@chatlychat/cli 0.1.3 → 0.1.5

package/dist/wac/document.d.ts

@@ -0,0 +1,110 @@
+/**
+ * `chatly.json` — the document, and the only thing in this feature allowed to
+ * refuse you.
+ *
+ * ═══ WHY THERE IS NO zod HERE, AND WHAT TAKES ITS PLACE ══════════════════
+ *
+ * This repo validates with zod everywhere and this schema wants it. It is not
+ * here for one reason: `@chatlychat/cli` is a PUBLISHED package whose
+ * dependency list is exactly `@chatlychat/sdk-node`, zod is not reachable
+ * from `apps/cli` (it is in the workspace catalog, but no package here
+ * declares it, so it is not installed under `apps/cli/node_modules`), and
+ * CLAUDE.md §2 forbids adding a dependency without explicit approval. Adding
+ * one to a published CLI is a product decision about what customers install,
+ * not a tidying-up decision — the same reason `args.ts` is hand-written
+ * rather than `commander`.
+ *
+ * So the checks below are hand-written, and deliberately shaped so the swap
+ * is mechanical if that approval comes: one `parseDocument` entry point,
+ * issues collected as `{ path, message }` with a dotted path, and all of them
+ * reported at once rather than the first. A zod `.strict()` object and
+ * `ZodError.issues` is a drop-in for the body of this file.
+ *
+ * ═══ WHERE STRICTNESS APPLIES, AND WHERE IT DELIBERATELY DOES NOT ════════
+ *
+ * CLAUDE.md records the bug twice over: a key the reader has never heard of
+ * is STRIPPED, so the write answers 200 and did nothing, and `helpProfile` vs
+ * `profile` cost a complete feature that way. The cure is to refuse the key
+ * by name and say what the valid ones are. That is done for every part of the
+ * document whose vocabulary the CLI OWNS:
+ *
+ *   - the top level (`version`, `workspace`, `resources`)
+ *   - the resource-type keys inside `resources`
+ *   - the per-row control keys the CLI invents (`bot:`, which is not an API
+ *     field at all)
+ *   - the natural key, which must be present and a non-empty string
+ *   - any field the API RETURNS and no write path accepts (`unwritable` in
+ *     `resources.ts`) — `triggers.brandId`, `brands.usage`,
+ *     `macros.usageCount` and twenty more. These are the dangerous ones:
+ *     they are spelled correctly, they come back on every read, and zod
+ *     strips them on the way in.
+ *
+ * It is NOT done for the rest of a row's fields, and that is a decision
+ * rather than an omission. `common.ts`'s `bodyFrom` already states the
+ * position for every write on this CLI: "the body goes to the API exactly as
+ * written, so the schema in `apps/api` is the only spelling that matters…
+ * the CLI simply refuses to add a second renaming layer on top." A per-row
+ * allow-list here would be a second COPY of nine API schemas, in a package
+ * published on a different cadence, and it would reject a field the API
+ * shipped yesterday — a gate that fails on correct input is a gate somebody
+ * switches off.
+ *
+ * What replaces it is better evidence than a copied list: `plan` compares the
+ * fields a row declares against the fields the SERVER returns for rows of
+ * that type, and warns about one no live row has ever carried. That catches
+ * `helpProfle` from the server's own vocabulary, with nothing to keep in
+ * step. Its blind spot — a workspace with no rows of that type yet — is
+ * reported as such rather than passed off as a clean bill. See `diff.ts`.
+ */
+import { type ResourceDef } from './resources.js';
+/** The file format's version. Bumped only for a change that breaks a reader. */
+export declare const DOCUMENT_VERSION = 1;
+export interface Issue {
+    /** Dotted, and it is the path IN THE FILE: `resources.bots[2].slug`. */
+    readonly path: string;
+    readonly message: string;
+}
+export interface DocumentRow {
+    /** The natural key's value, as written. */
+    readonly key: string;
+    /** Where in the file this row came from, for an error message. */
+    readonly path: string;
+    /** The row's API fields, with the CLI's own control keys removed. */
+    readonly body: Readonly<Record<string, unknown>>;
+    /** `{ botId: { type: 'bots', key: 'support' } }` — resolved by `diff.ts`. */
+    readonly refs: Readonly<Record<string, {
+        readonly type: string;
+        readonly key: string;
+    }>>;
+    /**
+     * Top-level fields whose value came, wholly or partly, from `${env:…}`.
+     * Rendered as the variable's name rather than its value, so a plan can be
+     * pasted into a ticket.
+     */
+    readonly fromEnv: ReadonlyArray<string>;
+}
+export interface DocumentSection {
+    readonly def: ResourceDef;
+    readonly rows: ReadonlyArray<DocumentRow>;
+}
+export interface WacDocument {
+    readonly version: number;
+    /** Optional guard: `apply` refuses a workspace that is not this one. */
+    readonly workspace: string | undefined;
+    /** In `RESOURCES` order — which is dependency order. */
+    readonly sections: ReadonlyArray<DocumentSection>;
+}
+/** Thrown with every issue at once, not the first one found. */
+export declare class DocumentError extends Error {
+    readonly issues: ReadonlyArray<Issue>;
+    constructor(issues: ReadonlyArray<Issue>);
+}
+/**
+ * Parse and validate. Throws `DocumentError` with every problem it found.
+ *
+ * Nothing here touches the network. `env` is the only ambient input and it is
+ * injected, which is what lets the spec drive this with a literal object and
+ * no transport at all.
+ */
+export declare function parseDocument(raw: unknown, env?: Readonly<Record<string, string | undefined>>): WacDocument;
+//# sourceMappingURL=document.d.ts.map

package/dist/wac/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/wac/document.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE/E,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAyBlC,MAAM,WAAW,KAAK;IACpB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACzF;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACnD;AAED,gEAAgE;AAChE,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAgB,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;gBAE1B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;CAQhD;AAwGD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GACrD,WAAW,CAiFb"}

package/dist/wac/document.js

@@ -0,0 +1,429 @@
+/**
+ * `chatly.json` — the document, and the only thing in this feature allowed to
+ * refuse you.
+ *
+ * ═══ WHY THERE IS NO zod HERE, AND WHAT TAKES ITS PLACE ══════════════════
+ *
+ * This repo validates with zod everywhere and this schema wants it. It is not
+ * here for one reason: `@chatlychat/cli` is a PUBLISHED package whose
+ * dependency list is exactly `@chatlychat/sdk-node`, zod is not reachable
+ * from `apps/cli` (it is in the workspace catalog, but no package here
+ * declares it, so it is not installed under `apps/cli/node_modules`), and
+ * CLAUDE.md §2 forbids adding a dependency without explicit approval. Adding
+ * one to a published CLI is a product decision about what customers install,
+ * not a tidying-up decision — the same reason `args.ts` is hand-written
+ * rather than `commander`.
+ *
+ * So the checks below are hand-written, and deliberately shaped so the swap
+ * is mechanical if that approval comes: one `parseDocument` entry point,
+ * issues collected as `{ path, message }` with a dotted path, and all of them
+ * reported at once rather than the first. A zod `.strict()` object and
+ * `ZodError.issues` is a drop-in for the body of this file.
+ *
+ * ═══ WHERE STRICTNESS APPLIES, AND WHERE IT DELIBERATELY DOES NOT ════════
+ *
+ * CLAUDE.md records the bug twice over: a key the reader has never heard of
+ * is STRIPPED, so the write answers 200 and did nothing, and `helpProfile` vs
+ * `profile` cost a complete feature that way. The cure is to refuse the key
+ * by name and say what the valid ones are. That is done for every part of the
+ * document whose vocabulary the CLI OWNS:
+ *
+ *   - the top level (`version`, `workspace`, `resources`)
+ *   - the resource-type keys inside `resources`
+ *   - the per-row control keys the CLI invents (`bot:`, which is not an API
+ *     field at all)
+ *   - the natural key, which must be present and a non-empty string
+ *   - any field the API RETURNS and no write path accepts (`unwritable` in
+ *     `resources.ts`) — `triggers.brandId`, `brands.usage`,
+ *     `macros.usageCount` and twenty more. These are the dangerous ones:
+ *     they are spelled correctly, they come back on every read, and zod
+ *     strips them on the way in.
+ *
+ * It is NOT done for the rest of a row's fields, and that is a decision
+ * rather than an omission. `common.ts`'s `bodyFrom` already states the
+ * position for every write on this CLI: "the body goes to the API exactly as
+ * written, so the schema in `apps/api` is the only spelling that matters…
+ * the CLI simply refuses to add a second renaming layer on top." A per-row
+ * allow-list here would be a second COPY of nine API schemas, in a package
+ * published on a different cadence, and it would reject a field the API
+ * shipped yesterday — a gate that fails on correct input is a gate somebody
+ * switches off.
+ *
+ * What replaces it is better evidence than a copied list: `plan` compares the
+ * fields a row declares against the fields the SERVER returns for rows of
+ * that type, and warns about one no live row has ever carried. That catches
+ * `helpProfle` from the server's own vocabulary, with nothing to keep in
+ * step. Its blind spot — a workspace with no rows of that type yet — is
+ * reported as such rather than passed off as a clean bill. See `diff.ts`.
+ */
+import { resourceDef, RESOURCE_TYPES } from './resources.js';
+/** The file format's version. Bumped only for a change that breaks a reader. */
+export const DOCUMENT_VERSION = 1;
+const TOP_LEVEL_KEYS = ['version', 'workspace', 'resources'];
+/**
+ * `${env:NAME}` inside any string value.
+ *
+ * Two of these resources cannot be described at all without a secret — a
+ * documentation source needs its provider token on create, a customer card
+ * needs an `Authorization` header — and a config file in git is the one place
+ * those must not be. An interpolation is the smallest thing that makes the
+ * file usable, and it is narrow on purpose: this exact form, in a string, and
+ * nothing else. No defaults, no shell, no file reads, no nesting.
+ *
+ * An UNSET variable is refused by name. It is not substituted with an empty
+ * string, and that is the whole point: CLAUDE.md records both halves of this
+ * failure — "a shell `read` cannot fail", where empty vars beat the sentinel
+ * and a health check invented findings, and "env fallback reaches
+ * production", where an unset variable became a localhost canonical URL on
+ * every page. An empty token here would be POSTed, verified against the
+ * provider, and fail with a message about the provider rather than about the
+ * variable nobody exported.
+ */
+const ENV_REF = /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/** Thrown with every issue at once, not the first one found. */
+export class DocumentError extends Error {
+    issues;
+    constructor(issues) {
+        super(`${String(issues.length)} problem(s) in the document:\n` +
+            issues.map((i) => `  ${i.path}\n      ${i.message}`).join('\n'));
+        this.name = 'DocumentError';
+        this.issues = issues;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** `a`, `b` and `c` — these go in error messages, so they read as English. */
+function list(names) {
+    if (names.length <= 1) {
+        return names[0] ?? '(none)';
+    }
+    return `${names.slice(0, -1).join(', ')} and ${String(names[names.length - 1])}`;
+}
+/**
+ * Did the author mean one of the valid keys?
+ *
+ * Levenshtein ≤ 2, which covers the real cases: a dropped letter, a doubled
+ * letter, a transposition, `botid` for `botId`, `eventTypes` for `events`.
+ * Anything further is not a typo and guessing would be noise.
+ */
+function nearest(key, valid) {
+    let best;
+    for (const candidate of valid) {
+        const d = distance(key.toLowerCase(), candidate.toLowerCase());
+        if (d <= 2 && (best === undefined || d < best.d)) {
+            best = { name: candidate, d };
+        }
+    }
+    return best?.name;
+}
+function distance(a, b) {
+    let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i += 1) {
+        const row = [i];
+        for (let j = 1; j <= b.length; j += 1) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            row.push(Math.min((row[j - 1] ?? 0) + 1, (prev[j] ?? 0) + 1, (prev[j - 1] ?? 0) + cost));
+        }
+        prev = row;
+    }
+    return prev[b.length] ?? Math.max(a.length, b.length);
+}
+function refuseUnknown(issues, path, actual, valid, what) {
+    for (const key of actual) {
+        if (valid.includes(key)) {
+            continue;
+        }
+        const guess = nearest(key, valid);
+        issues.push({
+            path: `${path}.${key}`,
+            message: `unknown ${what} "${key}".` +
+                (guess === undefined ? '' : ` Did you mean "${guess}"?`) +
+                ` Valid: ${list(valid)}.`,
+        });
+    }
+}
+/**
+ * Substitute `${env:NAME}` throughout a value. Collects unset names.
+ *
+ * `env` is a parameter rather than a read of `process.env` so the spec can
+ * drive it: a test that monkey-patches the process environment is a test that
+ * leaks into its neighbours.
+ */
+function interpolate(value, env, missing, used) {
+    if (typeof value === 'string') {
+        return value.replace(ENV_REF, (_match, name) => {
+            const found = env[name];
+            if (found === undefined || found === '') {
+                missing.add(name);
+                return '';
+            }
+            used.add(name);
+            return found;
+        });
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => interpolate(v, env, missing, used));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = interpolate(v, env, missing, used);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Parse and validate. Throws `DocumentError` with every problem it found.
+ *
+ * Nothing here touches the network. `env` is the only ambient input and it is
+ * injected, which is what lets the spec drive this with a literal object and
+ * no transport at all.
+ */
+export function parseDocument(raw, env = {}) {
+    const issues = [];
+    if (!isPlainObject(raw)) {
+        throw new DocumentError([
+            {
+                path: '(root)',
+                message: 'the document must be an object with `version` and `resources`, not ' +
+                    (Array.isArray(raw) ? 'an array' : typeof raw),
+            },
+        ]);
+    }
+    refuseUnknown(issues, '(root)', Object.keys(raw), [...TOP_LEVEL_KEYS], 'top-level key');
+    const version = raw['version'];
+    if (version === undefined) {
+        issues.push({
+            path: 'version',
+            message: `required. Write \`"version": ${String(DOCUMENT_VERSION)}\`.`,
+        });
+    }
+    else if (version !== DOCUMENT_VERSION) {
+        issues.push({
+            path: 'version',
+            message: `this CLI reads version ${String(DOCUMENT_VERSION)}; the document says ` +
+                `${JSON.stringify(version)}. Upgrade \`@chatlychat/cli\` rather than editing the number.`,
+        });
+    }
+    const workspaceRaw = raw['workspace'];
+    let workspace;
+    if (workspaceRaw !== undefined) {
+        if (typeof workspaceRaw !== 'string' || workspaceRaw.length === 0) {
+            issues.push({
+                path: 'workspace',
+                message: 'must be a workspace id string, or left out. It is a guard: `apply` refuses to run ' +
+                    'against any other workspace, which is what stops a staging file reaching production.',
+            });
+        }
+        else {
+            workspace = workspaceRaw;
+        }
+    }
+    const resourcesRaw = raw['resources'];
+    const sections = [];
+    if (resourcesRaw === undefined) {
+        issues.push({
+            path: 'resources',
+            message: `required. An object keyed by resource type: ${list(RESOURCE_TYPES)}.`,
+        });
+    }
+    else if (!isPlainObject(resourcesRaw)) {
+        issues.push({ path: 'resources', message: 'must be an object keyed by resource type.' });
+    }
+    else {
+        refuseUnknown(issues, 'resources', Object.keys(resourcesRaw), RESOURCE_TYPES, 'resource type');
+        /*
+         * Iterated in RESOURCES order, not in the file's key order.
+         *
+         * The order matters at apply time — a routing rule names a bot that this
+         * run may be about to create — and taking it from the file would make the
+         * result depend on how somebody chose to lay out their document.
+         */
+        for (const type of RESOURCE_TYPES) {
+            const value = resourcesRaw[type];
+            if (value === undefined) {
+                continue;
+            }
+            const def = resourceDef(type);
+            if (def === undefined) {
+                continue;
+            }
+            sections.push({ def, rows: parseSection(issues, def, value, env) });
+        }
+    }
+    if (issues.length > 0) {
+        throw new DocumentError(issues);
+    }
+    return { version: DOCUMENT_VERSION, workspace, sections };
+}
+function parseSection(issues, def, value, env) {
+    const at = `resources.${def.type}`;
+    /*
+     * The resource with no usable natural key is refused here, by name, with
+     * the reason.
+     *
+     * `channels` stays a VALID key under `resources` — dropping it would make
+     * the unknown-key message say "channels is not a resource type", which is
+     * wrong and sends the reader hunting for a spelling mistake. What it cannot
+     * be is non-empty. `publicId` is minted as a GLOBALLY unique reservation
+     * (another tenant may hold `web`), `type` and `publicId` are immutable
+     * afterwards, `config` reads back redacted, and the create response carries
+     * per-provider webhook registration results a diff cannot model.
+     *
+     * Half-supporting it — "we will update the ones we can match and ignore the
+     * rest" — is worse than refusing, because the thing it silently cannot do
+     * is the thing somebody put it in the file for.
+     */
+    if (def.keySource === 'server') {
+        if (Array.isArray(value) && value.length === 0) {
+            return [];
+        }
+        issues.push({
+            path: at,
+            message: `${def.label}s cannot be managed from a document. \`${def.naturalKey}\` is minted on ` +
+                'create and is unique across every workspace, not just yours, so a row here has no key ' +
+                `it can safely claim; \`type\` and \`${def.naturalKey}\` are then immutable, and ` +
+                '`config` reads back with `__redacted__` in every credential key, so even an update ' +
+                `diff is mostly unknowable. Use \`chatly ${def.type} create\` and ` +
+                `\`chatly ${def.type} update <id>\`, and remove this section.`,
+        });
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        issues.push({
+            path: at,
+            message: `must be an array of ${def.label} objects (it is ${typeof value}).`,
+        });
+        return [];
+    }
+    const rows = [];
+    const seen = new Map();
+    for (let i = 0; i < value.length; i += 1) {
+        const path = `${at}[${String(i)}]`;
+        const row = value[i];
+        if (!isPlainObject(row)) {
+            issues.push({ path, message: `must be an object, not ${typeof row}.` });
+            continue;
+        }
+        const keyValue = row[def.naturalKey];
+        if (typeof keyValue !== 'string' || keyValue.length === 0) {
+            /*
+             * The one field this file insists on, and the message says why rather
+             * than just "required": somebody reading it on a fresh checkout needs
+             * to know that the uuid they were about to paste is the wrong answer.
+             */
+            issues.push({
+                path: `${path}.${def.naturalKey}`,
+                message: `every ${def.label} needs \`${def.naturalKey}\`: a non-empty string. It is the ` +
+                    'natural key this file matches on, so `plan` can tell a create from an update ' +
+                    'without a server uuid — which does not exist yet in a new environment.' +
+                    (def.keyEnforced
+                        ? ''
+                        : ` Note the database does NOT make \`${def.naturalKey}\` unique for this ` +
+                            'resource, so this file is the only thing keeping it unique.'),
+            });
+            continue;
+        }
+        const duplicate = seen.get(keyValue);
+        if (duplicate !== undefined) {
+            issues.push({
+                path: `${path}.${def.naturalKey}`,
+                message: `duplicate ${def.naturalKey} "${keyValue}" — also at ${duplicate}. Two rows with one ` +
+                    'key cannot both be applied, and guessing which was meant is how the wrong resource ' +
+                    'gets overwritten.',
+            });
+            continue;
+        }
+        seen.set(keyValue, path);
+        /*
+         * Fields the API RETURNS and no write path accepts.
+         *
+         * The dangerous class, and the reason `unwritable` exists in
+         * `resources.ts`. These are spelled correctly, they come back on every
+         * read, and copying a `chatly bots list --json` row into the document is
+         * the obvious way to start one — so `brands.usage`, `macros.usageCount`,
+         * `triggers.brandId` and twenty more arrive looking exactly like
+         * settings. zod strips every one of them and the write answers 200.
+         */
+        for (const field of Object.keys(row)) {
+            if (!def.unwritable.includes(field)) {
+                continue;
+            }
+            issues.push({
+                path: `${path}.${field}`,
+                message: `\`${field}\` is returned on a read and NO write path accepts it, so zod would strip ` +
+                    'it and the API would answer 200 having ignored you. Remove it. (A document is not a ' +
+                    'copy of a list row: it holds the settings you choose, not the state the server ' +
+                    'reports.)',
+            });
+        }
+        const missing = new Set();
+        const usedEnv = new Set();
+        const body = {};
+        const refs = {};
+        const fromEnv = [];
+        for (const [field, rawValue] of Object.entries(row)) {
+            if (def.unwritable.includes(field)) {
+                continue;
+            }
+            const ref = def.references?.[field];
+            if (ref === undefined) {
+                /*
+                 * A FRESH set per field, not a shared one.
+                 *
+                 * This was one `usedEnv` for the whole row and the membership test
+                 * was `size > before`, which is correct exactly once: two fields
+                 * referencing the SAME variable left the second one unmarked, and an
+                 * unmarked field is printed by value. The spec caught it with a
+                 * document whose `token` and `baseUrl` both read `${env:X}` — the
+                 * token was masked and the live credential went out beside it.
+                 */
+                const perField = new Set();
+                body[field] = interpolate(rawValue, env, missing, perField);
+                if (perField.size > 0) {
+                    fromEnv.push(field);
+                    for (const name of perField) {
+                        usedEnv.add(name);
+                    }
+                }
+                continue;
+            }
+            /*
+             * A reference key. `bot: "support"` is not an API field — it resolves
+             * into `botId` — so it must never reach the body, and the wire field
+             * must not be written by hand beside it.
+             */
+            if (typeof rawValue !== 'string' || rawValue.length === 0) {
+                issues.push({
+                    path: `${path}.${field}`,
+                    message: `must be the \`${ref.type}\` natural key as a string.`,
+                });
+                continue;
+            }
+            if (row[ref.wire] !== undefined) {
+                issues.push({
+                    path: `${path}.${ref.wire}`,
+                    message: `remove it: this row has both \`${field}: "${rawValue}"\` and \`${ref.wire}\`. ` +
+                        `\`${ref.wire}\` is a server uuid, which pins the document to one environment — ` +
+                        `\`${field}\` is the portable form and is what this CLI resolves.`,
+                });
+                continue;
+            }
+            refs[ref.wire] = { type: ref.type, key: rawValue };
+        }
+        for (const name of missing) {
+            issues.push({
+                path,
+                message: `\${env:${name}} is used here and ${name} is unset or empty. It is NOT substituted ` +
+                    'with an empty string: an empty token would be sent, verified against the provider, ' +
+                    'and fail with a message about the provider rather than about the variable nobody ' +
+                    `exported. Export ${name} and run again.`,
+            });
+        }
+        rows.push({ key: keyValue, path, body, refs, fromEnv });
+    }
+    return rows;
+}
+//# sourceMappingURL=document.js.map

package/dist/wac/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/wac/document.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAE/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,GAAG,qCAAqC,CAAC;AAsCtD,gEAAgE;AAChE,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtB,MAAM,CAAuB;IAE7C,YAAmB,MAA4B;QAC7C,KAAK,CACH,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gCAAgC;YACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAA4B;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,GAAW,EAAE,KAA4B;IACxD,IAAI,IAA6C,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,GAAG,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CACpB,MAAe,EACf,IAAY,EACZ,MAA6B,EAC7B,KAA4B,EAC5B,IAAY;IAEZ,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE;YACtB,OAAO,EACL,WAAW,IAAI,KAAK,GAAG,IAAI;gBAC3B,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,IAAI,CAAC;gBACxD,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,KAAc,EACd,GAAiD,EACjD,OAAoB,EACpB,IAAiB;IAEjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,MAAoD,EAAE;IAEtD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC;YACtB;gBACE,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,qEAAqE;oBACrE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;aACjD;SACF,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,eAAe,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,gCAAgC,MAAM,CAAC,gBAAgB,CAAC,KAAK;SACvE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,OAAO,EACL,0BAA0B,MAAM,CAAC,gBAAgB,CAAC,sBAAsB;gBACxE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+DAA+D;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,oFAAoF;oBACpF,sFAAsF;aACzF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,YAAY,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,+CAA+C,IAAI,CAAC,cAAc,CAAC,GAAG;SAChF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;QAC/F;;;;;;WAMG;QACH,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CACnB,MAAe,EACf,GAAgB,EAChB,KAAc,EACd,GAAiD;IAEjD,MAAM,EAAE,GAAG,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC;IAEnC;;;;;;;;;;;;;;;OAeG;IACH,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,EAAE;YACR,OAAO,EACL,GAAG,GAAG,CAAC,KAAK,0CAA0C,GAAG,CAAC,UAAU,kBAAkB;gBACtF,wFAAwF;gBACxF,uCAAuC,GAAG,CAAC,UAAU,6BAA6B;gBAClF,qFAAqF;gBACrF,2CAA2C,GAAG,CAAC,IAAI,gBAAgB;gBACnE,YAAY,GAAG,CAAC,IAAI,0CAA0C;SACjE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,uBAAuB,GAAG,CAAC,KAAK,mBAAmB,OAAO,KAAK,IAAI;SAC7E,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QACnC,MAAM,GAAG,GAAY,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D;;;;eAIG;YACH,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE;gBACjC,OAAO,EACL,SAAS,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,UAAU,oCAAoC;oBAChF,+EAA+E;oBAC/E,wEAAwE;oBACxE,CAAC,GAAG,CAAC,WAAW;wBACd,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,sCAAsC,GAAG,CAAC,UAAU,qBAAqB;4BACzE,6DAA6D,CAAC;aACrE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE;gBACjC,OAAO,EACL,aAAa,GAAG,CAAC,UAAU,KAAK,QAAQ,eAAe,SAAS,sBAAsB;oBACtF,qFAAqF;oBACrF,mBAAmB;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEzB;;;;;;;;;WASG;QACH,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE;gBACxB,OAAO,EACL,KAAK,KAAK,4EAA4E;oBACtF,sFAAsF;oBACtF,iFAAiF;oBACjF,WAAW;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,MAAM,IAAI,GAAkD,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB;;;;;;;;;mBASG;gBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5D,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YACD;;;;eAIG;YACH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE;oBACxB,OAAO,EAAE,iBAAiB,GAAG,CAAC,IAAI,6BAA6B;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE;oBAC3B,OAAO,EACL,kCAAkC,KAAK,MAAM,QAAQ,aAAa,GAAG,CAAC,IAAI,MAAM;wBAChF,KAAK,GAAG,CAAC,IAAI,oEAAoE;wBACjF,KAAK,KAAK,wDAAwD;iBACrE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,OAAO,EACL,UAAU,IAAI,sBAAsB,IAAI,4CAA4C;oBACpF,qFAAqF;oBACrF,mFAAmF;oBACnF,oBAAoB,IAAI,iBAAiB;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/wac/render.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Printing a plan, and one rule behind every choice here: a diff nobody reads
+ * is worse than no diff, because it gets approved.
+ *
+ * So the shape is terraform's, because that is the shape people already know
+ * how to read — a sigil per action, the resource addressed as `type/key`, and
+ * the changed fields indented under it with old on the left. What is NOT
+ * terraform's: unchanged resources are one line each rather than a collapsed
+ * count, because on this surface a workspace has tens of resources and not
+ * thousands, and "the thing I expected to be unchanged is listed as
+ * unchanged" is the second most useful sentence a plan can say.
+ *
+ * Values are JSON, truncated. A macro body is 20,000 characters and a
+ * trigger's `actions` array is a nested object; neither belongs on a terminal
+ * line in full, and `--json` exists for the whole thing.
+ */
+import { type Plan } from './diff.js';
+/** One value, as JSON, clipped. `undefined` is `(unset)`, not `undefined`. */
+export declare function show(value: unknown): string;
+export interface RenderOptions {
+    /** `--prune` was passed, so orphan lines say "delete" rather than "kept". */
+    readonly prune: boolean;
+    /** Types whose live list may be short, where prune is refused regardless. */
+    readonly pruneUnsafe: ReadonlyArray<string>;
+}
+/** The whole plan, as `chatly plan` prints it. */
+export declare function renderPlan(plan: Plan, opts: RenderOptions): string;
+/**
+ * The line that follows a plan, and it is load-bearing.
+ *
+ * `plan` is the half of this feature that is safe, and saying so explicitly
+ * is what makes somebody willing to run it against production. "Nothing was
+ * written" is a claim the spec holds this CLI to: a recording transport
+ * asserts zero non-GET requests over the whole plan path.
+ */
+export declare function planFooter(plan: Plan, opts: RenderOptions): string;
+/**
+ * The plan, for `--json`, with every env-sourced value taken back out.
+ *
+ * `plan --json | tee plan.json` is a thing somebody does on the first day,
+ * and a plan item carries `row.body` — which holds the RESOLVED value of
+ * every `${env:…}` reference, including a docs source's provider token. The
+ * human renderer already masks those (`fromEnv` on each row); the JSON
+ * renderer printed them, which would have written a live credential into a
+ * file somebody then commits.
+ *
+ * So `row` does not go out at all — a consumer wants the diff, not a copy of
+ * its own input — and any change whose field came from the environment is
+ * reported as having come from the environment rather than by value.
+ */
+export declare function planForJson(plan: Plan): unknown;
+//# sourceMappingURL=render.d.ts.map

package/dist/wac/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/wac/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAA2B,KAAK,IAAI,EAAiB,MAAM,WAAW,CAAC;AAY9E,8EAA8E;AAC9E,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM3C;AAWD,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAgElE;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAkBlE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAmB/C"}