@chatlychat/cli 0.1.3 → 0.1.5

package/dist/run.js

@@ -8,8 +8,13 @@
  */
 import { ChatlyApiError, ChatlyClient, ChatlyTransportError } from '@chatlychat/sdk-node';
 import { bool, parseArgs, str } from './args.js';
+import * as ai from './commands/ai.js';
 import * as auth from './commands/auth.js';
+import * as config from './commands/config.js';
+import * as insights from './commands/insights.js';
+import * as integrations from './commands/integrations.js';
 import * as cmd from './commands/resources.js';
+import * as wac from './commands/workspace-as-code.js';
 import { resolveCredentials } from './config.js';
 import { HELP } from './help.js';
 /**
@@ -21,9 +26,82 @@ import { HELP } from './help.js';
  * drifts — it said `0.1.0` while the published package was `0.1.2` — so
  * `cli.spec.ts` asserts the two agree and fails if they do not.
  */
-const VERSION = '0.1.3';
+const VERSION = '0.1.5';
 /** Commands that need no credential. Everything else resolves a key first. */
 const UNAUTHENTICATED = new Set(['login', 'logout', 'help', 'version']);
+/**
+ * Every authenticated command, by the word a person types.
+ *
+ * A table rather than a `switch`, for one reason that is worth the churn:
+ * `cli.spec.ts` can now assert that every key here appears in `--help` and
+ * that every command documented in `--help` is reachable. A command with no
+ * help entry is a command nobody finds; a help entry with no command is a
+ * promise the CLI breaks. The `switch` this replaced could be checked for
+ * neither.
+ *
+ * Singular aliases are listed explicitly rather than derived by stripping an
+ * `s`, so `kb`, `search`, `whoami` and `ai` cannot acquire a nonsense twin.
+ */
+export const COMMANDS = {
+    // ── Core ──────────────────────────────────────────────────────────────
+    whoami: async (c, a) => auth.whoami(c, bool(a.flags, 'json')),
+    conversations: cmd.conversations,
+    contacts: cmd.contacts,
+    tickets: cmd.tickets,
+    search: cmd.search,
+    kb: cmd.kb,
+    events: cmd.events,
+    workspace: cmd.workspace,
+    // ── Config as code ────────────────────────────────────────────────────
+    bots: config.bots,
+    'bot-routes': config.botRoutes,
+    triggers: config.triggers,
+    brands: config.brands,
+    'email-templates': config.emailTemplates,
+    macros: config.macros,
+    'knowledge-gaps': config.knowledgeGaps,
+    // ── Integrations ──────────────────────────────────────────────────────
+    webhooks: integrations.webhooks,
+    'customer-cards': integrations.customerCards,
+    'docs-sources': integrations.docsSources,
+    channels: integrations.channels,
+    // ── Workspace as code ─────────────────────────────────────────────────
+    /*
+     * `plan` and `apply` are TWO entries rather than one `config` group with
+     * two subcommands, because `chatly plan` / `chatly apply` is what the
+     * integrator asked for by name and what anybody who has used terraform
+     * will type. Both read one JSON document and cover nine resource types; a
+     * group word in front would only make the muscle memory wrong.
+     */
+    plan: wac.plan,
+    apply: wac.apply,
+    // ── AI ────────────────────────────────────────────────────────────────
+    ai: ai.ai,
+    // ── Numbers ───────────────────────────────────────────────────────────
+    reports: insights.reports,
+    billing: insights.billing,
+    // ── Escape hatch ──────────────────────────────────────────────────────
+    api: cmd.api,
+};
+/** Singular spellings, for the groups where typing one reads naturally. */
+export const ALIASES = {
+    conversation: 'conversations',
+    contact: 'contacts',
+    ticket: 'tickets',
+    event: 'events',
+    webhook: 'webhooks',
+    report: 'reports',
+    channel: 'channels',
+    bot: 'bots',
+    'bot-route': 'bot-routes',
+    trigger: 'triggers',
+    brand: 'brands',
+    macro: 'macros',
+    'email-template': 'email-templates',
+    'customer-card': 'customer-cards',
+    'docs-source': 'docs-sources',
+    'knowledge-gap': 'knowledge-gaps',
+};
 const defaultFactory = (opts) => new ChatlyClient(opts);
 export async function run(argv, makeClient = defaultFactory) {
     const args = parseArgs(argv);
@@ -53,51 +131,19 @@ export async function run(argv, makeClient = defaultFactory) {
         return auth.logout();
     }
     if (!UNAUTHENTICATED.has(command)) {
+        const name = ALIASES[command] ?? command;
+        const handler = COMMANDS[name];
+        if (handler === undefined) {
+            process.stderr.write(`Unknown command "${command}". Run \`chatly --help\`.\n`);
+            return 2;
+        }
         // Resolution order and the reason for it are in config.ts.
         const creds = resolveCredentials(str(args.flags, 'key'), str(args.flags, 'api-url'));
         const chatly = makeClient({
             apiKey: creds.apiKey,
             ...(creds.apiUrl === undefined ? {} : { apiUrl: creds.apiUrl }),
         });
-        const json = bool(args.flags, 'json');
-        switch (command) {
-            case 'whoami':
-                return auth.whoami(chatly, json);
-            case 'conversations':
-            case 'conversation':
-                return cmd.conversations(chatly, args);
-            case 'contacts':
-            case 'contact':
-                return cmd.contacts(chatly, args);
-            case 'tickets':
-            case 'ticket':
-                return cmd.tickets(chatly, args);
-            case 'search':
-                return cmd.search(chatly, args);
-            case 'kb':
-                return cmd.kb(chatly, args);
-            case 'events':
-            case 'event':
-                return cmd.events(chatly, args);
-            case 'webhooks':
-            case 'webhook':
-                return cmd.webhooks(chatly, args);
-            case 'reports':
-            case 'report':
-                return cmd.reports(chatly, args);
-            case 'workspace':
-                return cmd.workspace(chatly, args);
-            case 'channels':
-            case 'channel':
-                return cmd.channels(chatly, args);
-            case 'billing':
-                return cmd.billing(chatly, args);
-            case 'api':
-                return cmd.api(chatly, args);
-            default:
-                process.stderr.write(`Unknown command "${command}". Run \`chatly --help\`.\n`);
-                return 2;
-        }
+        return handler(chatly, args);
     }
     process.stdout.write(HELP);
     return 0;
@@ -116,7 +162,8 @@ export function explain(err) {
         const hint = err.status === 401
             ? '\nThe key was rejected. Check it with `chatly whoami`, or run `chatly login` again.'
             : err.status === 403
-                ? '\nThe key is valid but lacks a scope for this route. `chatly whoami` lists what it has.'
+                ? '\nThe key is valid but lacks a scope for this route. `chatly whoami` lists what it ' +
+                    'has, and `chatly workspace key-scopes` lists every scope there is.'
                 : err.status === 429
                     ? `\nRate limited.${err.retryAfter === null ? '' : ` Retry after ${String(err.retryAfter)}s.`}`
                     : '';

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,8EAA8E;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAYxE,MAAM,cAAc,GAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA2B,EAC3B,aAA4B,cAAc;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7B;;;;;;OAMG;IACH,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IACE,OAAO,KAAK,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;QACrB,OAAO,KAAK,MAAM,EAClB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,2DAA2D;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEtC,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc;gBACjB,OAAO,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,UAAU,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,KAAK,SAAS,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI;gBACP,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,KAAK,QAAQ,CAAC;YACd,KAAK,OAAO;gBACV,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAClC,KAAK,UAAU,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,KAAK,SAAS,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,WAAW;gBACd,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACrC,KAAK,UAAU,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,KAAK;gBACR,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/B;gBACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,6BAA6B,CAAC,CAAC;gBAC/E,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,SAAS,GAAG,CAAC;QACxE,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,CAAC,CAAC,yFAAyF;gBAC3F,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,kBAAkB,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;oBAC/F,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,uEAAuE;SAC/F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAmB,MAAM,WAAW,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAC/C,OAAO,KAAK,GAAG,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,8EAA8E;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,QAAQ,GAEjB;IACF,yEAAyE;IACzE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7D,aAAa,EAAE,GAAG,CAAC,aAAa;IAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,SAAS,EAAE,GAAG,CAAC,SAAS;IAExB,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,YAAY,EAAE,MAAM,CAAC,SAAS;IAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,iBAAiB,EAAE,MAAM,CAAC,cAAc;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gBAAgB,EAAE,MAAM,CAAC,aAAa;IAEtC,yEAAyE;IACzE,QAAQ,EAAE,YAAY,CAAC,QAAQ;IAC/B,gBAAgB,EAAE,YAAY,CAAC,aAAa;IAC5C,cAAc,EAAE,YAAY,CAAC,WAAW;IACxC,QAAQ,EAAE,YAAY,CAAC,QAAQ;IAE/B,yEAAyE;IACzE;;;;;;OAMG;IACH,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,KAAK,EAAE,GAAG,CAAC,KAAK;IAEhB,yEAAyE;IACzE,EAAE,EAAE,EAAE,CAAC,EAAE;IAET,yEAAyE;IACzE,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;IAEzB,yEAAyE;IACzE,GAAG,EAAE,GAAG,CAAC,GAAG;CACb,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAqC;IACvD,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,GAAG,EAAE,MAAM;IACX,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,UAAU;IACnB,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,gBAAgB,EAAE,iBAAiB;IACnC,eAAe,EAAE,gBAAgB;IACjC,aAAa,EAAE,cAAc;IAC7B,eAAe,EAAE,gBAAgB;CAClC,CAAC;AAYF,MAAM,cAAc,GAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA2B,EAC3B,aAA4B,cAAc;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7B;;;;;;OAMG;IACH,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IACE,OAAO,KAAK,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;QACrB,OAAO,KAAK,MAAM,EAClB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,6BAA6B,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,2DAA2D;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,SAAS,GAAG,CAAC;QACxE,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,CAAC,CAAC,qFAAqF;oBACrF,oEAAoE;gBACtE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,kBAAkB,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;oBAC/F,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,uEAAuE;SAC/F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/wac/__tests__/wac-fixtures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared fixtures for the workspace-as-code suites.
+ *
+ * Extracted when `wac.spec.ts` reached 717 of the 650 lines
+ * `check-file-size` allows. Split at the FIXTURE boundary rather than by
+ * trimming assertions: there is not one assertion in this file, so a reader
+ * looking for what is pinned still finds all of it in a `*.spec.ts`.
+ */
+import { type ApplyOptions } from '../apply.js';
+import { type LiveSection } from '../diff.js';
+import { type ResourceDef } from '../resources.js';
+export declare const APPLY: ApplyOptions;
+export declare function doc(resources: Record<string, unknown>, extra?: Record<string, unknown>): {
+    version: number;
+    resources: Record<string, unknown>;
+};
+export declare function issues(input: unknown, env?: Record<string, string>): string[];
+export declare function live(rows: Record<string, ReadonlyArray<Record<string, unknown>>>): Map<string, LiveSection>;
+export declare function def(type: string): ResourceDef;
+//# sourceMappingURL=wac-fixtures.d.ts.map

package/dist/wac/__tests__/wac-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wac-fixtures.d.ts","sourceRoot":"","sources":["../../../src/wac/__tests__/wac-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEhE,eAAO,MAAM,KAAK,EAAE,YAAkE,CAAC;AAEvF,wBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;EAE1F;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,EAAE,CAUjF;AAED,wBAAgB,IAAI,CAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAC3D,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAE1B;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAM7C"}

package/dist/wac/__tests__/wac-fixtures.js

@@ -0,0 +1,38 @@
+/**
+ * Shared fixtures for the workspace-as-code suites.
+ *
+ * Extracted when `wac.spec.ts` reached 717 of the 650 lines
+ * `check-file-size` allows. Split at the FIXTURE boundary rather than by
+ * trimming assertions: there is not one assertion in this file, so a reader
+ * looking for what is pinned still finds all of it in a `*.spec.ts`.
+ */
+import { DocumentError, parseDocument } from '../document.js';
+import { resourceDef } from '../resources.js';
+export const APPLY = { prune: false, pruneUnsafe: [], writeOnly: false };
+export function doc(resources, extra = {}) {
+    return { version: 1, resources, ...extra };
+}
+export function issues(input, env = {}) {
+    try {
+        parseDocument(input, env);
+    }
+    catch (err) {
+        if (err instanceof DocumentError) {
+            return err.issues.map((i) => `${i.path}: ${i.message}`);
+        }
+        throw err;
+    }
+    return [];
+}
+export function live(rows) {
+    return new Map(Object.entries(rows).map(([k, v]) => [k, { rows: v }]));
+}
+export function def(type) {
+    const found = resourceDef(type);
+    if (found === undefined) {
+        throw new Error(`no such resource type: ${type}`);
+    }
+    return found;
+}
+/* ══ The schema ═══════════════════════════════════════════════════════════ */
+//# sourceMappingURL=wac-fixtures.js.map

package/dist/wac/__tests__/wac-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wac-fixtures.js","sourceRoot":"","sources":["../../../src/wac/__tests__/wac-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAEhE,MAAM,CAAC,MAAM,KAAK,GAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAEvF,MAAM,UAAU,GAAG,CAAC,SAAkC,EAAE,QAAiC,EAAE;IACzF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,MAA8B,EAAE;IACrE,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,IAA4D;IAE5D,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E"}

package/dist/wac/apply.d.ts

@@ -0,0 +1,113 @@
+/**
+ * `apply`: turning a plan into writes, and the three decisions that shape it.
+ *
+ * ═══ 1. PARTIAL FAILURE: CONTINUE, SKIP DEPENDENTS, EXIT NON-ZERO ════════
+ *
+ * Twelve resources, and the seventh answers 400. Stopping there leaves six
+ * applied and five untried; continuing leaves eleven applied and one failed.
+ * Both are half-applied — there is no transaction across nine REST
+ * collections and pretending otherwise would be a lie — so the choice is
+ * about which half-applied state is more useful, and continuing wins for
+ * three reasons:
+ *
+ *   - It reports every problem in one run. A document with four bad rows
+ *     takes one `apply` to find out, not four.
+ *   - The ones that succeeded are IDEMPOTENT to re-run. Every write carries
+ *     an `Idempotency-Key` (CONTRACT.md) and, more to the point, the next
+ *     `plan` recomputes from live state, so a succeeded resource is simply a
+ *     `noop` next time. Stopping early buys nothing that re-running does not.
+ *   - Stopping at the seventh tells you nothing about the eighth, and the
+ *     eighth is frequently the same mistake.
+ *
+ * The one thing continuing must NOT do is cascade. A routing rule that names
+ * a bot whose create just failed is SKIPPED, not attempted: attempting it
+ * produces a second, confusing error about a null `botId` that sends the
+ * reader to the wrong place. `dependsOn` on each plan item is what makes that
+ * possible, and the skip says which failure caused it.
+ *
+ * Whatever happened, the final output is three explicit buckets — applied,
+ * failed, skipped — and the exit code is 1 if either of the last two is
+ * non-empty. "Which resources changed" is never left to inference.
+ *
+ * ═══ 2. SECRETS: PRINTED ONCE, STORED NOWHERE ════════════════════════════
+ *
+ * Four creates on this surface answer with a credential that no route will
+ * ever read back: a bot's `signingSecret` and its `cb_` token, a customer
+ * card's `cc_` secret (returned BESIDE the card, not inside it), and a
+ * webhook endpoint's `whsec_`. Losing one means delete and recreate.
+ *
+ * So `apply` prints them, in a block of their own, at the end, where they
+ * cannot scroll past unnoticed — and writes them nowhere. Not into the
+ * document, not into a state file, not into `~/.config/chatly`. Writing a
+ * credential into a file that lives in git is the failure this feature would
+ * otherwise industrialise, and the document is the one file we KNOW is in
+ * git. There is deliberately no `--save-secrets`.
+ *
+ * The sweep is belt and braces: the declared `secrets` list per resource,
+ * PLUS anything whose field name reads like a credential. A hand-written list
+ * goes stale, and CLAUDE.md records twice over what that looks like — a
+ * gate's green line counting what it managed to parse rather than what
+ * exists. A field called `webhookToken` that nobody told `resources.ts` about
+ * is still surfaced.
+ *
+ * ═══ 3. THE BODY IS BUILT FROM THE DIFF, NOT FROM THE DOCUMENT ═══════════
+ *
+ * An update sends only the fields that changed, to the route that owns them —
+ * which is how a bot's `webhookUrl` reaches `/v1/bots/{id}/external` while
+ * its `model` reaches `/v1/bots/{id}`. The exception is a `fullReplace`
+ * resource, where a partial body would RESET everything it omits: `triggers`
+ * writes every settable field unconditionally, and an email template's PUT
+ * takes `{ subject, body }` and nothing else. For those the whole declared
+ * row goes over, and `plan` says so on the line so nobody finds out from the
+ * result.
+ */
+import { type ResourceDef } from './resources.js';
+import type { PlanItem } from './diff.js';
+export interface WriteOp {
+    readonly method: 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+    readonly path: string;
+    readonly body?: Record<string, unknown>;
+}
+export interface FoundSecret {
+    readonly type: string;
+    readonly key: string;
+    readonly field: string;
+    readonly value: string;
+}
+export interface ApplyOutcome {
+    readonly type: string;
+    readonly key: string;
+    readonly action: PlanItem['action'];
+    readonly state: 'applied' | 'failed' | 'skipped' | 'kept';
+    /** The failure, or the reason for a skip. */
+    readonly detail: string | undefined;
+    readonly secrets: ReadonlyArray<FoundSecret>;
+}
+export interface ApplyOptions {
+    readonly prune: boolean;
+    /** Types whose live list may be short, where prune is refused regardless. */
+    readonly pruneUnsafe: ReadonlyArray<string>;
+    /** Send fields that cannot be read back, even when nothing else changed. */
+    readonly writeOnly: boolean;
+}
+/**
+ * The writes one plan item needs, in order.
+ *
+ * `refIds` carries ids for references this run created, keyed `type/key` — a
+ * routing rule planned before its bot existed resolves here, at execution
+ * time, with the id the create actually returned.
+ */
+export declare function writesFor(def: ResourceDef, item: PlanItem, refIds: ReadonlyMap<string, string>, opts: ApplyOptions): ReadonlyArray<WriteOp>;
+/**
+ * Every credential-looking string in a write response.
+ *
+ * Two levels deep, because `POST /v1/customer-cards` answers
+ * `{ card: {...}, secret: "cc_…" }` — the secret beside the resource rather
+ * than inside it. Deeper than that is not swept: a nested config object can
+ * legitimately hold `__redacted__` and reporting the sentinel as a secret
+ * would be noise.
+ */
+export declare function harvestSecrets(def: ResourceDef, item: PlanItem, response: unknown): ReadonlyArray<FoundSecret>;
+/** The three buckets, as `apply` prints them. */
+export declare function renderOutcomes(outcomes: ReadonlyArray<ApplyOutcome>): string;
+//# sourceMappingURL=apply.d.ts.map

package/dist/wac/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/wac/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAC1D,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAMD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,OAAO,CAAC,CA4GxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,OAAO,GAChB,aAAa,CAAC,WAAW,CAAC,CA6B5B;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAiE5E"}

package/dist/wac/apply.js

@@ -0,0 +1,265 @@
+/**
+ * `apply`: turning a plan into writes, and the three decisions that shape it.
+ *
+ * ═══ 1. PARTIAL FAILURE: CONTINUE, SKIP DEPENDENTS, EXIT NON-ZERO ════════
+ *
+ * Twelve resources, and the seventh answers 400. Stopping there leaves six
+ * applied and five untried; continuing leaves eleven applied and one failed.
+ * Both are half-applied — there is no transaction across nine REST
+ * collections and pretending otherwise would be a lie — so the choice is
+ * about which half-applied state is more useful, and continuing wins for
+ * three reasons:
+ *
+ *   - It reports every problem in one run. A document with four bad rows
+ *     takes one `apply` to find out, not four.
+ *   - The ones that succeeded are IDEMPOTENT to re-run. Every write carries
+ *     an `Idempotency-Key` (CONTRACT.md) and, more to the point, the next
+ *     `plan` recomputes from live state, so a succeeded resource is simply a
+ *     `noop` next time. Stopping early buys nothing that re-running does not.
+ *   - Stopping at the seventh tells you nothing about the eighth, and the
+ *     eighth is frequently the same mistake.
+ *
+ * The one thing continuing must NOT do is cascade. A routing rule that names
+ * a bot whose create just failed is SKIPPED, not attempted: attempting it
+ * produces a second, confusing error about a null `botId` that sends the
+ * reader to the wrong place. `dependsOn` on each plan item is what makes that
+ * possible, and the skip says which failure caused it.
+ *
+ * Whatever happened, the final output is three explicit buckets — applied,
+ * failed, skipped — and the exit code is 1 if either of the last two is
+ * non-empty. "Which resources changed" is never left to inference.
+ *
+ * ═══ 2. SECRETS: PRINTED ONCE, STORED NOWHERE ════════════════════════════
+ *
+ * Four creates on this surface answer with a credential that no route will
+ * ever read back: a bot's `signingSecret` and its `cb_` token, a customer
+ * card's `cc_` secret (returned BESIDE the card, not inside it), and a
+ * webhook endpoint's `whsec_`. Losing one means delete and recreate.
+ *
+ * So `apply` prints them, in a block of their own, at the end, where they
+ * cannot scroll past unnoticed — and writes them nowhere. Not into the
+ * document, not into a state file, not into `~/.config/chatly`. Writing a
+ * credential into a file that lives in git is the failure this feature would
+ * otherwise industrialise, and the document is the one file we KNOW is in
+ * git. There is deliberately no `--save-secrets`.
+ *
+ * The sweep is belt and braces: the declared `secrets` list per resource,
+ * PLUS anything whose field name reads like a credential. A hand-written list
+ * goes stale, and CLAUDE.md records twice over what that looks like — a
+ * gate's green line counting what it managed to parse rather than what
+ * exists. A field called `webhookToken` that nobody told `resources.ts` about
+ * is still surfaced.
+ *
+ * ═══ 3. THE BODY IS BUILT FROM THE DIFF, NOT FROM THE DOCUMENT ═══════════
+ *
+ * An update sends only the fields that changed, to the route that owns them —
+ * which is how a bot's `webhookUrl` reaches `/v1/bots/{id}/external` while
+ * its `model` reaches `/v1/bots/{id}`. The exception is a `fullReplace`
+ * resource, where a partial body would RESET everything it omits: `triggers`
+ * writes every settable field unconditionally, and an email template's PUT
+ * takes `{ subject, body }` and nothing else. For those the whole declared
+ * row goes over, and `plan` says so on the line so nobody finds out from the
+ * result.
+ */
+import { looksLikeCredential, routeForField } from './resources.js';
+function fill(path, id) {
+    return path.replace('{id}', encodeURIComponent(id));
+}
+/**
+ * The writes one plan item needs, in order.
+ *
+ * `refIds` carries ids for references this run created, keyed `type/key` — a
+ * routing rule planned before its bot existed resolves here, at execution
+ * time, with the id the create actually returned.
+ */
+export function writesFor(def, item, refIds, opts) {
+    if (item.action === 'orphan') {
+        if (!opts.prune || def.remove === null || opts.pruneUnsafe.includes(def.type)) {
+            return [];
+        }
+        return [{ method: 'DELETE', path: fill(def.remove.path, item.liveId ?? '') }];
+    }
+    if (item.row === undefined || (item.action !== 'create' && item.action !== 'update')) {
+        return [];
+    }
+    /* References: resolved at plan time where possible, here where not. */
+    const wired = {};
+    for (const [wire, id] of Object.entries(item.resolved)) {
+        wired[wire] = id;
+    }
+    for (const [wire, ref] of Object.entries(item.row.refs)) {
+        if (wired[wire] === undefined) {
+            const id = refIds.get(`${ref.type}/${ref.key}`);
+            if (id !== undefined) {
+                wired[wire] = id;
+            }
+        }
+    }
+    if (item.action === 'create') {
+        if (def.create === null) {
+            return [];
+        }
+        return [
+            {
+                method: 'POST',
+                path: def.create.path,
+                body: { ...item.row.body, ...wired },
+            },
+        ];
+    }
+    /* ── An update. ──────────────────────────────────────────────────────── */
+    const liveId = item.liveId ?? '';
+    if (def.create?.upsert === true) {
+        /*
+         * `POST /v1/triggers` with the live id in the body. An id the workspace
+         * does not hold is a 404, not a create, so the id MUST come from the row
+         * this file matched by name — which is exactly what makes a declarative
+         * trigger possible at all.
+         */
+        return [
+            {
+                method: 'POST',
+                path: def.create.path,
+                body: { id: liveId, ...item.row.body, ...wired },
+            },
+        ];
+    }
+    /*
+     * Which fields go over.
+     *
+     * `fullReplace` sends every declared field, because a partial body RESETS
+     * what it omits — an email template's PUT takes `{ subject, body }` and
+     * writes both, and a trigger's upsert writes every settable column
+     * unconditionally. Everything else sends only what changed, which keeps a
+     * PATCH to a bot's model from touching its guardrails.
+     *
+     * `--write-only` adds the fields no diff can see. A customer card's
+     * `headers` and a docs source's `token` are never returned, so `plan`
+     * reports them as unknowable rather than changed — right by default (a diff
+     * that says "changed" every run is a diff nobody reads) and wrong when you
+     * have just rotated the credential in the file and need it pushed. This is
+     * the only way to push them, which is why the plan line names the flag.
+     */
+    const wanted = new Set(def.fullReplace === true
+        ? Object.keys({ ...item.row.body, ...wired }).filter((f) => f !== def.naturalKey)
+        : item.changes.map((c) => c.name));
+    if (opts.writeOnly) {
+        for (const field of def.opaque) {
+            if (item.row.body[field] !== undefined) {
+                wanted.add(field);
+            }
+        }
+    }
+    /*
+     * Emitted in `def.update` ORDER, not in the order the fields happened to
+     * change. Two PATCHes to two routes is already an unavoidable
+     * non-atomicity; making their order depend on which key the author listed
+     * first would make it unreproducible as well, and a flaky request sequence
+     * is a thing nobody can debug from a log.
+     */
+    const ops = [];
+    for (const route of def.update) {
+        const body = {};
+        for (const field of wanted) {
+            if (routeForField(def, field) !== route) {
+                continue;
+            }
+            body[field] = wired[field] ?? item.row.body[field];
+        }
+        if (Object.keys(body).length === 0) {
+            continue;
+        }
+        ops.push({ method: route.method, path: fill(route.path, liveId), body });
+    }
+    return ops;
+}
+/**
+ * Every credential-looking string in a write response.
+ *
+ * Two levels deep, because `POST /v1/customer-cards` answers
+ * `{ card: {...}, secret: "cc_…" }` — the secret beside the resource rather
+ * than inside it. Deeper than that is not swept: a nested config object can
+ * legitimately hold `__redacted__` and reporting the sentinel as a secret
+ * would be noise.
+ */
+export function harvestSecrets(def, item, response) {
+    const out = [];
+    const seen = new Set();
+    const scan = (value, depth) => {
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            return;
+        }
+        for (const [field, raw] of Object.entries(value)) {
+            if (typeof raw === 'string') {
+                if (raw.length > 0 &&
+                    raw !== '__redacted__' &&
+                    (def.secrets.includes(field) || looksLikeCredential(field)) &&
+                    !seen.has(`${field}:${raw}`)) {
+                    seen.add(`${field}:${raw}`);
+                    out.push({ type: def.type, key: item.key, field, value: raw });
+                }
+                continue;
+            }
+            if (depth < 1) {
+                scan(raw, depth + 1);
+            }
+        }
+    };
+    scan(response, 0);
+    return out;
+}
+/** The three buckets, as `apply` prints them. */
+export function renderOutcomes(outcomes) {
+    const applied = outcomes.filter((o) => o.state === 'applied');
+    const failed = outcomes.filter((o) => o.state === 'failed');
+    const skipped = outcomes.filter((o) => o.state === 'skipped');
+    const kept = outcomes.filter((o) => o.state === 'kept');
+    const lines = [];
+    const verb = (o) => o.action === 'orphan' ? 'deleted' : o.action === 'create' ? 'created' : 'changed';
+    if (applied.length > 0) {
+        lines.push(`Applied (${String(applied.length)})`);
+        for (const o of applied) {
+            lines.push(`  ✓ ${o.type}/${o.key}   ${verb(o)}`);
+        }
+    }
+    if (failed.length > 0) {
+        lines.push('', `Failed (${String(failed.length)}) — nothing was written for these`);
+        for (const o of failed) {
+            lines.push(`  ✗ ${o.type}/${o.key}`);
+            lines.push(`      ${o.detail ?? 'no detail recorded, which is itself a bug.'}`);
+        }
+    }
+    if (skipped.length > 0) {
+        lines.push('', `Skipped (${String(skipped.length)}) — not attempted`);
+        for (const o of skipped) {
+            lines.push(`  · ${o.type}/${o.key}`);
+            lines.push(`      ${o.detail ?? 'no detail recorded, which is itself a bug.'}`);
+        }
+    }
+    if (kept.length > 0) {
+        lines.push('', `Left alone (${String(kept.length)}) — on the server, not in the document`);
+        for (const o of kept) {
+            lines.push(`  · ${o.type}/${o.key}${o.detail === undefined ? '' : `   ${o.detail}`}`);
+        }
+    }
+    const secrets = outcomes.flatMap((o) => o.secrets);
+    if (secrets.length > 0) {
+        /*
+         * Last, and loud. These are shown exactly once by the API and this is the
+         * only moment they exist anywhere outside the database. The banner says
+         * what to do rather than merely that they are secret, because "copy it
+         * now" is the actionable part and the recovery (delete and recreate) is
+         * worse than it sounds for a webhook endpoint.
+         */
+        lines.push('', '─── SHOWN ONCE ────────────────────────────────────────────────────', 'The API returns each of these exactly once and no route reads them', 'back. Copy them into your secret store NOW. They are not written to', 'the document, to a state file, or to disk anywhere — losing one means', 'deleting and recreating the resource.', '');
+        for (const s of secrets) {
+            lines.push(`  ${s.type}/${s.key}  ${s.field} = ${s.value}`);
+        }
+        lines.push('───────────────────────────────────────────────────────────────────');
+    }
+    if (lines.length === 0) {
+        return 'Nothing to do — the workspace already matches the document.\n';
+    }
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=apply.js.map