@chatlychat/cli 0.1.3 → 0.1.5

package/dist/wac/render.js

@@ -0,0 +1,156 @@
+/**
+ * Printing a plan, and one rule behind every choice here: a diff nobody reads
+ * is worse than no diff, because it gets approved.
+ *
+ * So the shape is terraform's, because that is the shape people already know
+ * how to read — a sigil per action, the resource addressed as `type/key`, and
+ * the changed fields indented under it with old on the left. What is NOT
+ * terraform's: unchanged resources are one line each rather than a collapsed
+ * count, because on this surface a workspace has tens of resources and not
+ * thousands, and "the thing I expected to be unchanged is listed as
+ * unchanged" is the second most useful sentence a plan can say.
+ *
+ * Values are JSON, truncated. A macro body is 20,000 characters and a
+ * trigger's `actions` array is a nested object; neither belongs on a terminal
+ * line in full, and `--json` exists for the whole thing.
+ */
+import { tally } from './diff.js';
+const SIGIL = {
+    create: '+',
+    update: '~',
+    noop: '=',
+    orphan: '-',
+    blocked: '!',
+};
+const MAX_VALUE = 72;
+/** One value, as JSON, clipped. `undefined` is `(unset)`, not `undefined`. */
+export function show(value) {
+    if (value === undefined) {
+        return '(unset)';
+    }
+    const text = JSON.stringify(value) ?? String(value);
+    return text.length > MAX_VALUE ? `${text.slice(0, MAX_VALUE - 1)}…` : text;
+}
+function changeLine(item, change) {
+    const masked = item.row?.fromEnv.includes(change.name) === true;
+    const to = masked ? '(from the environment)' : show(change.to);
+    if (item.action === 'create') {
+        return `      ${change.name} = ${to}`;
+    }
+    return `      ${change.name}: ${masked ? '(unreadable)' : show(change.from)} -> ${to}`;
+}
+/** The whole plan, as `chatly plan` prints it. */
+export function renderPlan(plan, opts) {
+    const counts = tally(plan);
+    const out = [];
+    for (const item of plan.items) {
+        const head = `  ${SIGIL[item.action]} ${item.type}/${item.key}`;
+        if (item.action === 'noop') {
+            out.push(`${head}   unchanged`);
+            for (const note of item.notes) {
+                out.push(`      · ${note}`);
+            }
+            continue;
+        }
+        if (item.action === 'orphan') {
+            const fate = item.notes.length > 0
+                ? 'kept'
+                : opts.pruneUnsafe.includes(item.type)
+                    ? 'kept — this type cannot be pruned safely on this run'
+                    : opts.prune
+                        ? 'DELETE'
+                        : 'kept — `--prune` would delete it';
+            out.push(`${head}   on the server, not in this document; ${fate}`);
+            for (const note of item.notes) {
+                out.push(`      · ${note}`);
+            }
+            continue;
+        }
+        if (item.action === 'blocked') {
+            out.push(`${head}   CANNOT APPLY`);
+            out.push(`      ${item.reason ?? 'no reason recorded, which is itself a bug.'}`);
+            for (const change of item.changes) {
+                out.push(changeLine(item, change));
+            }
+            continue;
+        }
+        out.push(`${head}   ${item.action === 'create' ? 'create' : 'change'}`);
+        for (const change of item.changes) {
+            out.push(changeLine(item, change));
+        }
+        for (const note of item.notes) {
+            out.push(`      · ${note}`);
+        }
+    }
+    if (out.length === 0) {
+        out.push('  (the document declares no resources)');
+    }
+    const summary = `${String(counts.create)} to create, ${String(counts.update)} to change, ` +
+        `${String(counts.noop)} unchanged, ${String(counts.orphan)} on the server only, ` +
+        `${String(counts.blocked)} that cannot be applied`;
+    const parts = [`Plan: ${summary}`, '', ...out];
+    if (plan.warnings.length > 0) {
+        parts.push('', 'Warnings');
+        for (const warning of plan.warnings) {
+            parts.push(`  ! ${warning}`);
+        }
+    }
+    return `${parts.join('\n')}\n`;
+}
+/**
+ * The line that follows a plan, and it is load-bearing.
+ *
+ * `plan` is the half of this feature that is safe, and saying so explicitly
+ * is what makes somebody willing to run it against production. "Nothing was
+ * written" is a claim the spec holds this CLI to: a recording transport
+ * asserts zero non-GET requests over the whole plan path.
+ */
+export function planFooter(plan, opts) {
+    const counts = tally(plan);
+    const lines = ['', 'Nothing was written — `plan` issues reads only.'];
+    if (counts.create + counts.update === 0 && (counts.orphan === 0 || !opts.prune)) {
+        lines.push('There is nothing to apply.');
+    }
+    else {
+        lines.push(`Run \`chatly apply\`${opts.prune ? ' --prune' : ''} to make ` +
+            `${String(counts.create + counts.update + (opts.prune ? counts.orphan : 0))} change(s).`);
+    }
+    if (counts.blocked > 0) {
+        lines.push(`${String(counts.blocked)} resource(s) cannot be applied and \`apply\` will skip them ` +
+            'rather than half-write them. The reason is on each line.');
+    }
+    return `${lines.join('\n')}\n`;
+}
+/**
+ * The plan, for `--json`, with every env-sourced value taken back out.
+ *
+ * `plan --json | tee plan.json` is a thing somebody does on the first day,
+ * and a plan item carries `row.body` — which holds the RESOLVED value of
+ * every `${env:…}` reference, including a docs source's provider token. The
+ * human renderer already masks those (`fromEnv` on each row); the JSON
+ * renderer printed them, which would have written a live credential into a
+ * file somebody then commits.
+ *
+ * So `row` does not go out at all — a consumer wants the diff, not a copy of
+ * its own input — and any change whose field came from the environment is
+ * reported as having come from the environment rather than by value.
+ */
+export function planForJson(plan) {
+    return {
+        plan: plan.items.map((item) => ({
+            type: item.type,
+            key: item.key,
+            action: item.action,
+            liveId: item.liveId ?? null,
+            reason: item.reason ?? null,
+            notes: item.notes,
+            dependsOn: item.dependsOn,
+            changes: item.changes.map((change) => item.row?.fromEnv.includes(change.name) === true
+                ? { name: change.name, from: '(unreadable)', to: '(from the environment)' }
+                : { name: change.name, from: change.from ?? null, to: change.to }),
+        })),
+        warnings: plan.warnings,
+        pruneUnsafe: plan.pruneUnsafe,
+    };
+}
+//# sourceMappingURL=render.js.map

package/dist/wac/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/wac/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAA8C,MAAM,WAAW,CAAC;AAE9E,MAAM,KAAK,GAAuC;IAChD,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,GAAG;CACb,CAAC;AAEF,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,8EAA8E;AAC9E,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,MAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,SAAS,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;AACzF,CAAC;AASD,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,IAAmB;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,CAAC,CAAC,sDAAsD;oBACxD,CAAC,CAAC,IAAI,CAAC,KAAK;wBACV,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,kCAAkC,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,2CAA2C,IAAI,EAAE,CAAC,CAAC;YACnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,4CAA4C,EAAE,CAAC,CAAC;YACjF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc;QAC1E,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB;QACjF,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAErD,MAAM,KAAK,GAAG,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC;IAE/C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,IAAmB;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,iDAAiD,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,uBAAuB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW;YAC5D,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,8DAA8D;YACrF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;gBAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,wBAAwB,EAAE;gBAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CACpE;SACF,CAAC,CAAC;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC"}

package/dist/wac/resource-def.d.ts

@@ -0,0 +1,116 @@
+/**
+ * The SHAPE of a resource definition, and the helpers that read one.
+ *
+ * Split out of `resources.ts` only because the two together ran past the
+ * 650-line ceiling (`scripts/check-file-size.mjs`). The division is the
+ * useful one anyway: this file is the vocabulary, `resources.ts` is the nine
+ * answers written in it, and reading one does not require reading the other.
+ * `resources.ts` re-exports everything here, so every importer sees one
+ * module.
+ */
+/** The verbs a document can cause. */
+export type Action = 'create' | 'update' | 'noop' | 'orphan' | 'blocked';
+export interface ResourceRef {
+    /** The resource type the value names. */
+    readonly type: string;
+    /** The field the API actually reads, which the ref resolves into. */
+    readonly wire: string;
+}
+export interface UpdateRoute {
+    readonly method: 'PATCH' | 'PUT';
+    /** `{id}` is replaced with the encoded live id. */
+    readonly path: string;
+    /**
+     * The ONLY fields this route can change. Omitted means "anything not
+     * claimed by a more specific route" — the catch-all. A resource with no
+     * catch-all can only change the fields its routes name, and a diff on any
+     * other field is reported as un-appliable instead of being sent somewhere
+     * that will strip it and answer 200.
+     */
+    readonly fields?: ReadonlyArray<string>;
+}
+export interface ResourceDef {
+    /** The key under `resources:` and the word in every plan line. */
+    readonly type: string;
+    /** Singular, for a sentence. */
+    readonly label: string;
+    /** The field holding the natural key, in the document and on the live row. */
+    readonly naturalKey: string;
+    readonly keySource: 'authored' | 'server';
+    /** True when the database enforces the key. False when only this file does. */
+    readonly keyEnforced: boolean;
+    /** The server's own normalisation, applied to both sides before matching. */
+    readonly normalizeKey?: (key: string) => string;
+    readonly list: {
+        readonly path: string;
+        readonly paged: boolean;
+    };
+    /** The field on a live row that identifies it in a write path. */
+    readonly idField: string;
+    readonly create: {
+        readonly path: string;
+        /** POST is an upsert keyed on the body's `id`, not a plain create. */
+        readonly upsert?: boolean;
+    } | null;
+    /** Empty means there is no way to change one in place. */
+    readonly update: ReadonlyArray<UpdateRoute>;
+    /** Said when a changed field matches no update route. */
+    readonly updateBlocked?: string;
+    /**
+     * The write REPLACES the resource: a field the document omits reverts to
+     * its default. `plan` says so on every change to one of these.
+     */
+    readonly fullReplace?: boolean;
+    /** `null` when `--prune` cannot delete one; `removeBlocked` says why. */
+    readonly remove: {
+        readonly path: string;
+    } | null;
+    readonly removeBlocked?: string;
+    /**
+     * Fields that are never readable back, so a diff must not claim they
+     * changed. Half the answer; the other half is the `__redacted__` sentinel,
+     * detected at runtime in `diff.ts`.
+     */
+    readonly opaque: ReadonlyArray<string>;
+    /**
+     * Fields a CREATE answers with exactly once. A floor, not a fence:
+     * `apply.ts` also sweeps every response for anything that looks like a
+     * credential, so a field added next month is surfaced rather than dropped.
+     */
+    readonly secrets: ReadonlyArray<string>;
+    /**
+     * Returned on a read and accepted by NO write path. A document declaring
+     * one is refused at parse time: zod would strip it and answer 200, and the
+     * author would never find out.
+     */
+    readonly unwritable: ReadonlyArray<string>;
+    /** The live row, reshaped into the vocabulary the document writes. */
+    readonly project?: (row: Record<string, unknown>) => Record<string, unknown>;
+    /** Document-only keys naming another resource by ITS natural key. */
+    readonly references?: Readonly<Record<string, ResourceRef>>;
+}
+/** The server's spelling of a key, for matching. */
+export declare function normalizedKey(def: ResourceDef, key: string): string;
+/** The live row in the vocabulary the document writes. */
+export declare function projected(def: ResourceDef, row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Which update route owns a field, or `undefined` if none does.
+ *
+ * A route with no `fields` is the catch-all and is tried last, so a field a
+ * specific route claims (`webhookUrl` → `/v1/bots/{id}/external`) is never
+ * swept into the general PATCH.
+ */
+export declare function routeForField(def: ResourceDef, field: string): UpdateRoute | undefined;
+/**
+ * Anything that reads like a credential, by NAME.
+ *
+ * `secrets` on each definition is a hand-written list, and a hand-written
+ * list goes stale — the failure CLAUDE.md names twice, where a gate's green
+ * line counts what it managed to parse rather than what exists. So `apply`
+ * also runs every write response through this, and a field called
+ * `webhookToken` that nobody told this file about is still surfaced to the
+ * operator instead of being dropped on the floor. False positives are cheap:
+ * the cost is one extra line of output.
+ */
+export declare function looksLikeCredential(field: string): boolean;
+//# sourceMappingURL=resource-def.d.ts.map

package/dist/wac/resource-def.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-def.d.ts","sourceRoot":"","sources":["../../src/wac/resource-def.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sCAAsC;AACtC,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClE,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7E,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CAC7D;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAKtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/wac/resource-def.js

@@ -0,0 +1,44 @@
+/**
+ * The SHAPE of a resource definition, and the helpers that read one.
+ *
+ * Split out of `resources.ts` only because the two together ran past the
+ * 650-line ceiling (`scripts/check-file-size.mjs`). The division is the
+ * useful one anyway: this file is the vocabulary, `resources.ts` is the nine
+ * answers written in it, and reading one does not require reading the other.
+ * `resources.ts` re-exports everything here, so every importer sees one
+ * module.
+ */
+/** The server's spelling of a key, for matching. */
+export function normalizedKey(def, key) {
+    return def.normalizeKey === undefined ? key : def.normalizeKey(key);
+}
+/** The live row in the vocabulary the document writes. */
+export function projected(def, row) {
+    return def.project === undefined ? row : def.project(row);
+}
+/**
+ * Which update route owns a field, or `undefined` if none does.
+ *
+ * A route with no `fields` is the catch-all and is tried last, so a field a
+ * specific route claims (`webhookUrl` → `/v1/bots/{id}/external`) is never
+ * swept into the general PATCH.
+ */
+export function routeForField(def, field) {
+    return (def.update.find((r) => r.fields?.includes(field) === true) ??
+        def.update.find((r) => r.fields === undefined));
+}
+/**
+ * Anything that reads like a credential, by NAME.
+ *
+ * `secrets` on each definition is a hand-written list, and a hand-written
+ * list goes stale — the failure CLAUDE.md names twice, where a gate's green
+ * line counts what it managed to parse rather than what exists. So `apply`
+ * also runs every write response through this, and a field called
+ * `webhookToken` that nobody told this file about is still surfaced to the
+ * operator instead of being dropped on the floor. False positives are cheap:
+ * the cost is one extra line of output.
+ */
+export function looksLikeCredential(field) {
+    return /secret|token|password|credential|privatekey|apikey/i.test(field);
+}
+//# sourceMappingURL=resource-def.js.map

package/dist/wac/resource-def.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-def.js","sourceRoot":"","sources":["../../src/wac/resource-def.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkFH,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,GAAW;IACzD,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,GAA4B;IACtE,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,KAAa;IAC3D,OAAO,CACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC"}

package/dist/wac/resources.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The resource table `chatly plan` and `chatly apply` work from.
+ *
+ * ═══ WHY A TABLE ══════════════════════════════════════════════════════════
+ *
+ * The ask behind this feature, in the integrator's words: "we wrote ~600
+ * lines to idempotently upsert tools, bots, routes, cards and channel
+ * config." Those 600 lines are nine copies of the same four steps — list,
+ * index by some stable name, compare, write — differing only in a route and a
+ * field name. This file is those differences and nothing else; `diff.ts` is
+ * the four steps, once, and `apply.ts` is the writes.
+ *
+ * ═══ IDENTITY: THE DECISION EVERYTHING ELSE RESTS ON ═════════════════════
+ *
+ * A declarative file cannot refer to resources by the server's uuid. On a
+ * fresh checkout against a fresh workspace there are no uuids, and a file
+ * carrying them is a file you cannot apply to a second environment — which
+ * is the whole reason this exists ("teams that run more than one
+ * environment"). So every resource needs a NATURAL KEY: a field the author
+ * writes, that comes back on the list read, and that identifies one row.
+ *
+ * Read off the handlers and the migrations, the nine are:
+ *
+ *   brands          slug        UNIQUE (workspace_id, slug)
+ *   bots            slug        UNIQUE (workspace_id, slug) WHERE NOT NULL
+ *   macros          shortCode   UNIQUE (workspace_id, lower(short_code))
+ *   emailTemplates  kind        UNIQUE (workspace_id, kind) — and a path param
+ *   customerCards   key         UNIQUE (workspace_id, key)
+ *   botRoutes       name        NO CONSTRAINT
+ *   triggers        name        NO CONSTRAINT
+ *   webhooks        url         NO CONSTRAINT
+ *   docsSources     label       NO CONSTRAINT
+ *   channels        publicId    UNIQUE — but minted by the server
+ *
+ * The first five are real: the database refuses a second row, so matching on
+ * the key cannot pick the wrong one. The next four are a CONVENTION the
+ * document enforces rather than a constraint the server does — so `diff.ts`
+ * refuses to touch a key that appears twice on either side instead of
+ * guessing, which is the only honest thing to do with a key that can repeat.
+ *
+ * ── The resource with no natural key at all ──────────────────────────────
+ *
+ * CHANNELS. `publicId` is required on create but it is a RESERVATION, not a
+ * name you choose freely: `channels_public_id_unique` is global rather than
+ * workspace-scoped, so another tenant may already hold `web`. `type` and
+ * `publicId` are both immutable afterwards, `config` reads back with
+ * `__redacted__` in every credential key, and the create response carries
+ * per-provider webhook registration results that a diff cannot model. A
+ * `channels:` section is therefore REFUSED by `document.ts`, by name, with
+ * the reason — not half-supported. `chatly channels create|update` is the
+ * way, and that is what the refusal says.
+ *
+ * ═══ VERIFIED AGAINST HANDLERS, NOT AGAINST NAMES ════════════════════════
+ *
+ * Every path, key, `paged` flag, update field-set and projection below was
+ * read off `apps/api/src/modules/**` and `packages/db/migrations/**`.
+ * CLAUDE.md records why that is not optional: the SDK manifest's first
+ * version listed two routes that do not exist and had its `paged` flag wrong
+ * in BOTH directions, and a fake transport that answers every route with a
+ * page envelope agrees with whatever the manifest says. Seven of the nine
+ * list routes here are `@PaginationExempt` bare arrays; treating one as a
+ * page is the bug two SDKs shipped.
+ *
+ * Six things in this table exist only because a handler said so, and each
+ * would be a live bug if guessed:
+ *
+ *  1. `macros.shortCode` does not round-trip. `normaliseShortCode` strips a
+ *     leading `/` and lowercases, so a document saying `/Refund` would never
+ *     match the stored `refund`, would create on every run, and would then
+ *     collide with the unique index forever. Hence `normalizeKey`.
+ *  2. `emailTemplates` keeps the customised copy under `override`, not at the
+ *     top level, and the list always returns all five kinds with
+ *     `override: null` for the ones on the built-in. A naive diff reads
+ *     `row.subject` — which does not exist — and reports a change every run.
+ *     Hence `project`.
+ *  3. A bot's external config comes back nested under `externalAgent` and is
+ *     written to a DIFFERENT route (`PATCH /v1/bots/{id}/external`). Hence
+ *     `project` plus a second update route.
+ *  4. `webhooks` has NO general PATCH. Only the pinned schema version can
+ *     change; `url`, `eventTypes` and `description` are frozen at create.
+ *  5. `triggers` POST is a FULL REPLACE keyed on the body's `id`, and an
+ *     unknown id is a 404 rather than a create. So the id must come from the
+ *     live row, and an omitted field is RESET to its default — hence
+ *     `fullReplace`, which makes `plan` say so out loud.
+ *  6. `docsSources` PATCH accepts six fields. `provider`, `spaceId`,
+ *     `organizationId`, `includePaths` and `excludePaths` are create-only, so
+ *     a change to one of them is reported as un-appliable rather than sent to
+ *     a route that will strip it and answer 200.
+ */
+export type { Action, ResourceDef, ResourceRef, UpdateRoute } from './resource-def.js';
+export { looksLikeCredential, normalizedKey, projected, routeForField } from './resource-def.js';
+import type { ResourceDef } from './resource-def.js';
+/**
+ * Dependency order, and it is the array order.
+ *
+ * `botRoutes` after `bots` because a route names a bot, and in a single
+ * `apply` that bot may not exist until this run creates it. Nothing else
+ * references anything else, so the rest is ordered by how likely somebody is
+ * to be looking for it.
+ */
+export declare const RESOURCES: ReadonlyArray<ResourceDef>;
+export declare const RESOURCE_TYPES: ReadonlyArray<string>;
+export declare function resourceDef(type: string): ResourceDef | undefined;
+//# sourceMappingURL=resources.d.ts.map

package/dist/wac/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/wac/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWrD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,aAAa,CAAC,WAAW,CAibhD,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAIlF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAEjE"}