {
+		case "driverFailure": return `failed: ${error.cause.message}`;
+		case "unexpectedThrow": return "unexpected error";
+		case "updateUnsupported": return "update not supported";
+	}
+}
+function renderEvent(event, deps) {
+	const { clack, config } = deps;
+	switch (event.kind) {
+		case "applySummary":
+			clack.logMessage(applySummaryLine(event));
+			return;
+		case "deployFailure":
+			renderDeployError(event.error, clack);
+			return;
+		case "deploySuccess":
+			clack.logSuccess(`${event.environment}: ${event.resourceCount} resources reconciled`);
+			return;
+		case "resourceOpFailed":
+			clack.logError(`${event.resourceKind}.${event.key} ${describeApplyError(event.error)}`);
+			return;
+		case "resourceOpNoop":
+			clack.logMessage(`${event.resourceKind}.${event.key} unchanged`);
+			return;
+		case "resourceOpStarted": return;
+		case "resourceOpSucceeded":
+			renderResourceOpSucceeded(event, clack);
+			return;
+		case "stateWritten": clack.logMessage(`State written to ${formatStateLabel(config, event.environment)}`);
+	}
+}
+//#endregion
+//#region src/core/derive-price-fields.ts
+/**
+* Translate a Mantle-style optional price into the Open Cloud wire shape.
+*
+* `desired.price === undefined` (no price declared) becomes
+* `{ isForSale: false }` and the `price` key is omitted entirely. A defined
+* price (including `0`) becomes `{ isForSale: true, price }`. Both
+* `developerProduct` create and update paths share this helper so the
+* "absent ⇒ off-sale" semantics live in exactly one place.
+*
+* @param desired - Object carrying the user-declared `price`.
+* @returns The wire-shape `{ isForSale, price? }` fragment.
+*
+* @example
+*
+* ```ts
+* import { derivePriceFields } from "@bedrock-rbx/core";
+*
+* expect(derivePriceFields({ price: undefined })).toStrictEqual({ isForSale: false });
+* expect(derivePriceFields({ price: 250 })).toStrictEqual({ isForSale: true, price: 250 });
+* ```
+*/
+function derivePriceFields(desired) {
+	if (desired.price === void 0) return { isForSale: false };
+	return {
+		isForSale: true,
+		price: desired.price
+	};
+}
+//#endregion
+//#region src/core/plan-follow-up-patch.ts
+/**
+* Plan the optional follow-up PATCH body needed after a developer-product
+* create POST. Returns `undefined` when no PATCH is required: either the
+* user did not declare `storePageEnabled`, or the create response already
+* matches the desired value.
+*
+* @param desired - Desired state for the developer product being created.
+* @param createResponse - The `storePageEnabled` value reported by the create POST response.
+* @returns The PATCH body to issue, or `undefined` when no follow-up is needed.
+*/
+function planFollowUpPatch(desired, createResponse) {
+	if (desired.storePageEnabled === void 0) return;
+	if (desired.storePageEnabled === createResponse.storePageEnabled) return;
+	return { storePageEnabled: desired.storePageEnabled };
+}
+//#endregion
+//#region src/adapters/developer-product-driver.ts
+/**
+* Wraps {@link DeveloperProductsClient} as a `ResourceDriver<"developerProduct">`
+* that maps a desired-state entry to an ocale create or update call and the
+* response back to a `ResourceCurrentState<"developerProduct">`. The
+* `update` path consumes the upstream `204 No Content` response and
+* synthesizes the post-update `ResourceCurrentState` from `desired` plus
+* the existing `current.outputs`, carrying `iconImageAssetId` forward when
+* present.
+*
+* Upstream `OpenCloudError` results pass through as `Result` failures.
+*
+* @param deps - Injected ocale client and owning universe.
+* @returns A driver indexable by `"developerProduct"` in a `DriverRegistry`.
+*
+* @example
+*
+* ```ts
+* import type { HttpClient } from "@bedrock-rbx/ocale";
+* import { DeveloperProductsClient } from "@bedrock-rbx/ocale/developer-products";
+* import {
+*     asResourceKey,
+*     asRobloxAssetId,
+*     createDeveloperProductDriver,
+* } from "@bedrock-rbx/core";
+*
+* const httpClient: HttpClient = {
+*     async request() {
+*         return {
+*             data: {
+*                 body: {
+*                     createdTimestamp: "2024-01-15T10:30:00.000Z",
+*                     description: "Stocks the player up with 1,000 premium gems.",
+*                     iconImageAssetId: null,
+*                     isForSale: false,
+*                     isImmutable: false,
+*                     name: "Gem Pack",
+*                     priceInformation: null,
+*                     productId: 9_876_543_210,
+*                     storePageEnabled: false,
+*                     universeId: 1_234_567_890,
+*                     updatedTimestamp: "2024-01-15T10:30:00.000Z",
+*                 },
+*                 headers: {},
+*                 status: 200,
+*             },
+*             success: true,
+*         };
+*     },
+* };
+*
+* const driver = createDeveloperProductDriver({
+*     client: new DeveloperProductsClient({
+*         apiKey: "rbx-your-key",
+*         httpClient,
+*         sleep: async () => {},
+*     }),
+*     readFile: async () => new Uint8Array([0x89, 0x50, 0x4e, 0x47]),
+*     universeId: asRobloxAssetId("1234567890"),
+* });
+*
+* return driver
+*     .create({
+*         description: "Stocks the player up with 1,000 premium gems.",
+*         isRegionalPricingEnabled: undefined,
+*         key: asResourceKey("gem-pack"),
+*         kind: "developerProduct",
+*         name: "Gem Pack",
+*         price: undefined,
+*         storePageEnabled: undefined,
+*     })
+*     .then((result) => {
+*         expect(result.success).toBeTrue();
+*         if (result.success) {
+*             expect(result.data.outputs.productId).toBe("9876543210");
+*         }
+*     });
+* ```
+*/
+function createDeveloperProductDriver(deps) {
+	const effective = {
+		...deps,
+		readFile: withRedactedIcon(deps.readFile)
+	};
+	return {
+		async create(desired) {
+			return createOne(effective, desired);
+		},
+		async update(current, desired) {
+			return updateOne(effective, {
+				current,
+				desired
+			});
+		}
+	};
+}
+function toCurrentState$2(desired, data) {
+	const iconImageAssetId = data.iconImageAssetId === void 0 ? void 0 : asRobloxAssetId(data.iconImageAssetId);
+	return {
+		data: {
+			...desired,
+			outputs: {
+				productId: asRobloxAssetId(data.id),
+				...iconImageAssetId === void 0 ? {} : { iconImageAssetId }
+			}
+		},
+		success: true
+	};
+}
+async function applyFollowUpPatch(deps, { created, desired }) {
+	const followUp = planFollowUpPatch(desired, created);
+	if (followUp === void 0) return toCurrentState$2(desired, created);
+	if ((await deps.client.update({
+		productId: asRobloxAssetId(created.id),
+		universeId: deps.universeId,
+		...followUp
+	})).success) return toCurrentState$2(desired, created);
+	return toCurrentState$2({
+		...desired,
+		storePageEnabled: created.storePageEnabled
+	}, created);
+}
+async function createOne(deps, desired) {
+	const imageFile = desired.icon === void 0 ? void 0 : await deps.readFile(desired.icon["en-us"]);
+	const created = await deps.client.create({
+		name: desired.name,
+		description: desired.description,
+		universeId: deps.universeId,
+		...imageFile === void 0 ? {} : { imageFile },
+		...derivePriceFields(desired),
+		...desired.isRegionalPricingEnabled === void 0 ? {} : { isRegionalPricingEnabled: desired.isRegionalPricingEnabled }
+	});
+	if (!created.success) return created;
+	return applyFollowUpPatch(deps, {
+		created: created.data,
+		desired
+	});
+}
+async function updateOne(deps, { current, desired }) {
+	const imageFile = desired.icon !== void 0 && shouldReuploadIcon(current.iconFileHashes, desired.iconFileHashes) ? await deps.readFile(desired.icon["en-us"]) : void 0;
+	const result = await deps.client.update({
+		name: desired.name,
+		description: desired.description,
+		productId: current.outputs.productId,
+		universeId: deps.universeId,
+		...imageFile === void 0 ? {} : { imageFile },
+		...derivePriceFields(desired),
+		...desired.isRegionalPricingEnabled === void 0 ? {} : { isRegionalPricingEnabled: desired.isRegionalPricingEnabled },
+		...desired.storePageEnabled === void 0 ? {} : { storePageEnabled: desired.storePageEnabled }
+	});
+	if (!result.success) return result;
+	return {
+		data: {
+			...desired,
+			outputs: current.outputs
+		},
+		success: true
+	};
+}
+//#endregion
+//#region src/adapters/game-pass-driver.ts
+/**
+* Wraps {@link GamePassesClient} as a `ResourceDriver<"gamePass">` that maps
+* a desired-state entry to an ocale create call and the response back to a
+* `ResourceCurrentState<"gamePass">`.
+*
+* Upstream `OpenCloudError` results pass through as `Result` failures.
+* Filesystem errors from `deps.readFile` do not fit the `OpenCloudError`
+* shape and propagate as promise rejections; shell callers are expected to
+* translate them if a unified error surface is required.
+*
+* @param deps - Injected ocale client, file reader, and owning universe.
+* @returns A driver indexable by `"gamePass"` in a `DriverRegistry`.
+* @throws Whatever `deps.readFile` rejects with.
+*
+* @example
+*
+* ```ts
+* import type { HttpClient } from "@bedrock-rbx/ocale";
+* import { GamePassesClient } from "@bedrock-rbx/ocale/game-passes";
+* import {
+*     asResourceKey,
+*     asRobloxAssetId,
+*     asSha256Hex,
+*     createGamePassDriver,
+* } from "@bedrock-rbx/core";
+*
+* const httpClient: HttpClient = {
+*     async request() {
+*         return {
+*             data: {
+*                 body: {
+*                     createdTimestamp: "2024-01-15T10:30:00.000Z",
+*                     description: "Grants VIP perks.",
+*                     gamePassId: 9_876_543_210,
+*                     iconAssetId: 1_122_334_455,
+*                     isForSale: true,
+*                     name: "VIP Pass",
+*                     updatedTimestamp: "2024-01-15T10:30:00.000Z",
+*                 },
+*                 headers: {},
+*                 status: 200,
+*             },
+*             success: true,
+*         };
+*     },
+* };
+*
+* const driver = createGamePassDriver({
+*     client: new GamePassesClient({
+*         apiKey: "rbx-your-key",
+*         httpClient,
+*         sleep: async () => {},
+*     }),
+*     readFile: async () => new Uint8Array([0x89, 0x50, 0x4e, 0x47]),
+*     universeId: asRobloxAssetId("1234567890"),
+* });
+*
+* return driver
+*     .create({
+*         description: "Grants VIP perks.",
+*         icon: { "en-us": "assets/vip-icon.png" },
+*         iconFileHashes: {
+*             "en-us": asSha256Hex(
+*                 "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+*             ),
+*         },
+*         key: asResourceKey("vip-pass"),
+*         kind: "gamePass",
+*         name: "VIP Pass",
+*         price: 500,
+*     })
+*     .then((result) => {
+*         expect(result.success).toBeTrue();
+*         if (result.success) {
+*             expect(result.data.outputs.assetId).toBe("9876543210");
+*         }
+*     });
+* ```
+*/
+function createGamePassDriver(deps) {
+	const effective = {
+		...deps,
+		readFile: withRedactedIcon(deps.readFile)
+	};
+	return {
+		async create(desired) {
+			return createGamePass(effective, desired);
+		},
 		async update(current, desired) {
 			return updateGamePass(effective, {
 				current,
@@ -1177,62 +1765,6 @@ async function updateGamePass(deps, states) {
 	});
 }
 //#endregion
-//#region src/core/environment.ts
-/**
-* Source pattern for environment names, including `^` and `$` anchors.
-* Letters, digits, `-`, `_`, length 1-64.
-*
-* Exported so the config schema can validate `environments` keys against
-* the same alphabet and length cap that adapters enforce on storage
-* identifiers. Single source of truth: changing the alphabet here changes
-* both the runtime check and the schema-level key constraint.
-*
-* Anchors are embedded so callers do not have to re-add them, matching
-* the `RESOURCE_KEY_PATTERN_SOURCE` convention in `types/ids.ts`.
-*/
-const ENV_NAME_PATTERN_SOURCE = "^[A-Za-z0-9_-]{1,64}$";
-const ENVIRONMENT_NAME_PATTERN = new RegExp(ENV_NAME_PATTERN_SOURCE);
-/**
-* Validate an environment name at a state-adapter boundary.
-*
-* Adapters that map environment names onto filesystem-like identifiers
-* (gist filenames, S3 keys) must reject names that could collide or escape
-* their storage layout. This helper accepts letters, digits, `-`, and `_`
-* only, with length between 1 and 64, and returns a `StateError` for
-* anything outside that set so the adapter can fail loudly instead of
-* silently stripping characters.
-*
-* @example
-*
-* ```ts
-* import { validateEnvironmentName } from "@bedrock-rbx/core";
-*
-* const ok = validateEnvironmentName("production");
-* expect(ok.success).toBeTrue();
-*
-* const bad = validateEnvironmentName("prod/staging");
-* expect(bad.success).toBeFalse();
-* ```
-*
-* @param environment - Raw environment name supplied by a caller.
-* @returns `Ok(environment)` when the name is safe to use, or
-* `Err(StateError)` with a descriptive reason when it is not.
-*/
-function validateEnvironmentName(environment) {
-	if (!ENVIRONMENT_NAME_PATTERN.test(environment)) return {
-		err: {
-			file: environment,
-			kind: "stateError",
-			reason: `invalid environment name: must match ${String(ENVIRONMENT_NAME_PATTERN)}`
-		},
-		success: false
-	};
-	return {
-		data: environment,
-		success: true
-	};
-}
-//#endregion
 //#region src/core/state-file.ts
 const envelopeSchema = type({
 	$bedrock: { version: "1" },
@@ -1361,7 +1893,9 @@ const GITHUB_API_BASE = "https://api.github.com";
 const GITHUB_API_VERSION = "2026-03-10";
 const USER_AGENT = "bedrock";
 const MAX_INLINE_BYTES = 1e7;
-const MAX_RETRIES = 3;
+const MAX_RETRIES = 6;
+const BASE_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 16e3;
 const RETRYABLE_STATUSES = new Set([
 	409,
 	502,
@@ -1404,6 +1938,7 @@ function createGistStateAdapter(deps) {
 	const ctx = {
 		fetchFn: deps.fetch ?? globalThis.fetch.bind(globalThis),
 		gistId: deps.gistId,
+		random: deps.random ?? Math.random,
 		sleep: deps.sleep ?? defaultSleep,
 		token: deps.token
 	};
@@ -1444,12 +1979,26 @@ function toGistFile(entry) {
 		size
 	};
 }
-function mapHttpError({ file, gistId, status }) {
+function isRateLimited(headers) {
+	return headers.get("retry-after") !== null || headers.get("x-ratelimit-remaining") === "0";
+}
+function rateLimitReason(status, headers) {
+	const retryAfter = headers.get("retry-after");
+	if (retryAfter !== null) return `rate limited (${status}): retry after ${retryAfter}s`;
+	return `rate limited (${status})`;
+}
+function mapHttpError({ file, gistId, response }) {
+	const { headers, status } = response;
 	if (status === 404) return {
 		file,
 		kind: "stateError",
 		reason: `gist ${gistId} not found: check gistId`
 	};
+	if (status === 403 && isRateLimited(headers)) return {
+		file,
+		kind: "stateError",
+		reason: rateLimitReason(status, headers)
+	};
 	if (status === 401 || status === 403) return {
 		file,
 		kind: "stateError",
@@ -1485,14 +2034,15 @@ async function sendGet(ctx) {
 function isRetryableStatus(status) {
 	return RETRYABLE_STATUSES.has(status);
 }
-function backoffMs(attempt) {
-	return 1e3 * 2 ** attempt;
+function backoffMs(attempt, random) {
+	const half = Math.min(MAX_BACKOFF_MS, BASE_BACKOFF_MS * 2 ** attempt) / 2;
+	return half + random() * half;
 }
-async function withRetry(sleep, operation) {
+async function withRetry(retry, operation) {
 	let response = await operation();
 	for (let attempt = 0; attempt < MAX_RETRIES; attempt += 1) {
 		if (response.ok || !isRetryableStatus(response.status)) return response;
-		await sleep(backoffMs(attempt));
+		await retry.sleep(backoffMs(attempt, retry.random));
 		response = await operation();
 	}
 	return response;
@@ -1500,7 +2050,7 @@ async function withRetry(sleep, operation) {
 async function fetchGistBody(ctx, file) {
 	let response;
 	try {
-		response = await withRetry(ctx.sleep, async () => sendGet(ctx));
+		response = await withRetry(ctx, async () => sendGet(ctx));
 	} catch (err) {
 		return {
 			err: networkError(err, file),
@@ -1511,7 +2061,7 @@ async function fetchGistBody(ctx, file) {
 		err: mapHttpError({
 			file,
 			gistId: ctx.gistId,
-			status: response.status
+			response
 		}),
 		success: false
 	};
@@ -1530,14 +2080,14 @@ function stateErr(file, reason) {
 		success: false
 	};
 }
-async function readGistContent({ entry, fetchFn, file, sleep }) {
+async function readGistContent({ entry, fetchFn, file, retry }) {
 	if (entry.size > MAX_INLINE_BYTES) return stateErr(file, `state file too large: ${entry.size} bytes`);
 	if (entry.isTruncated) {
 		if (entry.rawUrl === void 0) return stateErr(file, "truncated gist file missing raw_url");
 		const { rawUrl } = entry;
 		let rawResponse;
 		try {
-			rawResponse = await withRetry(sleep, async () => fetchFn(rawUrl));
+			rawResponse = await withRetry(retry, async () => fetchFn(rawUrl));
 		} catch (err) {
 			return {
 				err: networkError(err, file),
@@ -1563,7 +2113,7 @@ async function readPath(ctx, environment) {
 		entry,
 		fetchFn: ctx.fetchFn,
 		file,
-		sleep: ctx.sleep
+		retry: ctx
 	});
 }
 async function sendPatch(ctx, body) {
@@ -1612,7 +2162,7 @@ async function writePath(ctx, state) {
 	const body = JSON.stringify({ files: { [fileName(state.environment)]: { content: serializeStateFile(state) } } });
 	let response;
 	try {
-		response = await withRetry(ctx.sleep, async () => sendPatch(ctx, body));
+		response = await withRetry(ctx, async () => sendPatch(ctx, body));
 	} catch (err) {
 		return {
 			err: networkError(err, file),
@@ -1633,12 +2183,36 @@ async function writePath(ctx, state) {
 		err: mapHttpError({
 			file,
 			gistId: ctx.gistId,
-			status: response.status
+			response
 		}),
 		success: false
 	};
 }
 //#endregion
+//#region src/adapters/no-op-progress-adapter.ts
+/**
+* Build a {@link ProgressPort} that silently drops every event. Useful for
+* tests and programmatic callers who want to invoke deploy logic without
+* any rendering.
+*
+* @example
+*
+* ```ts
+* import { createNoOpProgressAdapter } from "@bedrock-rbx/core";
+*
+* const port = createNoOpProgressAdapter();
+*
+* expect(() =>
+*     port.emit({ environment: "production", kind: "deploySuccess", resourceCount: 3 }),
+* ).not.toThrow();
+* ```
+*
+* @returns A `ProgressPort` whose `emit` method is a no-op.
+*/
+function createNoOpProgressAdapter() {
+	return { emit() {} };
+}
+//#endregion
 //#region src/core/resources.ts
 /**
 * Ordered list of optional metadata fields the driver routes through
@@ -1724,634 +2298,484 @@ const UNIVERSE_SINGLETON_KEY = asResourceKey("main");
 *
 * @param deps - Injected ocale client, file reader, and owning universe.
 * @returns A driver indexable by `"place"` in a `DriverRegistry`.
-* @throws Whatever `deps.readFile` rejects with.
-*
-* @example
-*
-* ```ts
-* import type { HttpClient } from "@bedrock-rbx/ocale";
-* import { PlacesClient } from "@bedrock-rbx/ocale/places";
-* import {
-*     asResourceKey,
-*     asRobloxAssetId,
-*     asSha256Hex,
-*     createPlaceDriver,
-* } from "@bedrock-rbx/core";
-*
-* const httpClient: HttpClient = {
-*     async request() {
-*         return {
-*             data: { body: { versionNumber: 1 }, headers: {}, status: 200 },
-*             success: true,
-*         };
-*     },
-* };
-*
-* const driver = createPlaceDriver({
-*     client: new PlacesClient({
-*         apiKey: "rbx-your-key",
-*         httpClient,
-*         sleep: async () => {},
-*     }),
-*     readFile: async () =>
-*         new Uint8Array([
-*             0x3c, 0x72, 0x6f, 0x62, 0x6c, 0x6f, 0x78, 0x21, 0x89, 0xff, 0x0d, 0x0a, 0x1a,
-*             0x0a,
-*         ]),
-*     universeId: asRobloxAssetId("1234567890"),
-* });
-*
-* return driver
-*     .create({
-*         description: undefined,
-*         displayName: undefined,
-*         fileHash: asSha256Hex(
-*             "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-*         ),
-*         filePath: "places/start.rbxl",
-*         key: asResourceKey("start-place"),
-*         kind: "place",
-*         placeId: asRobloxAssetId("4711"),
-*         serverSize: undefined,
-*     })
-*     .then((result) => {
-*         expect(result.success).toBeTrue();
-*         if (result.success) {
-*             expect(result.data.outputs.versionNumber).toBe(1);
-*         }
-*     });
-* ```
-*/
-function createPlaceDriver(deps) {
-	return {
-		async create(desired) {
-			return publishPlace(deps, desired);
-		},
-		async update(_current, desired) {
-			return publishPlace(deps, desired);
-		}
-	};
-}
-function buildMetadataParameters(universeId, desired) {
-	const metadata = PLACE_MANAGED_METADATA_FIELDS.reduce((accumulator, field) => {
-		const value = desired[field];
-		return value === void 0 ? accumulator : {
-			...accumulator,
-			[field]: value
-		};
-	}, {});
-	if (Object.keys(metadata).length === 0) return;
-	return {
-		...metadata,
-		placeId: desired.placeId,
-		universeId
-	};
-}
-function detectFormat(filePath) {
-	if (filePath.endsWith(".rbxlx")) return "rbxlx";
-	if (filePath.endsWith(".rbxl")) return "rbxl";
-}
-async function publishVersion(deps, desired) {
-	const format = detectFormat(desired.filePath);
-	if (format === void 0) return {
-		err: new ApiError(`Unsupported place file extension for ${desired.filePath}; expected .rbxl or .rbxlx`, { statusCode: 0 }),
-		success: false
-	};
-	const body = await deps.readFile(desired.filePath);
-	return deps.client.publish({
-		body: Uint8Array.from(body),
-		format,
-		placeId: desired.placeId,
-		universeId: deps.universeId
-	});
-}
-async function publishPlace(deps, desired) {
-	const publishResult = await publishVersion(deps, desired);
-	if (!publishResult.success) return publishResult;
-	const metadataParameters = buildMetadataParameters(deps.universeId, desired);
-	if (metadataParameters !== void 0) {
-		const metadataResult = await deps.client.update(metadataParameters);
-		if (!metadataResult.success) return metadataResult;
-	}
-	return {
-		data: {
-			...desired,
-			outputs: publishResult.data
-		},
-		success: true
-	};
-}
-//#endregion
-//#region src/adapters/universe-driver.ts
-/**
-* Wraps {@link UniversesClient} as a `ResourceDriver<"universe">`. `create`
-* and `update` both delegate to a shared reconcile helper because Open
-* Cloud cannot mint universes; the user supplies an existing `universeId`
-* and bedrock adopts the universe on first apply.
-*
-* A `NotFound` error (HTTP 404) from `UniversesClient.update` is repackaged
-* as an adoption-error `ApiError` whose message names the config key and
-* the `universeId`, so operators can tell adoption failure apart from
-* transient upstream errors. A successful response whose `rootPlaceId` is
-* absent surfaces as an `ApiError` with status 200, mirroring the
-* malformed-response guard in `GamePassDriver`.
-*
-* When `displayName` is declared, the driver routes that field through
-* `PlacesClient.update` on the root place after the universe PATCH
-* succeeds. A subsequent places failure surfaces to the caller as the
-* driver's error result without rolling back the prior universe patch,
-* so callers observing a partial failure should reconcile by
-* reapplying rather than assuming the universe-level fields are
-* unchanged.
-*
-* @param deps - Injected ocale clients (universes plus places for the
-*   read-only universe fields Roblox derives from the root place).
-* @returns A driver indexable by `"universe"` in a `DriverRegistry`.
+* @throws Whatever `deps.readFile` rejects with.
 *
 * @example
 *
 * ```ts
 * import type { HttpClient } from "@bedrock-rbx/ocale";
 * import { PlacesClient } from "@bedrock-rbx/ocale/places";
-* import { UniversesClient } from "@bedrock-rbx/ocale/universes";
-* import { validUniverseBody } from "@bedrock-rbx/ocale/testing";
 * import {
+*     asResourceKey,
 *     asRobloxAssetId,
-*     createUniverseDriver,
-*     UNIVERSE_SINGLETON_KEY,
+*     asSha256Hex,
+*     createPlaceDriver,
 * } from "@bedrock-rbx/core";
 *
-* const universeBodyHttpClient: HttpClient = {
+* const httpClient: HttpClient = {
 *     async request() {
 *         return {
-*             data: {
-*                 body: validUniverseBody({
-*                     path: "universes/1234567890",
-*                     rootPlace: "universes/1234567890/places/4711",
-*                 }),
-*                 headers: {},
-*                 status: 200,
-*             },
+*             data: { body: { versionNumber: 1 }, headers: {}, status: 200 },
 *             success: true,
 *         };
 *     },
 * };
 *
-* const driver = createUniverseDriver({
-*     places: new PlacesClient({
-*         apiKey: "rbx-your-key",
-*         httpClient: universeBodyHttpClient,
-*         sleep: async () => {},
-*     }),
-*     universes: new UniversesClient({
+* const driver = createPlaceDriver({
+*     client: new PlacesClient({
 *         apiKey: "rbx-your-key",
-*         httpClient: universeBodyHttpClient,
+*         httpClient,
 *         sleep: async () => {},
 *     }),
+*     readFile: async () =>
+*         new Uint8Array([
+*             0x3c, 0x72, 0x6f, 0x62, 0x6c, 0x6f, 0x78, 0x21, 0x89, 0xff, 0x0d, 0x0a, 0x1a,
+*             0x0a,
+*         ]),
+*     universeId: asRobloxAssetId("1234567890"),
 * });
 *
 * return driver
 *     .create({
-*         consoleEnabled: undefined,
-*         desktopEnabled: true,
+*         description: undefined,
 *         displayName: undefined,
-*         key: UNIVERSE_SINGLETON_KEY,
-*         kind: "universe",
-*         mobileEnabled: undefined,
-*         privateServerPriceRobux: undefined,
-*         tabletEnabled: undefined,
-*         universeId: asRobloxAssetId("1234567890"),
-*         voiceChatEnabled: true,
-*         vrEnabled: undefined,
+*         fileHash: asSha256Hex(
+*             "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+*         ),
+*         filePath: "places/start.rbxl",
+*         key: asResourceKey("start-place"),
+*         kind: "place",
+*         placeId: asRobloxAssetId("4711"),
+*         serverSize: undefined,
 *     })
 *     .then((result) => {
 *         expect(result.success).toBeTrue();
 *         if (result.success) {
-*             expect(result.data.outputs.rootPlaceId).toBe("4711");
+*             expect(result.data.outputs.versionNumber).toBe(1);
 *         }
 *     });
 * ```
 */
-function createUniverseDriver(deps) {
+function createPlaceDriver(deps) {
 	return {
 		async create(desired) {
-			return reconcileUniverse({
-				deps,
-				desired
-			});
+			return publishPlace(deps, desired);
 		},
 		async update(_current, desired) {
-			return reconcileUniverse({
-				deps,
-				desired
-			});
+			return publishPlace(deps, desired);
 		}
 	};
 }
-function toCurrentState(desired, rootPlaceId) {
-	return {
-		...desired,
-		outputs: { rootPlaceId: asRobloxAssetId(rootPlaceId) }
-	};
-}
-function buildParameters(desired) {
-	const base = UNIVERSE_MANAGED_FLAGS.reduce((accumulator, flag) => {
-		const isEnabled = desired[flag];
-		return isEnabled === void 0 ? accumulator : {
+function buildMetadataParameters(universeId, desired) {
+	const metadata = PLACE_MANAGED_METADATA_FIELDS.reduce((accumulator, field) => {
+		const value = desired[field];
+		return value === void 0 ? accumulator : {
 			...accumulator,
-			[flag]: isEnabled
+			[field]: value
 		};
-	}, { universeId: desired.universeId });
+	}, {});
+	if (Object.keys(metadata).length === 0) return;
 	return {
-		..."privateServerPriceRobux" in desired ? {
-			...base,
-			privateServerPriceRobux: desired.privateServerPriceRobux
-		} : base,
-		...copyDeclaredSocialLinks(desired)
+		...metadata,
+		placeId: desired.placeId,
+		universeId
 	};
 }
-function wrapUpdateError(err, desired) {
-	if (err instanceof ApiError && err.statusCode === 404) return new ApiError(`Universe ${desired.universeId} (key '${desired.key}') was not found; adoption failed`, { statusCode: 404 });
-	return err;
-}
-function hasUniverseLevelUpdate(desired) {
-	if (UNIVERSE_MANAGED_FLAGS.some((flag) => desired[flag] !== void 0)) return true;
-	if ("privateServerPriceRobux" in desired) return true;
-	return SOCIAL_LINK_FIELDS.some((field) => field in desired);
+function detectFormat(filePath) {
+	if (filePath.endsWith(".rbxlx")) return "rbxlx";
+	if (filePath.endsWith(".rbxl")) return "rbxl";
 }
-async function resolveUniverse(deps, desired) {
-	const result = hasUniverseLevelUpdate(desired) ? await deps.universes.update(buildParameters(desired)) : await deps.universes.get({ universeId: desired.universeId });
-	if (!result.success) return {
-		err: wrapUpdateError(result.err, desired),
-		success: false
-	};
-	const { rootPlaceId } = result.data;
-	if (rootPlaceId === void 0) return {
-		err: new ApiError(`Malformed universe response for ${desired.universeId}: rootPlaceId missing`, { statusCode: 200 }),
+async function publishVersion(deps, desired) {
+	const format = detectFormat(desired.filePath);
+	if (format === void 0) return {
+		err: new ApiError(`Unsupported place file extension for ${desired.filePath}; expected .rbxl or .rbxlx`, { statusCode: 0 }),
 		success: false
 	};
-	return {
-		data: { rootPlaceId },
-		success: true
-	};
+	const body = await deps.readFile(desired.filePath);
+	return deps.client.publish({
+		body: Uint8Array.from(body),
+		format,
+		placeId: desired.placeId,
+		universeId: deps.universeId
+	});
 }
-async function reconcileUniverse(inputs) {
-	const { deps, desired } = inputs;
-	const universeResult = await resolveUniverse(deps, desired);
-	if (!universeResult.success) return universeResult;
-	const { rootPlaceId } = universeResult.data;
-	if (desired.displayName !== void 0) {
-		const placesResult = await deps.places.update({
-			displayName: desired.displayName,
-			placeId: rootPlaceId,
-			universeId: desired.universeId
-		});
-		if (!placesResult.success) return {
-			err: placesResult.err,
-			success: false
-		};
+async function publishPlace(deps, desired) {
+	const publishResult = await publishVersion(deps, desired);
+	if (!publishResult.success) return publishResult;
+	const metadataParameters = buildMetadataParameters(deps.universeId, desired);
+	if (metadataParameters !== void 0) {
+		const metadataResult = await deps.client.update(metadataParameters);
+		if (!metadataResult.success) return metadataResult;
 	}
 	return {
-		data: toCurrentState(desired, rootPlaceId),
-		success: true
-	};
-}
-//#endregion
-//#region src/cli/clack-port.ts
-/**
-* Construct a `ClackPort` whose methods delegate to `@clack/prompts`. The
-* resulting port writes to `process.stdout` via clack's defaults. Kept in
-* its own module so consumers that never need the clack-backed rendering
-* (programmatic deploys, custom adapters) do not pull `@clack/prompts`
-* into their bundle.
-*
-* @example
-*
-* ```ts
-* import { createClackPort } from "@bedrock-rbx/core";
-*
-* const port = createClackPort();
-*
-* expect(typeof port.logSuccess).toBe("function");
-* ```
-*
-* @returns A port whose six methods each invoke the matching clack helper.
-*/
-function createClackPort() {
-	return {
-		cancel: (message) => {
-			cancel(message);
-		},
-		intro: (message) => {
-			intro(message);
-		},
-		logError: (message) => {
-			log.error(message);
-		},
-		logMessage: (message) => {
-			log.message(message);
-		},
-		logSuccess: (message) => {
-			log.success(message);
+		data: {
+			...desired,
+			outputs: publishResult.data
 		},
-		outro: (message) => {
-			outro(message);
-		}
+		success: true
 	};
 }
 //#endregion
-//#region src/core/validate-universe-xor.ts
-/**
-* Walk the loose authored-shape and surface every place the
-* universeId-XOR-between-root-and-env rule is violated. Pure: returns
-* the issue list; the caller hands it to arktype's `ctx.reject` so each
-* one lands at the offending config path. The schema's runtime narrow
-* uses this to enforce the rule at validation time before the validated
-* value is cast to the strict `Config` discriminated union.
-*
-* @param value - Parsed config the schema is validating.
-* @returns Zero or more issues. Empty when the config satisfies the rule.
-*/
-function collectUniverseIdIssues(value) {
-	const rootUniverseId = value.universe?.universeId;
-	const hasRootUniverseBlock = value.universe !== void 0;
-	const environmentEntries = Object.entries(value.environments);
-	const hasEnvironmentUniverseId = environmentEntries.some(([, environment]) => environment.universe?.universeId !== void 0);
-	const environmentIssues = collectEnvironmentIssues(rootUniverseId, environmentEntries);
-	const rootIssues = hasRootUniverseBlock && rootUniverseId === void 0 && !hasEnvironmentUniverseId ? [{
-		message: "universeId must be declared on the root universe block, or on every environment that declares its own universe overlay.",
-		path: ["universe", "universeId"]
-	}] : [];
-	return [...environmentIssues, ...rootIssues];
-}
-function collectEnvironmentIssues(rootUniverseId, environmentEntries) {
-	return environmentEntries.flatMap(([environmentName, environment]) => {
-		if (environment.universe === void 0) return [];
-		if (rootUniverseId !== void 0 && environment.universe.universeId !== void 0) return [{
-			message: "universeId is declared at the root universe block; remove it from this environment overlay (root is authoritative) or remove it from the root and declare it on every environment.",
-			path: [
-				"environments",
-				environmentName,
-				"universe",
-				"universeId"
-			]
-		}];
-		if (rootUniverseId === void 0 && environment.universe.universeId === void 0) return [{
-			message: "universeId must be declared on this environment overlay because the root universe block does not provide one.",
-			path: [
-				"environments",
-				environmentName,
-				"universe",
-				"universeId"
-			]
-		}];
-		return [];
-	});
-}
-//#endregion
-//#region src/core/schema.ts
+//#region src/adapters/universe-driver.ts
 /**
-* Narrow a `StateConfig` to the `GistStateConfig` arm. The `(string & {})`
-* autocomplete idiom prevents TypeScript from narrowing on
-* `backend === "gist"` alone, so dispatch sites use this guard to
-* preserve the `gistId` field shape.
+* Wraps {@link UniversesClient} as a `ResourceDriver<"universe">`. `create`
+* and `update` both delegate to a shared reconcile helper because Open
+* Cloud cannot mint universes; the user supplies an existing `universeId`
+* and bedrock adopts the universe on first apply.
+*
+* A `NotFound` error (HTTP 404) from `UniversesClient.update` is repackaged
+* as an adoption-error `ApiError` whose message names the config key and
+* the `universeId`, so operators can tell adoption failure apart from
+* transient upstream errors. A successful response whose `rootPlaceId` is
+* absent surfaces as an `ApiError` with status 200, mirroring the
+* malformed-response guard in `GamePassDriver`.
+*
+* When `displayName` is declared, the driver routes that field through
+* `PlacesClient.update` on the root place after the universe PATCH
+* succeeds. A subsequent places failure surfaces to the caller as the
+* driver's error result without rolling back the prior universe patch,
+* so callers observing a partial failure should reconcile by
+* reapplying rather than assuming the universe-level fields are
+* unchanged.
+*
+* @param deps - Injected ocale clients (universes plus places for the
+*   read-only universe fields Roblox derives from the root place).
+* @returns A driver indexable by `"universe"` in a `DriverRegistry`.
 *
 * @example
 *
 * ```ts
-* import { isGistStateConfig } from "@bedrock-rbx/core";
-* import type { StateConfig } from "@bedrock-rbx/core/config";
+* import type { HttpClient } from "@bedrock-rbx/ocale";
+* import { PlacesClient } from "@bedrock-rbx/ocale/places";
+* import { UniversesClient } from "@bedrock-rbx/ocale/universes";
+* import { validUniverseBody } from "@bedrock-rbx/ocale/testing";
+* import {
+*     asRobloxAssetId,
+*     createUniverseDriver,
+*     UNIVERSE_SINGLETON_KEY,
+* } from "@bedrock-rbx/core";
 *
-* const config: StateConfig = { backend: "gist", gistId: "abc" };
+* const universeBodyHttpClient: HttpClient = {
+*     async request() {
+*         return {
+*             data: {
+*                 body: validUniverseBody({
+*                     path: "universes/1234567890",
+*                     rootPlace: "universes/1234567890/places/4711",
+*                 }),
+*                 headers: {},
+*                 status: 200,
+*             },
+*             success: true,
+*         };
+*     },
+* };
 *
-* expect(isGistStateConfig(config)).toBeTrue();
-* if (isGistStateConfig(config)) {
-*     expect(config.gistId).toBe("abc");
-* }
-* ```
+* const driver = createUniverseDriver({
+*     places: new PlacesClient({
+*         apiKey: "rbx-your-key",
+*         httpClient: universeBodyHttpClient,
+*         sleep: async () => {},
+*     }),
+*     universes: new UniversesClient({
+*         apiKey: "rbx-your-key",
+*         httpClient: universeBodyHttpClient,
+*         sleep: async () => {},
+*     }),
+* });
 *
-* @param config - Resolved state config to inspect.
-* @returns `true` when `config.backend === "gist"`; otherwise `false`.
+* return driver
+*     .create({
+*         consoleEnabled: undefined,
+*         desktopEnabled: true,
+*         displayName: undefined,
+*         key: UNIVERSE_SINGLETON_KEY,
+*         kind: "universe",
+*         mobileEnabled: undefined,
+*         privateServerPriceRobux: undefined,
+*         tabletEnabled: undefined,
+*         universeId: asRobloxAssetId("1234567890"),
+*         voiceChatEnabled: true,
+*         vrEnabled: undefined,
+*     })
+*     .then((result) => {
+*         expect(result.success).toBeTrue();
+*         if (result.success) {
+*             expect(result.data.outputs.rootPlaceId).toBe("4711");
+*         }
+*     });
+* ```
 */
-function isGistStateConfig(config) {
-	return config.backend === "gist";
+function createUniverseDriver(deps) {
+	return {
+		async create(desired) {
+			return reconcileUniverse({
+				deps,
+				desired
+			});
+		},
+		async update(_current, desired) {
+			return reconcileUniverse({
+				deps,
+				desired
+			});
+		}
+	};
 }
-const OPTIONAL_BOOLEAN$2 = "boolean | undefined";
-const OPTIONAL_STRING = "string | undefined";
-const REDACTED_KEY = "redacted?";
-const NON_EMPTY_OVERRIDE_MESSAGE = "a non-empty override object; use `redacted: true` for default placeholders";
-/**
-* Shared arktype constraint for any optional positive-integer field.
-* Reused by per-kind entry schemas so positive-integer fields validate
-* identically.
-*/
-const OPTIONAL_POSITIVE_INTEGER = "(number.integer >= 1) | undefined";
-/**
-* Shared arktype constraint for any optional Robux-price field. The schema
-* rejects negatives, fractional values, `NaN`, and `Infinity` at config
-* validation time so a malformed price surfaces with a path attributing the
-* failure to the offending field, rather than slipping through to the
-* Roblox API and surfacing as an opaque error at apply time. Per-kind entry
-* schemas reuse this constant so all Robux-price fields validate
-* identically.
-*/
-const OPTIONAL_ROBUX_PRICE = "number.integer >= 0 | undefined";
-const gamePassRedacted = type({
-	"description?": "string",
-	"icon?": iconMap,
-	"name?": "string"
-}).onUndeclaredKey("reject").narrow((value, ctx) => {
-	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
-	return true;
-}).or(OPTIONAL_BOOLEAN$2);
-const placeRedacted = type({
-	"description?": "string",
-	"displayName?": "string"
-}).onUndeclaredKey("reject").narrow((value, ctx) => {
-	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
-	return true;
-}).or(OPTIONAL_BOOLEAN$2);
-const productRedacted = type({
-	"description?": "string",
-	"icon?": iconMap,
-	"name?": "string"
-}).onUndeclaredKey("reject").narrow((value, ctx) => {
-	if (Object.keys(value).length === 0) return ctx.mustBe(NON_EMPTY_OVERRIDE_MESSAGE);
-	return true;
-}).or(OPTIONAL_BOOLEAN$2);
-const gamePassEntry = type({
-	"name": "string",
-	"description": "string",
-	"icon": iconMap,
-	"price?": OPTIONAL_ROBUX_PRICE,
-	[REDACTED_KEY]: gamePassRedacted
-});
-const passesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassEntry }).onUndeclaredKey("reject");
-const developerProductEntry = type({
-	"name": "string",
-	"description": "string",
-	"icon?": iconMap,
-	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
-	"price?": OPTIONAL_ROBUX_PRICE,
-	[REDACTED_KEY]: productRedacted,
-	"storePageEnabled?": OPTIONAL_BOOLEAN$2
-}).onUndeclaredKey("reject");
-const productsCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductEntry }).onUndeclaredKey("reject");
-const ROBLOX_ID_DIGITS = "string.digits";
-const placeEntry = type({
-	"description?": OPTIONAL_STRING,
-	"displayName?": OPTIONAL_STRING,
-	"filePath": "string",
-	[REDACTED_KEY]: placeRedacted,
-	"serverSize?": OPTIONAL_POSITIVE_INTEGER
-}).onUndeclaredKey("reject");
-const placesCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeEntry }).onUndeclaredKey("reject");
-const socialLinkOrUndefined$1 = type({
-	title: "string",
-	uri: "string"
-}).onUndeclaredKey("reject").or("undefined");
-const universeEntry = type({
-	"consoleEnabled?": OPTIONAL_BOOLEAN$2,
-	"desktopEnabled?": OPTIONAL_BOOLEAN$2,
-	"discordSocialLink?": socialLinkOrUndefined$1,
-	"displayName?": OPTIONAL_STRING,
-	"facebookSocialLink?": socialLinkOrUndefined$1,
-	"guildedSocialLink?": socialLinkOrUndefined$1,
-	"mobileEnabled?": OPTIONAL_BOOLEAN$2,
-	"privateServerPriceRobux?": OPTIONAL_ROBUX_PRICE,
-	"robloxGroupSocialLink?": socialLinkOrUndefined$1,
-	"tabletEnabled?": OPTIONAL_BOOLEAN$2,
-	"twitchSocialLink?": socialLinkOrUndefined$1,
-	"twitterSocialLink?": socialLinkOrUndefined$1,
-	"universeId?": ROBLOX_ID_DIGITS,
-	"voiceChatEnabled?": OPTIONAL_BOOLEAN$2,
-	"vrEnabled?": OPTIONAL_BOOLEAN$2,
-	"youtubeSocialLink?": socialLinkOrUndefined$1
-}).onUndeclaredKey("reject");
-const stateConfig = type({
-	"backend": "string",
-	"gistId?": "string > 0"
-}).onUndeclaredKey("reject");
-const gamePassOverlay = type({
-	"description?": "string",
-	"icon?": iconMap,
-	"name?": "string",
-	"price?": OPTIONAL_ROBUX_PRICE,
-	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2
-}).onUndeclaredKey("reject");
-const passesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: gamePassOverlay }).onUndeclaredKey("reject");
-const developerProductOverlay = type({
-	"description?": "string",
-	"icon?": iconMap,
-	"isRegionalPricingEnabled?": OPTIONAL_BOOLEAN$2,
-	"name?": "string",
-	"price?": OPTIONAL_ROBUX_PRICE,
-	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
-	"storePageEnabled?": OPTIONAL_BOOLEAN$2
-}).onUndeclaredKey("reject");
-const productsOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: developerProductOverlay }).onUndeclaredKey("reject");
-const placeOverlay = type({
-	"description?": OPTIONAL_STRING,
-	"displayName?": OPTIONAL_STRING,
-	"filePath?": "string",
-	"placeId": ROBLOX_ID_DIGITS,
-	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
-	"serverSize?": OPTIONAL_POSITIVE_INTEGER
-}).onUndeclaredKey("reject");
-const placesOverlayCollection = type({ [`[/${RESOURCE_KEY_PATTERN_SOURCE}/]`]: placeOverlay }).onUndeclaredKey("reject");
-const universeOverlay = universeEntry;
-const environmentEntry = type({
-	"label?": OPTIONAL_STRING,
-	"passes?": passesOverlayCollection,
-	"places?": placesOverlayCollection,
-	"products?": productsOverlayCollection,
-	[REDACTED_KEY]: OPTIONAL_BOOLEAN$2,
-	"state?": stateConfig,
-	"universe?": universeOverlay
-}).onUndeclaredKey("reject");
-const rootSchema = type({
-	"displayNamePrefix?": type({
-		"enabled?": OPTIONAL_BOOLEAN$2,
-		"format?": OPTIONAL_STRING
-	}).onUndeclaredKey("reject"),
-	"environments": type({ [`[/${ENV_NAME_PATTERN_SOURCE}/]`]: environmentEntry }).onUndeclaredKey("reject").narrow((value, ctx) => {
-		if (Object.keys(value).length === 0) return ctx.mustBe("an environments record with at least one declared environment");
-		return true;
-	}),
-	"extends?": "unknown",
-	"passes?": passesCollection,
-	"places?": placesCollection,
-	"products?": productsCollection,
-	"state?": stateConfig,
-	"universe?": universeEntry
-}).onUndeclaredKey("reject").narrow((value, ctx) => {
-	return collectUniverseIdIssues(value).reduce((_accumulator, issue) => {
-		return ctx.reject({
-			message: issue.message,
-			path: [...issue.path]
+function toCurrentState(desired, rootPlaceId) {
+	return {
+		...desired,
+		outputs: { rootPlaceId: asRobloxAssetId(rootPlaceId) }
+	};
+}
+function buildParameters(desired) {
+	const base = UNIVERSE_MANAGED_FLAGS.reduce((accumulator, flag) => {
+		const isEnabled = desired[flag];
+		return isEnabled === void 0 ? accumulator : {
+			...accumulator,
+			[flag]: isEnabled
+		};
+	}, { universeId: desired.universeId });
+	return {
+		..."privateServerPriceRobux" in desired ? {
+			...base,
+			privateServerPriceRobux: desired.privateServerPriceRobux
+		} : base,
+		...copyDeclaredSocialLinks(desired)
+	};
+}
+function wrapUpdateError(err, desired) {
+	if (err instanceof ApiError && err.statusCode === 404) return new ApiError(`Universe ${desired.universeId} (key '${desired.key}') was not found; adoption failed`, { statusCode: 404 });
+	return err;
+}
+function hasUniverseLevelUpdate(desired) {
+	if (UNIVERSE_MANAGED_FLAGS.some((flag) => desired[flag] !== void 0)) return true;
+	if ("privateServerPriceRobux" in desired) return true;
+	return SOCIAL_LINK_FIELDS.some((field) => field in desired);
+}
+async function resolveUniverse(deps, desired) {
+	const result = hasUniverseLevelUpdate(desired) ? await deps.universes.update(buildParameters(desired)) : await deps.universes.get({ universeId: desired.universeId });
+	if (!result.success) return {
+		err: wrapUpdateError(result.err, desired),
+		success: false
+	};
+	const { rootPlaceId } = result.data;
+	if (rootPlaceId === void 0) return {
+		err: new ApiError(`Malformed universe response for ${desired.universeId}: rootPlaceId missing`, { statusCode: 200 }),
+		success: false
+	};
+	return {
+		data: { rootPlaceId },
+		success: true
+	};
+}
+async function reconcileUniverse(inputs) {
+	const { deps, desired } = inputs;
+	const universeResult = await resolveUniverse(deps, desired);
+	if (!universeResult.success) return universeResult;
+	const { rootPlaceId } = universeResult.data;
+	if (desired.displayName !== void 0) {
+		const placesResult = await deps.places.update({
+			displayName: desired.displayName,
+			placeId: rootPlaceId,
+			universeId: desired.universeId
 		});
-	}, true);
-});
+		if (!placesResult.success) return {
+			err: placesResult.err,
+			success: false
+		};
+	}
+	return {
+		data: toCurrentState(desired, rootPlaceId),
+		success: true
+	};
+}
+//#endregion
+//#region src/cli/default-spawner.ts
 /**
-* Validate a parsed config value against the runtime schema. Returns the
-* validated `Config` on success or a `validationFailed` `ConfigError` with
-* one issue per problem, each attributed to a field path. `sourceFile`
-* appears in the error so callers can point a human at the offending file.
+* Translate a `child.on("close", code, signal)` payload into the
+* {@link Spawner.spawn} return shape. Extracted from the adapter so the
+* signal-terminated branch can be exercised without launching a real
+* process. The caller normalizes node's `null` to `undefined` at the
+* boundary so this helper never sees `null`.
+* @param code - Exit code reported by the child, or `undefined` if the
+*   child was terminated by a signal before exiting.
+* @param signal - Signal name reported by the child, or `undefined` when
+*   no signal terminated it.
+* @returns `Ok(code)` for a clean exit (including `0`); otherwise
+*   `Err(launchFailed)` carrying a synthetic Error whose message names
+*   the signal.
+*/
+function classifySpawnClose(code, signal) {
+	if (code !== void 0) return {
+		data: code,
+		success: true
+	};
+	return {
+		err: {
+			cause: /* @__PURE__ */ new Error(`spawned process terminated by signal ${signal ?? "unknown"}`),
+			kind: "launchFailed"
+		},
+		success: false
+	};
+}
+/**
+* Construct a {@link Spawner} backed by `node:child_process.spawn` with
+* `stdio` inherited from the parent process. The child's environment is
+* `process.env` overlaid with {@link SpawnInvocation.envOverrides} (overrides
+* win on key collision).
+*
+* - Exit codes resolve as `Ok(exitCode)` (including `0`).
+* - `ENOENT` and other launch-time errors resolve as `Err(launchFailed)`
+*   with the original error in `cause` (its `code` field carries the
+*   errno where present).
+* - Children terminated by signal before producing an exit code collapse
+*   into `launchFailed` with a synthetic `Error` whose message names the
+*   signal; a distinct variant lands the day a caller needs to act on the
+*   difference.
+*
+* @returns A `Spawner` whose `spawn` settles once the child closes.
+* @example
+*
+* ```ts
+* import { createDefaultSpawner } from "@bedrock-rbx/core";
+* import process from "node:process";
+*
+* const spawner = createDefaultSpawner();
+*
+* return spawner
+*     .spawn({
+*         args: ["-e", "process.exit(0)"],
+*         command: process.execPath,
+*         envOverrides: {},
+*     })
+*     .then((result) => {
+*         expect(result.success).toBeTrue();
+*         if (result.success) {
+*             expect(result.data).toBe(0);
+*         }
+*     });
+* ```
+*/
+function createDefaultSpawner() {
+	return { spawn: spawnViaChildProcess };
+}
+async function spawnViaChildProcess(invocation) {
+	return new Promise((resolve) => {
+		const child = spawn(invocation.command, [...invocation.args], {
+			env: {
+				...process.env,
+				...invocation.envOverrides
+			},
+			stdio: "inherit"
+		});
+		child.once("error", (error) => {
+			resolve({
+				err: {
+					cause: error,
+					kind: "launchFailed"
+				},
+				success: false
+			});
+		});
+		child.once("close", (code, signal) => {
+			resolve(classifySpawnClose(code ?? void 0, signal ?? void 0));
+		});
+	});
+}
+//#endregion
+//#region src/cli/credential-environment-overrides.ts
+/**
+* Map CLI credential flags to their corresponding env-var names, omitting
+* entries whose flag is `undefined`.
+* @param flags - CLI credential flag values to translate.
+* @returns An immutable record of env-var names to their override values.
+*/
+function buildCredentialOverrides(flags) {
+	const overrides = {};
+	if (flags.apiKey !== void 0) overrides["BEDROCK_API_KEY"] = flags.apiKey;
+	if (flags.githubToken !== void 0) overrides["BEDROCK_GITHUB_TOKEN"] = flags.githubToken;
+	return overrides;
+}
+//#endregion
+//#region src/cli/dispatch-override.ts
+/**
+* Dispatch a single `.bedrock/<command>.ts` override invocation through the
+* supplied {@link Spawner}. Encapsulates the spawn protocol:
+*
+* - argv = `[overridePath, "--env", environment]`, with `"--config", configFile`
+*   appended when supplied.
+* - `apiKey` becomes the `BEDROCK_API_KEY` env-var override; `githubToken`
+*   becomes `BEDROCK_GITHUB_TOKEN`. Neither value appears in argv.
+* - `BEDROCK_CLI=1` is always set in the env. The override's `deploy()`
+*   reads this on the `getEnv` seam to default to the clack progress
+*   adapter; absent that downstream wiring, the variable is a forward-
+*   compatible signal a future caller can act on.
+*
+* The dispatcher itself reads no ambient state: every input arrives via the
+* `invocation` argument and the `Spawner` port is the only side-effect seam.
+*
+* @param invocation - Path, environment, and parsed deploy-flag inputs.
+* @param spawner - Port the dispatcher hands the resolved
+*   {@link SpawnInvocation} to.
+* @returns `Ok(undefined)` when the child exited zero; otherwise an
+*   {@link SpawnOverrideError} discriminating launch vs non-zero exit.
 *
-* @param input - Parsed value from a config source (object tree from a
-* config loader, or a hand-built literal). Shape is checked, not assumed.
-* @param sourceFile - Path or identifier of the source file, used in the
-* `validationFailed` error.
-* @returns `Ok` with the validated `Config`, or `Err` with a
-* `validationFailed` error carrying each issue's field path.
 * @example
 *
 * ```ts
-* import { validateConfig } from "@bedrock-rbx/core";
+* import { dispatchOverride, type Spawner } from "@bedrock-rbx/core";
 *
-* const ok = validateConfig(
-*     {
-*         environments: { production: {} },
-*         passes: {
-*             "vip-pass": {
-*                 description: "VIP perks.",
-*                 icon: { "en-us": "assets/vip.png" },
-*                 name: "VIP Pass",
-*                 price: 500,
-*             },
-*         },
+* const spawner: Spawner = {
+*     async spawn() {
+*         return { data: 0, success: true };
 *     },
-*     "bedrock.config.ts",
-* );
-* expect(ok.success).toBeTrue();
+* };
 *
-* const err = validateConfig(
-*     { environments: { production: {} }, passes: { "vip-pass": { name: "VIP" } } },
-*     "bedrock.config.ts",
-* );
-* expect(err.success).toBeFalse();
-* if (!err.success) {
-*     expect(err.err.kind).toBe("validationFailed");
-* }
+* return dispatchOverride(
+*     {
+*         environment: "production",
+*         overridePath: "/abs/.bedrock/deploy.ts",
+*     },
+*     spawner,
+* ).then((result) => {
+*     expect(result.success).toBeTrue();
+* });
 * ```
 */
-function validateConfig(input, sourceFile) {
-	const validated = rootSchema(input);
-	if (validated instanceof ArkErrors) return {
+async function dispatchOverride(invocation, spawner) {
+	const args = [
+		invocation.overridePath,
+		"--env",
+		invocation.environment
+	];
+	if (invocation.configFile !== void 0) args.push("--config", invocation.configFile);
+	const credentialOverrides = buildCredentialOverrides(invocation);
+	const launched = await spawner.spawn({
+		args,
+		command: "bun",
+		envOverrides: {
+			...credentialOverrides,
+			BEDROCK_CLI: "1"
+		}
+	});
+	if (!launched.success) return {
 		err: {
-			issues: Array.from(validated, (issue) => {
-				return {
-					message: issue.message,
-					path: [...issue.path].map((segment) => String(segment))
-				};
-			}),
-			kind: "validationFailed",
-			sourceFile
+			cause: launched.err.cause,
+			kind: "launchFailed"
+		},
+		success: false
+	};
+	const exitCode = launched.data;
+	if (exitCode !== 0) return {
+		err: {
+			exitCode,
+			kind: "nonZeroExit"
 		},
 		success: false
 	};
 	return {
-		data: validated,
+		data: void 0,
 		success: true
 	};
 }
@@ -2412,8 +2836,19 @@ async function normalize$3(input, io) {
 		success: true
 	};
 }
+function changedFieldsBetween$3(desired, current) {
+	return [
+		...desired.description === current.description ? [] : ["description"],
+		...desired.icon?.["en-us"] === current.icon?.["en-us"] ? [] : ["icon"],
+		...iconHashesEqual(current.iconFileHashes, desired.iconFileHashes) ? [] : ["iconFileHashes"],
+		...desired.name === current.name ? [] : ["name"],
+		...desired.price === current.price ? [] : ["price"],
+		...desired.isRegionalPricingEnabled === void 0 || desired.isRegionalPricingEnabled === current.isRegionalPricingEnabled ? [] : ["isRegionalPricingEnabled"],
+		...desired.storePageEnabled === void 0 || desired.storePageEnabled === current.storePageEnabled ? [] : ["storePageEnabled"]
+	];
+}
 function fieldsEqual$3(desired, current) {
-	return desired.description === current.description && desired.icon?.["en-us"] === current.icon?.["en-us"] && iconHashesEqual(current.iconFileHashes, desired.iconFileHashes) && desired.name === current.name && desired.price === current.price && (desired.isRegionalPricingEnabled === void 0 || desired.isRegionalPricingEnabled === current.isRegionalPricingEnabled) && (desired.storePageEnabled === void 0 || desired.storePageEnabled === current.storePageEnabled);
+	return changedFieldsBetween$3(desired, current).length === 0;
 }
 function assertReconcilable(current, desired) {
 	if (current.iconFileHashes !== void 0 && desired.iconFileHashes === void 0) return {
@@ -2432,10 +2867,11 @@ function assertReconcilable(current, desired) {
 /**
 * Resource-kind module for Roblox developer products. Owns the entry
 * schema, flattening, icon-hash normalization, drift-equality, and the
-* plan-time icon-removal rejection for the `developerProduct` kind.
+* pre-reconcile icon-removal rejection for the `developerProduct` kind.
 */
 const developerProductKind = {
 	assertReconcilable,
+	changedFieldsBetween: changedFieldsBetween$3,
 	entrySchema: entrySchema$3,
 	fieldsEqual: fieldsEqual$3,
 	flatten: flatten$3,
@@ -2482,8 +2918,17 @@ async function normalize$2(input, io) {
 		success: true
 	};
 }
+function changedFieldsBetween$2(desired, current) {
+	return [
+		...desired.description === current.description ? [] : ["description"],
+		...desired.icon["en-us"] === current.icon["en-us"] ? [] : ["icon"],
+		...iconHashesEqual(current.iconFileHashes, desired.iconFileHashes) ? [] : ["iconFileHashes"],
+		...desired.name === current.name ? [] : ["name"],
+		...desired.price === current.price ? [] : ["price"]
+	];
+}
 function fieldsEqual$2(desired, current) {
-	return desired.description === current.description && desired.icon["en-us"] === current.icon["en-us"] && iconHashesEqual(current.iconFileHashes, desired.iconFileHashes) && desired.name === current.name && desired.price === current.price;
+	return changedFieldsBetween$2(desired, current).length === 0;
 }
 /**
 * Resource-kind module for Roblox game passes. Owns the entry schema,
@@ -2491,6 +2936,7 @@ function fieldsEqual$2(desired, current) {
 * `gamePass` kind.
 */
 const gamePassKind = {
+	changedFieldsBetween: changedFieldsBetween$2,
 	entrySchema: entrySchema$2,
 	fieldsEqual: fieldsEqual$2,
 	flatten: flatten$2,
@@ -2539,12 +2985,19 @@ async function normalize$1(input, io) {
 		success: true
 	};
 }
+function changedFieldsBetween$1(desired, current) {
+	return [
+		...desired.fileHash === current.fileHash ? [] : ["fileHash"],
+		...desired.filePath === current.filePath ? [] : ["filePath"],
+		...desired.placeId === current.placeId ? [] : ["placeId"],
+		...PLACE_MANAGED_METADATA_FIELDS.filter((field) => {
+			const desiredValue = desired[field];
+			return desiredValue !== void 0 && desiredValue !== current[field];
+		})
+	];
+}
 function fieldsEqual$1(desired, current) {
-	if (desired.fileHash !== current.fileHash || desired.filePath !== current.filePath || desired.placeId !== current.placeId) return false;
-	return PLACE_MANAGED_METADATA_FIELDS.every((field) => {
-		const desiredValue = desired[field];
-		return desiredValue === void 0 || desiredValue === current[field];
-	});
+	return changedFieldsBetween$1(desired, current).length === 0;
 }
 /**
 * Resource-kind module for Roblox places. Owns the entry schema,
@@ -2552,6 +3005,7 @@ function fieldsEqual$1(desired, current) {
 * kind.
 */
 const placeKind = {
+	changedFieldsBetween: changedFieldsBetween$1,
 	entrySchema: entrySchema$1,
 	fieldsEqual: fieldsEqual$1,
 	flatten: flatten$1,
@@ -2634,22 +3088,20 @@ function socialLinkEqual(a, b) {
 	if (b === void 0) return false;
 	return a.title === b.title && a.uri === b.uri;
 }
-function declaredSocialLinksEqual(desired, current) {
-	for (const field of SOCIAL_LINK_FIELDS) {
-		if (!(field in desired)) continue;
-		if (!socialLinkEqual(desired[field], current[field])) return false;
-	}
-	return true;
+function changedFieldsBetween(desired, current) {
+	return [
+		...desired.universeId === current.universeId ? [] : ["universeId"],
+		...UNIVERSE_MANAGED_FLAGS.filter((flag) => {
+			const isDesiredEnabled = desired[flag];
+			return isDesiredEnabled !== void 0 && isDesiredEnabled !== current[flag];
+		}),
+		...desired.displayName === void 0 || desired.displayName === current.displayName ? [] : ["displayName"],
+		..."privateServerPriceRobux" in desired && desired.privateServerPriceRobux !== current.privateServerPriceRobux ? ["privateServerPriceRobux"] : [],
+		...SOCIAL_LINK_FIELDS.filter((field) => field in desired && !socialLinkEqual(desired[field], current[field]))
+	];
 }
 function fieldsEqual(desired, current) {
-	if (desired.universeId !== current.universeId) return false;
-	for (const flag of UNIVERSE_MANAGED_FLAGS) {
-		const isDesiredEnabled = desired[flag];
-		if (isDesiredEnabled !== void 0 && isDesiredEnabled !== current[flag]) return false;
-	}
-	if (desired.displayName !== void 0 && desired.displayName !== current.displayName) return false;
-	if ("privateServerPriceRobux" in desired && desired.privateServerPriceRobux !== current.privateServerPriceRobux) return false;
-	return declaredSocialLinksEqual(desired, current);
+	return changedFieldsBetween(desired, current).length === 0;
 }
 //#endregion
 //#region src/core/kinds/index.ts
@@ -2675,6 +3127,7 @@ const defaultKindRegistry = {
 	gamePass: gamePassKind,
 	place: placeKind,
 	universe: {
+		changedFieldsBetween,
 		entrySchema,
 		fieldsEqual,
 		flatten,
@@ -2695,12 +3148,16 @@ const defaultKindRegistry = {
 * `update` op if any declared field differs or a `noop` op if every field
 * matches.
 *
-* Ops appear in the order their desired entries appear in the input array so
-* callers can rely on declaration order when logging or applying ops.
+* Ops appear in the order their desired entries appear in the input array.
+* `applyOps` regroups them into Phase 1 (universe) and Phase 2 (everything
+* else) when dispatching; the execution order within Phase 2 is not
+* guaranteed because Phase 2 dispatches concurrently. Persisted state-file
+* order is determined by the merge in `deploy.runReconcile` (which retains
+* prior-snapshot positions for unchanged keys), not by this diff output.
 *
 * @param desired - Declared desired state from user config, already normalized
 *   (file hashes computed, nullable wire values mapped to `undefined`).
-* @param current - Last-known live state from the state file.
+* @param current - Last-known current state from the state file.
 * @returns Operations to reconcile the two snapshots.
 *
 * @example
@@ -2760,6 +3217,11 @@ const defaultKindRegistry = {
 * const ops = diff([unchanged, drifted, fresh], current);
 *
 * expect(ops.map((op) => op.type)).toEqual(["noop", "update", "create"]);
+*
+* const updateOp = ops[1]!;
+* if (updateOp.type === "update") {
+*     expect(updateOp.changedFields).toStrictEqual(["name"]);
+* }
 * ```
 */
 function diff(desired, current) {
@@ -2769,21 +3231,21 @@ function diff(desired, current) {
 function compositeKey$1(resource) {
 	return `${resource.kind}:${resource.key}`;
 }
-function desiredFieldsEqual(desired, current) {
-	return defaultKindRegistry[desired.kind].fieldsEqual(desired, current);
-}
 function operationFor(desired, current) {
 	if (current === void 0) return {
 		key: desired.key,
 		desired,
 		type: "create"
 	};
-	if (desiredFieldsEqual(desired, current)) return {
+	const changedFields = defaultKindRegistry[desired.kind].changedFieldsBetween(desired, current);
+	if (changedFields.length === 0) return {
 		key: desired.key,
+		kind: desired.kind,
 		type: "noop"
 	};
 	return {
 		key: desired.key,
+		changedFields,
 		current,
 		desired,
 		type: "update"
@@ -2879,79 +3341,89 @@ function capitalize(value) {
 function flattenConfig(config) {
 	return Object.values(defaultKindRegistry).flatMap((module) => module.flatten(config));
 }
-//#endregion
-//#region src/core/resolve-state-config.ts
 /**
-* Pick the `StateConfig` that applies to `environment`. Per-environment
-* overrides win over the root block; if neither is present, returns
-* `Err(stateNotConfigured)` so the deploy boundary can surface a typed
-* error instead of silently falling back.
-*
-* @param config - Validated project config.
-* @param environment - Target environment name.
-* @returns The resolved `StateConfig`, or `Err(stateNotConfigured)` when
-* neither the environment override nor the root block is set.
-* @example
-*
-* ```ts
-* import { resolveStateConfig } from "@bedrock-rbx/core";
-*
-* const result = resolveStateConfig(
-*     {
-*         state: { backend: "gist", gistId: "root-gist" },
-*         environments: {
-*             production: { state: { backend: "gist", gistId: "prod-gist" } },
-*         },
-*     },
-*     "production",
-* );
+* Common prefix used to build the default name pushed for a redacted
+* developer-product. The full default produced by {@link defaultRedactedProductName}
+* is `${REDACTED_PRODUCT_NAME} ${suffix}`, where `suffix` is a 6-hex-char
+* digest of the resource key (see {@link redactedNameSuffix}). The suffix is
+* required because Roblox enforces per-universe uniqueness on
+* developer-product names, so a shared bare placeholder would collide across
+* multiple redacted entries. The prefix avoids the word `Redacted` and the
+* `#` separator because Roblox's text-moderation filter has been observed
+* silently replacing names matching `Redacted Product #<hex>` with
+* `########################`, which then causes downstream `DuplicateProductName`
+* errors when other redacted entries are moderated to the same string.
+*/
+const REDACTED_PRODUCT_NAME = "Hidden Product";
+const PASS_PRODUCT_ENV_FIELDS = [
+	"description",
+	"icon",
+	"name",
+	"price"
+];
+const PLACE_ENV_FIELDS = ["description", "displayName"];
+/**
+* Six-character lowercase hex digest of `SHA-256(key)`, used as the
+* disambiguating suffix on a redacted developer-product's default `name`.
+* Stable across config edits (driven only by the bedrock resource key, not
+* declaration order) and opaque to a Roblox player browsing the marketplace.
+* A natural collision is caught before any apply-side driver I/O by `assertAllReconcilable`.
+*
+* @param key - Bedrock resource key for the developer product being redacted.
+* @returns The first six lowercase hex characters of the SHA-256 digest of `key`.
+*/
+function redactedNameSuffix(key) {
+	return createHash("sha256").update(key).digest("hex").slice(0, 6);
+}
+/**
+* Default redacted name for a developer product with the given resource key.
+* Combines {@link REDACTED_PRODUCT_NAME} with {@link redactedNameSuffix} so
+* each redacted entry resolves to a unique value the upstream API will accept.
 *
-* expect(result.success).toBeTrue();
-* if (result.success) {
-*     expect(result.data).toContainEntry(["gistId", "prod-gist"]);
-* }
-* ```
+* @param key - Bedrock resource key for the developer product being redacted.
+* @returns The placeholder name pushed to Roblox for this product.
 */
-function resolveStateConfig(config, environment) {
-	const override = config.environments[environment]?.state;
-	if (override !== void 0) return {
-		data: override,
-		success: true
-	};
-	if (config.state !== void 0) return {
-		data: config.state,
-		success: true
-	};
-	return {
-		err: {
-			environment,
-			kind: "stateNotConfigured"
-		},
-		success: false
-	};
+function defaultRedactedProductName(key) {
+	return `${REDACTED_PRODUCT_NAME} ${redactedNameSuffix(key)}`;
 }
 /**
 * Pure transform that substitutes bedrock-supplied placeholder content for
-* every resource whose effective `redacted` flag is truthy. The effective
-* flag is the per-resource `redacted` value when set, otherwise the
-* `environmentRedacted` fallback. A `redacted` object form replaces
-* matching fields with the supplied values and falls back to the bedrock
-* defaults for the rest. Runs between env-overlay merge and display-name
-* prefix render so the rest of the pipeline (flatten, normalize, diff,
-* apply) operates on already-redacted values and needs no special-case
-* redaction logic.
+* every resource whose effective redaction state is truthy. Three layers
+* compose field-by-field per resource: env-resource (most-specific, from
+* `inputs.envResource`), root-resource (the `redacted` field on the
+* passed-in entry), and env-level (least-specific, `inputs.envLevel`).
+* The first non-undefined value sets state (`false` carves out); object
+* layers then contribute fields with the most-specific layer winning per
+* field, and bedrock defaults fill any field nobody set. Runs between
+* env-overlay merge and display-name prefix render so the rest of the
+* pipeline (flatten, normalize, diff, apply) operates on already-redacted
+* values and needs no special-case redaction logic.
 *
 * @param config - Post-merge `ResolvedConfig` produced by `selectEnvironment`.
-* @param environmentRedacted - Environment-level redaction toggle. Resources
-*   that omit a per-resource `redacted` flag inherit this value.
+* @param inputs - Aggregated redaction layers. Omit to skip redaction
+*   entirely. See {@link RedactionInputs} for the shape.
 * @returns A `ResolvedConfig` whose redacted entries carry placeholder
 *   values; non-redacted entries pass through verbatim, and the input is
 *   not mutated.
 */
-function applyRedaction(config, environmentRedacted = false) {
-	const passes = redactPasses(config.passes, environmentRedacted);
-	const places = redactPlaces(config.places, environmentRedacted);
-	const products = redactProducts(config.products, environmentRedacted);
+function applyRedaction(config, inputs) {
+	const environmentLevel = inputs?.envLevel;
+	const environmentResource = inputs?.envResource;
+	const passes = redactPasses({
+		collection: config.passes,
+		envLevel: environmentLevel,
+		envResource: environmentResource?.passes
+	});
+	const places = redactPlaces({
+		collection: config.places,
+		envLevel: environmentLevel,
+		envResource: environmentResource?.places
+	});
+	const products = redactProducts({
+		collection: config.products,
+		envLevel: environmentLevel,
+		envResource: environmentResource?.products
+	});
 	if (passes === config.passes && places === config.places && products === config.products) return config;
 	return {
 		...config,
@@ -2962,9 +3434,10 @@ function applyRedaction(config, environmentRedacted = false) {
 }
 /**
 * Inspect the pre-redaction merged config and produce one annotation per
-* resource flagged `redacted: true`. Callers thread the result into plan
-* output so authors can see which resources are redacted in the active
-* environment and whether their real-value edits are being suppressed.
+* resource flagged `redacted: true` at either the root entry or its
+* env-overlay counterpart. Callers thread the result into plan output so
+* authors can see which resources are redacted in the active environment
+* and whether their real-value edits are being suppressed.
 *
 * Operates on the pre-redaction view because the post-redaction config no
 * longer carries the real `name`/`description`/`icon` values needed to
@@ -2972,42 +3445,107 @@ function applyRedaction(config, environmentRedacted = false) {
 *
 * @param merged - `ResolvedConfig` produced by environment overlay merge,
 *   before `applyRedaction` has substituted placeholders.
+* @param environmentResource - Per-kind env-overlay redaction layers
+*   extracted from the active env entry. Omit when the caller has no
+*   env-overlay layer.
 * @returns Zero or more annotations, one per redacted resource. Empty when
 *   the config declares no redacted resources.
 */
-function collectRedactionAnnotations(merged) {
-	const passes = Object.entries(merged.passes ?? {}).filter(([, entry]) => entry.redacted === true).map(([key, entry]) => {
+function collectRedactionAnnotations(merged, environmentResource) {
+	const passes = Object.entries(merged.passes ?? {}).filter(([key, entry]) => entry.redacted === true || environmentResource?.passes?.[key] === true).map(([key, entry]) => {
 		return {
 			key: asResourceKey(key),
 			hasRealValueEdits: passHasRealValueEdits(entry),
 			kind: "gamePass"
 		};
 	});
-	const products = Object.entries(merged.products ?? {}).filter(([, entry]) => entry.redacted === true).map(([key, entry]) => {
+	const products = Object.entries(merged.products ?? {}).filter(([key, entry]) => entry.redacted === true || environmentResource?.products?.[key] === true).map(([key, entry]) => {
 		return {
 			key: asResourceKey(key),
-			hasRealValueEdits: productHasRealValueEdits(entry),
+			hasRealValueEdits: productHasRealValueEdits(key, entry),
 			kind: "developerProduct"
 		};
 	});
 	return [...passes, ...products];
 }
+function pickEnvironmentFields(environmentLevel, fields) {
+	if (environmentLevel === void 0 || typeof environmentLevel === "boolean") return environmentLevel;
+	return Object.fromEntries(fields.map((field) => [field, environmentLevel[field]]));
+}
+/**
+* Walk redaction layers most-specific to least-specific and produce the
+* effective per-field override for one resource. Returns `undefined` when the
+* resource is not redacted; returns a (possibly empty) object when it is.
+* State step: the first non-undefined layer sets state -- `false` carves out,
+* `true` or object enables. Fields step: walk every object layer in the same
+* order, taking the first value per field. A field's value may itself be
+* `undefined` (the env-level projection produced by {@link pickEnvironmentFields}
+* includes every projected key, even when the env override left it absent);
+* downstream per-kind redact functions collapse those back to bedrock
+* placeholder defaults via `??`.
+*
+* @template Override - Per-kind override type the resource accepts.
+* @param layers - Layers ordered most-specific (index 0) to least-specific.
+* @returns The effective override, or `undefined` when not redacted.
+*/
+function resolveEffectiveOverride(layers) {
+	const firstNonUndefined = layers.find((layer) => layer !== void 0);
+	if (firstNonUndefined === void 0 || firstNonUndefined === false) return;
+	const effective = {};
+	for (const layer of layers) {
+		if (typeof layer !== "object") continue;
+		for (const [field, value] of Object.entries(layer)) if (!(field in effective)) effective[field] = value;
+	}
+	return effective;
+}
+function resolveEntries(inputs) {
+	const { collection, environmentForKind, envResource } = inputs;
+	return Object.entries(collection).map(([key, entry]) => {
+		return {
+			key,
+			entry,
+			override: resolveEffectiveOverride([
+				envResource?.[key],
+				entry.redacted,
+				environmentForKind
+			])
+		};
+	});
+}
+function redactCollection(inputs) {
+	const { collection, environmentForKind, envResource, redact } = inputs;
+	if (collection === void 0) return;
+	const resolved = resolveEntries({
+		collection,
+		environmentForKind,
+		envResource
+	});
+	if (resolved.every((item) => item.override === void 0)) return collection;
+	return Object.fromEntries(resolved.map((item) => {
+		return item.override === void 0 ? [item.key, item.entry] : [item.key, redact({
+			key: item.key,
+			entry: item.entry,
+			override: item.override
+		})];
+	}));
+}
 function redactPass(entry, override) {
 	return {
 		...entry,
 		name: override.name ?? "Redacted Pass",
 		description: override.description ?? "",
-		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" }
+		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" },
+		...entry.price === void 0 ? {} : { price: override.price ?? 99999 }
 	};
 }
-function redactPasses(passes, environmentRedacted) {
-	if (passes === void 0) return;
-	if (!Object.values(passes).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return passes;
-	return Object.fromEntries(Object.entries(passes).map(([key, entry]) => {
-		const effective = entry.redacted ?? environmentRedacted;
-		if (effective === false) return [key, entry];
-		return [key, redactPass(entry, typeof effective === "object" ? effective : {})];
-	}));
+function redactPasses(inputs) {
+	const { collection, envLevel, envResource } = inputs;
+	return redactCollection({
+		collection,
+		environmentForKind: pickEnvironmentFields(envLevel, PASS_PRODUCT_ENV_FIELDS),
+		envResource,
+		redact: (item) => redactPass(item.entry, item.override)
+	});
 }
 function redactPlace(entry, override) {
 	return {
@@ -3016,37 +3554,39 @@ function redactPlace(entry, override) {
 		displayName: override.displayName ?? entry.displayName
 	};
 }
-function redactPlaces(places, environmentRedacted) {
-	if (places === void 0) return;
-	if (!Object.values(places).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return places;
-	return Object.fromEntries(Object.entries(places).map(([key, entry]) => {
-		const effective = entry.redacted ?? environmentRedacted;
-		if (effective === false) return [key, entry];
-		return [key, redactPlace(entry, typeof effective === "object" ? effective : {})];
-	}));
+function redactPlaces(inputs) {
+	const { collection, envLevel, envResource } = inputs;
+	return redactCollection({
+		collection,
+		environmentForKind: pickEnvironmentFields(envLevel, PLACE_ENV_FIELDS),
+		envResource,
+		redact: (item) => redactPlace(item.entry, item.override)
+	});
 }
-function redactProduct(entry, override) {
+function redactProduct(inputs) {
+	const { key, entry, override } = inputs;
 	return {
 		...entry,
-		name: override.name ?? "Redacted Product",
+		name: override.name ?? defaultRedactedProductName(key),
 		description: override.description ?? "",
-		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" }
+		icon: override.icon ?? { "en-us": "<bedrock:redacted-icon.png>" },
+		...entry.price === void 0 ? {} : { price: override.price ?? 99999 }
 	};
 }
-function redactProducts(products, environmentRedacted) {
-	if (products === void 0) return;
-	if (!Object.values(products).some((entry) => (entry.redacted ?? environmentRedacted) !== false)) return products;
-	return Object.fromEntries(Object.entries(products).map(([key, entry]) => {
-		const effective = entry.redacted ?? environmentRedacted;
-		if (effective === false) return [key, entry];
-		return [key, redactProduct(entry, typeof effective === "object" ? effective : {})];
-	}));
+function redactProducts(inputs) {
+	const { collection, envLevel, envResource } = inputs;
+	return redactCollection({
+		collection,
+		environmentForKind: pickEnvironmentFields(envLevel, PASS_PRODUCT_ENV_FIELDS),
+		envResource,
+		redact: redactProduct
+	});
 }
 function passHasRealValueEdits(entry) {
-	return entry.name !== "Redacted Pass" || entry.description !== "" || entry.icon["en-us"] !== "<bedrock:redacted-icon.png>";
+	return entry.name !== "Redacted Pass" || entry.description !== "" || entry.icon["en-us"] !== "<bedrock:redacted-icon.png>" || entry.price !== void 0 && entry.price !== 99999;
 }
-function productHasRealValueEdits(entry) {
-	return entry.name !== "Redacted Product" || entry.description !== "" || entry.icon !== void 0 && entry.icon["en-us"] !== "<bedrock:redacted-icon.png>";
+function productHasRealValueEdits(key, entry) {
+	return !(entry.name === defaultRedactedProductName(key) || entry.name === "Hidden Product") || entry.description !== "" || entry.icon !== void 0 && entry.icon["en-us"] !== "<bedrock:redacted-icon.png>" || entry.price !== void 0 && entry.price !== 99999;
 }
 //#endregion
 //#region src/core/select-environment.ts
@@ -3096,6 +3636,22 @@ function selectMergedEnvironment(config, environment) {
 	};
 }
 /**
+* Build the per-resource env-overlay redaction layer that `applyRedaction`
+* and `collectRedactionAnnotations` consume. Reads each redactable kind off
+* the environment entry and projects every entry's `redacted` field into
+* the layer; omits kinds the env entry does not declare.
+*
+* @param entry - Environment entry whose overlay redaction values to extract.
+* @returns A `EnvironmentResourceRedaction` ready to pass downstream.
+*/
+function extractResourceRedaction(entry) {
+	return {
+		...entry.passes ? { passes: extractRedactionLayer(entry.passes) } : {},
+		...entry.places ? { places: extractRedactionLayer(entry.places) } : {},
+		...entry.products ? { products: extractRedactionLayer(entry.products) } : {}
+	};
+}
+/**
 * Project a validated `Config` onto a single environment. Looks up the
 * matching `environments[environment]` entry, deep-merges its resource
 * overlay (`passes`, `places`, `universe`) over the root config via defu,
@@ -3226,10 +3782,17 @@ function mergeUniverse(overlay, base) {
 	if (overlay === void 0 && base === void 0) return;
 	return defu(overlay ?? {}, base ?? {});
 }
+function stripRedacted(overlay) {
+	if (overlay === void 0) return;
+	return Object.fromEntries(Object.entries(overlay).map(([key, entryValue]) => {
+		const { redacted: _redacted, ...rest } = entryValue;
+		return [key, rest];
+	}));
+}
 function mergeOverlays(config, entry) {
-	const passes = mergeKeyedRecord(entry.passes, config.passes);
-	const places = mergeKeyedRecord(entry.places, config.places);
-	const products = mergeKeyedRecord(entry.products, config.products);
+	const passes = mergeKeyedRecord(stripRedacted(entry.passes), config.passes);
+	const places = mergeKeyedRecord(stripRedacted(entry.places), config.places);
+	const products = mergeKeyedRecord(stripRedacted(entry.products), config.products);
 	const universe = mergeUniverse(entry.universe, config.universe);
 	const state = entry.state ?? config.state;
 	const { places: _placesRoot, products: _productsRoot, universe: _universeRoot, ...rest } = config;
@@ -3277,6 +3840,11 @@ function findIncompletePlace(projected, environment) {
 		};
 	}
 }
+function extractRedactionLayer(overlay) {
+	const layer = {};
+	for (const [key, entryValue] of Object.entries(overlay)) if (entryValue.redacted !== void 0) layer[key] = entryValue.redacted;
+	return layer;
+}
 function resolvePrefix(config, entry) {
 	if (config.displayNamePrefix?.enabled === false) return;
 	const { label } = entry;
@@ -3302,7 +3870,10 @@ function applyPlacesPrefix(places, prefix) {
 }
 function redactAndPrefix(inputs) {
 	const { config, entry, merged } = inputs;
-	const redacted = applyRedaction(merged, entry.redacted);
+	const redacted = applyRedaction(merged, {
+		envLevel: entry.redacted,
+		envResource: extractResourceRedaction(entry)
+	});
 	const prefix = resolvePrefix(config, entry);
 	const places = applyPlacesPrefix(redacted.places, prefix);
 	const universe = applyUniversePrefix(redacted.universe, prefix);
@@ -3313,212 +3884,95 @@ function redactAndPrefix(inputs) {
 	};
 }
 //#endregion
-//#region src/core/validate-plan.ts
-/**
-* Plan-time invariant check that runs after `buildDesired` and before
-* `diff`. Walks paired `(kind, key)` entries and dispatches to each
-* kind module's optional `assertReconcilable` hook so kind-specific
-* rejections (e.g. Removing a developer-product icon, which the upstream
-* API has no documented unset path for) surface as typed errors before
-* `diff` runs and before any apply-side driver I/O is attempted.
-*
-* Pure and synchronous. Current-only entries (no matching desired) are
-* ignored: their reconciliation is `diff`'s concern, not this seam's.
-*
-* @param desired - Desired state from `buildDesired`.
-* @param current - Prior current state from the state port.
-* @returns `Ok(undefined)` when every paired entry passes its kind-level
-*   reconcilability check, or the first `Err` returned by a hook.
-*
-* @example
-*
-* ```ts
-* import { asResourceKey, asRobloxAssetId, asSha256Hex, validatePlan } from "@bedrock-rbx/core";
-*
-* const result = validatePlan(
-*     [
-*         {
-*             description: "Stocks the player up with 1,000 premium gems.",
-*             isRegionalPricingEnabled: undefined,
-*             key: asResourceKey("gem-pack"),
-*             kind: "developerProduct",
-*             name: "Gem Pack",
-*             price: undefined,
-*             storePageEnabled: undefined,
-*         },
-*     ],
-*     [
-*         {
-*             description: "Stocks the player up with 1,000 premium gems.",
-*             icon: { "en-us": "assets/gem-pack.png" },
-*             iconFileHashes: {
-*                 "en-us": asSha256Hex(
-*                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-*                 ),
-*             },
-*             isRegionalPricingEnabled: undefined,
-*             key: asResourceKey("gem-pack"),
-*             kind: "developerProduct",
-*             name: "Gem Pack",
-*             outputs: { productId: asRobloxAssetId("9876543210") },
-*             price: undefined,
-*             storePageEnabled: undefined,
-*         },
-*     ],
-* );
-*
-* expect(result.success).toBeFalse();
-* if (!result.success) {
-*     expect(result.err.kind).toBe("iconRemovalRejected");
-* }
-* ```
-*/
-function validatePlan(desired, current) {
-	const currentByKey = new Map(current.map((entry) => [compositeKey(entry), entry]));
-	for (const entry of desired) {
-		const matched = currentByKey.get(compositeKey(entry));
-		if (matched === void 0) continue;
-		const check = defaultKindRegistry[entry.kind].assertReconcilable?.(matched, entry);
-		if (check !== void 0 && !check.success) return check;
-	}
-	return {
-		data: void 0,
-		success: true
-	};
-}
-function compositeKey(resource) {
-	return `${resource.kind}:${resource.key}`;
-}
-//#endregion
 //#region src/shell/apply-ops.ts
 /**
-* Dispatch each reconciliation operation to the matching resource driver
-* with first-fail semantics: on the first `Err` (driver failure or
-* `updateUnsupported`), the remaining operations are skipped and the error
-* is returned verbatim.
+* Dispatch reconciliation operations to their matching drivers in two phases
+* with continue-on-failure semantics. Phase 1 runs universe ops sequentially
+* (singleton per environment; sequencing it before everything else avoids the
+* `displayName` race against the root `Place`). Phase 2 dispatches every
+* remaining non-noop op concurrently via `Promise.all`; every op is
+* attempted regardless of earlier failures.
 *
 * Behaviour:
-* - `create` operations are routed to `registry[op.desired.kind].create`.
-* - `update` operations are routed to `registry[op.desired.kind].update`
-*   when the driver exposes it; otherwise they short-circuit to an
-*   `updateUnsupported` Err without invoking the driver.
+* - `create` operations route to `registry[op.desired.kind].create`.
+* - `update` operations route to `registry[op.desired.kind].update` when the
+*   driver exposes it; otherwise they yield an `updateUnsupported`
+*   `ApplyError` without invoking the driver.
 * - `noop` operations are skipped entirely (no I/O, no dispatch).
-*
-* On success the returned array carries the driver outputs for every
-* non-noop op, in dispatched order. Noops are not represented; callers
-* needing a full post-apply snapshot merge with the pre-apply current
-* state keyed by `ResourceKey`.
-*
-* @param ops - Reconciliation operations produced by `diff`, applied in order.
-* @param registry - Per-kind driver table; dispatch uses `op.desired.kind` as the index.
-* @returns `Ok(state)` when every operation succeeds, where `state` holds
-*   driver outputs for each non-noop op in dispatched order; or the first
-*   failure encountered.
-* @throws Whatever the dispatched driver rejects with outside its `Result`
-*   return. A driver whose injected I/O (file reads, network calls, etc.)
-*   throws will surface that rejection here rather than translating it into
-*   a `Result` failure; wrap the call site in a try/catch when drivers are
-*   not trusted to contain their own rejections.
+* - A driver that throws outside its `Result` contract is caught at the
+*   dispatch boundary and translated to an `unexpectedThrow` `ApplyError`
+*   scoped to that op alone; the rest of the batch keeps running.
+*
+* On Ok the returned array carries driver outputs for every non-noop op
+* in phase order: Phase 1 universe entries first, then Phase 2 entries in
+* their input order. Noops are not represented; callers needing a full
+* post-apply snapshot merge with the pre-apply current state keyed by
+* `ResourceKey`.
+*
+* On Err the aggregate carries every survivor in `applied` (Phase 1 first,
+* then Phase 2 input order) and every failure in `failures` with the same
+* grouping. Neither array reflects completion order.
+*
+* @param ops - Reconciliation operations produced by `diff`, applied in
+*   declaration order.
+* @param registry - Per-kind driver table; dispatch uses `op.desired.kind`
+*   as the index.
+* @param reporting - Optional progress wiring. When supplied, `applyOps`
+*   emits one `resourceOpStarted` and one terminal event per non-noop op,
+*   one `resourceOpNoop` per noop op, and a final `applySummary` carrying
+*   the per-type counts and the wall-clock apply duration. When omitted,
+*   no events fire.
+* @returns `Ok(state)` when every op succeeded; otherwise
+*   `Err(AggregateApplyError)` with the survivors and the non-empty
+*   failures tuple.
 * @example
 *
 * ```ts
-* import {
-*     applyOps,
-*     asResourceKey,
-*     asRobloxAssetId,
-*     asSha256Hex,
-*     type DriverRegistry,
-*     type Operation,
-* } from "@bedrock-rbx/core";
+* import { applyOps, type DriverRegistry } from "@bedrock-rbx/core";
 *
-* const registry: DriverRegistry = {
-*     gamePass: {
-*         async create(desired) {
-*             return {
-*                 data: {
-*                     ...desired,
-*                     outputs: {
-*                         assetId: asRobloxAssetId("9876543210"),
-*                         iconAssetIds: { "en-us": asRobloxAssetId("1122334455") },
-*                     },
-*                 },
-*                 success: true,
-*             };
-*         },
-*     },
-*     place: {
-*         async create(desired) {
-*             return {
-*                 data: { ...desired, outputs: { versionNumber: 1 } },
-*                 success: true,
-*             };
-*         },
-*     },
-*     universe: {
-*         async create(desired) {
-*             return {
-*                 data: { ...desired, outputs: { rootPlaceId: asRobloxAssetId("4711") } },
-*                 success: true,
-*             };
-*         },
-*     },
-*     developerProduct: {
-*         async create(desired) {
-*             return {
-*                 data: {
-*                     ...desired,
-*                     outputs: { productId: asRobloxAssetId("8172635495") },
-*                 },
-*                 success: true,
-*             };
-*         },
-*     },
+* const noopRegistry: DriverRegistry = {
+*     developerProduct: { create: async () => ({ err: new Error("stub") as never, success: false }) },
+*     gamePass: { create: async () => ({ err: new Error("stub") as never, success: false }) },
+*     place: { create: async () => ({ err: new Error("stub") as never, success: false }) },
+*     universe: { create: async () => ({ err: new Error("stub") as never, success: false }) },
 * };
 *
-* const ops: ReadonlyArray<Operation> = [
-*     {
-*         key: asResourceKey("vip-pass"),
-*         type: "create",
-*         desired: {
-*             key: asResourceKey("vip-pass"),
-*             name: "VIP Pass",
-*             description: "Grants VIP perks.",
-*             icon: { "en-us": "assets/vip-icon.png" },
-*             iconFileHashes: {
-*                 "en-us": asSha256Hex(
-*                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-*                 ),
-*             },
-*             kind: "gamePass",
-*             price: 500,
-*         },
-*     },
-* ];
-*
-* return applyOps(ops, registry).then((result) => {
-*     expect(result.success).toBe(true);
-*     expect(result.success && result.data).toHaveLength(1);
+* return applyOps([], noopRegistry).then((result) => {
+*     expect(result).toStrictEqual({ data: [], success: true });
 * });
 * ```
 */
-async function applyOps(ops, registry) {
-	const applied = [];
-	for (const op of ops) {
-		if (op.type === "noop") continue;
-		const outcome = await dispatchOp(op, registry);
-		if (!outcome.success) return {
-			err: {
-				...outcome.err,
-				appliedSoFar: applied
-			},
-			success: false
-		};
-		applied.push(outcome.data);
-	}
-	return {
+async function applyOps(ops, registry, reporting) {
+	const start = Date.now();
+	const { noopCount, phase1, phase2 } = partitionAndEmitNoops(ops, reporting);
+	const pairs = await dispatchInPhases({
+		phase1,
+		phase2,
+		registry,
+		reporting
+	});
+	const end = Date.now();
+	const { applied, failures } = partitionOutcomes(pairs.map((pair) => pair.outcome));
+	emitApplySummary({
+		end,
+		failures,
+		noopCount,
+		pairs,
+		reporting,
+		start
+	});
+	const [head, ...tail] = failures;
+	if (head === void 0) return {
 		data: applied,
 		success: true
 	};
+	return {
+		err: {
+			applied,
+			failures: [head, ...tail]
+		},
+		success: false
+	};
 }
 function driverFailure(key, cause) {
 	return {
@@ -3552,7 +4006,7 @@ async function applyOne(op, driver) {
 	const updated = await driver.update(op.current, op.desired);
 	return updated.success ? updated : driverFailure(op.key, updated.err);
 }
-async function dispatchOp(op, registry) {
+async function dispatchByKind(op, registry) {
 	switch (op.desired.kind) {
 		case "developerProduct": return applyOne(op, registry.developerProduct);
 		case "gamePass": return applyOne(op, registry.gamePass);
@@ -3560,6 +4014,161 @@ async function dispatchOp(op, registry) {
 		case "universe": return applyOne(op, registry.universe);
 	}
 }
+async function dispatchOp(op, registry) {
+	try {
+		return await dispatchByKind(op, registry);
+	} catch (err) {
+		return {
+			err: {
+				key: op.key,
+				cause: err,
+				kind: "unexpectedThrow"
+			},
+			success: false
+		};
+	}
+}
+function createSucceededEvent(input) {
+	const { key, environment, state } = input;
+	switch (state.kind) {
+		case "developerProduct": return {
+			key,
+			environment,
+			kind: "resourceOpSucceeded",
+			opType: "create",
+			outputs: state.outputs,
+			resourceKind: "developerProduct"
+		};
+		case "gamePass": return {
+			key,
+			environment,
+			kind: "resourceOpSucceeded",
+			opType: "create",
+			outputs: state.outputs,
+			resourceKind: "gamePass"
+		};
+		case "place": return {
+			key,
+			environment,
+			kind: "resourceOpSucceeded",
+			opType: "create",
+			outputs: state.outputs,
+			resourceKind: "place"
+		};
+		case "universe": return {
+			key,
+			environment,
+			kind: "resourceOpSucceeded",
+			opType: "create",
+			outputs: state.outputs,
+			resourceKind: "universe"
+		};
+	}
+}
+function toTerminalEvent(input) {
+	const { environment, op, outcome } = input;
+	if (!outcome.success) return {
+		key: op.key,
+		environment,
+		error: outcome.err,
+		kind: "resourceOpFailed",
+		opType: op.type,
+		resourceKind: op.desired.kind
+	};
+	if (op.type === "update") return {
+		key: op.key,
+		changedFields: op.changedFields,
+		environment,
+		kind: "resourceOpSucceeded",
+		opType: "update",
+		resourceKind: op.desired.kind
+	};
+	return createSucceededEvent({
+		key: op.key,
+		environment,
+		state: outcome.data
+	});
+}
+async function reportAndDispatch(input) {
+	const { op, registry, reporting } = input;
+	if (reporting !== void 0) reporting.progress.emit({
+		key: op.key,
+		environment: reporting.environment,
+		kind: "resourceOpStarted",
+		opType: op.type,
+		resourceKind: op.desired.kind
+	});
+	const outcome = await dispatchOp(op, registry);
+	if (reporting !== void 0) reporting.progress.emit(toTerminalEvent({
+		environment: reporting.environment,
+		op,
+		outcome
+	}));
+	return {
+		op,
+		outcome
+	};
+}
+async function dispatchInPhases(input) {
+	const phase1Pairs = [];
+	for (const op of input.phase1) phase1Pairs.push(await reportAndDispatch({
+		op,
+		registry: input.registry,
+		reporting: input.reporting
+	}));
+	const phase2Pairs = await Promise.all(input.phase2.map(async (op) => {
+		return reportAndDispatch({
+			op,
+			registry: input.registry,
+			reporting: input.reporting
+		});
+	}));
+	return [...phase1Pairs, ...phase2Pairs];
+}
+function emitApplySummary(input) {
+	if (input.reporting === void 0) return;
+	const created = input.pairs.filter((pair) => pair.outcome.success && pair.op.type === "create").length;
+	const updated = input.pairs.filter((pair) => pair.outcome.success && pair.op.type === "update").length;
+	input.reporting.progress.emit({
+		created,
+		durationMs: input.end - input.start,
+		environment: input.reporting.environment,
+		failed: input.failures.length,
+		kind: "applySummary",
+		noop: input.noopCount,
+		updated
+	});
+}
+function partitionOutcomes(outcomes) {
+	return {
+		applied: outcomes.flatMap((outcome) => outcome.success ? [outcome.data] : []),
+		failures: outcomes.flatMap((outcome) => outcome.success ? [] : [outcome.err])
+	};
+}
+function emitNoop(op, reporting) {
+	if (reporting === void 0) return;
+	reporting.progress.emit({
+		key: op.key,
+		environment: reporting.environment,
+		kind: "resourceOpNoop",
+		resourceKind: op.kind
+	});
+}
+function partitionAndEmitNoops(ops, reporting) {
+	const phase1 = [];
+	const phase2 = [];
+	let noopCount = 0;
+	for (const op of ops) if (op.type === "noop") {
+		noopCount += 1;
+		emitNoop(op, reporting);
+	} else if (op.desired.kind === "universe") phase1.push(op);
+	else phase2.push(op);
+	return {
+		noopCount,
+		phase1,
+		phase2
+	};
+}
 //#endregion
 //#region src/shell/build-default-registry.ts
 /**
@@ -3728,7 +4337,7 @@ const STATE_PORT_HINT = "pass a custom statePort via opts.statePort";
 * const port = buildStatePort({
 *     fetch: async () =>
 *         new Response(JSON.stringify({ files: {} }), { status: 200 }),
-*     getEnv: (name) => (name === "GITHUB_TOKEN" ? "ghp_example" : undefined),
+*     getEnv: (name) => (name === "BEDROCK_GITHUB_TOKEN" ? "ghp_example" : undefined),
 *     stateConfig: { backend: "gist", gistId: "abc123" },
 * });
 *
@@ -3751,12 +4360,12 @@ function buildStatePort(deps) {
 	};
 }
 function buildGistStatePort(stateConfig, deps) {
-	const token = deps.getEnv("GITHUB_TOKEN");
+	const token = deps.getEnv("BEDROCK_GITHUB_TOKEN") ?? deps.getEnv("GITHUB_TOKEN");
 	if (token === void 0) return {
 		err: {
 			kind: "missingCredential",
 			purpose: "stateBackend",
-			variable: "GITHUB_TOKEN"
+			variable: "BEDROCK_GITHUB_TOKEN"
 		},
 		success: false
 	};
@@ -3770,6 +4379,62 @@ function buildGistStatePort(stateConfig, deps) {
 	};
 }
 //#endregion
+//#region src/core/assert-all-reconcilable.ts
+/**
+* Batch reconcilability check that runs after `buildDesired` and before
+* `diff`. Walks paired `(kind, key)` entries and dispatches to each
+* kind module's optional `assertReconcilable` hook so kind-specific
+* rejections (e.g. Removing a developer-product icon, which the upstream
+* API has no documented unset path for) surface as typed errors before
+* `diff` runs and before any apply-side driver I/O is attempted.
+*
+* Pure and synchronous. Current-only entries (no matching desired) are
+* ignored: their reconciliation is `diff`'s concern, not this seam's.
+*
+* @param desired - Desired state from `buildDesired`.
+* @param current - Prior current state from the state port.
+* @returns `Ok(undefined)` when every paired entry passes its kind-level
+*   reconcilability check, or the first `Err` returned by a hook.
+*/
+function assertAllReconcilable(desired, current) {
+	const collision = detectProductNameCollision(desired);
+	if (collision !== void 0) return collision;
+	const currentByKey = new Map(current.map((entry) => [compositeKey(entry), entry]));
+	for (const entry of desired) {
+		const matched = currentByKey.get(compositeKey(entry));
+		if (matched === void 0) continue;
+		const check = defaultKindRegistry[entry.kind].assertReconcilable?.(matched, entry);
+		if (check !== void 0 && !check.success) return check;
+	}
+	return {
+		data: void 0,
+		success: true
+	};
+}
+function compositeKey(resource) {
+	return `${resource.kind}:${resource.key}`;
+}
+function detectProductNameCollision(desired) {
+	const seenByName = /* @__PURE__ */ new Map();
+	for (const entry of desired) {
+		if (entry.kind !== "developerProduct") continue;
+		const prior = seenByName.get(entry.name);
+		if (prior === void 0) {
+			seenByName.set(entry.name, entry.key);
+			continue;
+		}
+		return {
+			err: {
+				keys: [prior, entry.key],
+				kind: "redactedNameCollision",
+				message: `developer products '${prior}' and '${entry.key}' both resolve to the wire name '${entry.name}'. Roblox enforces per-universe uniqueness on developer-product names, so the second update would be rejected as DuplicateProductName. Set 'redacted: { name: "<unique>" }' on one of them to disambiguate.`,
+				resolvedName: entry.name
+			},
+			success: false
+		};
+	}
+}
+//#endregion
 //#region src/shell/load-config-internal.ts
 const LUAU_BOOTSTRAP_TEMP_PREFIX = "bedrock-luau-bootstrap-";
 /**
@@ -4143,10 +4808,26 @@ function attributeLoadError(err, cwd) {
 //#endregion
 //#region src/shell/deploy.ts
 /**
+* Decide whether `BEDROCK_CLI` should select the clack-backed default
+* progress adapter. Exported for direct unit coverage of the boundary
+* (`undefined` and empty string both flip to no-op; any non-empty value
+* picks clack).
+*
+* @param value - Raw `BEDROCK_CLI` value as returned by `getEnv`.
+* @returns `true` if the clack adapter should be the default.
+*/
+function isCliEnvironmentFlagSet(value) {
+	return value !== void 0 && value !== "";
+}
+/**
 * Run a full reconcile end-to-end. Default-constructs missing deps from
-* the project config and the environment variables `GITHUB_TOKEN` and
-* `BEDROCK_API_KEY`; never reads `process.env` when `statePort`,
-* `registry`, and `config` are all supplied explicitly.
+* the project config and the environment variables `BEDROCK_GITHUB_TOKEN`
+* and `BEDROCK_API_KEY`; emits a terminal `deploySuccess` or `deployFailure`
+* event through the resolved `progress` port. When `progress` is omitted,
+* the default port comes from `BEDROCK_CLI`: a non-empty value selects the
+* clack-backed adapter, any other reading selects the no-op adapter. No
+* environment lookups happen when `statePort`, `registry`, `config`, and
+* `progress` are all supplied explicitly.
 *
 * @param options - Target environment plus optional overrides.
 * @returns The persisted `BedrockState` on success, or a stage-tagged
@@ -4207,9 +4888,15 @@ function attributeLoadError(err, cwd) {
 * ```
 */
 async function deploy(options) {
-	const resolved = await resolveDeps(options);
-	if (!resolved.success) return resolved;
-	return runReconcile(options.environment, resolved.data);
+	if (options.progress !== void 0) return runAndEmit(options, options.progress);
+	if (!isCliEnvironmentFlagSet(getEnvironmentOf(options)("BEDROCK_CLI"))) return runAndEmit(options, createNoOpProgressAdapter());
+	return runWithDeferredClackProgress(options);
+}
+function readProcessEnvironment(name) {
+	return process.env[name];
+}
+function getEnvironmentOf(options) {
+	return options.getEnv ?? readProcessEnvironment;
 }
 async function pickConfig(options) {
 	if (options.config !== void 0) return {
@@ -4229,12 +4916,6 @@ async function pickConfig(options) {
 		success: true
 	};
 }
-function readProcessEnvironment(name) {
-	return process.env[name];
-}
-function getEnvironmentOf(options) {
-	return options.getEnv ?? readProcessEnvironment;
-}
 function pickStatePort(options, config) {
 	if (options.statePort !== void 0) return {
 		data: options.statePort,
@@ -4297,7 +4978,7 @@ function mergeResources(pre, applied) {
 	return [...byKey.values()];
 }
 function buildSnapshot(inputs) {
-	const appliedResources = inputs.applied.success ? inputs.applied.data : inputs.applied.err.appliedSoFar;
+	const appliedResources = inputs.applied.success ? inputs.applied.data : inputs.applied.err.applied;
 	return {
 		environment: inputs.environment,
 		resources: mergeResources(inputs.priorResources, appliedResources),
@@ -4305,13 +4986,6 @@ function buildSnapshot(inputs) {
 	};
 }
 function finalize(inputs) {
-	if (!inputs.applied.success) return {
-		err: {
-			cause: inputs.applied.err,
-			kind: "applyFailed"
-		},
-		success: false
-	};
 	if (!inputs.written.success) return {
 		err: {
 			cause: inputs.written.err,
@@ -4320,6 +4994,13 @@ function finalize(inputs) {
 		},
 		success: false
 	};
+	if (!inputs.applied.success) return {
+		err: {
+			cause: inputs.applied.err,
+			kind: "applyFailed"
+		},
+		success: false
+	};
 	return {
 		data: inputs.merged,
 		success: true
@@ -4343,7 +5024,7 @@ async function runReconcile(environment, deps) {
 		success: false
 	};
 	const priorResources = prior.data?.resources ?? [];
-	const validated = validatePlan(desired.data, priorResources);
+	const validated = assertAllReconcilable(desired.data, priorResources);
 	if (!validated.success) return {
 		err: {
 			cause: validated.err,
@@ -4351,17 +5032,80 @@ async function runReconcile(environment, deps) {
 		},
 		success: false
 	};
-	const applied = await applyOps(diff(desired.data, priorResources), deps.registry);
+	const applied = await applyOps(diff(desired.data, priorResources), deps.registry, {
+		environment,
+		progress: deps.progress
+	});
 	const merged = buildSnapshot({
 		applied,
 		environment,
 		priorResources
 	});
+	const written = await deps.statePort.write(merged);
+	if (written.success) deps.progress.emit({
+		environment,
+		kind: "stateWritten"
+	});
 	return finalize({
 		applied,
 		merged,
-		written: await deps.statePort.write(merged)
+		written
+	});
+}
+async function runDeploy(options, progress) {
+	const resolved = await resolveDeps(options);
+	if (!resolved.success) return resolved;
+	return runReconcile(options.environment, {
+		...resolved.data,
+		progress
+	});
+}
+function emitTerminalEvent(inputs) {
+	const { environment, progress, result } = inputs;
+	if (result.success) {
+		progress.emit({
+			environment,
+			kind: "deploySuccess",
+			resourceCount: result.data.resources.length
+		});
+		return;
+	}
+	progress.emit({
+		environment,
+		error: result.err,
+		kind: "deployFailure"
+	});
+}
+async function runAndEmit(options, progress) {
+	const result = await runDeploy(options, progress);
+	emitTerminalEvent({
+		environment: options.environment,
+		progress,
+		result
+	});
+	return result;
+}
+async function runWithDeferredClackProgress(options) {
+	const resolved = await resolveDeps(options);
+	const progress = createDefaultProgressAdapter(resolved.success ? resolved.data.config : options.config);
+	if (!resolved.success) {
+		emitTerminalEvent({
+			environment: options.environment,
+			progress,
+			result: resolved
+		});
+		return resolved;
+	}
+	const result = await runReconcile(options.environment, {
+		...resolved.data,
+		progress
+	});
+	emitTerminalEvent({
+		environment: options.environment,
+		progress,
+		result
 	});
+	return result;
 }
 //#endregion
 //#region src/core/migrate/build-state.ts
@@ -5483,7 +6227,7 @@ const PRODUCT_ICON_KIND = "productIcon";
 * and the Roblox-assigned `iconImageAssetId` lands on the outputs.
 *
 * Resources whose payload is malformed (non-object, missing required string
-* field, missing `productId`, malformed `fileHash`) are dropped silently.
+* field, missing `assetId`, malformed `fileHash`) are dropped silently.
 * Orphan `productIcon_<k>` resources (no matching product) emit one
 * `ambiguous` warning each.
 *
@@ -5546,7 +6290,7 @@ function readProductInputs(raw) {
 }
 function readProductOutputs(raw) {
 	if (!isObjectPayload$1(raw)) return;
-	const productId = coerceRobloxId$2(raw["productId"]);
+	const productId = coerceRobloxId$2(raw["assetId"]);
 	if (productId === void 0) return;
 	return { productId };
 }
@@ -6513,6 +7257,6 @@ function isFileMissing(err) {
 	return typeof err === "object" && err !== null && "code" in err && typeof err.code === "string" && FILE_MISSING_CODES.has(err.code);
 }
 //#endregion
-export { createGamePassDriver as A, createClackProgressAdapter as B, createPlaceDriver as C, parseStateFile as D, createGistStateAdapter as E, asSha256Hex as F, renderMigrationSummary as G, renderDeployError as H, isResourceKey as I, renderParseError as K, isRobloxAssetId as L, shouldReuploadIcon as M, asResourceKey as N, serializeStateFile as O, asRobloxAssetId as P, isSha256Hex as R, createUniverseDriver as S, UNIVERSE_SINGLETON_KEY as T, renderMigrateError as U, renderBuildStatePortError as V, renderMigrateParseError as W, diff as _, buildStatePort as a, validateConfig as b, applyOps as c, selectMergedEnvironment as d, collectRedactionAnnotations as f, renderDisplayNamePrefix as g, DEFAULT_PREFIX_FORMAT as h, loadConfig$1 as i, createDeveloperProductDriver as j, validateEnvironmentName as k, validatePlan as l, flattenConfig as m, serializeConfig as n, buildDesired as o, resolveStateConfig as p, renderStateWriteError as q, deploy as r, buildDefaultRegistry as s, migrateMantleState as t, selectEnvironment as u, defaultKindRegistry as v, SOCIAL_LINK_FIELDS as w, createClackPort as x, isGistStateConfig as y, derivePriceFields as z };
+export { renderStateWriteError as $, createGamePassDriver as A, asSha256Hex as B, createPlaceDriver as C, createGistStateAdapter as D, createNoOpProgressAdapter as E, validateConfig as F, renderBuildStatePortError as G, isRobloxAssetId as H, shouldReuploadIcon as I, renderMigrateParseError as J, renderDeployError as K, validateEnvironmentName as L, derivePriceFields as M, createClackProgressAdapter as N, parseStateFile as O, isGistStateConfig as P, renderParseError as Q, asResourceKey as R, createUniverseDriver as S, UNIVERSE_SINGLETON_KEY as T, isSha256Hex as U, isResourceKey as V, resolveStateConfig as W, renderOverrideDiscoveryError as X, renderMigrationSummary as Y, renderOverrideError as Z, diff as _, assertAllReconcilable as a, buildCredentialOverrides as b, buildDefaultRegistry as c, selectEnvironment as d, createClackPort as et, selectMergedEnvironment as f, renderDisplayNamePrefix as g, DEFAULT_PREFIX_FORMAT as h, loadConfig$1 as i, createDeveloperProductDriver as j, serializeStateFile as k, applyOps as l, flattenConfig as m, serializeConfig as n, buildStatePort as o, collectRedactionAnnotations as p, renderMigrateError as q, deploy as r, buildDesired as s, migrateMantleState as t, extractResourceRedaction as u, defaultKindRegistry as v, SOCIAL_LINK_FIELDS as w, createDefaultSpawner as x, dispatchOverride as y, asRobloxAssetId as z };
 
-//# sourceMappingURL=migrate-mantle-state-CQjWBZwT.mjs.map
+//# sourceMappingURL=migrate-mantle-state-ClQ40EFD.mjs.map