@sfdxy/anypoint-connect 0.15.0 → 0.16.2

package/dist/safety/secrets.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Secret detection and redaction
+ * Keeps secret values out of tool responses, CLI output and error messages.
+ */
+/** The placeholder the platform returns for stored secure property values. */
+export declare const MASKED = "******";
+/**
+ * True when a property name looks like it holds a secret. The name is split on `.`, `_`, `-`
+ * and camel-case boundaries, so `db.password`, `clientSecret` and `API_KEY` all match while
+ * `tokenizer.mode` or `keystore.type` do not.
+ */
+export declare function looksSecret(key: string): boolean;
+/** Mask a value, keeping the last two characters of long values so a caller can tell values apart. */
+export declare function redactValue(value: string): string;
+/**
+ * Mask secret-looking entries of a flat record. `keys` forces masking for extra names
+ * (for example every key of a secure property map).
+ */
+export declare function redactRecord(record: Record<string, string>, options?: {
+    keys?: Iterable<string>;
+}): Record<string, string>;
+/**
+ * Recursively mask secret-looking fields in an arbitrary JSON value, such as an API error
+ * body the platform echoed back.
+ */
+export declare function redactDeep(value: unknown, depth?: number): unknown;
+/**
+ * Replace every occurrence of known secret values in free text. Values shorter than four
+ * characters are skipped because they would match ordinary text.
+ */
+export declare function redactText(text: string, knownSecrets: Iterable<string>): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/safety/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E"}

package/dist/safety/secrets.js

@@ -0,0 +1,91 @@
+/**
+ * Secret detection and redaction
+ * Keeps secret values out of tool responses, CLI output and error messages.
+ */
+/** The placeholder the platform returns for stored secure property values. */
+export const MASKED = '******';
+const SECRET_SEGMENTS = new Set([
+    'password',
+    'passwd',
+    'pwd',
+    'secret',
+    'token',
+    'credential',
+    'credentials',
+    'passphrase',
+    'apikey',
+    'privatekey',
+    'clientsecret',
+]);
+const SECRET_PAIRS = [
+    ['private', 'key'],
+    ['api', 'key'],
+    ['client', 'secret'],
+    ['access', 'key'],
+];
+/**
+ * True when a property name looks like it holds a secret. The name is split on `.`, `_`, `-`
+ * and camel-case boundaries, so `db.password`, `clientSecret` and `API_KEY` all match while
+ * `tokenizer.mode` or `keystore.type` do not.
+ */
+export function looksSecret(key) {
+    const segments = key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[\s._\-/:]+/)
+        .filter(Boolean);
+    if (segments.some((segment) => SECRET_SEGMENTS.has(segment)))
+        return true;
+    for (let i = 0; i < segments.length - 1; i++) {
+        if (SECRET_PAIRS.some(([a, b]) => segments[i] === a && segments[i + 1] === b))
+            return true;
+    }
+    return false;
+}
+/** Mask a value, keeping the last two characters of long values so a caller can tell values apart. */
+export function redactValue(value) {
+    if (value === MASKED)
+        return MASKED;
+    return value.length > 8 ? `${MASKED}…${value.slice(-2)}` : MASKED;
+}
+/**
+ * Mask secret-looking entries of a flat record. `keys` forces masking for extra names
+ * (for example every key of a secure property map).
+ */
+export function redactRecord(record, options = {}) {
+    const forced = new Set(options.keys ?? []);
+    return Object.fromEntries(Object.entries(record).map(([key, value]) => [
+        key,
+        forced.has(key) || looksSecret(key) ? redactValue(String(value)) : value,
+    ]));
+}
+/**
+ * Recursively mask secret-looking fields in an arbitrary JSON value, such as an API error
+ * body the platform echoed back.
+ */
+export function redactDeep(value, depth = 0) {
+    if (depth > 20)
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => redactDeep(item, depth + 1));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            looksSecret(key) && typeof item === 'string' ? redactValue(item) : redactDeep(item, depth + 1),
+        ]));
+    }
+    return value;
+}
+/**
+ * Replace every occurrence of known secret values in free text. Values shorter than four
+ * characters are skipped because they would match ordinary text.
+ */
+export function redactText(text, knownSecrets) {
+    const values = [...new Set(knownSecrets)].filter((v) => v && v !== MASKED && v.length >= 4);
+    values.sort((a, b) => b.length - a.length);
+    let result = text;
+    for (const value of values)
+        result = result.split(value).join(MASKED);
+    return result;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/safety/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/errors.d.ts

@@ -6,7 +6,8 @@
  * Extracts a human-readable message from an unknown error value.
  * For AxiosErrors, prefers the API response body (which often contains
  * a more descriptive message than the generic HTTP status).
- * Safely handles Error instances, strings, and other types.
+ * Safely handles Error instances, strings, and other types. Secret-looking
+ * fields in an echoed response body are masked.
  */
 export declare function errorMessage(error: unknown): string;
 /**

package/dist/utils/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAGjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM;gBAH/B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,CAAC,EAAE,MAAM,YAAA;IAMnC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc;CAc7D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAGjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM;gBAH/B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,CAAC,EAAE,MAAM,YAAA;IAMnC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc;CAc7D"}

package/dist/utils/errors.js

@@ -3,11 +3,13 @@
  * Shared error formatting for CLI and MCP error handling
  */
 import { AxiosError } from 'axios';
+import { redactDeep } from '../safety/secrets.js';
 /**
  * Extracts a human-readable message from an unknown error value.
  * For AxiosErrors, prefers the API response body (which often contains
  * a more descriptive message than the generic HTTP status).
- * Safely handles Error instances, strings, and other types.
+ * Safely handles Error instances, strings, and other types. Secret-looking
+ * fields in an echoed response body are masked.
  */
 export function errorMessage(error) {
     if (error instanceof AxiosError && error.response) {
@@ -17,8 +19,8 @@ export function errorMessage(error) {
         if (data && typeof data === 'object') {
             if ('message' in data)
                 return String(data.message);
-            // Some APIs return { error: '...' } or { status, ... } — show full body
-            return `HTTP ${error.response.status}: ${JSON.stringify(data)}`;
+            // Some APIs return { error: '...' } or { status, ... } — show the body, masked
+            return `HTTP ${error.response.status}: ${JSON.stringify(redactDeep(data))}`;
         }
         return `HTTP ${error.response.status || 'unknown'}`;
     }

package/dist/utils/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAE,IAA4B,CAAC,OAAO,CAAC,CAAC;YAC5E,wEAAwE;YACxE,OAAO,QAAQ,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGxB;IACA;IACA;IAJb,YACI,OAAe,EACN,KAAa,EACb,MAAe,EACf,aAAsB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAS;QACf,kBAAa,GAAb,aAAa,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAc,EAAE,KAAa;QACrC,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAsE,CAAC;YACnG,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACtF,MAAM,aAAa,GAAG,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1G,OAAO,IAAI,cAAc,CACrB,2BAA2B,KAAK,CAAC,QAAQ,CAAC,MAAM,MAAM,MAAM,EAAE,EAC9D,KAAK,EACL,KAAK,CAAC,QAAQ,CAAC,MAAM,EACrB,aAAa,CAChB,CAAC;QACN,CAAC;QACD,OAAO,IAAI,cAAc,CAAC,sBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;CACJ"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAE,IAA4B,CAAC,OAAO,CAAC,CAAC;YAC5E,+EAA+E;YAC/E,OAAO,QAAQ,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,QAAQ,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGxB;IACA;IACA;IAJb,YACI,OAAe,EACN,KAAa,EACb,MAAe,EACf,aAAsB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAS;QACf,kBAAa,GAAb,aAAa,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAc,EAAE,KAAa;QACrC,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAsE,CAAC;YACnG,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACtF,MAAM,aAAa,GAAG,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1G,OAAO,IAAI,cAAc,CACrB,2BAA2B,KAAK,CAAC,QAAQ,CAAC,MAAM,MAAM,MAAM,EAAE,EAC9D,KAAK,EACL,KAAK,CAAC,QAAQ,CAAC,MAAM,EACrB,aAAa,CAChB,CAAC;QACN,CAAC;QACD,OAAO,IAAI,cAAc,CAAC,sBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;CACJ"}

package/dist/workflows/app-change.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Application change workflow
+ * One plan and one PATCH for every change to an existing CloudHub 2.0 application: artifact,
+ * runtime, settings and update strategy, applied in place or as stop, change, start. Shared by
+ * the MCP tools and the CLI so previews, runtime checks, secret handling and waits match.
+ */
+import type { AnypointClient } from '../client/AnypointClient.js';
+import type { Environment } from '../api/AccessManagementApi.js';
+import type { ArtifactRef, CH2Deployment, DeploymentPatch } from '../api/CloudHub2Api.js';
+import { type DeploymentChange, type SettingsChange, type SettingsPlan } from '../safety/deployment.js';
+import { type RuntimeSpec } from '../safety/runtime.js';
+import { type SecretSource } from '../safety/secret-sources.js';
+import { type PhaseSnapshot } from './app-state.js';
+export type ChangeMode = 'inPlace' | 'stopStart';
+export type UpdateStrategy = 'rolling' | 'recreate';
+/** A settings change as callers express it: inline values plus server-side sources. */
+export interface SettingsChangeInput extends SettingsChange {
+    propertiesFrom?: SecretSource[];
+    securePropertiesFrom?: SecretSource[];
+}
+/** Resolve file and environment sources into values. Returns the secret values for output scrubbing. */
+export declare function resolveSettingsInput(input: SettingsChangeInput | undefined, options?: {
+    projectRoot?: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    change: SettingsChange | undefined;
+    secretValues: string[];
+};
+export interface AppChangeRequest {
+    orgId: string;
+    env: Environment;
+    appName: string;
+    /** Prefetched deployment detail; looked up by name when omitted. */
+    existing?: CH2Deployment | null;
+    ref?: Partial<ArtifactRef>;
+    runtime?: RuntimeSpec;
+    settings?: SettingsChange;
+    updateStrategy?: UpdateStrategy;
+    mode?: ChangeMode;
+    /** Restart even when nothing else changes (stop then start). */
+    restart?: boolean;
+    /** Values to scrub from every response and error. */
+    secretValues?: string[];
+}
+export interface RuntimeCheck {
+    checked: boolean;
+    reason?: string;
+    targetId: string;
+    current: {
+        version: string;
+        java?: string;
+        releaseChannel?: string;
+        supported?: boolean;
+    };
+    requested?: {
+        version: string;
+        java?: string;
+        releaseChannel?: string;
+        supported?: boolean;
+    };
+    suggestions?: string[];
+}
+export interface AppChangePlan {
+    request: AppChangeRequest;
+    existing: CH2Deployment;
+    mode: ChangeMode;
+    patch: DeploymentPatch;
+    changes: DeploymentChange[];
+    settings?: SettingsPlan;
+    runtimeCheck: RuntimeCheck;
+    steps: string[];
+    warnings: string[];
+    /** Problems that stop the change before anything is written. */
+    blockers: string[];
+    production: boolean;
+    /** Nothing would change. */
+    noop: boolean;
+}
+/** Build the plan: what changes, the single PATCH body, the runtime check and the steps. Nothing is written. */
+export declare function planAppChange(client: AnypointClient, request: AppChangeRequest): Promise<AppChangePlan>;
+/** A serializable preview of the plan. Never contains secret values. */
+export declare function describeAppChange(plan: AppChangePlan): {
+    preserved: string;
+    production?: boolean | undefined;
+    noop?: boolean | undefined;
+    blockers?: string[] | undefined;
+    warnings?: string[] | undefined;
+    runtimeCheck: RuntimeCheck;
+    steps: string[];
+    settings?: import("../safety/deployment.js").SettingsDiff | undefined;
+    app: string;
+    environment: string;
+    mode: ChangeMode;
+    current: {
+        ref: ArtifactRef;
+        runtime: {
+            version: string;
+            releaseChannel?: string;
+            java?: string;
+        } | undefined;
+        updateStrategy: string;
+        desiredState: string;
+        phase: import("./app-state.js").AppPhase;
+    };
+    changes: DeploymentChange[];
+};
+export interface AppChangeResult {
+    deployment: CH2Deployment;
+    performed: string[];
+    snapshot?: PhaseSnapshot;
+    timedOut?: boolean;
+    /** The stop step ran but the start step did not; the app is left stopped. */
+    leftStopped?: boolean;
+}
+export interface ExecuteOptions {
+    wait?: boolean;
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    graceMs?: number;
+    onStatus?: (step: string, snapshot: PhaseSnapshot) => void;
+}
+/** Apply a plan. Errors and results are scrubbed of the request's secret values. */
+export declare function executeAppChange(client: AnypointClient, plan: AppChangePlan, options?: ExecuteOptions): Promise<AppChangeResult>;
+//# sourceMappingURL=app-change.d.ts.map

package/dist/workflows/app-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-change.d.ts","sourceRoot":"","sources":["../../src/workflows/app-change.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE1F,OAAO,EAIH,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,YAAY,EACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAuD,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE7G,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEtF,OAAO,EAAoC,KAAK,aAAa,EAAmB,MAAM,gBAAgB,CAAC;AAEvG,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpD,uFAAuF;AACvF,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACvD,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;CACzC;AAED,wGAAwG;AACxG,wBAAgB,oBAAoB,CAChC,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAChE;IAAE,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBhE;AAED,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gEAAgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1F,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7F,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,4BAA4B;IAC5B,IAAI,EAAE,OAAO,CAAC;CACjB;AAmCD,gHAAgH;AAChH,wBAAsB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CA0K7G;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;EAwBpD;AAED,MAAM,WAAW,eAAe;IAC5B,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;CAC9D;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,cAAmB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAmE1B"}

package/dist/workflows/app-change.js

@@ -0,0 +1,305 @@
+/**
+ * Application change workflow
+ * One plan and one PATCH for every change to an existing CloudHub 2.0 application: artifact,
+ * runtime, settings and update strategy, applied in place or as stop, change, start. Shared by
+ * the MCP tools and the CLI so previews, runtime checks, secret handling and waits match.
+ */
+import { isEmptySettingsChange, mergeForArtifactUpdate, planSettingsChange, } from '../safety/deployment.js';
+import { isProductionEnv } from '../safety/guards.js';
+import { parseRuntimeString, resolveRuntime, suggestRuntimes } from '../safety/runtime.js';
+import { looksSecret, redactText } from '../safety/secrets.js';
+import { resolveSecretSources } from '../safety/secret-sources.js';
+import { errorMessage } from '../utils/errors.js';
+import { deploymentPhase, waitForAppPhase } from './app-state.js';
+/** Resolve file and environment sources into values. Returns the secret values for output scrubbing. */
+export function resolveSettingsInput(input, options = {}) {
+    if (!input)
+        return { change: undefined, secretValues: [] };
+    const properties = { ...resolveSecretSources(input.propertiesFrom, options), ...(input.properties ?? {}) };
+    const secureProperties = {
+        ...resolveSecretSources(input.securePropertiesFrom, options),
+        ...(input.secureProperties ?? {}),
+    };
+    const change = {
+        ...(Object.keys(properties).length ? { properties } : {}),
+        ...(Object.keys(secureProperties).length ? { secureProperties } : {}),
+        ...(input.removeProperties?.length ? { removeProperties: input.removeProperties } : {}),
+        ...(input.removeSecureProperties?.length ? { removeSecureProperties: input.removeSecureProperties } : {}),
+        ...(input.moveToSecure?.length ? { moveToSecure: input.moveToSecure } : {}),
+    };
+    const secretValues = [
+        ...Object.values(secureProperties),
+        ...Object.entries(properties)
+            .filter(([key]) => looksSecret(key))
+            .map(([, value]) => value),
+    ];
+    return { change: isEmptySettingsChange(change) ? undefined : change, secretValues };
+}
+function refsDiffer(a, b) {
+    return (a.groupId !== b.groupId ||
+        a.artifactId !== b.artifactId ||
+        a.version !== b.version ||
+        a.packaging !== b.packaging);
+}
+async function loadCatalog(client, orgId, targetId) {
+    try {
+        const target = await client.runtimes.getTarget(orgId, targetId);
+        if (!target)
+            return { reason: `target ${targetId} is not in the organization's runtime catalog` };
+        if (target.runtimes.length === 0)
+            return { reason: `target ${targetId} lists no runtime versions` };
+        return { catalog: target.runtimes };
+    }
+    catch (error) {
+        return { reason: `runtime catalog unavailable: ${errorMessage(error)}` };
+    }
+}
+/** Pick the Java version to send: requested, else the current one if still offered, else 17, else the newest offered. */
+function chooseJava(resolved, requested, current) {
+    if (requested)
+        return requested;
+    if (!resolved || resolved.java.length === 0)
+        return current;
+    if (current && resolved.java.includes(current))
+        return current;
+    if (resolved.java.includes('17'))
+        return '17';
+    return resolved.java[resolved.java.length - 1];
+}
+/** Build the plan: what changes, the single PATCH body, the runtime check and the steps. Nothing is written. */
+export async function planAppChange(client, request) {
+    const existing = request.existing ?? (await client.cloudHub2.findDetailByName(request.orgId, request.env.id, request.appName));
+    if (!existing)
+        throw new Error(`Application "${request.appName}" not found in ${request.env.name}`);
+    const mode = request.mode ?? (request.restart ? 'stopStart' : 'inPlace');
+    const changes = [];
+    const warnings = [];
+    const blockers = [];
+    const patch = {};
+    const settings = existing.target?.deploymentSettings ?? {};
+    // Artifact
+    if (request.ref && Object.values(request.ref).some((v) => v !== undefined)) {
+        const nextRef = mergeForArtifactUpdate(existing, request.ref).application.ref;
+        if (refsDiffer(existing.application.ref, nextRef)) {
+            patch.application = { ...patch.application, ref: nextRef };
+            for (const field of ['groupId', 'artifactId', 'version', 'packaging']) {
+                if (existing.application.ref[field] !== nextRef[field]) {
+                    changes.push({ field: `ref.${field}`, from: existing.application.ref[field], to: nextRef[field] });
+                }
+            }
+        }
+    }
+    // Settings
+    let settingsPlan;
+    if (!isEmptySettingsChange(request.settings)) {
+        settingsPlan = planSettingsChange(existing, request.settings);
+        warnings.push(...settingsPlan.warnings);
+        if (settingsPlan.changed) {
+            patch.application = {
+                ...patch.application,
+                configuration: { 'mule.agent.application.properties.service': settingsPlan.service },
+            };
+        }
+    }
+    // Runtime
+    const currentRuntime = settings.runtime ?? { version: 'unknown' };
+    const current = parseRuntimeString(currentRuntime.version, currentRuntime.java);
+    const { catalog, reason } = await loadCatalog(client, request.orgId, existing.target.targetId);
+    const runtimeCheck = {
+        checked: Boolean(catalog),
+        ...(reason ? { reason } : {}),
+        targetId: existing.target.targetId,
+        current: {
+            version: current.version,
+            ...(current.java ? { java: current.java } : {}),
+            ...(currentRuntime.releaseChannel ? { releaseChannel: currentRuntime.releaseChannel } : {}),
+            ...(catalog
+                ? { supported: Boolean(resolveRuntime(catalog, { version: current.version, java: current.java })) }
+                : {}),
+        },
+    };
+    let nextRuntime;
+    if (request.runtime) {
+        const resolved = catalog ? resolveRuntime(catalog, request.runtime) : undefined;
+        runtimeCheck.requested = {
+            version: request.runtime.version,
+            ...(request.runtime.java ? { java: request.runtime.java } : {}),
+            ...(request.runtime.releaseChannel ? { releaseChannel: request.runtime.releaseChannel } : {}),
+            ...(catalog ? { supported: Boolean(resolved) } : {}),
+        };
+        if (catalog && !resolved) {
+            runtimeCheck.suggestions = suggestRuntimes(catalog, request.runtime.java ? request.runtime : { ...request.runtime, java: current.java });
+            blockers.push(`Runtime ${request.runtime.version}${request.runtime.java ? ` (Java ${request.runtime.java})` : ''} is not offered by ${existing.target.targetId}. Nearest supported: ${runtimeCheck.suggestions.join('; ') || 'none listed'}`);
+        }
+        nextRuntime = {
+            version: resolved?.version ?? request.runtime.version,
+            ...((request.runtime.releaseChannel ?? resolved?.releaseChannel ?? currentRuntime.releaseChannel)
+                ? {
+                    releaseChannel: request.runtime.releaseChannel ?? resolved?.releaseChannel ?? currentRuntime.releaseChannel,
+                }
+                : {}),
+            ...(chooseJava(resolved, request.runtime.java, current.java)
+                ? { java: chooseJava(resolved, request.runtime.java, current.java) }
+                : {}),
+        };
+        if (!catalog)
+            warnings.push(`Runtime ${nextRuntime.version} was not validated (${reason})`);
+        if (nextRuntime.version !== current.version)
+            changes.push({ field: 'runtime', from: current.version, to: nextRuntime.version });
+        if (nextRuntime.java && nextRuntime.java !== current.java)
+            changes.push({ field: 'java', from: current.java, to: nextRuntime.java });
+        if (nextRuntime.releaseChannel && nextRuntime.releaseChannel !== currentRuntime.releaseChannel) {
+            changes.push({
+                field: 'releaseChannel',
+                from: currentRuntime.releaseChannel,
+                to: nextRuntime.releaseChannel,
+            });
+        }
+        if (changes.every((c) => !['runtime', 'java', 'releaseChannel'].includes(c.field)))
+            nextRuntime = undefined;
+    }
+    // Update strategy
+    const strategyChange = request.updateStrategy && request.updateStrategy !== (settings.updateStrategy ?? 'rolling')
+        ? request.updateStrategy
+        : undefined;
+    if (strategyChange)
+        changes.push({ field: 'updateStrategy', from: settings.updateStrategy ?? 'rolling', to: strategyChange });
+    if (nextRuntime || strategyChange) {
+        // The live target is restated exactly as read, so only the runtime and strategy differ.
+        patch.target = {
+            provider: existing.target.provider,
+            targetId: existing.target.targetId,
+            replicas: existing.target.replicas,
+            deploymentSettings: {
+                ...settings,
+                ...(nextRuntime ? { runtime: nextRuntime } : {}),
+                ...(strategyChange ? { updateStrategy: strategyChange } : {}),
+            },
+        };
+    }
+    const createsSpec = Boolean(patch.application?.ref || patch.application?.configuration || patch.target);
+    if (catalog && runtimeCheck.current.supported === false && !nextRuntime && createsSpec) {
+        runtimeCheck.suggestions = suggestRuntimes(catalog, current);
+        blockers.push(`The app's current runtime ${current.version}${current.java ? ` (Java ${current.java})` : ''} is no longer offered by ${existing.target.targetId}, so the platform will reject a new spec. Pass runtime with one of: ${runtimeCheck.suggestions.join('; ') || 'none listed'}`);
+    }
+    const noop = !createsSpec && !request.restart;
+    if (mode === 'stopStart' && !noop)
+        patch.application = { ...patch.application, desiredState: 'STARTED' };
+    if (settingsPlan?.changed)
+        warnings.push('Applying a settings change restarts the application.');
+    if (mode === 'inPlace' && createsSpec && (settings.updateStrategy ?? 'rolling') === 'rolling' && !strategyChange) {
+        warnings.push('Rolling update: old and new replicas overlap briefly. For apps with streaming or polling listeners use mode stopStart, or set updateStrategy recreate.');
+    }
+    if (mode === 'inPlace' && existing.application.desiredState === 'STOPPED' && createsSpec) {
+        warnings.push('The application is stopped; the change applies but it stays stopped until started.');
+    }
+    const steps = noop
+        ? []
+        : mode === 'stopStart'
+            ? [
+                ...(existing.application.desiredState !== 'STOPPED'
+                    ? ['stop the application and wait until it is stopped']
+                    : []),
+                createsSpec ? 'apply the change and start in one update' : 'start the application',
+                'wait until every replica runs the new spec',
+            ]
+            : ['apply the change in one update (one new spec)', 'wait until every replica runs the new spec'];
+    return {
+        request,
+        existing,
+        mode,
+        patch,
+        changes,
+        ...(settingsPlan ? { settings: settingsPlan } : {}),
+        runtimeCheck,
+        steps,
+        warnings,
+        blockers,
+        production: isProductionEnv(request.env.name, request.env.isProduction),
+        noop,
+    };
+}
+/** A serializable preview of the plan. Never contains secret values. */
+export function describeAppChange(plan) {
+    const { existing, request } = plan;
+    const preview = {
+        app: existing.name,
+        environment: request.env.name,
+        mode: plan.mode,
+        current: {
+            ref: existing.application.ref,
+            runtime: existing.target?.deploymentSettings?.runtime,
+            updateStrategy: existing.target?.deploymentSettings?.updateStrategy ?? 'rolling',
+            desiredState: existing.application.desiredState,
+            phase: deploymentPhase(existing).phase,
+        },
+        changes: plan.changes,
+        ...(plan.settings ? { settings: plan.settings.diff } : {}),
+        runtimeCheck: plan.runtimeCheck,
+        steps: plan.steps,
+        ...(plan.warnings.length ? { warnings: plan.warnings } : {}),
+        ...(plan.blockers.length ? { blockers: plan.blockers } : {}),
+        ...(plan.noop ? { noop: true } : {}),
+        ...(plan.production ? { production: true } : {}),
+        preserved: 'target, replicas, resources, other settings and stored secure values',
+    };
+    return JSON.parse(redactText(JSON.stringify(preview), request.secretValues ?? []));
+}
+/** Apply a plan. Errors and results are scrubbed of the request's secret values. */
+export async function executeAppChange(client, plan, options = {}) {
+    if (plan.blockers.length)
+        throw new Error(plan.blockers.join('\n'));
+    const { orgId, env, secretValues = [] } = plan.request;
+    const { existing } = plan;
+    const performed = [];
+    if (plan.noop)
+        return { deployment: existing, performed };
+    // `previous` enables the staleness check, needed only when the target state looks like the
+    // starting state (an in-place update of a running app). Stop and start are told apart by state.
+    const waitFor = (step, previous, sentAt, expectedSpecVersion) => waitForAppPhase(client.cloudHub2, orgId, env.id, existing.id, {
+        expectedSpecVersion,
+        previousModifiedDate: previous?.lastModifiedDate,
+        sinceChange: sentAt,
+        timeoutMs: options.timeoutMs,
+        pollIntervalMs: options.pollIntervalMs,
+        graceMs: options.graceMs,
+        onStatus: options.onStatus ? (snapshot) => options.onStatus?.(step, snapshot) : undefined,
+    });
+    try {
+        let before = existing;
+        if (plan.mode === 'stopStart' && existing.application.desiredState !== 'STOPPED') {
+            const sentAt = Date.now();
+            await client.cloudHub2.setDesiredState(orgId, env.id, existing.id, 'STOPPED');
+            performed.push('stop requested');
+            const stopped = await waitFor('stop', undefined, sentAt);
+            if (!stopped.snapshot.settled) {
+                throw new Error(`Stop did not complete (${stopped.snapshot.phase}${stopped.timedOut ? ', timed out' : ''}); the change was not applied. The app may still be stopping.`);
+            }
+            performed.push('stopped');
+            before = stopped.deployment;
+        }
+        const sentAt = Date.now();
+        const deployment = await client.cloudHub2.patchDeployment(orgId, env.id, existing.id, plan.patch);
+        performed.push(plan.mode === 'stopStart' ? 'change applied and start requested' : 'change applied');
+        if (!options.wait)
+            return { deployment, performed };
+        const expected = deployment.desiredVersion && deployment.desiredVersion !== before.desiredVersion
+            ? deployment.desiredVersion
+            : undefined;
+        const wasRunning = before.application.desiredState !== 'STOPPED';
+        const result = await waitFor('apply', wasRunning ? before : undefined, sentAt, expected);
+        performed.push(result.snapshot.settled ? 'settled' : `wait ended in ${result.snapshot.phase}`);
+        return { deployment: result.deployment, performed, snapshot: result.snapshot, timedOut: result.timedOut };
+    }
+    catch (error) {
+        const leftStopped = performed.includes('stopped') && !performed.some((step) => step.startsWith('change applied'));
+        const message = redactText(errorMessage(error), secretValues);
+        const err = new Error(leftStopped
+            ? `${message}\nThe application was stopped and is still stopped. Steps done: ${performed.join(', ')}`
+            : performed.length
+                ? `${message}\nSteps done: ${performed.join(', ')}`
+                : message);
+        throw err;
+    }
+}
+//# sourceMappingURL=app-change.js.map