@tula-tech/cli 0.0.0-stage → 0.1.1

package/dist/shared/chunk-4qr9zsgj.js

@@ -0,0 +1,4437 @@
+// @bun
+// src/commands/apply.ts
+import { basename, resolve } from "path";
+import { ifMatch, isTulaAdminError as isTulaAdminError5 } from "@tula-tech/admin";
+import { providerSecret as providerSecret2, resolveSecret } from "@tula-tech/config";
+import { MAX_WEBHOOK_URL_LENGTH as MAX_WEBHOOK_URL_LENGTH2 } from "@tula-tech/contract";
+import { CONFIG_HASH_HEADER, CONFIG_MANAGED_BY_HEADER } from "@tula-tech/contract/headers";
+
+// src/args.ts
+class UsageError2 extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UsageError";
+  }
+}
+var KEY_ADVICE = "Set TULA_SECRET_KEY, or pass --secret-key-file <path> (- for standard input).";
+var SECRET_FLAGS = new Map([
+  ["secret-key", KEY_ADVICE],
+  ["key", KEY_ADVICE],
+  ["secret", KEY_ADVICE],
+  ["token", KEY_ADVICE],
+  [
+    "admin-token",
+    "Set TULA_ADMIN_TOKEN, or pass --admin-token-file <path> (- for standard input)."
+  ],
+  [
+    "password",
+    'Run `tula policy test` and type it at the prompt, or pipe it in: `printf %s "$PW" | tula policy test`.'
+  ]
+]);
+function parseArgs2(argv, options) {
+  const flags = {};
+  const positionals = [];
+  const byShort = new Map(Object.entries(options).flatMap(([name, spec]) => spec.short ? [[spec.short, name]] : []));
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--") {
+      positionals.push(...argv.slice(index + 1));
+      break;
+    }
+    if (!argument.startsWith("-") || argument === "-") {
+      positionals.push(argument);
+      continue;
+    }
+    const long = argument.startsWith("--");
+    const equals = long ? argument.indexOf("=") : -1;
+    const given = long ? argument.slice(2, equals === -1 ? undefined : equals) : argument.slice(1);
+    const name = long ? given : byShort.get(given);
+    const spec = name !== undefined && Object.hasOwn(options, name) ? options[name] : undefined;
+    if (name === undefined || !spec) {
+      const advice = SECRET_FLAGS.get(given);
+      if (advice !== undefined) {
+        throw new UsageError2(`There is no --${given} option: a secret on the command line ends up in shell history ` + `and process lists. ${advice}`);
+      }
+      throw new UsageError2(`Unknown option ${long ? "--" : "-"}${given.slice(0, 40)}.`);
+    }
+    if (spec.type === "boolean") {
+      if (equals !== -1) {
+        throw new UsageError2(`--${name} takes no value.`);
+      }
+      flags[name] = true;
+      continue;
+    }
+    const value = equals === -1 ? argv[index + 1] : argument.slice(equals + 1);
+    if (value === undefined || equals === -1 && value.startsWith("--")) {
+      throw new UsageError2(`--${name} needs a value.`);
+    }
+    flags[name] = value;
+    if (equals === -1) {
+      index += 1;
+    }
+  }
+  return { flags, positionals };
+}
+
+// src/diff.ts
+import { providerSecret } from "@tula-tech/config";
+import {
+  HOOK_FIELDS,
+  HOOK_POINTS,
+  hasEnabledSignInMethod,
+  hookWeakenings,
+  isEmailTemplateKind,
+  isSmsTemplateKind,
+  MAX_NATIVE_APPS,
+  MAX_WEBHOOK_ENDPOINTS,
+  NATIVE_APP_PLATFORMS,
+  nativeAppIdentifier,
+  nativeAppWeakenings,
+  normalizeAppLinkPaths,
+  normalizeCertFingerprints,
+  OAUTH_PROVIDERS,
+  oauthProviderWeakenings,
+  parseStoredEnvironmentSettings,
+  settingsWeakenings
+} from "@tula-tech/contract";
+var MANAGING_TOOL2 = "tula-apply";
+var EMAIL_TEMPLATES_PATH = "emails.templates";
+var SMS_TEMPLATES_PATH = "sms.templates";
+function isTemplatePath(path) {
+  return path.startsWith(`${EMAIL_TEMPLATES_PATH}.`) || path.startsWith(`${SMS_TEMPLATES_PATH}.`);
+}
+var SET_PATHS2 = [
+  "urls.allowedOrigins",
+  "urls.allowedRedirectUrls",
+  "sms.allowedCountries"
+];
+var NAMED_ENTRY_PATHS = [
+  "sessions.profiles",
+  "sessions.jwtTemplates",
+  EMAIL_TEMPLATES_PATH,
+  SMS_TEMPLATES_PATH
+];
+var WHOLE_VALUE = /^sessions\.jwtTemplates\.[^.]+\.claims\.[^.]+$/;
+var DEPLOYMENT_DEFAULTS = ["password", "urls.allowedOrigins"];
+var TEMPLATE_PATH = /^(?:emails|sms)\.templates\.[^.]+$/;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function same(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function diffSets(path, before, after) {
+  const key = (value) => JSON.stringify(value);
+  const had = new Set(before.map(key));
+  const has = new Set(after.map(key));
+  const added = after.filter((value, index) => !had.has(key(value)) && after.findIndex((other) => key(other) === key(value)) === index);
+  const removed = before.filter((value, index) => !has.has(key(value)) && before.findIndex((other) => key(other) === key(value)) === index);
+  return added.length === 0 && removed.length === 0 ? [] : [{ path, kind: "changed", before, after, added, removed }];
+}
+function diffAt(path, before, after, setPaths) {
+  if (before === undefined && after === undefined) {
+    return [];
+  }
+  if (TEMPLATE_PATH.test(path) && isPlainObject(before ?? after)) {
+    const [had, has] = [before ?? {}, after ?? {}];
+    if (isPlainObject(had) && isPlainObject(has)) {
+      const keys = [...new Set([...Object.keys(has), ...Object.keys(had)])];
+      return keys.flatMap((key) => diffAt(`${path}.${key}`, had[key], has[key], setPaths));
+    }
+  }
+  if (before === undefined) {
+    return [{ path, kind: "added", after }];
+  }
+  if (after === undefined) {
+    return [{ path, kind: "removed", before }];
+  }
+  if (isPlainObject(before) && isPlainObject(after) && !WHOLE_VALUE.test(path)) {
+    const keys = [...new Set([...Object.keys(after), ...Object.keys(before)])];
+    return keys.flatMap((key) => diffAt(path === "" ? key : `${path}.${key}`, before[key], after[key], setPaths));
+  }
+  if (Array.isArray(before) && Array.isArray(after) && setPaths.includes(path)) {
+    return diffSets(path, before, after);
+  }
+  return same(before, after) ? [] : [{ path, kind: "changed", before, after }];
+}
+function diffValues2(before, after, setPaths = SET_PATHS2) {
+  return diffAt("", before, after, setPaths);
+}
+function nativeAppSnapshot(apps) {
+  return JSON.stringify(apps.map((app) => {
+    const { id, platform } = app;
+    const loose = app;
+    const fingerprints = app.sha256CertFingerprints;
+    const paths = app.appLinkPaths;
+    return [
+      id,
+      platform,
+      loose.bundleId ?? loose.packageName ?? null,
+      loose.teamId ?? null,
+      Array.isArray(fingerprints) ? [...fingerprints].map(String).sort() : null,
+      Array.isArray(paths) ? [...paths].map(String).sort() : []
+    ];
+  }).sort((a, b) => String(a[0]).localeCompare(String(b[0]))));
+}
+function nativeAppKey(platform, identifier) {
+  return `${platform}/${identifier}`;
+}
+function identityOf(app) {
+  if (app.platform === "ios") {
+    return {
+      platform: "ios",
+      teamId: app.teamId,
+      bundleId: app.bundleId,
+      appLinkPaths: remotePaths(app)
+    };
+  }
+  if (app.platform === "android") {
+    return {
+      platform: "android",
+      packageName: app.packageName,
+      sha256CertFingerprints: app.sha256CertFingerprints,
+      appLinkPaths: remotePaths(app)
+    };
+  }
+  return null;
+}
+function remotePaths(app) {
+  const paths = app.appLinkPaths;
+  return Array.isArray(paths) ? paths.map(String) : [];
+}
+function appLinkPathFields(current, entry) {
+  if (entry.appLinkPaths === undefined) {
+    return [];
+  }
+  const after = normalizeAppLinkPaths(entry.appLinkPaths);
+  if (!current) {
+    return after.length === 0 ? [] : [{ path: "appLinkPaths", kind: "added", after }];
+  }
+  const before = [...new Set(current.appLinkPaths ?? [])].sort();
+  const added = after.filter((path) => !before.includes(path));
+  const removed = before.filter((path) => !after.includes(path));
+  return added.length === 0 && removed.length === 0 ? [] : [{ path: "appLinkPaths", kind: "changed", before, after, added, removed }];
+}
+function unmanagedLinkPaths(current, entry) {
+  if (entry.appLinkPaths !== undefined || current?.platform !== entry.platform) {
+    return 0;
+  }
+  return new Set(current.appLinkPaths ?? []).size;
+}
+function nativeAppFields(current, entry) {
+  const sameApp = current?.platform === entry.platform ? current : null;
+  return [...identityFields(current, entry), ...appLinkPathFields(sameApp, entry)];
+}
+function identityFields(current, entry) {
+  if (entry.platform === "ios") {
+    if (current?.platform !== "ios") {
+      return [{ path: "teamId", kind: "added", after: entry.teamId }];
+    }
+    return current.teamId === entry.teamId ? [] : [{ path: "teamId", kind: "changed", before: current.teamId, after: entry.teamId }];
+  }
+  const after = normalizeCertFingerprints(entry.sha256CertFingerprints);
+  if (current?.platform !== "android") {
+    return [{ path: "sha256CertFingerprints", kind: "added", after }];
+  }
+  const before = normalizeCertFingerprints(current.sha256CertFingerprints);
+  const added = after.filter((fingerprint) => !before.includes(fingerprint));
+  const removed = before.filter((fingerprint) => !after.includes(fingerprint));
+  return added.length === 0 && removed.length === 0 ? [] : [{ path: "sha256CertFingerprints", kind: "changed", before, after, added, removed }];
+}
+function planNativeApps(remote, desired, options) {
+  if (desired === undefined) {
+    return { managed: false, apps: [], overLimit: null, seen: nativeAppSnapshot([]) };
+  }
+  const existing = remote ?? [];
+  const known = new Set(NATIVE_APP_PLATFORMS);
+  const byKey = new Map;
+  for (const app of existing) {
+    const identity = identityOf(app);
+    if (identity) {
+      byKey.set(nativeAppKey(identity.platform, nativeAppIdentifier(identity)), app);
+    }
+  }
+  const listed = new Set;
+  const apps = desired.map((entry) => {
+    const identifier = nativeAppIdentifier(entry);
+    const key = nativeAppKey(entry.platform, identifier);
+    listed.add(key);
+    const current = byKey.get(key);
+    const was = current ? identityOf(current) : null;
+    const fields = nativeAppFields(was, entry);
+    const weakened = nativeAppWeakenings(was, entry).map((field) => field === "app" ? `nativeApps.${key}` : `nativeApps.${key}.${field}`);
+    if (!current) {
+      return { platform: entry.platform, identifier, action: "create", fields, weakened, entry };
+    }
+    const unmanaged = unmanagedLinkPaths(was, entry);
+    return {
+      platform: entry.platform,
+      identifier,
+      id: current.id,
+      action: fields.length > 0 ? "update" : "none",
+      fields,
+      weakened,
+      entry,
+      ...unmanaged > 0 && { unmanagedLinkPaths: unmanaged }
+    };
+  });
+  for (const app of existing) {
+    const identity = identityOf(app);
+    if (!identity || !known.has(app.platform)) {
+      const loose = app;
+      apps.push({
+        platform: String(loose.platform),
+        identifier: String(loose.bundleId ?? loose.packageName ?? ""),
+        id: app.id,
+        action: "unknown",
+        fields: [],
+        weakened: []
+      });
+      continue;
+    }
+    const identifier = nativeAppIdentifier(identity);
+    if (!listed.has(nativeAppKey(identity.platform, identifier))) {
+      apps.push({
+        platform: identity.platform,
+        identifier,
+        id: app.id,
+        action: options.prune === true ? "delete" : "unmanaged",
+        fields: [],
+        weakened: []
+      });
+    }
+  }
+  const count = (action) => apps.filter((app) => app.action === action).length;
+  const after = existing.length + count("create") - count("delete");
+  return {
+    managed: true,
+    apps,
+    overLimit: count("create") > 0 && after > MAX_NATIVE_APPS ? after : null,
+    seen: nativeAppSnapshot(existing)
+  };
+}
+function hookSnapshot(hooks) {
+  return JSON.stringify(hooks.map((hook) => [
+    hook.id,
+    hook.point,
+    hook.url,
+    hook.enabled,
+    hook.deadlineMs,
+    hook.failureMode
+  ]).sort((a, b) => String(a[0]).localeCompare(String(b[0]))));
+}
+function strengthOf(hook) {
+  return { enabled: hook.enabled, failureMode: hook.failureMode === "allow" ? "allow" : "deny" };
+}
+function planHooks(remote, desired, options) {
+  if (desired === undefined) {
+    return { managed: false, hooks: [], seen: hookSnapshot([]) };
+  }
+  const existing = remote ?? [];
+  const known = new Set(HOOK_POINTS);
+  const hooks = [];
+  for (const point of HOOK_POINTS) {
+    const current = existing.find((hook) => hook.point === point);
+    const entry = Object.hasOwn(desired, point) ? desired[point] : undefined;
+    if (!entry) {
+      if (current) {
+        const removed = options.prune === true;
+        hooks.push({
+          point,
+          id: current.id,
+          url: current.url,
+          action: removed ? "delete" : "unmanaged",
+          fields: [],
+          weakened: removed && hookWeakenings(strengthOf(current), null).length > 0 ? [`hooks.${point}`] : []
+        });
+      }
+      continue;
+    }
+    const weakened = hookWeakenings(current ? strengthOf(current) : null, entry).map((field) => `hooks.${point}.${field}`);
+    if (!current) {
+      hooks.push({
+        point,
+        url: entry.url,
+        action: "create",
+        fields: HOOK_FIELDS.map((path) => ({ path, kind: "added", after: entry[path] })),
+        weakened
+      });
+      continue;
+    }
+    const fields = HOOK_FIELDS.flatMap((path) => current[path] === entry[path] ? [] : [{ path, kind: "changed", before: current[path], after: entry[path] }]);
+    hooks.push({
+      point,
+      id: current.id,
+      url: entry.url,
+      action: fields.length > 0 ? "update" : "none",
+      fields,
+      weakened
+    });
+  }
+  for (const hook of existing) {
+    if (!known.has(hook.point)) {
+      hooks.push({
+        point: hook.point,
+        id: hook.id,
+        url: hook.url,
+        action: "unknown",
+        fields: [],
+        weakened: []
+      });
+    }
+  }
+  return { managed: true, hooks, seen: hookSnapshot(existing) };
+}
+function webhookSnapshot(endpoints) {
+  return JSON.stringify(endpoints.map((endpoint) => [
+    endpoint.id,
+    endpoint.url,
+    [...new Set(endpoint.eventTypes)].sort(),
+    endpoint.enabled,
+    endpoint.disabledReason
+  ]).sort((a, b) => String(a[0]).localeCompare(String(b[0]))));
+}
+function planEndpoint(desired, matches) {
+  const { url } = desired;
+  const types = [...desired.eventTypes].sort();
+  if (matches.length > 1) {
+    return { url, action: "ambiguous", fields: [], duplicates: matches.map((match) => match.id) };
+  }
+  const current = matches[0];
+  if (!current) {
+    const fields = [{ path: "eventTypes", kind: "added", after: types }];
+    if (desired.enabled !== undefined) {
+      fields.push({ path: "enabled", kind: "added", after: desired.enabled });
+    }
+    return { url, action: "create", fields };
+  }
+  const fields = diffSets("eventTypes", [...new Set(current.eventTypes)].sort(), types).map((change) => ({
+    ...change,
+    added: [...change.added ?? []].sort(),
+    removed: [...change.removed ?? []].sort()
+  }));
+  const switched = desired.enabled !== undefined && desired.enabled !== current.enabled;
+  if (switched) {
+    fields.push({
+      path: "enabled",
+      kind: "changed",
+      before: current.enabled,
+      after: desired.enabled
+    });
+  }
+  const reenables = switched && desired.enabled === true && typeof current.disabledReason === "string" ? current.disabledReason : undefined;
+  return {
+    url,
+    id: current.id,
+    action: fields.length > 0 ? "update" : "none",
+    fields,
+    ...reenables !== undefined && { reenables }
+  };
+}
+function planWebhooks(remote, desired, options) {
+  if (desired === undefined) {
+    return {
+      managed: false,
+      endpoints: [],
+      removedFirst: 0,
+      overLimit: null,
+      seen: webhookSnapshot([])
+    };
+  }
+  const existing = remote ?? [];
+  const listed = new Set(desired.map((endpoint) => endpoint.url));
+  const endpoints = [
+    ...desired.map((endpoint) => planEndpoint(endpoint, existing.filter((candidate) => candidate.url === endpoint.url))),
+    ...existing.filter((endpoint) => !listed.has(endpoint.url)).map((endpoint) => ({
+      url: endpoint.url,
+      id: endpoint.id,
+      action: options.prune ? "delete" : "unmanaged",
+      fields: []
+    }))
+  ];
+  const count = (action) => endpoints.filter((endpoint) => endpoint.action === action).length;
+  const creates = count("create");
+  const after = existing.length + creates - count("delete");
+  const overLimit = after > MAX_WEBHOOK_ENDPOINTS ? after : null;
+  return {
+    managed: true,
+    endpoints,
+    removedFirst: overLimit === null ? Math.max(0, existing.length + creates - MAX_WEBHOOK_ENDPOINTS) : 0,
+    overLimit,
+    seen: webhookSnapshot(existing)
+  };
+}
+var DEPENDENTS_UNREAD2 = "unread";
+function readDependentCount2(provider, answer) {
+  if (typeof answer !== "object" || answer === null) {
+    return null;
+  }
+  const { provider: named, accounts, more } = answer;
+  if (named !== provider || typeof accounts !== "number" || !Number.isSafeInteger(accounts) || accounts < 0 || typeof more !== "boolean") {
+    return null;
+  }
+  return { accounts, more };
+}
+var KEEPS_SECRET = new Set(["enabled", "tenant", "additionalClientIds"]);
+var CLIENT_IDS = "additionalClientIds";
+var UNREAD_AS_A_COUNT = { accounts: 0, more: true };
+function countToJudge(known) {
+  return known === DEPENDENTS_UNREAD2 ? UNREAD_AS_A_COUNT : known ?? undefined;
+}
+function providerWeakenings(provider, before, fields) {
+  const clientIds = fields?.[CLIENT_IDS];
+  const dependents = countToJudge(before?.dependents);
+  const weakened = oauthProviderWeakenings(before && {
+    additionalClientIds: before.additionalClientIds,
+    enabled: before.enabled,
+    ...dependents && { dependents }
+  }, fields && {
+    ...Array.isArray(clientIds) && { additionalClientIds: clientIds },
+    enabled: fields.enabled === true
+  });
+  return weakened.map((field) => fields === null ? `providers.${provider}` : `providers.${provider}.${field}`);
+}
+function providerFields(provider, providers) {
+  if (provider === "apple") {
+    const apple = providers.apple;
+    return apple && {
+      clientId: apple.clientId,
+      teamId: apple.teamId,
+      keyId: apple.keyId,
+      enabled: apple.enabled
+    };
+  }
+  if (provider === "microsoft") {
+    const microsoft = providers.microsoft;
+    return microsoft && {
+      clientId: microsoft.clientId,
+      tenant: microsoft.tenant,
+      enabled: microsoft.enabled
+    };
+  }
+  if (provider === "google") {
+    const google = providers.google;
+    return google && {
+      clientId: google.clientId,
+      [CLIENT_IDS]: google.additionalClientIds ?? [],
+      enabled: google.enabled
+    };
+  }
+  const client = providers[provider];
+  return client && { clientId: client.clientId, enabled: client.enabled };
+}
+function clientIdsOf(current) {
+  const listed = current?.additionalClientIds;
+  return Array.isArray(listed) ? listed.filter((id) => typeof id === "string").sort() : [];
+}
+function planProviders2(remote, desired, options, dependents = {}) {
+  const countOf = (provider, goesOff) => goesOff && Object.hasOwn(dependents, provider) ? { dependents: dependents[provider] } : {};
+  const plans = [];
+  for (const provider of [...OAUTH_PROVIDERS].sort()) {
+    const current = remote.find((entry) => entry.provider === provider);
+    const configured = current?.configured === true;
+    const enabledBefore = configured && current.enabled;
+    const fields = providerFields(provider, desired);
+    if (!fields) {
+      if (configured) {
+        plans.push({
+          provider,
+          action: options.prune ? "delete" : "unmanaged",
+          fields: [],
+          secret: "none",
+          enabledBefore,
+          enabledAfter: options.prune ? false : enabledBefore,
+          weakened: options.prune ? providerWeakenings(provider, {
+            additionalClientIds: clientIdsOf(current),
+            enabled: enabledBefore,
+            ...countOf(provider, enabledBefore)
+          }, null) : [],
+          ...countOf(provider, options.prune === true && enabledBefore)
+        });
+      }
+      continue;
+    }
+    const secretEnv = providerSecret(desired, provider)?.$env;
+    const enabledAfter = fields.enabled === true;
+    if (!configured) {
+      plans.push({
+        provider,
+        action: "create",
+        fields: Object.entries(fields).filter(([path, after]) => path !== CLIENT_IDS || after.length > 0).map(([path, after]) => ({ path, kind: "added", after })),
+        secret: "set",
+        secretEnv,
+        enabledBefore,
+        enabledAfter,
+        weakened: providerWeakenings(provider, null, fields)
+      });
+      continue;
+    }
+    const changes = Object.entries(fields).flatMap(([path, after]) => {
+      if (path === CLIENT_IDS) {
+        return diffSets(path, clientIdsOf(current), after);
+      }
+      const before = current[path];
+      return same(before, after) ? [] : [{ path, kind: "changed", before, after }];
+    });
+    const identityChanged = changes.some((change) => !KEEPS_SECRET.has(change.path));
+    const secret = identityChanged || options.rotateSecrets ? "set" : "keep";
+    plans.push({
+      provider,
+      action: changes.length > 0 || secret === "set" ? "update" : "none",
+      fields: changes,
+      secret,
+      secretEnv,
+      enabledBefore,
+      enabledAfter,
+      weakened: providerWeakenings(provider, {
+        additionalClientIds: clientIdsOf(current),
+        enabled: enabledBefore,
+        ...countOf(provider, enabledBefore && !enabledAfter)
+      }, fields),
+      ...countOf(provider, enabledBefore && !enabledAfter)
+    });
+  }
+  return plans;
+}
+function providersGoingOff2(remote, desired, options) {
+  return planProviders2(remote, desired, options).filter((change) => change.enabledBefore && !change.enabledAfter).map((change) => change.provider);
+}
+function planMarker(remote, configHash) {
+  const current = remote.managedBy;
+  if (current === undefined) {
+    return { supported: false, pending: false, reason: "none", current: null, configHash };
+  }
+  const reason = current === null ? "unmanaged" : current.tool !== MANAGING_TOOL2 ? "other-tool" : current.configHash !== configHash ? "other-config" : current.drifted ? "drifted" : "none";
+  return { supported: true, pending: reason !== "none", reason, current, configHash };
+}
+function unknownTemplateKind(path) {
+  for (const [prefix, known] of [
+    [EMAIL_TEMPLATES_PATH, isEmailTemplateKind],
+    [SMS_TEMPLATES_PATH, isSmsTemplateKind]
+  ]) {
+    if (path.startsWith(`${prefix}.`)) {
+      const [kind = ""] = path.slice(prefix.length + 1).split(".");
+      return !known(kind);
+    }
+  }
+  return false;
+}
+function weakenings(before, after) {
+  try {
+    return settingsWeakenings(parseStoredEnvironmentSettings(before), parseStoredEnvironmentSettings(after));
+  } catch {
+    return [];
+  }
+}
+function buildPlan2(remote, environment, options) {
+  const kept = [];
+  const body = structuredClone(environment.settings);
+  if (body.password === undefined) {
+    body.password = structuredClone(remote.settings.password);
+    kept.push(DEPLOYMENT_DEFAULTS[0]);
+  }
+  if (body.urls.allowedOrigins === undefined) {
+    body.urls.allowedOrigins = [...remote.settings.urls.allowedOrigins];
+    kept.push(DEPLOYMENT_DEFAULTS[1]);
+  }
+  const settings = diffValues2(remote.settings, body);
+  const unknown = settings.filter((change) => change.kind === "removed" && (!NAMED_ENTRY_PATHS.some((prefix) => change.path.startsWith(`${prefix}.`)) || unknownTemplateKind(change.path))).map((change) => change.path);
+  const providers = planProviders2(remote.providers, environment.providers, options, remote.dependents);
+  const webhooks = planWebhooks(remote.webhooks, environment.webhooks, options);
+  const hooks = planHooks(remote.hooks, environment.hooks, options);
+  const nativeApps = planNativeApps(remote.nativeApps, environment.nativeApps, options);
+  const marker = planMarker(remote, options.configHash);
+  return {
+    revision: remote.revision,
+    settings,
+    weakened: [
+      ...weakenings(remote.settings, body),
+      ...providers.flatMap((provider) => provider.weakened),
+      ...hooks.hooks.flatMap((hook) => hook.weakened),
+      ...nativeApps.apps.flatMap((app) => app.weakened)
+    ],
+    kept,
+    unknown,
+    providers,
+    webhooks,
+    hooks,
+    nativeApps,
+    marker,
+    body,
+    changes: settings.length > 0 || marker.pending || providers.some((provider) => ["create", "update", "delete"].includes(provider.action)) || webhooks.endpoints.some((endpoint) => ["create", "update", "delete", "ambiguous"].includes(endpoint.action)) || hooks.hooks.some((hook) => ["create", "update", "delete"].includes(hook.action)) || nativeApps.apps.some((app) => ["create", "update", "delete"].includes(app.action))
+  };
+}
+function orderOperations2(plan) {
+  const settings = plan.settings.length > 0 || plan.marker.pending ? [{ kind: "settings" }] : [];
+  const writes = plan.providers.filter((change) => change.action === "create" || change.action === "update");
+  const takesAway = (change) => change.enabledBefore && !change.enabledAfter;
+  const set = (change) => ({
+    kind: "provider.set",
+    provider: change.provider,
+    change
+  });
+  const adding = writes.filter((change) => !takesAway(change)).map(set);
+  const removing = writes.filter(takesAway).map(set);
+  const deleting = plan.providers.filter((change) => change.action === "delete").map((change) => ({ kind: "provider.delete", provider: change.provider, change }));
+  const signIn = hasEnabledSignInMethod(plan.body) ? [...settings, ...adding, ...removing, ...deleting] : [...adding, ...settings, ...removing, ...deleting];
+  return [
+    ...signIn,
+    ...orderWebhooks(plan.webhooks),
+    ...orderHooks(plan.hooks),
+    ...orderNativeApps(plan.nativeApps)
+  ];
+}
+function orderNativeApps(nativeApps) {
+  const removals = [];
+  const narrowing = [];
+  const widening = [];
+  const creates = [];
+  for (const change of nativeApps.apps) {
+    const { id, entry } = change;
+    if (change.action === "create" && entry) {
+      creates.push({ kind: "nativeApp.create", entry, change });
+    } else if (id !== undefined && change.action === "update" && entry) {
+      const bucket = change.weakened.length > 0 ? widening : narrowing;
+      bucket.push({ kind: "nativeApp.update", id, entry, change });
+    } else if (id !== undefined && change.action === "delete") {
+      removals.push({ kind: "nativeApp.delete", id, change });
+    }
+  }
+  return [...removals, ...narrowing, ...widening, ...creates];
+}
+function isHookPoint(point) {
+  return HOOK_POINTS.includes(point);
+}
+function orderHooks(hooks) {
+  const creates = [];
+  const tightening = [];
+  const loosening = [];
+  const removals = [];
+  for (const change of hooks.hooks) {
+    const { point, id } = change;
+    if (!isHookPoint(point)) {
+      continue;
+    }
+    if (change.action === "create") {
+      creates.push({ kind: "hook.create", point, change });
+    } else if (id !== undefined && change.action === "update") {
+      const bucket = change.weakened.length > 0 ? loosening : tightening;
+      bucket.push({ kind: "hook.update", point, id, change });
+    } else if (id !== undefined && change.action === "delete") {
+      removals.push({ kind: "hook.delete", point, id, change });
+    }
+  }
+  return [...creates, ...tightening, ...loosening, ...removals];
+}
+function orderWebhooks(webhooks) {
+  const updates = [];
+  const creates = [];
+  const removals = [];
+  for (const change of webhooks.endpoints) {
+    if (change.action === "create") {
+      creates.push({ kind: "webhook.create", url: change.url, change });
+    } else if (change.id !== undefined && change.action === "update") {
+      updates.push({ kind: "webhook.update", url: change.url, id: change.id, change });
+    } else if (change.id !== undefined && change.action === "delete") {
+      removals.push({ kind: "webhook.delete", url: change.url, id: change.id, change });
+    }
+  }
+  return [
+    ...updates,
+    ...removals.slice(0, webhooks.removedFirst),
+    ...creates,
+    ...removals.slice(webhooks.removedFirst)
+  ];
+}
+
+// src/doctor.ts
+import { isTulaAdminError } from "@tula-tech/admin";
+
+// src/version.ts
+var VERSION2 = "0.1.1";
+
+// src/doctor.ts
+var SKEW_WARN_MS = 5000;
+var SKEW_FAIL_MS = 30000;
+var STATUS_TIMEOUT_MS = 1e4;
+var STATUSES = new Set(["ok", "warn", "fail", "skipped"]);
+var CONTROLS = /[\u{0}-\u{1F}\u{7F}-\u{9F}\p{Zl}\p{Zp}]/gu;
+var INVISIBLE = /[\p{Cf}\p{Co}\p{Cn}\p{Cs}]/gu;
+function printable2(value, max = 600) {
+  const text = typeof value === "string" ? value : "";
+  return text.replace(CONTROLS, " ").replace(INVISIBLE, "").slice(0, max).replace(INVISIBLE, "");
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function serverChecks(data) {
+  const checks = isRecord(data) && Array.isArray(data.checks) ? data.checks : [];
+  return checks.filter(isRecord).map((check) => ({
+    id: printable2(check.id, 60) || "unknown",
+    source: "server",
+    status: typeof check.status === "string" && STATUSES.has(check.status) ? check.status : "fail",
+    summary: printable2(check.summary),
+    ...typeof check.fix === "string" ? { fix: printable2(check.fix) } : {},
+    ...Array.isArray(check.values) ? { values: check.values.slice(0, 50).map((value) => printable2(value, 300)) } : {}
+  }));
+}
+async function status(io, url, signal) {
+  const send = io.fetch ?? ((target, init) => fetch(target, init));
+  try {
+    const response = await send(`${url}/v1/status`, {
+      method: "GET",
+      headers: { accept: "application/json", "user-agent": `tula-cli/${VERSION2}` },
+      redirect: "manual",
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(STATUS_TIMEOUT_MS)]) : AbortSignal.timeout(STATUS_TIMEOUT_MS)
+    });
+    const body = await response.json().catch(() => null);
+    const version = isRecord(body) && typeof body.version === "string" ? body.version : undefined;
+    return { status: response.status, version: version && printable2(version, 40) };
+  } catch {
+    return null;
+  }
+}
+function parseUrl(text) {
+  try {
+    return new URL(text);
+  } catch {
+    return null;
+  }
+}
+function isLoopback(url) {
+  try {
+    const host = new URL(url).hostname.toLowerCase();
+    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function refusedCheck(error) {
+  const base = { id: "server_checks", source: "cli" };
+  if (isTulaAdminError(error)) {
+    if (error.status === 404) {
+      return {
+        ...base,
+        status: "warn",
+        summary: "The server has no instance admin token, so its own checks (database, migrations, master key, mail, Redis) did not run.",
+        fix: "Set TULA_ADMIN_TOKEN in the API\u2019s environment (`openssl rand -hex 32`), restart it, and set the same value here."
+      };
+    }
+    if (error.status === 401) {
+      return {
+        ...base,
+        status: "fail",
+        summary: "The server refused the admin token.",
+        fix: "Set TULA_ADMIN_TOKEN here to the value in the API\u2019s environment (or pass --admin-token-file). After changing it on the server, restart the API."
+      };
+    }
+    if (error.code === "service.unavailable") {
+      return {
+        ...base,
+        status: "fail",
+        summary: "The API refused the request because the store behind its rate limits (Redis) does not answer.",
+        fix: "Check REDIS_URL in the API\u2019s environment and that Redis is running and reachable from the API. Until it answers, sign-in is refused too."
+      };
+    }
+    if (error.code === "rate_limited") {
+      return {
+        ...base,
+        status: "fail",
+        summary: "The API is rate limiting this machine\u2019s diagnostics requests.",
+        fix: "Wait a minute and run `tula doctor` again."
+      };
+    }
+    return {
+      ...base,
+      status: "fail",
+      summary: `The server-side checks could not be read (${printable2(error.code, 60)}${error.status > 0 ? `, HTTP ${error.status}` : ""}).`,
+      fix: "Check that TULA_API_URL is the Tula API itself (not a page in front of it) and that the CLI and the server are the same version."
+    };
+  }
+  return {
+    ...base,
+    status: "fail",
+    summary: "The server-side checks could not be read.",
+    fix: "Run `tula doctor` again; if it persists, look at the API\u2019s logs."
+  };
+}
+async function examine2(input) {
+  const { apiUrl, instance, io, signal } = input;
+  const now = io.now ?? (() => new Date);
+  const report = { apiUrl, checks: [] };
+  const answer = await status(io, apiUrl, signal);
+  if (answer?.status !== 200) {
+    report.checks.push({
+      id: "api",
+      source: "cli",
+      status: "fail",
+      summary: answer ? `The API URL answers with HTTP ${answer.status} instead of the API\u2019s status.` : "The API cannot be reached from this machine.",
+      fix: "Check TULA_API_URL (or --api-url): it is the address of the Tula API, with no path. Check that the API is running (`tula dev`, or `docker compose ps`) and, for https, that its certificate is valid."
+    });
+    return report;
+  }
+  report.version = answer.version;
+  report.checks.push({
+    id: "api",
+    source: "cli",
+    status: "ok",
+    summary: `The API answers${apiUrl.startsWith("https:") ? " over TLS" : ""}.`
+  });
+  report.checks.push(answer.version === VERSION2 ? {
+    id: "version",
+    source: "cli",
+    status: "ok",
+    summary: `The CLI and the API are the same version (${VERSION2}).`
+  } : {
+    id: "version",
+    source: "cli",
+    status: "warn",
+    summary: `The CLI is version ${VERSION2} and the API is ${answer.version ?? "unknown"}.`,
+    fix: "Use the CLI of the API\u2019s version: a different one may not know every setting or check."
+  });
+  if (!instance) {
+    report.checks.push({
+      id: "server_checks",
+      source: "cli",
+      status: "warn",
+      summary: "No admin token here, so the server\u2019s own checks (database, migrations, master key, mail, Redis) did not run.",
+      fix: "Set TULA_ADMIN_TOKEN to the value in the API\u2019s environment, or pass --admin-token-file <path>."
+    });
+    return report;
+  }
+  const before = now().getTime();
+  let data;
+  try {
+    data = (await instance.call("getInstanceDiagnostics", { signal })).data;
+  } catch (error) {
+    report.checks.push(refusedCheck(error));
+    return report;
+  }
+  const after = now().getTime();
+  const body = isRecord(data) ? data : {};
+  report.environment = printable2(body.environment, 20) || undefined;
+  const server = serverChecks(data);
+  const serverTime = typeof body.time === "string" ? Date.parse(body.time) : Number.NaN;
+  if (!Number.isNaN(serverTime)) {
+    const skewMs = Math.abs(serverTime - (before + after) / 2);
+    report.checks.push(skewMs < SKEW_WARN_MS ? {
+      id: "local_clock",
+      source: "cli",
+      status: "ok",
+      summary: "This machine\u2019s clock and the API\u2019s agree."
+    } : {
+      id: "local_clock",
+      source: "cli",
+      status: skewMs >= SKEW_FAIL_MS ? "fail" : "warn",
+      summary: `This machine\u2019s clock and the API\u2019s differ by about ${Math.round(skewMs / 1000)} seconds.`,
+      fix: "Synchronize the clocks (NTP). A server that verifies Tula\u2019s tokens on a clock this far off refuses valid ones or accepts expired ones."
+    });
+  }
+  const skipped = server.find((check) => check.id === "public_url" && check.status === "skipped");
+  const named = typeof body.publicUrl === "string" ? parseUrl(body.publicUrl) : null;
+  if (skipped && named && isLoopback(named.href)) {
+    const configured = parseUrl(apiUrl);
+    if (configured && named.origin === configured.origin && named.username === "" && named.password === "") {
+      const reached = apiUrl.replace(/\/+$/, "") === named.origin ? answer : await status(io, named.origin, signal);
+      Object.assign(skipped, reached?.status === 200 ? {
+        source: "cli",
+        status: "ok",
+        summary: "PUBLIC_URL is a loopback address and reaches the API from this machine."
+      } : {
+        source: "cli",
+        status: "warn",
+        summary: "PUBLIC_URL is a loopback address that does not reach the API from this machine.",
+        fix: "Set PUBLIC_URL in the API\u2019s environment to the address clients use to reach it (for local development, the port the API is published on), and restart it."
+      });
+    } else {
+      Object.assign(skipped, {
+        source: "cli",
+        status: "skipped",
+        summary: "PUBLIC_URL is a loopback address other than the API URL given here, so it was not requested: `tula doctor` asks only the address you give it. If clients reach the API there, run `tula doctor --api-url <PUBLIC_URL>`; if not, set PUBLIC_URL to the address they use."
+      });
+    }
+  }
+  report.checks.push(...server);
+  return report;
+}
+function exitCode2(report, strict) {
+  const failing = (check) => check.status === "fail" || strict && check.status === "warn";
+  return report.checks.some(failing) ? 1 : 0;
+}
+function reportToJson2(report, strict) {
+  return { ...report, ok: exitCode2(report, strict) === 0 };
+}
+function renderReport2(output, report) {
+  const { style } = output;
+  const labels = {
+    ok: style.green("ok     "),
+    warn: style.yellow("warn   "),
+    fail: style.red("FAIL   "),
+    skipped: style.dim("skipped")
+  };
+  const about = [report.environment, report.version && `version ${report.version}`].filter(Boolean).join(", ");
+  output.line(style.bold(`tula doctor: ${report.apiUrl}${about ? ` (${about})` : ""}`));
+  output.line();
+  const width = Math.max(...report.checks.map((check) => check.id.length));
+  const indent = " ".repeat(2 + 7 + 2 + width + 2);
+  for (const check of report.checks) {
+    output.line(`  ${labels[check.status]}  ${check.id.padEnd(width)}  ${check.summary}`);
+    for (const value of check.values ?? []) {
+      output.line(`${indent}- ${value}`);
+    }
+    if (check.fix !== undefined && check.status !== "ok") {
+      output.line(`${indent}fix: ${check.fix}`);
+    }
+  }
+  output.line();
+  const count = (status) => report.checks.filter((check) => check.status === status).length;
+  const warnings = count("warn");
+  output.line(`${count("ok")} ok, ${count("fail")} failed, ${warnings} warning${warnings === 1 ? "" : "s"}, ${count("skipped")} skipped.`);
+}
+
+// src/framework.ts
+import { isTulaAdminError as isTulaAdminError2 } from "@tula-tech/admin";
+import { isConfigError } from "@tula-tech/config";
+
+// src/output.ts
+function shouldUseColor2(sink, env) {
+  const noColor = env.NO_COLOR;
+  return sink.isTTY === true && (noColor === undefined || noColor === "") && env.TERM !== "dumb";
+}
+function styles(color) {
+  const wrap = (open, close) => (text) => color ? `\x1B[${open}m${text}\x1B[${close}m` : text;
+  return {
+    green: wrap(32, 39),
+    red: wrap(31, 39),
+    yellow: wrap(33, 39),
+    dim: wrap(2, 22),
+    bold: wrap(1, 22)
+  };
+}
+var MIN_REDACTED_LENGTH = 6;
+function createOutput2(stdout, stderr, env) {
+  const secrets = new Set;
+  const errorSecrets = new Set;
+  const clean = (text, sets) => {
+    let cleaned = text;
+    for (const set of sets) {
+      for (const secret of set) {
+        cleaned = cleaned.split(secret).join("[redacted]");
+      }
+    }
+    return cleaned;
+  };
+  return {
+    line: (text = "") => {
+      stdout.write(`${clean(text, [secrets])}
+`);
+    },
+    error: (text) => {
+      stderr.write(`${clean(text, [secrets, errorSecrets])}
+`);
+    },
+    style: styles(shouldUseColor2(stdout, env)),
+    errorStyle: styles(shouldUseColor2(stderr, env)),
+    redact: (value, scope = "all") => {
+      const trimmed = value.trim();
+      if (scope === "errors") {
+        if (trimmed.length >= MIN_REDACTED_LENGTH) {
+          errorSecrets.add(trimmed);
+        }
+        return;
+      }
+      if (trimmed.length >= MIN_REDACTED_LENGTH) {
+        secrets.add(trimmed);
+        for (const line of trimmed.split(`
+`)) {
+          if (line.trim().length >= MIN_REDACTED_LENGTH * 4) {
+            secrets.add(line.trim());
+          }
+        }
+      }
+    }
+  };
+}
+
+// src/framework.ts
+var EXIT2 = { ok: 0, error: 1, changes: 2, refused: 2 };
+function optionLines(options) {
+  const all = {
+    ...options,
+    help: { type: "boolean", short: "h", description: "Show this help." }
+  };
+  const rows = Object.entries(all).map(([name, spec]) => [
+    `${spec.short ? `-${spec.short}, ` : "    "}--${name}${spec.value ? ` ${spec.value}` : ""}`,
+    spec.description
+  ]);
+  const width = Math.max(...rows.map(([left]) => left.length));
+  return rows.map(([left, right]) => `  ${left.padEnd(width)}  ${right}`);
+}
+function commandHelp(command) {
+  return [
+    `Usage: ${command.usage}`,
+    "",
+    command.description ?? command.summary,
+    "",
+    "Options:",
+    ...optionLines(command.options)
+  ];
+}
+function generalHelp(commands) {
+  const width = Math.max(...commands.map((command) => command.name.length));
+  return [
+    "Usage: tula <command> [options]",
+    "",
+    "Commands:",
+    ...commands.map((command) => `  ${command.name.padEnd(width)}  ${command.summary}`),
+    "",
+    "Run `tula <command> --help` for a command\u2019s options."
+  ];
+}
+function reportAdminError(output, error) {
+  const { errorStyle } = output;
+  const where = error.status > 0 ? ` (${error.code}, HTTP ${error.status})` : ` (${error.code})`;
+  output.error(`${errorStyle.red("error:")} ${error.message}${where}`);
+  for (const problem of error.errors) {
+    output.error(`  ${problem.field}: ${problem.message}`);
+  }
+  if (error.retryAfterMs !== undefined) {
+    output.error(`  Try again in ${Math.ceil(error.retryAfterMs / 1000)}s.`);
+  }
+}
+function reportError2(output, error) {
+  const { errorStyle } = output;
+  if (isTulaAdminError2(error)) {
+    reportAdminError(output, error);
+  } else if (isConfigError(error) || error instanceof UsageError2) {
+    output.error(`${errorStyle.red("error:")} ${error.message}`);
+  } else {
+    const text = error instanceof Error ? `${error.name}: ${error.message}` : "an unknown error";
+    output.error(`${errorStyle.red("error:")} unexpected failure (${text})`);
+  }
+  return EXIT2.error;
+}
+async function runCli2(argv, io, commands) {
+  const output = createOutput2(io.stdout, io.stderr, io.env);
+  const [name, ...rest] = argv;
+  if (name === undefined || name === "--help" || name === "-h" || name === "help") {
+    for (const line of generalHelp(commands)) {
+      output.line(line);
+    }
+    return name === undefined ? EXIT2.error : EXIT2.ok;
+  }
+  if (name === "--version" || name === "-v") {
+    output.line(VERSION2);
+    return EXIT2.ok;
+  }
+  const command = commands.find((candidate) => candidate.name === name);
+  if (!command) {
+    const shown = name.startsWith("-") ? "an option" : `"${name.slice(0, 40)}"`;
+    output.error(`${output.errorStyle.red("error:")} ${shown} is not a tula command.`);
+    for (const line of generalHelp(commands)) {
+      output.error(line);
+    }
+    return EXIT2.error;
+  }
+  try {
+    const parsed = parseArgs2(rest, {
+      ...command.options,
+      help: { type: "boolean", short: "h", description: "Show this help." }
+    });
+    if (parsed.flags.help) {
+      for (const line of commandHelp(command)) {
+        output.line(line);
+      }
+      return EXIT2.ok;
+    }
+    const allowed = command.maxPositionals ?? 0;
+    if (parsed.positionals.length > allowed) {
+      throw new UsageError2(allowed === 0 ? `tula ${command.name} takes no arguments, only options.` : `tula ${command.name} takes at most ${allowed} argument${allowed === 1 ? "" : "s"}. Usage: ${command.usage}`);
+    }
+    return await command.run({ ...parsed, io, output });
+  } catch (error) {
+    return reportError2(output, error);
+  }
+}
+
+// src/render.ts
+import {
+  MAX_EMAIL_BODY_LENGTH,
+  MAX_NATIVE_APPS as MAX_NATIVE_APPS2,
+  MAX_WEBHOOK_ENDPOINTS as MAX_WEBHOOK_ENDPOINTS2,
+  MAX_WEBHOOK_URL_LENGTH
+} from "@tula-tech/contract";
+var MAX_VALUE_LENGTH = 100;
+function show(value) {
+  const text = JSON.stringify(value) ?? "undefined";
+  return text.length > MAX_VALUE_LENGTH ? `${text.slice(0, MAX_VALUE_LENGTH - 1)}\u2026` : text;
+}
+function shown(change, value) {
+  return typeof value === "string" && isTemplatePath(change.path) ? show(printable2(value, MAX_EMAIL_BODY_LENGTH)) : show(value);
+}
+function settingLine(output, change) {
+  const { style } = output;
+  if (change.kind === "added") {
+    return style.green(`  + ${change.path}: ${shown(change, change.after)}`);
+  }
+  if (change.kind === "removed") {
+    const note = isTemplatePath(change.path) ? " (the built-in copy is sent)" : "";
+    return style.red(`  - ${change.path}: ${shown(change, change.before)}${note}`);
+  }
+  if (change.added || change.removed) {
+    const entries = [
+      ...(change.added ?? []).map((entry) => `+${show(entry)}`),
+      ...(change.removed ?? []).map((entry) => `-${show(entry)}`)
+    ];
+    return style.yellow(`  ~ ${change.path}: ${entries.join(" ")}`);
+  }
+  return style.yellow(`  ~ ${change.path}: ${shown(change, change.before)} \u2192 ${shown(change, change.after)}`);
+}
+function secretNote(change) {
+  if (change.secret === "set") {
+    return `secret set from $${change.secretEnv ?? "?"}`;
+  }
+  return change.secret === "keep" ? "stored secret kept" : "";
+}
+function clean(entry) {
+  return typeof entry === "string" ? printable2(entry, 128) : entry;
+}
+function providerLine(output, change) {
+  const { style } = output;
+  const fields = change.fields.map((field) => {
+    if (field.added || field.removed) {
+      const entries = [
+        ...(field.added ?? []).map((entry) => `+${show(clean(entry))}`),
+        ...(field.removed ?? []).map((entry) => `-${show(clean(entry))}`)
+      ];
+      return `${field.path} ${entries.join(" ")}`;
+    }
+    return field.kind === "changed" ? `${field.path} ${show(field.before)} \u2192 ${show(field.after)}` : `${field.path} ${show(field.after)}`;
+  });
+  const details = [...fields, secretNote(change)].filter((part) => part !== "").join(", ");
+  const suffix = details === "" ? "" : ` (${details})`;
+  switch (change.action) {
+    case "create":
+      return style.green(`  + ${change.provider}: create${suffix}`);
+    case "update":
+      return style.yellow(`  ~ ${change.provider}: update${suffix}`);
+    case "delete":
+      return style.red(`  - ${change.provider}: delete`);
+    case "unmanaged":
+      return style.dim(`  = ${change.provider}: unmanaged (on the server, not in the file; --prune deletes it)`);
+    default:
+      return style.dim(`  = ${change.provider}: unchanged`);
+  }
+}
+function address(url) {
+  return printable2(url, MAX_WEBHOOK_URL_LENGTH);
+}
+var plural = (count, one, many) => count === 1 ? one : many;
+function removedEndpoints(count) {
+  return `${count} webhook ${plural(count, "endpoint with its", "endpoints with their")} pending deliveries and ${plural(count, "its delivery log", "their delivery logs")}`;
+}
+function webhookFields(change) {
+  return change.fields.map((field) => {
+    if (field.path === "eventTypes") {
+      const entries = field.kind === "added" ? field.after.map((entry) => show(entry)) : [
+        ...(field.added ?? []).map((entry) => `+${show(entry)}`),
+        ...(field.removed ?? []).map((entry) => `-${show(entry)}`)
+      ];
+      return `eventTypes ${entries.join(" ")}`;
+    }
+    if (field.kind === "added") {
+      return `${field.path} ${show(field.after)}`;
+    }
+    const why = change.reenables === undefined ? "" : ` (the server had switched it off: ${printable2(change.reenables, 60)})`;
+    return `${field.path} ${show(field.before)} \u2192 ${show(field.after)}${why}`;
+  });
+}
+function webhookLine(output, change) {
+  const { style } = output;
+  const url = address(change.url);
+  const fields = webhookFields(change).join(", ");
+  switch (change.action) {
+    case "create":
+      return style.green(`  + ${url}: create (${fields}; a signing secret is made, shown once)`);
+    case "update":
+      return style.yellow(`  ~ ${url}: update (${fields})`);
+    case "delete":
+      return style.red(`  - ${url}: remove, with its pending deliveries and its delivery log`);
+    case "unmanaged":
+      return style.dim(`  = ${url}: unmanaged (on the server, not in the file; --prune removes it, with its pending deliveries and its delivery log)`);
+    case "ambiguous":
+      return style.red(`  ! ${url}: cannot be matched (the server has ${change.duplicates?.length ?? 0} endpoints with this address)`);
+    default:
+      return style.dim(`  = ${url}: unchanged`);
+  }
+}
+function pointName(point) {
+  return printable2(point, 60);
+}
+function hookFields(change) {
+  return change.fields.map((field) => {
+    const value = (entry) => field.path === "url" ? address(String(entry)) : show(entry);
+    return field.kind === "added" ? `${field.path} ${value(field.after)}` : `${field.path} ${value(field.before)} \u2192 ${value(field.after)}`;
+  });
+}
+function hookLine(output, change) {
+  const { style } = output;
+  const point = pointName(change.point);
+  const fields = hookFields(change).join(", ");
+  switch (change.action) {
+    case "create":
+      return style.green(`  + ${point}: create (${fields}; a signing secret is made, shown once)`);
+    case "update":
+      return style.yellow(`  ~ ${point}: update (${fields})`);
+    case "delete":
+      return style.red(`  - ${point}: remove (${address(change.url)}), with its signing secret`);
+    case "unmanaged":
+      return style.dim(`  = ${point}: unmanaged (on the server, not in the file; --prune removes it)`);
+    case "unknown":
+      return style.dim(`  = ${point}: a point this version of tula does not know (left alone, also with --prune)`);
+    default:
+      return style.dim(`  = ${point}: unchanged`);
+  }
+}
+function appName(change) {
+  return `${printable2(change.platform, 20)} ${printable2(change.identifier, 255)}`;
+}
+function appValue(value) {
+  return printable2(String(value), 95);
+}
+function nativeAppFields2(change) {
+  return change.fields.map((field) => {
+    if (field.path === "sha256CertFingerprints" || field.path === "appLinkPaths") {
+      const entries = field.kind === "added" ? field.after.map(appValue) : [
+        ...(field.added ?? []).map((entry) => `+${appValue(entry)}`),
+        ...(field.removed ?? []).map((entry) => `-${appValue(entry)}`)
+      ];
+      return `${field.path} ${entries.join(" ")}`;
+    }
+    return field.kind === "added" ? `${field.path} ${appValue(field.after)}` : `${field.path} ${appValue(field.before)} \u2192 ${appValue(field.after)}`;
+  });
+}
+function unmanagedLinkPathsLine(change) {
+  const count = change.unmanagedLinkPaths ?? 0;
+  if (count === 0) {
+    return null;
+  }
+  const paths = count === 1 ? "1 link path" : `${count} link paths`;
+  return `      ${paths} on the server, not managed by the file (kept; write appLinkPaths to manage them, [] to remove them)`;
+}
+function nativeAppLine(output, change) {
+  const { style } = output;
+  const name = appName(change);
+  const fields = nativeAppFields2(change).join(", ");
+  switch (change.action) {
+    case "create":
+      return style.green(`  + ${name}: register (${fields})`);
+    case "update":
+      return style.yellow(`  ~ ${name}: update (${fields})`);
+    case "delete":
+      return style.red(`  - ${name}: remove (the served files stop naming it)`);
+    case "unmanaged":
+      return style.dim(`  = ${name}: unmanaged (on the server, not in the file; --prune removes it)`);
+    case "unknown":
+      return style.dim(`  = ${name}: a platform this version of tula does not know (left alone, also with --prune)`);
+    default:
+      return style.dim(`  = ${name}: unchanged`);
+  }
+}
+function hookCounts(plan) {
+  const count = (action) => plan.hooks.hooks.filter((hook) => hook.action === action).length;
+  return { created: count("create"), removed: count("delete") };
+}
+function webhookCounts(plan) {
+  const count = (action) => plan.webhooks.endpoints.filter((endpoint) => endpoint.action === action).length;
+  return { created: count("create"), removed: count("delete") };
+}
+function planBlockers(plan) {
+  const blockers = [];
+  for (const change of plan.webhooks.endpoints) {
+    if (change.action === "ambiguous") {
+      const ids = (change.duplicates ?? []).map((id) => printable2(id, 40));
+      blockers.push(`The server has ${ids.length} webhook endpoints with the address ${address(change.url)} ` + `(ids ${ids.join(", ")}): tula cannot tell which one the file means and changes none ` + "of them. Remove all but one by hand (DELETE /v1/admin/webhook-endpoints/<id>), then " + "run again.");
+    }
+  }
+  if (plan.webhooks.overLimit !== null) {
+    blockers.push(`The environment would have ${plan.webhooks.overLimit} webhook endpoints and may have ${MAX_WEBHOOK_ENDPOINTS2}.`);
+  }
+  const apps = plan.nativeApps?.overLimit ?? null;
+  if (apps !== null) {
+    blockers.push(`The environment would have ${apps} native apps and may have ${MAX_NATIVE_APPS2}.`);
+  }
+  return blockers;
+}
+var OVER_LIMIT_ADVICE = "List fewer in the file, or remove the ones it does not list (--prune).";
+var MARKER_REASONS = {
+  unmanaged: "the server does not record a config file as the source of these settings yet",
+  "other-tool": "another tool is on record as managing these settings",
+  "other-config": "another version of the config file was applied last",
+  drifted: "the settings were changed outside the config file since the last apply",
+  none: ""
+};
+function deletedAuditAge(plan) {
+  const retentionDays = plan.body.audit?.retentionDays;
+  return plan.weakened.includes("audit.retentionDays") && typeof retentionDays === "number" ? retentionDays : null;
+}
+function switchesOffTextedSecondStep(plan) {
+  return plan.settings.some((change) => change.path === "mfa.smsCode.enabled" && change.before === true && change.after !== true);
+}
+var TEXTED_SECOND_STEP_LOCKED = "those whose only second step is a texted code cannot sign in until it is back or an administrator resets their two-step verification";
+var MAX_COUNTRIES_NAMED = 20;
+function countriesTakenOut(plan) {
+  const change = plan.settings.find((entry) => entry.path === "sms.allowedCountries");
+  const removed = change?.removed ?? [];
+  return removed.filter((entry) => typeof entry === "string").map((entry) => printable2(entry, 8)).sort();
+}
+function dependentAccountLines(plan) {
+  return plan.providers.flatMap((change) => {
+    if (change.dependents === undefined) {
+      return [];
+    }
+    const outcome = change.action === "delete" ? "until it is configured again" : "while it is off";
+    if (change.dependents === null) {
+      return [
+        `the accounts that can sign in only with ${change.provider} could not be counted (this server has no count): if there are any they are locked out ${outcome}, and this plan was not judged for them`
+      ];
+    }
+    if (change.dependents === DEPENDENTS_UNREAD2) {
+      return [
+        `the accounts that can sign in only with ${change.provider} could not be counted (the count could not be read): if there are any they are locked out ${outcome}, and this plan is taken to weaken security`
+      ];
+    }
+    const { accounts, more } = change.dependents;
+    if (accounts === 0 && !more) {
+      return [];
+    }
+    if (accounts === 0) {
+      return [
+        `none of the accounts the server read can sign in only with ${change.provider}, and it did not read them all: the rest were not looked at, so how many there are is not known`
+      ];
+    }
+    const count = `${more ? "at least " : ""}${accounts}`;
+    const one = accounts === 1 && !more;
+    return [
+      `${count} ${accounts === 1 ? "account" : "accounts"} can sign in only with ${change.provider}: ${one ? "it is" : "they are"} locked out ${outcome}`
+    ];
+  });
+}
+function switchesTextMessagesOff(plan) {
+  return plan.settings.some((change) => change.path === "sms.enabled" && change.before === true && change.after !== true);
+}
+function planWarnings2(plan) {
+  const warnings = [];
+  if (plan.weakened.length > 0) {
+    warnings.push(`weakens security: ${plan.weakened.join(", ")} (\`tula apply --yes\` needs --allow-weaker)`);
+  }
+  warnings.push(...dependentAccountLines(plan));
+  const doomed = deletedAuditAge(plan);
+  if (doomed !== null) {
+    warnings.push(`deletes audit entries older than ${doomed} days, for good, starting with the next retention run (every ten minutes; a large backlog takes several)`);
+  }
+  if (switchesOffTextedSecondStep(plan)) {
+    warnings.push("switches off the texted code as the second step (mfa.smsCode: off in the file, or left out of it): users whose only second step is a texted code cannot sign in until it is on again or an administrator resets their two-step verification");
+  }
+  if (switchesTextMessagesOff(plan)) {
+    warnings.push(`switches text messages off (sms.enabled: off in the file, or left out of it): no user can receive a code any more, and ${TEXTED_SECOND_STEP_LOCKED}`);
+  }
+  const countries = countriesTakenOut(plan);
+  if (countries.length > 0) {
+    const named = countries.slice(0, MAX_COUNTRIES_NAMED).join(", ");
+    const more = countries.length - MAX_COUNTRIES_NAMED;
+    warnings.push(`stops text messages to ${named}${more > 0 ? ` and ${more} more` : ""} (taken out of sms.allowedCountries): users whose number is there can no longer receive a code, unless a country that stays shares its prefix, and ${TEXTED_SECOND_STEP_LOCKED}`);
+  }
+  const { created, removed } = webhookCounts(plan);
+  if (removed > 0) {
+    warnings.push(`removes ${removedEndpoints(removed)}, for good (\`tula apply --yes\` needs --allow-webhook-removal)`);
+  }
+  if (created > 0) {
+    warnings.push(`creates ${created} webhook ${plural(created, "endpoint: its signing secret is", "endpoints: each signing secret is")} shown once, to the run that creates it (\`tula apply\` needs --secrets-file <path>, --show-secrets or --discard-secrets)`);
+  }
+  const hooks = hookCounts(plan).created;
+  if (hooks > 0) {
+    warnings.push(`creates ${hooks} ${plural(hooks, "hook: its signing secret is", "hooks: each signing secret is")} shown once, to the run that creates it (\`tula apply\` needs --secrets-file <path>, --show-secrets or --discard-secrets)`);
+  }
+  for (const change of plan.webhooks.endpoints) {
+    if (change.reenables !== undefined) {
+      warnings.push(`switches on a webhook endpoint the server switched off (${address(change.url)}: ${printable2(change.reenables, 60)}); if it still fails the server switches it off again`);
+    }
+  }
+  const first = plan.webhooks.removedFirst;
+  if (first > 0) {
+    warnings.push(`the environment is at its limit of ${MAX_WEBHOOK_ENDPOINTS2} webhook endpoints: ${first} of the removals ${plural(first, "is", "are")} made before the new ${plural(created, "endpoint is", "endpoints are")} created, to make room`);
+  }
+  if (plan.marker.reason === "other-tool") {
+    warnings.push(MARKER_REASONS["other-tool"]);
+  }
+  if (plan.marker.current?.drifted) {
+    warnings.push(MARKER_REASONS.drifted);
+  }
+  if (plan.unknown.length > 0) {
+    warnings.push(`the server has settings this version of tula does not know (${plan.unknown.join(", ")}); ` + "applying resets them to their defaults, so `tula apply` refuses without " + "--allow-unknown. Upgrade tula first.");
+  }
+  return warnings;
+}
+function applyRequirements2(plan) {
+  const { created, removed } = webhookCounts(plan);
+  return {
+    allowUnknown: plan.unknown.length > 0,
+    allowWeaker: plan.weakened.length > 0,
+    allowWebhookRemoval: removed > 0,
+    webhookSecrets: created > 0,
+    hookSecrets: hookCounts(plan).created > 0
+  };
+}
+function removedWebhooks(plan) {
+  const { removed } = webhookCounts(plan);
+  return removed > 0 ? removedEndpoints(removed) : null;
+}
+function describeOperation2(operation) {
+  if (operation.kind === "settings") {
+    return "settings: replace";
+  }
+  if (operation.kind === "hook.create" || operation.kind === "hook.update" || operation.kind === "hook.delete") {
+    const did = { "hook.create": "create", "hook.update": "update", "hook.delete": "remove" };
+    return `hook ${operation.point}: ${did[operation.kind]}`;
+  }
+  if (operation.kind === "nativeApp.create" || operation.kind === "nativeApp.update" || operation.kind === "nativeApp.delete") {
+    const did = {
+      "nativeApp.create": "register",
+      "nativeApp.update": "update",
+      "nativeApp.delete": "remove"
+    };
+    return `native app ${appName(operation.change)}: ${did[operation.kind]}`;
+  }
+  if (operation.kind === "provider.delete") {
+    return `provider ${operation.provider}: delete`;
+  }
+  if (operation.kind === "provider.set") {
+    return `provider ${operation.provider}: ${operation.change.action}`;
+  }
+  const action = {
+    "webhook.create": "create",
+    "webhook.update": "update",
+    "webhook.delete": "remove"
+  };
+  return `webhook ${address(operation.url)}: ${action[operation.kind]}`;
+}
+function renderPlan2(output, target, plan) {
+  const { style } = output;
+  output.line(style.bold(`Environment "${target.environment}" at ${target.apiUrl}`) + style.dim(` (settings revision ${plan.revision})`));
+  output.line();
+  output.line(style.bold("Settings"));
+  if (plan.settings.length === 0) {
+    output.line(style.dim("  no changes"));
+  }
+  for (const change of plan.settings) {
+    output.line(settingLine(output, change));
+  }
+  if (plan.marker.pending) {
+    output.line(style.yellow(`  ~ managed-by record: ${MARKER_REASONS[plan.marker.reason]}`));
+  }
+  if (plan.kept.length > 0) {
+    output.line(style.dim(`  kept as on the server (not in the file): ${plan.kept.join(", ")}`));
+  }
+  if (plan.providers.length > 0) {
+    output.line();
+    output.line(style.bold("Providers"));
+    for (const change of plan.providers) {
+      output.line(providerLine(output, change));
+    }
+  }
+  if (plan.webhooks.managed) {
+    output.line();
+    output.line(style.bold("Webhooks"));
+    if (plan.webhooks.endpoints.length === 0) {
+      output.line(style.dim("  none in the file, none on the server"));
+    }
+    for (const change of plan.webhooks.endpoints) {
+      output.line(webhookLine(output, change));
+    }
+    const actions = new Set(plan.webhooks.endpoints.map((endpoint) => endpoint.action));
+    if (actions.has("create") && (actions.has("delete") || actions.has("unmanaged"))) {
+      output.line(style.dim("  an endpoint is its address: a changed address is a new endpoint with a new signing secret; the old one stays until it is removed (--prune), and its pending deliveries and its delivery log go with it"));
+    }
+  }
+  if (plan.hooks.managed) {
+    output.line();
+    output.line(style.bold("Hooks"));
+    if (plan.hooks.hooks.length === 0) {
+      output.line(style.dim("  none in the file, none on the server"));
+    }
+    for (const change of plan.hooks.hooks) {
+      output.line(hookLine(output, change));
+    }
+  }
+  if (plan.nativeApps.managed) {
+    output.line();
+    output.line(style.bold("Native apps"));
+    if (plan.nativeApps.apps.length === 0) {
+      output.line(style.dim("  none in the file, none on the server"));
+    }
+    for (const change of plan.nativeApps.apps) {
+      output.line(nativeAppLine(output, change));
+      const note = unmanagedLinkPathsLine(change);
+      if (note !== null) {
+        output.line(style.dim(note));
+      }
+    }
+  }
+  const warnings = planWarnings2(plan);
+  if (warnings.length > 0) {
+    output.line();
+    for (const warning of warnings) {
+      output.line(style.yellow(`  ! ${warning}`));
+    }
+  }
+  output.line();
+}
+function planToJson2(target, plan) {
+  return {
+    environment: target.environment,
+    apiUrl: target.apiUrl,
+    revision: plan.revision,
+    changes: plan.changes,
+    settings: plan.settings,
+    weakened: plan.weakened,
+    kept: plan.kept,
+    unknown: plan.unknown,
+    providers: plan.providers,
+    webhooks: {
+      managed: plan.webhooks.managed,
+      endpoints: plan.webhooks.endpoints,
+      removedFirst: plan.webhooks.removedFirst,
+      overLimit: plan.webhooks.overLimit
+    },
+    hooks: { managed: plan.hooks.managed, hooks: plan.hooks.hooks },
+    nativeApps: {
+      managed: plan.nativeApps.managed,
+      apps: plan.nativeApps.apps.map(({ entry: _entry, ...change }) => change),
+      overLimit: plan.nativeApps.overLimit
+    },
+    blockers: planBlockers(plan),
+    managedBy: {
+      supported: plan.marker.supported,
+      pending: plan.marker.pending,
+      reason: plan.marker.reason,
+      current: plan.marker.current,
+      configHash: plan.marker.configHash
+    },
+    warnings: planWarnings2(plan),
+    applyRequires: applyRequirements2(plan)
+  };
+}
+
+// src/commands/shared.ts
+import { isTulaAdminError as isTulaAdminError4 } from "@tula-tech/admin";
+import {
+  DEFAULT_CONFIG_FILE,
+  hashEnvironmentConfig,
+  loadConfig,
+  selectEnvironment
+} from "@tula-tech/config";
+
+// src/target.ts
+import {
+  createAdminClient,
+  createAgentClient,
+  createInstanceClient,
+  isTulaAdminError as isTulaAdminError3
+} from "@tula-tech/admin";
+import { secretKeyMatchesKind } from "@tula-tech/config";
+function variableSuffix(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function own(env, name) {
+  const value = Object.hasOwn(env, name) ? env[name] : undefined;
+  return value === undefined || value.trim() === "" ? undefined : value.trim();
+}
+async function resolveTarget2(input) {
+  const { name, environment, flags, io, output } = input;
+  const suffix = variableSuffix(name);
+  const keyFile = typeof flags["secret-key-file"] === "string" ? flags["secret-key-file"] : undefined;
+  let secretKey;
+  if (keyFile !== undefined) {
+    if (keyFile === "-" && io.stdinIsTTY) {
+      throw new UsageError2("--secret-key-file - reads the key from standard input, and standard input is a " + "terminal: the key would be shown as you type it. Pipe it in instead " + "(e.g. `your-secret-store read tula | tula diff --secret-key-file -`), or use a file.");
+    }
+    const read = keyFile === "-" ? io.readStdin : io.readFile;
+    if (!read) {
+      throw new UsageError2("--secret-key-file cannot be read here.");
+    }
+    secretKey = (await read(keyFile).catch(() => {
+      throw new UsageError2(keyFile === "-" ? "Could not read the secret key from standard input." : "Could not read the file given as --secret-key-file.");
+    })).trim();
+  } else {
+    secretKey = own(io.env, `TULA_SECRET_KEY_${suffix}`) ?? own(io.env, "TULA_SECRET_KEY");
+  }
+  if (!secretKey) {
+    throw new UsageError2(`No secret key: set TULA_SECRET_KEY (or TULA_SECRET_KEY_${suffix}), or pass --secret-key-file <path>.`);
+  }
+  output.redact(secretKey);
+  const apiUrl = (typeof flags["api-url"] === "string" ? flags["api-url"] : undefined) ?? own(io.env, `TULA_API_URL_${suffix}`) ?? own(io.env, "TULA_API_URL");
+  if (!apiUrl) {
+    throw new UsageError2(`No API URL: set TULA_API_URL (or TULA_API_URL_${suffix}), or pass --api-url <url>.`);
+  }
+  let admin;
+  try {
+    admin = createAdminClient({
+      baseUrl: apiUrl,
+      secretKey,
+      fetch: io.fetch,
+      userAgent: `tula-cli/${VERSION2}`,
+      allowInsecureHttp: flags["insecure-http"] === true
+    });
+  } catch (error) {
+    if (isTulaAdminError3(error) && error.code === "client.invalid_url" && /^http:/i.test(apiUrl) && flags["insecure-http"] !== true) {
+      throw new UsageError2("The API URL is plain http and is not this machine: the secret key and provider " + "secrets would cross the network in clear text (client.invalid_url). Use an https " + "URL, or pass --insecure-http for a private network you trust. Nothing was sent.");
+    }
+    throw error;
+  }
+  if (!secretKeyMatchesKind(environment.kind, secretKey)) {
+    throw new UsageError2(`The config says "${name}" is a ${environment.kind} environment, and the secret key is not ` + `a ${environment.kind} key. Nothing was read or changed.`);
+  }
+  return { apiUrl: apiUrl.replace(/\/+$/, ""), admin };
+}
+async function resolveAgent2(input) {
+  const { name, flags, io, output } = input;
+  const suffix = variableSuffix(name);
+  const file = typeof flags["agent-key-file"] === "string" ? flags["agent-key-file"] : undefined;
+  const agentKey = file !== undefined ? await readSecretFile2(file, "--agent-key-file", io) : own(io.env, `TULA_AGENT_KEY_${suffix}`) ?? own(io.env, "TULA_AGENT_KEY");
+  if (!agentKey) {
+    return null;
+  }
+  output.redact(agentKey);
+  const apiUrl = (typeof flags["api-url"] === "string" ? flags["api-url"] : undefined) ?? own(io.env, `TULA_API_URL_${suffix}`) ?? own(io.env, "TULA_API_URL");
+  if (!apiUrl) {
+    throw new UsageError2(`No API URL: set TULA_API_URL (or TULA_API_URL_${suffix}), or pass --api-url <url>.`);
+  }
+  try {
+    return {
+      apiUrl: apiUrl.replace(/\/+$/, ""),
+      admin: createAgentClient({
+        baseUrl: apiUrl,
+        agentKey,
+        fetch: io.fetch,
+        userAgent: `tula-cli/${VERSION2}`,
+        allowInsecureHttp: flags["insecure-http"] === true
+      })
+    };
+  } catch (error) {
+    if (isTulaAdminError3(error) && error.code === "client.invalid_url") {
+      throw new UsageError2(PLAIN_HTTP);
+    }
+    if (isTulaAdminError3(error) && error.code === "client.invalid_agent_key") {
+      throw new UsageError2("The agent key is not usable: it is an agent key (tula_ak_\u2026), made in the dashboard or " + "with the admin API. A secret key is never given to an agent.");
+    }
+    throw error;
+  }
+}
+var PLAIN_HTTP = "The API URL is plain http and is not this machine: the credential would cross the network " + "in clear text (client.invalid_url). Use an https URL, or pass --insecure-http for a " + "private network you trust. Nothing was sent.";
+function resolveApiUrl2(flags, io) {
+  const apiUrl = (typeof flags["api-url"] === "string" ? flags["api-url"] : undefined) ?? own(io.env, "TULA_API_URL");
+  if (!apiUrl) {
+    throw new UsageError2("No API URL: set TULA_API_URL, or pass --api-url <url>.");
+  }
+  let url;
+  try {
+    url = new URL(apiUrl);
+  } catch {
+    throw new UsageError2("The API URL is not a URL. Set TULA_API_URL to e.g. https://auth.example.com.");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) {
+    throw new UsageError2("The API URL must be an http(s) URL without credentials in it.");
+  }
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+async function readSecretFile2(path, option, io) {
+  if (path === "-" && io.stdinIsTTY) {
+    throw new UsageError2(`${option} - reads from standard input, and standard input is a terminal: the value ` + "would be shown as you type it. Pipe it in instead, or use a file.");
+  }
+  const read = path === "-" ? io.readStdin : io.readFile;
+  if (!read) {
+    throw new UsageError2(`${option} cannot be read here.`);
+  }
+  const text = await read(path).catch(() => {
+    throw new UsageError2(path === "-" ? `Could not read ${option} from standard input.` : `Could not read the file given as ${option}.`);
+  });
+  return text.trim();
+}
+async function resolveInstance2(input) {
+  const { apiUrl, flags, io, output } = input;
+  const file = typeof flags["admin-token-file"] === "string" ? flags["admin-token-file"] : undefined;
+  const token = file !== undefined ? await readSecretFile2(file, "--admin-token-file", io) : own(io.env, "TULA_ADMIN_TOKEN");
+  if (!token) {
+    return null;
+  }
+  output.redact(token);
+  try {
+    return createInstanceClient({
+      baseUrl: apiUrl,
+      adminToken: token,
+      fetch: io.fetch,
+      userAgent: `tula-cli/${VERSION2}`,
+      allowInsecureHttp: flags["insecure-http"] === true
+    });
+  } catch (error) {
+    if (isTulaAdminError3(error) && error.code === "client.invalid_url") {
+      throw new UsageError2(PLAIN_HTTP);
+    }
+    if (isTulaAdminError3(error) && error.code === "client.invalid_token") {
+      throw new UsageError2("The admin token is not usable: it is the server\u2019s TULA_ADMIN_TOKEN (at least 32 characters), not an API key.");
+    }
+    throw error;
+  }
+}
+
+// src/commands/shared.ts
+var PLAN_OPTIONS = {
+  config: {
+    type: "string",
+    short: "c",
+    value: "<path>",
+    description: `The config file. Default: ${DEFAULT_CONFIG_FILE} in the current directory.`
+  },
+  env: {
+    type: "string",
+    short: "e",
+    value: "<name>",
+    description: "The environment in the config. May be left out when the file has one."
+  },
+  "api-url": {
+    type: "string",
+    value: "<url>",
+    description: "The Tula API. Default: TULA_API_URL_<NAME>, then TULA_API_URL."
+  },
+  "insecure-http": {
+    type: "boolean",
+    description: "Allow a plain http API URL that is not localhost: the secret key then crosses the network in clear text. For a private network you trust."
+  },
+  "secret-key-file": {
+    type: "string",
+    value: "<path>",
+    description: "Read the secret key from a file (- for standard input, piped; apply then needs --yes). Default: TULA_SECRET_KEY_<NAME>, then TULA_SECRET_KEY."
+  },
+  prune: {
+    type: "boolean",
+    description: "Delete providers, and remove webhook endpoints, hooks and native apps, that the server has and the file does not list (default: leave them). A file with no webhooks list keeps every endpoint, one with no hooks key every hook, and one with no nativeApps list every app."
+  },
+  "rotate-secrets": {
+    type: "boolean",
+    description: "Send every managed provider\u2019s secret again, changed or not."
+  },
+  json: { type: "boolean", description: "Print the plan as JSON." }
+};
+async function readRemote(admin, options) {
+  const settings = await admin.call("getEnvironmentSettings");
+  const providers = await admin.call("listOAuthProviders");
+  const webhooks = options.webhooks ? (await admin.call("listWebhookEndpoints")).data.data : undefined;
+  const hooks = options.hooks ? (await admin.call("listHooks")).data.data : undefined;
+  const nativeApps = options.nativeApps ? (await admin.call("listNativeApps")).data.data : undefined;
+  const managedBy = settings.data.managedBy;
+  return {
+    revision: settings.data.revision,
+    settings: settings.data.settings,
+    managedBy,
+    providers: providers.data.data,
+    ...webhooks !== undefined && { webhooks },
+    ...hooks !== undefined && { hooks },
+    ...nativeApps !== undefined && { nativeApps }
+  };
+}
+function isUnknownRoute(error) {
+  return error.status === 404 && error.code === "resource.not_found";
+}
+async function readDependents(admin, providers) {
+  const dependents = {};
+  for (const provider of providers) {
+    try {
+      const answer = await admin.call("getOAuthProviderDependents", { params: { provider } });
+      dependents[provider] = readDependentCount2(provider, answer.data) ?? DEPENDENTS_UNREAD2;
+    } catch (error) {
+      if (!isTulaAdminError4(error)) {
+        throw error;
+      }
+      dependents[provider] = isUnknownRoute(error) ? null : DEPENDENTS_UNREAD2;
+    }
+  }
+  return dependents;
+}
+async function prepare(context) {
+  const { flags, io, output } = context;
+  const path = typeof flags.config === "string" ? flags.config : DEFAULT_CONFIG_FILE;
+  const { config } = await loadConfig(path, io.cwd);
+  const requested = typeof flags.env === "string" ? flags.env : undefined;
+  const environment = selectEnvironment(config, requested);
+  const name = requested ?? Object.keys(config.environments)[0];
+  const target = await resolveTarget2({ name, environment, flags, io, output });
+  const remote = await readRemote(target.admin, {
+    webhooks: environment.webhooks !== undefined,
+    hooks: environment.hooks !== undefined,
+    nativeApps: environment.nativeApps !== undefined
+  });
+  const prune = flags.prune === true;
+  const dependents = await readDependents(target.admin, providersGoingOff2(remote.providers, environment.providers, { prune }));
+  const plan = buildPlan2({ ...remote, dependents }, environment, {
+    configHash: await hashEnvironmentConfig(environment),
+    prune,
+    rotateSecrets: flags["rotate-secrets"] === true
+  });
+  return { name, environment, target, plan };
+}
+
+// src/commands/apply.ts
+var APPLY_OPTIONS = {
+  ...PLAN_OPTIONS,
+  yes: {
+    type: "boolean",
+    short: "y",
+    description: "Apply without asking. Required when not at a terminal (CI)."
+  },
+  "allow-unknown": {
+    type: "boolean",
+    description: "Apply although the server has settings this version of tula does not know: they are reset to their defaults."
+  },
+  "allow-weaker": {
+    type: "boolean",
+    description: "With --yes: apply although the plan weakens security (it is listed in the plan)."
+  },
+  "allow-webhook-removal": {
+    type: "boolean",
+    description: "With --yes: apply although the plan removes a webhook endpoint (--prune), with its pending deliveries and its delivery log."
+  },
+  "secrets-file": {
+    type: "string",
+    value: "<path>",
+    description: "Write the signing secret of each webhook endpoint and each hook the run creates to this new file (JSON, mode 0600). The server shows a secret only once."
+  },
+  "show-secrets": {
+    type: "boolean",
+    description: "Print the signing secret of each webhook endpoint and each hook the run creates."
+  },
+  "discard-secrets": {
+    type: "boolean",
+    description: "Create webhook endpoints and hooks without keeping their signing secrets (rotate an endpoint\u2019s later to get one; a hook has to be removed and added again)."
+  },
+  "expect-revision": {
+    type: "string",
+    value: "<n>",
+    description: "Apply only if the settings are still at this revision (the one `tula diff` printed)."
+  }
+};
+function warningBeforeQuestion(plan) {
+  const removed = removedWebhooks(plan);
+  const removes = removed === null ? "" : `This REMOVES ${removed}, for good. `;
+  const paths = plan.weakened.join(", ");
+  const doomed = deletedAuditAge(plan);
+  if (doomed === null) {
+    return `${paths ? `This WEAKENS security (${paths}). ` : ""}${removes}`;
+  }
+  const deletes = `DELETES audit entries older than ${doomed} days, for good`;
+  return plan.weakened.length === 1 ? `This ${deletes} (${paths}). ${removes}` : `This WEAKENS security (${paths}) and ${deletes}. ${removes}`;
+}
+function byKind(created) {
+  return {
+    webhooks: created.filter((entry) => entry.hook === undefined),
+    hooks: created.filter((entry) => entry.hook !== undefined)
+  };
+}
+function secretChoice(context) {
+  const { flags, io } = context;
+  const path = flags["secrets-file"];
+  const choice = {
+    file: typeof path === "string" ? resolve(io.cwd, path) : undefined,
+    show: flags["show-secrets"] === true,
+    discard: flags["discard-secrets"] === true
+  };
+  if (choice.discard && (choice.show || choice.file !== undefined)) {
+    throw new UsageError2("--discard-secrets cannot be combined with --secrets-file or --show-secrets: keep the signing secrets or do not.");
+  }
+  if (path === "-" || path === "") {
+    throw new UsageError2("--secrets-file takes the path of a new file.");
+  }
+  return choice;
+}
+var NO_SECRETS = `[]
+`;
+async function secretsHost(context, file) {
+  const host = context.io.host;
+  if (!host) {
+    throw new UsageError2("--secrets-file needs a file system, which this run does not have.");
+  }
+  let present;
+  try {
+    present = await host.readFile(file);
+  } catch (error) {
+    if (error instanceof UsageError2) {
+      throw new UsageError2(`--secrets-file: ${error.message} Nothing was changed.`);
+    }
+    throw error;
+  }
+  if (present !== null) {
+    throw new UsageError2(`--secrets-file: ${basename(file)} already exists. It may hold the signing secrets of an earlier run, which are shown only once: name a file that does not exist. Nothing was changed.`);
+  }
+  return host;
+}
+var LATER = {
+  webhook: "To get a secret later, rotate it: for the 24 hours of the overlap deliveries are then " + "also signed with the first secret, which nobody holds. That is harmless.",
+  hook: "A hook\u2019s secret cannot be rotated: to get one later, remove the hook and add it again " + "(its receiver cannot verify a question until then)."
+};
+var NEEDS_SECRET_CHOICE = (endpoints, hooks) => {
+  const created = endpoints + hooks;
+  const what = [
+    endpoints > 0 ? `${endpoints} webhook ${endpoints === 1 ? "endpoint" : "endpoints"}` : "",
+    hooks > 0 ? `${hooks} ${hooks === 1 ? "hook" : "hooks"}` : ""
+  ].filter((part) => part !== "").join(" and ");
+  const later = [endpoints > 0 ? LATER.webhook : "", hooks > 0 ? LATER.hook : ""].filter((part) => part !== "").join(" ");
+  return `This plan creates ${what}, and the server shows ` + `${created === 1 ? "its signing secret" : "each signing secret"} only once, in its answer to this run. ` + `Nothing was changed. Say what to do with ${created === 1 ? "it" : "them"}:
+` + `  --secrets-file <path>  write to a new file only you can read (mode 0600)
+` + `  --show-secrets         print on standard output
+` + `  --discard-secrets      keep nothing. ${later}`;
+};
+
+class StaleWebhooks extends Error {
+}
+
+class UnreadWebhooks extends Error {
+  reason;
+  constructor(reason) {
+    super("the webhook endpoints could not be read again");
+    this.reason = reason;
+  }
+}
+var UNREAD_WEBHOOKS = "The webhook endpoints could not be read again before the first write to them, so nothing " + "was written to them.";
+var STALE_WEBHOOKS = "The webhook endpoints were changed by someone else after this plan was made. Nothing was " + "written to them. Run `tula diff` again and review the new plan.";
+
+class StaleHooks extends Error {
+}
+
+class UnreadHooks extends Error {
+  reason;
+  constructor(reason) {
+    super("the hooks could not be read again");
+    this.reason = reason;
+  }
+}
+var UNREAD_HOOKS = "The hooks could not be read again before the first write to them, so nothing was written " + "to them.";
+var STALE_HOOKS = "The hooks were changed by someone else after this plan was made. Nothing was written to " + "them. Run `tula diff` again and review the new plan.";
+
+class StaleNativeApps extends Error {
+  constructor() {
+    super("the native apps changed after the plan was made");
+  }
+}
+
+class UnreadNativeApps extends Error {
+  reason;
+  constructor(reason) {
+    super("the native apps could not be read again");
+    this.reason = reason;
+  }
+}
+var UNREAD_NATIVE_APPS = "The native apps could not be read again before the first write to them, so nothing was " + "written to them.";
+var STALE_NATIVE_APPS = "The native apps were changed by someone else after this plan was made. Nothing was written " + "to them. Run `tula diff` again and review the new plan.";
+async function runNativeAppOperation(admin, operation) {
+  if (operation.kind === "nativeApp.delete") {
+    await admin.call("deleteNativeApp", { params: { id: operation.id } });
+    return;
+  }
+  const { entry } = operation;
+  if (operation.kind === "nativeApp.create") {
+    await admin.call("createNativeApp", { body: entry });
+    return;
+  }
+  const differs = (path) => operation.change.fields.some((field) => field.path === path);
+  await admin.call("updateNativeApp", {
+    params: { id: operation.id },
+    body: {
+      ...entry.platform === "ios" && differs("teamId") && { teamId: entry.teamId },
+      ...entry.platform === "android" && differs("sha256CertFingerprints") && {
+        sha256CertFingerprints: entry.sha256CertFingerprints
+      },
+      ...differs("appLinkPaths") && entry.appLinkPaths !== undefined && { appLinkPaths: entry.appLinkPaths }
+    }
+  });
+}
+async function runHookOperation(admin, environment, operation) {
+  if (operation.kind === "hook.delete") {
+    await admin.call("deleteHook", { params: { id: operation.id } });
+    return;
+  }
+  const desired = environment.hooks?.[operation.point];
+  if (!desired) {
+    throw new Error("a hook operation has no entry in the config");
+  }
+  if (operation.kind === "hook.update") {
+    const changed = (path) => operation.change.fields.some((field) => field.path === path);
+    await admin.call("updateHook", {
+      params: { id: operation.id },
+      body: {
+        ...changed("url") && { url: desired.url },
+        ...changed("enabled") && { enabled: desired.enabled },
+        ...changed("deadlineMs") && { deadlineMs: desired.deadlineMs },
+        ...changed("failureMode") && { failureMode: desired.failureMode }
+      }
+    });
+    return;
+  }
+  const answer = await admin.call("createHook", {
+    body: {
+      point: operation.point,
+      url: desired.url,
+      enabled: desired.enabled,
+      deadlineMs: desired.deadlineMs,
+      failureMode: desired.failureMode
+    }
+  });
+  return { hook: operation.point, id: answer.data.id, url: desired.url, secret: answer.data.secret };
+}
+function resolveSecrets(context, environment, operations) {
+  const secrets = new Map;
+  for (const operation of operations) {
+    if (operation.kind === "provider.set" && operation.change.secret === "set") {
+      const ref = providerSecret2(environment.providers, operation.provider);
+      if (ref) {
+        const value = resolveSecret(ref, context.io.env);
+        context.output.redact(value);
+        secrets.set(operation.provider, value);
+      }
+    }
+  }
+  return secrets;
+}
+function webhookBody(environment, operation) {
+  const desired = environment.webhooks?.find((endpoint) => endpoint.url === operation.url);
+  if (!desired) {
+    throw new Error("a webhook operation has no entry in the config");
+  }
+  const changed = (path) => operation.change.fields.some((field) => field.path === path);
+  return {
+    desired,
+    update: {
+      ...changed("eventTypes") && { eventTypes: desired.eventTypes },
+      ...changed("enabled") && { enabled: desired.enabled }
+    }
+  };
+}
+async function runWebhookOperation(admin, environment, operation) {
+  if (operation.kind === "webhook.delete") {
+    await admin.call("deleteWebhookEndpoint", { params: { id: operation.id } });
+    return;
+  }
+  const { desired, update } = webhookBody(environment, operation);
+  if (operation.kind === "webhook.update") {
+    await admin.call("updateWebhookEndpoint", { params: { id: operation.id }, body: update });
+    return;
+  }
+  const answer = await admin.call("createWebhookEndpoint", {
+    body: {
+      url: desired.url,
+      eventTypes: desired.eventTypes,
+      ...desired.enabled !== undefined && { enabled: desired.enabled }
+    }
+  });
+  return { id: answer.data.id, url: desired.url, secret: answer.data.secret };
+}
+async function runOperation(admin, plan, environment, secrets, operation) {
+  if (operation.kind === "settings") {
+    const answer = await admin.call("replaceEnvironmentSettings", {
+      headers: {
+        "If-Match": ifMatch(plan.revision),
+        ...plan.marker.supported && {
+          [CONFIG_MANAGED_BY_HEADER]: MANAGING_TOOL2,
+          [CONFIG_HASH_HEADER]: plan.marker.configHash
+        }
+      },
+      body: plan.body
+    });
+    return answer.data.revision;
+  }
+  if (operation.kind === "provider.delete") {
+    await admin.call("deleteOAuthProvider", { params: { provider: operation.provider } });
+    return;
+  }
+  const secret = secrets.get(operation.provider);
+  if (operation.provider === "apple") {
+    const apple = environment.providers.apple;
+    if (apple) {
+      await admin.call("updateOAuthProvider", {
+        params: { provider: "apple" },
+        body: {
+          clientId: apple.clientId,
+          teamId: apple.teamId,
+          keyId: apple.keyId,
+          enabled: apple.enabled,
+          ...secret !== undefined && { privateKey: secret }
+        }
+      });
+    }
+    return;
+  }
+  if (operation.provider === "microsoft") {
+    const microsoft = environment.providers.microsoft;
+    if (microsoft) {
+      await admin.call("updateOAuthProvider", {
+        params: { provider: "microsoft" },
+        body: {
+          clientId: microsoft.clientId,
+          tenant: microsoft.tenant,
+          enabled: microsoft.enabled,
+          ...secret !== undefined && { clientSecret: secret }
+        }
+      });
+    }
+    return;
+  }
+  const client = environment.providers[operation.provider];
+  if (client) {
+    await admin.call("updateOAuthProvider", {
+      params: { provider: operation.provider },
+      body: {
+        clientId: client.clientId,
+        enabled: client.enabled,
+        ..."additionalClientIds" in client && client.additionalClientIds !== undefined && {
+          additionalClientIds: client.additionalClientIds
+        },
+        ...secret !== undefined && { clientSecret: secret }
+      }
+    });
+  }
+  return;
+}
+function expectedRevision(flag) {
+  if (flag === undefined) {
+    return;
+  }
+  if (typeof flag !== "string" || !/^(0|[1-9][0-9]{0,8})$/.test(flag)) {
+    throw new UsageError2("--expect-revision takes a revision number, e.g. --expect-revision 7.");
+  }
+  return Number(flag);
+}
+var STALE = "The settings were changed by someone else after this plan was made. Nothing was written to " + "the settings. Run `tula diff` again and review the new plan.";
+var applyCommand2 = {
+  name: "apply",
+  summary: "Make the environment what tula.config.ts says.",
+  usage: "tula apply [--env <name>] [--config <path>] [--yes] [--prune] [--rotate-secrets] [--expect-revision <n>] [--allow-unknown] [--allow-weaker] [--allow-webhook-removal] [--secrets-file <path> | --show-secrets | --discard-secrets] [--json]",
+  description: "Prints the plan, asks for confirmation, then replaces the environment\u2019s settings (only if " + "nobody changed them since the plan was made) and creates, updates or deletes OAuth " + "providers and, when the file lists them, webhook endpoints, hooks and native apps. Provider secrets " + "are read from the environment variables the config names. The signing secret of a new " + "webhook endpoint or a new hook is made by the server and shown once: the run needs " + `--secrets-file, --show-secrets or --discard-secrets.
+
+` + "It refuses a plan that would reset settings this version of tula does not know (unless " + "--allow-unknown), and with --yes a plan that weakens security (unless --allow-weaker) or " + `removes a webhook endpoint (unless --allow-webhook-removal).
+
+` + "Exit codes: 0 applied (or nothing to do), 1 an error or a declined confirmation.",
+  options: APPLY_OPTIONS,
+  run: async (context) => {
+    const { flags, io, output } = context;
+    const json = flags.json === true;
+    const expected = expectedRevision(flags["expect-revision"]);
+    if (flags["secret-key-file"] === "-" && flags.yes !== true) {
+      throw new UsageError2("The secret key is read from standard input, so standard input cannot also answer the " + "confirmation: pass --yes as well. Nothing was read or changed.");
+    }
+    const choice = secretChoice(context);
+    const { name, environment, target, plan } = await prepare(context);
+    const header = { environment: name, apiUrl: target.apiUrl };
+    if (!json) {
+      renderPlan2(output, header, plan);
+    }
+    const operations = orderOperations2(plan);
+    const created = [];
+    const notKept = [];
+    const report = (applied, failed, revision) => {
+      if (json) {
+        const notApplied = operations.slice(applied.length + (failed ? 1 : 0));
+        output.line(JSON.stringify({
+          ...planToJson2(header, plan),
+          applied: applied.map(describeOperation2),
+          failed: failed ? describeOperation2(failed) : null,
+          notApplied: notApplied.map(describeOperation2),
+          revisionAfter: revision,
+          ...choice.file !== undefined && created.length > 0 && { secretsFile: choice.file },
+          ...notKept.length > 0 && { secretsNotKept: notKept },
+          ...choice.show && {
+            webhookSecrets: byKind(created).webhooks,
+            hookSecrets: byKind(created).hooks
+          }
+        }, null, 2));
+      }
+    };
+    if (expected !== undefined && expected !== plan.revision) {
+      output.error(`${output.errorStyle.red("error:")} The settings are at revision ${plan.revision}, not ` + `${expected}: they were changed after that plan was made. Nothing was changed. Run ` + "`tula diff` again and review the new plan.");
+      return EXIT2.error;
+    }
+    const blockers = planBlockers(plan);
+    for (const blocker of blockers) {
+      const advice = blocker.includes("may have") ? ` ${OVER_LIMIT_ADVICE}` : "";
+      output.error(`${output.errorStyle.red("error:")} ${blocker} Nothing was changed.${advice}`);
+    }
+    if (blockers.length > 0) {
+      return EXIT2.error;
+    }
+    if (operations.length === 0) {
+      if (json) {
+        report([], undefined, plan.revision);
+      } else {
+        output.line("No changes: the environment is as the config says.");
+      }
+      return EXIT2.ok;
+    }
+    if (plan.unknown.length > 0 && flags["allow-unknown"] !== true) {
+      output.error(`${output.errorStyle.red("error:")} The server has settings this version of tula does ` + `not know (${plan.unknown.join(", ")}); applying would reset them to their defaults. ` + "Nothing was changed. Upgrade tula, or pass --allow-unknown to reset them.");
+      return EXIT2.error;
+    }
+    if (flags.yes === true && plan.weakened.length > 0 && flags["allow-weaker"] !== true) {
+      output.error(`${output.errorStyle.red("error:")} This plan weakens security ` + `(${plan.weakened.join(", ")}), and with --yes nobody is asked. Nothing was changed. ` + "Pass --allow-weaker with --yes to apply it.");
+      return EXIT2.error;
+    }
+    const removed = removedWebhooks(plan);
+    if (flags.yes === true && removed !== null && flags["allow-webhook-removal"] !== true) {
+      output.error(`${output.errorStyle.red("error:")} This plan removes ${removed}, for good, and with ` + "--yes nobody is asked. Nothing was changed. Pass --allow-webhook-removal with --yes " + "to apply it.");
+      return EXIT2.error;
+    }
+    const endpoints = webhookCounts(plan).created;
+    const hooks = hookCounts(plan).created;
+    const creating = endpoints + hooks;
+    if (creating > 0 && !choice.show && !choice.discard && choice.file === undefined) {
+      output.error(`${output.errorStyle.red("error:")} ${NEEDS_SECRET_CHOICE(endpoints, hooks)}`);
+      return EXIT2.error;
+    }
+    const secretsFile = creating > 0 && choice.file !== undefined ? { path: choice.file, host: await secretsHost(context, choice.file) } : undefined;
+    const secrets = resolveSecrets(context, environment, operations);
+    if (flags.yes !== true) {
+      if (!io.isTTY || !io.prompt) {
+        throw new UsageError2("Not at a terminal, so there is nobody to confirm: pass --yes to apply without asking. Nothing was changed.");
+      }
+      const answer = await io.prompt(`${warningBeforeQuestion(plan)}Apply these changes to "${name}" at ${target.apiUrl}? Type yes to continue: `);
+      if (answer.trim().toLowerCase() !== "yes") {
+        output.error("Cancelled. Nothing was changed.");
+        return EXIT2.error;
+      }
+    }
+    if (operations[0]?.kind !== "settings" && operations.some((op) => op.kind === "settings")) {
+      const now = await target.admin.call("getEnvironmentSettings");
+      if (now.data.revision !== plan.revision) {
+        output.error(`${output.errorStyle.red("error:")} ${STALE}`);
+        return EXIT2.error;
+      }
+    }
+    let inFile = NO_SECRETS;
+    let written = 0;
+    const keep = async (file) => {
+      if (await file.host.readFile(file.path) !== inFile) {
+        throw new Error("the secrets file is no longer the one this run created");
+      }
+      const next = `${JSON.stringify(created, null, 2)}
+`;
+      await file.host.writeSecretFile(file.path, next);
+      inFile = next;
+      written = created.length;
+    };
+    if (secretsFile) {
+      try {
+        await secretsFile.host.createSecretFile(secretsFile.path, NO_SECRETS);
+      } catch (error) {
+        const why = error instanceof UsageError2 ? error.message : "It could not be created.";
+        output.error(`${output.errorStyle.red("error:")} --secrets-file: ${why} Nothing was changed.`);
+        return EXIT2.error;
+      }
+    }
+    const release = async () => {
+      if (!secretsFile || written > 0) {
+        return;
+      }
+      try {
+        if (await secretsFile.host.readFile(secretsFile.path) === NO_SECRETS) {
+          await secretsFile.host.removeFile(secretsFile.path);
+        }
+      } catch {}
+    };
+    const secretsNote = (say) => {
+      const signing = (count) => `${count} signing ${count === 1 ? "secret" : "secrets"}`;
+      if (secretsFile && written > 0) {
+        say(`Wrote ${signing(written)} to ${secretsFile.path} (mode 0600). It is not shown again: give it to the receiver, then delete the file.`);
+      } else if (choice.discard && created.length > 0) {
+        const { webhooks, hooks } = byKind(created);
+        const were = (count) => count === 1 ? "was" : "were";
+        if (webhooks.length > 0) {
+          say(`${signing(webhooks.length)} ${were(webhooks.length)} not kept (--discard-secrets). To get one, rotate it: POST /v1/admin/webhook-endpoints/<id>/secret/rotate.`);
+        }
+        if (hooks.length > 0) {
+          say(`${signing(hooks.length)} of ${hooks.length === 1 ? "a hook" : "hooks"} ${were(hooks.length)} not kept (--discard-secrets). A hook\u2019s secret cannot be rotated: to get one, remove the hook and apply again.`);
+        }
+      }
+    };
+    const applied = [];
+    let revision = plan.revision;
+    let webhooksChecked = false;
+    let hooksChecked = false;
+    let nativeAppsChecked = false;
+    const stop = async (failed) => {
+      const notApplied = operations.slice(applied.length);
+      if (applied.length > 0) {
+        output.error("Applied before the failure:");
+        for (const done of applied) {
+          output.error(`  ${describeOperation2(done)}`);
+        }
+      }
+      if (notApplied.length > 0) {
+        output.error("Not applied:");
+        for (const pending of notApplied) {
+          output.error(`  ${describeOperation2(pending)}`);
+        }
+      }
+      if (applied.length > 0 && notApplied.length > 0) {
+        output.error("Run `tula apply` again to finish: it starts from what the server has now.");
+      }
+      secretsNote((text) => output.error(text));
+      await release();
+      report(applied, failed, revision);
+      return EXIT2.error;
+    };
+    for (const operation of operations) {
+      let unkept;
+      const take = async (made) => {
+        if (!choice.show) {
+          output.redact(made.secret);
+        }
+        created.push(made);
+        if (secretsFile) {
+          await keep(secretsFile).catch(() => {
+            unkept = made;
+          });
+        }
+      };
+      try {
+        if (operation.kind === "hook.create" || operation.kind === "hook.update" || operation.kind === "hook.delete") {
+          if (!hooksChecked) {
+            const now = await target.admin.call("listHooks").catch((reason) => {
+              throw new UnreadHooks(reason);
+            });
+            if (hookSnapshot(now.data.data) !== plan.hooks.seen) {
+              throw new StaleHooks;
+            }
+            hooksChecked = true;
+          }
+          const made = await runHookOperation(target.admin, environment, operation);
+          if (made) {
+            await take(made);
+          }
+        } else if (operation.kind === "nativeApp.create" || operation.kind === "nativeApp.update" || operation.kind === "nativeApp.delete") {
+          if (!nativeAppsChecked) {
+            const now = await target.admin.call("listNativeApps").catch((reason) => {
+              throw new UnreadNativeApps(reason);
+            });
+            if (nativeAppSnapshot(now.data.data) !== plan.nativeApps.seen) {
+              throw new StaleNativeApps;
+            }
+            nativeAppsChecked = true;
+          }
+          await runNativeAppOperation(target.admin, operation);
+        } else if (operation.kind === "webhook.create" || operation.kind === "webhook.update" || operation.kind === "webhook.delete") {
+          if (!webhooksChecked) {
+            const now = await target.admin.call("listWebhookEndpoints").catch((reason) => {
+              throw new UnreadWebhooks(reason);
+            });
+            if (webhookSnapshot(now.data.data) !== plan.webhooks.seen) {
+              throw new StaleWebhooks;
+            }
+            webhooksChecked = true;
+          }
+          const made = await runWebhookOperation(target.admin, environment, operation);
+          if (made) {
+            await take(made);
+          }
+        } else {
+          revision = await runOperation(target.admin, plan, environment, secrets, operation) ?? revision;
+        }
+      } catch (error) {
+        const stale = operation.kind === "settings" && isTulaAdminError5(error) && error.code === "precondition.failed";
+        if (stale) {
+          output.error(`${output.errorStyle.red("error:")} ${STALE}`);
+        } else if (error instanceof StaleWebhooks) {
+          output.error(`${output.errorStyle.red("error:")} ${STALE_WEBHOOKS}`);
+        } else if (error instanceof UnreadWebhooks) {
+          output.error(`${output.errorStyle.red("error:")} ${UNREAD_WEBHOOKS}`);
+          reportError2(output, error.reason);
+        } else if (error instanceof StaleHooks) {
+          output.error(`${output.errorStyle.red("error:")} ${STALE_HOOKS}`);
+        } else if (error instanceof UnreadHooks) {
+          output.error(`${output.errorStyle.red("error:")} ${UNREAD_HOOKS}`);
+          reportError2(output, error.reason);
+        } else if (error instanceof StaleNativeApps) {
+          output.error(`${output.errorStyle.red("error:")} ${STALE_NATIVE_APPS}`);
+        } else if (error instanceof UnreadNativeApps) {
+          output.error(`${output.errorStyle.red("error:")} ${UNREAD_NATIVE_APPS}`);
+          reportError2(output, error.reason);
+        } else {
+          output.error(`Failed: ${describeOperation2(operation)}`);
+          reportError2(output, error);
+          const reason = isTulaAdminError5(error) ? error.params.reason : undefined;
+          const judged = operation.kind === "webhook.create" || operation.kind === "hook.create" || operation.kind === "hook.update";
+          if (judged && typeof reason === "string") {
+            output.error(`  reason: ${printable2(reason, 60)}`);
+          }
+        }
+        return stop(operation);
+      }
+      applied.push(operation);
+      if (!json) {
+        output.line(output.style.green(`  done  ${describeOperation2(operation)}`));
+        const creates = operation.kind === "webhook.create" || operation.kind === "hook.create";
+        const made = creates ? created.at(-1) : undefined;
+        if (made && choice.show) {
+          output.line(`        signing secret, shown this once: ${made.secret}`);
+        }
+      }
+      if (unkept !== undefined && secretsFile) {
+        const lost = unkept;
+        const what = lost.hook === undefined ? `The webhook endpoint ${printable2(lost.url, MAX_WEBHOOK_URL_LENGTH2)}` : `The hook ${lost.hook}`;
+        const later = lost.hook === undefined ? `To get one, rotate it: POST /v1/admin/webhook-endpoints/${printable2(lost.id, 40)}/secret/rotate.` : "A hook\u2019s secret cannot be rotated: to get one, remove the hook and apply again.";
+        notKept.push({
+          ...lost.hook !== undefined && { hook: lost.hook },
+          id: lost.id,
+          url: lost.url
+        });
+        output.error(`${output.errorStyle.red("error:")} ${what} was created, but its signing secret could not be written to ${secretsFile.path}: it was not kept. ${later}`);
+        return stop(undefined);
+      }
+    }
+    if (json) {
+      report(applied, undefined, revision);
+    } else {
+      output.line();
+      output.line(`Applied ${applied.length} ${applied.length === 1 ? "change" : "changes"}. ` + `Settings are at revision ${revision}.`);
+      secretsNote((text) => output.line(text));
+    }
+    await release();
+    return EXIT2.ok;
+  }
+};
+
+// src/commands/approve.ts
+import { isTulaAdminError as isTulaAdminError6 } from "@tula-tech/admin";
+import { OAUTH_PROVIDERS as OAUTH_PROVIDERS2 } from "@tula-tech/contract";
+var PROPOSAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var CONSEQUENCES = {
+  ban_user: "The user is banned at once: every session of theirs ends and they cannot sign in.",
+  unban_user: "The user\u2019s ban is lifted at once: they can sign in again. Sessions that were ended stay ended.",
+  end_session: "That one session is ended at once: whoever holds it is signed out and has to sign in again.",
+  disable_oauth_provider: "Sign-in with that provider is switched off at once: nobody signs in or signs up with it until it is switched on again. Its credentials are kept."
+};
+var TARGET_WORDS = {
+  user: "user",
+  session: "session",
+  oauth_provider: "provider"
+};
+function targetWord(proposal) {
+  const type = String(proposal.target.type);
+  return Object.hasOwn(TARGET_WORDS, type) ? TARGET_WORDS[type] : printable2(type, 40);
+}
+var REFUSALS = {
+  expired: "The proposal has expired. Nothing was changed. The agent can ask again.",
+  already_decided: "The proposal was already approved: a proposal is approved once. Nothing was changed by this run.",
+  mismatch: "The proposal is not the one that was shown: its operation or its target differs. Nothing was changed.",
+  agent_key_revoked: "The agent key that asked for this was revoked: what a revoked key asked for is never carried out. Nothing was changed.",
+  production_environment: "This is a production environment, and its settings do not (or no longer) accept proposals from an agent (agents.proposalsInProduction). Nothing was changed, and the proposal is not spent: it can still be approved before it expires if the setting is switched on."
+};
+var EXPIRY_WORDS = {
+  time: "expired (it was not approved in time)",
+  agent_key_revoked: "expired (the agent key that asked for it was revoked)"
+};
+function failureWords(proposal) {
+  const spent = "The proposal is spent: it cannot be approved again.";
+  const reason = proposal.failureReason === null ? "" : String(proposal.failureReason);
+  if (reason === "incomplete" && proposal.operation === "ban_user") {
+    const id = printable2(proposal.target.id, 64);
+    return "Approved, and only partly carried out. The user is banned, and ending their sessions failed: " + "a session of theirs may still be live until its access token runs out, and is refused at its next refresh. " + `End them now: DELETE /v1/admin/users/${id}/sessions with your secret key, or the user\u2019s page in the dashboard. ${spent}`;
+  }
+  if (reason === "incomplete") {
+    return `Approved, and only partly carried out: the change was made and a later step failed. Check the target. ${spent}`;
+  }
+  const what = targetWord(proposal);
+  if (reason === "target_not_found") {
+    return `Approved, but nothing was changed: the ${what} no longer exists. ${spent}`;
+  }
+  if (reason === "last_sign_in_method") {
+    return "Approved, but nothing was changed: switching this provider off would leave the environment " + `with no way to sign in, which the server refuses for an administrator too. The provider is still on. ${spent}`;
+  }
+  return `Approved, but the operation failed on the server (${reason === "" ? "unknown" : printable2(reason, 40)}). ` + `Check the ${what} as it is now, and have the agent ask again if the change is still wanted. ${spent}`;
+}
+var STATUS_WORDS = {
+  pending: "waiting for approval",
+  expired: "expired",
+  approved: "approved, its operation not finished",
+  executed: "approved and carried out",
+  failed: "approved, and its operation did not end as carried out"
+};
+function statusWords(proposal) {
+  const status = String(proposal.status);
+  if (status === "expired") {
+    const reason = proposal.expiryReason === null ? "time" : String(proposal.expiryReason);
+    return Object.hasOwn(EXPIRY_WORDS, reason) ? EXPIRY_WORDS[reason] : "expired";
+  }
+  if (status === "failed" && proposal.failureReason === "incomplete") {
+    return "approved, and only partly carried out";
+  }
+  return Object.hasOwn(STATUS_WORDS, status) ? STATUS_WORDS[status] : printable2(status, 40);
+}
+function timeLeft(expiresAt, now) {
+  const ms = Date.parse(expiresAt) - now.getTime();
+  if (!Number.isFinite(ms) || ms <= 0) {
+    return "now";
+  }
+  const seconds = Math.ceil(ms / 1000);
+  return seconds >= 60 ? `in about ${Math.round(seconds / 60)} min` : `in ${seconds} s`;
+}
+async function describeProvider(admin, id) {
+  const { data } = await admin.call("listOAuthProviders", {});
+  const found = data.data.find((one) => one.provider === id);
+  const name = printable2(id, 64);
+  if (!found?.configured) {
+    return { text: `provider ${name} (not configured now)`, providerOn: false };
+  }
+  return {
+    text: `provider ${name} (${found.enabled ? "on now" : "already off"})`,
+    providerOn: found.enabled === true
+  };
+}
+var NOT_COUNTED = {
+  unread: "the count could not be read",
+  none: "this server has no count"
+};
+function dependentsWords(known) {
+  if (known === null || known === DEPENDENTS_UNREAD2) {
+    const why = known === null ? NOT_COUNTED.none : NOT_COUNTED.unread;
+    return `The accounts that can sign in only with this provider could not be counted (${why}): if there are any they are locked out while it is off.`;
+  }
+  const { accounts, more } = known;
+  const when = "Counted just now; the server counts again when it switches the provider off.";
+  if (accounts === 0 && !more) {
+    return `No account was found that can sign in only with this provider. ${when}`;
+  }
+  if (accounts === 0) {
+    return `No account that can sign in only with this provider was found among the accounts the server read, and it did not read them all: the rest were not looked at, so how many there are is not known. ${when}`;
+  }
+  const one = accounts === 1 && !more;
+  const count = `${more ? "At least " : ""}${accounts} ${accounts === 1 ? "account" : "accounts"}`;
+  return `${count} can sign in only with this provider: ${one ? "it is" : "they are"} locked out while it is off. ${when}`;
+}
+async function dependentsOf(admin, proposal, about) {
+  if (proposal.operation !== "disable_oauth_provider" || !about.providerOn) {
+    return null;
+  }
+  const provider = OAUTH_PROVIDERS2.find((one) => one === proposal.target.id);
+  if (provider === undefined) {
+    return dependentsWords(DEPENDENTS_UNREAD2);
+  }
+  let known;
+  try {
+    const read = (await readDependents(admin, [provider]))[provider];
+    known = read === undefined ? DEPENDENTS_UNREAD2 : read;
+  } catch {
+    known = DEPENDENTS_UNREAD2;
+  }
+  return dependentsWords(known);
+}
+function userLabel(user) {
+  const email = printable2(user.email ?? "", 320);
+  const name = printable2([user.firstName, user.lastName].filter(Boolean).join(" "), 200);
+  return [email || "no email address", name].filter(Boolean).join(", ");
+}
+async function describeSessionText(admin, sessionId) {
+  const id = printable2(sessionId, 64);
+  let session;
+  try {
+    session = await readSession(admin, sessionId);
+  } catch (error) {
+    if (isTulaAdminError6(error) && error.code === "resource.not_found") {
+      return `session ${id} (no such session now)`;
+    }
+    return `session ${id} (could not be read)`;
+  }
+  let whose;
+  try {
+    const { data } = await admin.call("getUser", { params: { userId: session.userId } });
+    whose = userLabel(data);
+  } catch (error) {
+    whose = isTulaAdminError6(error) && error.code === "resource.not_found" ? "no such user now" : "the user could not be read";
+  }
+  const owner = printable2(session.userId, 64);
+  const client = printable2(session.client, 40);
+  const since = printable2(session.createdAt, 40);
+  const state = session.active === true ? "live now" : "already ended";
+  return `session ${id} (of user ${owner}: ${whose}; ${client} client, signed in ${since}; ${state})`;
+}
+async function readSession(admin, sessionId) {
+  const { data } = await admin.call("getSession", { params: { sessionId } });
+  return data;
+}
+async function describeTarget(admin, proposal) {
+  const id = printable2(proposal.target.id, 64);
+  if (proposal.target.type === "oauth_provider") {
+    return describeProvider(admin, proposal.target.id);
+  }
+  const said = (text) => ({ text, providerOn: false });
+  if (proposal.target.type === "session") {
+    return said(await describeSessionText(admin, proposal.target.id));
+  }
+  if (proposal.target.type !== "user") {
+    return said(`${targetWord(proposal)} ${id}`);
+  }
+  try {
+    const { data } = await admin.call("getUser", { params: { userId: proposal.target.id } });
+    return said(`user ${id} (${userLabel(data)}${data.bannedAt ? "; already banned" : ""})`);
+  } catch (error) {
+    if (isTulaAdminError6(error) && error.code === "resource.not_found") {
+      return said(`user ${id} (no such user now)`);
+    }
+    throw error;
+  }
+}
+var ALREADY_SO = {
+  unban_user: "the user was not banned",
+  end_session: "the session had already ended",
+  disable_oauth_provider: "the provider was already off"
+};
+function render(line, proposal, about, now) {
+  const status = String(proposal.status);
+  line(`Proposal ${printable2(proposal.id, 64)}`);
+  line(`  Asked for by   an agent (agent key ${printable2(proposal.proposedBy.id, 64)})`);
+  line(`  Operation      ${printable2(proposal.operation, 40)}`);
+  line(`  About          ${about}`);
+  line(`  What it does   ${printable2(proposal.summary, 400)}`);
+  line(`  Status         ${statusWords(proposal)}`);
+  if (status === "pending") {
+    line(`  Expires        ${timeLeft(proposal.expiresAt, now)} (${printable2(proposal.expiresAt, 40)})`);
+  }
+}
+var NOT_A_TERMINAL = "tula approve asks its question at a terminal and takes the answer typed there: standard " + "input and standard error are not both a terminal, so there is nobody to ask. There is no " + "option that answers for you. Nothing was read or changed.";
+function toJson(proposal) {
+  return {
+    id: printable2(proposal.id, 64),
+    operation: printable2(proposal.operation, 40),
+    target: {
+      type: printable2(proposal.target.type, 40),
+      id: printable2(proposal.target.id, 64)
+    },
+    summary: printable2(proposal.summary, 400),
+    status: printable2(proposal.status, 40),
+    proposedBy: { type: "agent", id: printable2(proposal.proposedBy.id, 64) },
+    createdAt: printable2(proposal.createdAt, 40),
+    expiresAt: printable2(proposal.expiresAt, 40),
+    approvedBy: proposal.approvedBy ? {
+      type: printable2(proposal.approvedBy.type, 40),
+      id: proposal.approvedBy.id === null ? null : printable2(proposal.approvedBy.id, 64)
+    } : null,
+    ...typeof proposal.changed === "boolean" ? { changed: proposal.changed } : {},
+    approvedAt: proposal.approvedAt === null ? null : printable2(proposal.approvedAt, 40),
+    failureReason: proposal.failureReason === null ? null : printable2(proposal.failureReason, 40),
+    expiryReason: proposal.expiryReason === null ? null : printable2(proposal.expiryReason, 40)
+  };
+}
+async function run(context) {
+  const { flags, io, output, positionals } = context;
+  const id = positionals[0];
+  if (id === undefined) {
+    throw new UsageError2("Which proposal? Usage: tula approve <proposal id>");
+  }
+  if (!PROPOSAL_ID.test(id)) {
+    throw new UsageError2("That is not a proposal id (a UUID, as the agent reported it). Nothing was read or changed.");
+  }
+  if (flags["secret-key-file"] === "-") {
+    throw new UsageError2("--secret-key-file - takes the key from standard input, which is where the question of " + "tula approve is answered: put the key in a file or in the environment. Nothing was " + "read or changed.");
+  }
+  const ask = io.isTTY === true ? io.prompt : undefined;
+  if (ask === undefined) {
+    throw new UsageError2(NOT_A_TERMINAL);
+  }
+  const name = typeof flags.env === "string" ? flags.env : "default";
+  const target = await resolveTarget2({ name, environment: {}, flags, io, output }).catch((error) => {
+    if (isTulaAdminError6(error) && error.code === "client.agent_key") {
+      throw new UsageError2("That is an agent key (tula_ak_\u2026). A proposal is approved by a person, with a secret " + "key (tula_sk_\u2026): an agent key cannot approve. Nothing was read or changed.");
+    }
+    throw error;
+  });
+  const now = io.now?.() ?? new Date;
+  const json = flags.json === true;
+  const say = json ? (text) => output.error(text) : (text) => output.line(text);
+  const { data: proposal } = await target.admin.call("getProposal", { params: { id } });
+  const described = await describeTarget(target.admin, proposal);
+  const about = described.text;
+  render(say, proposal, about, now);
+  say("");
+  const consequence = Object.hasOwn(CONSEQUENCES, proposal.operation) ? CONSEQUENCES[proposal.operation] : undefined;
+  if (consequence === undefined) {
+    output.error(`${output.errorStyle.red("error:")} This version of tula does not know the operation of ` + "this proposal, and does not approve what it cannot describe. Nothing was changed.");
+    return EXIT2.error;
+  }
+  if (proposal.status !== "pending") {
+    if (json) {
+      output.line(JSON.stringify(toJson(proposal), null, 2));
+    }
+    output.error(`${output.errorStyle.red("error:")} This proposal is ${statusWords(proposal)}: there is nothing to approve. Nothing was changed by this run.`);
+    return EXIT2.error;
+  }
+  const dependents = await dependentsOf(target.admin, proposal, described);
+  const asked = dependents === null ? consequence : `${consequence} ${dependents}`;
+  const answer = await ask(`${asked} Approve ${printable2(proposal.operation, 40)} for ${about} at ${target.apiUrl}? Type yes to continue: `);
+  if (answer.trim().toLowerCase() !== "yes") {
+    output.error("Cancelled. Nothing was changed.");
+    return EXIT2.error;
+  }
+  let decided;
+  try {
+    const answer = await target.admin.call("approveProposal", {
+      params: { id },
+      body: { operation: proposal.operation, target: proposal.target }
+    });
+    decided = answer.data;
+  } catch (error) {
+    if (isTulaAdminError6(error) && error.code === "resource.conflict") {
+      const reason = typeof error.params.reason === "string" ? error.params.reason : "";
+      const why = Object.hasOwn(REFUSALS, reason) ? REFUSALS[reason] : undefined;
+      if (why !== undefined) {
+        output.error(`${output.errorStyle.red("error:")} ${why}`);
+        return EXIT2.error;
+      }
+    }
+    throw error;
+  }
+  if (json) {
+    output.line(JSON.stringify(toJson(decided), null, 2));
+  }
+  if (decided.status === "executed") {
+    if (decided.changed === false) {
+      const already = Object.hasOwn(ALREADY_SO, decided.operation) ? ALREADY_SO[decided.operation] : "it was already so";
+      say(`Approved and carried out; ${already}, so nothing changed. The proposal is spent.`);
+      return EXIT2.ok;
+    }
+    say(`Approved and carried out. ${consequence}`);
+    return EXIT2.ok;
+  }
+  if (decided.status !== "failed") {
+    output.error(`${output.errorStyle.red("error:")} Approved, and the server could not record how the operation ended. Check the ${targetWord(decided)} as it is now. The proposal is spent: it cannot be approved again.`);
+    return EXIT2.error;
+  }
+  output.error(`${output.errorStyle.red("error:")} ${failureWords(decided)}`);
+  return EXIT2.error;
+}
+var approveCommand2 = {
+  name: "approve",
+  summary: "Approve a change an AI agent proposed, after showing what it does.",
+  usage: "tula approve <proposal id> [--env <name>] [--api-url <url>] [--secret-key-file <path>] [--json]",
+  description: "Shows a proposal an agent made through `tula mcp` (what it would do, to whom, and when it " + "expires), asks, then approves it on a typed yes: the operation is carried out at once, " + "and recorded with the agent as its actor and you as the one who approved. A proposal is " + `approved once, and only before it expires.
+
+` + "It needs a terminal: the question is asked there and the answer typed, and no option " + "answers it (there is no --yes). Away from a terminal, in a script or in CI, it refuses " + `before it reads or changes anything.
+
+` + "The secret key decides the environment and is what makes the approval yours: " + "--secret-key-file, TULA_SECRET_KEY_<NAME> or TULA_SECRET_KEY, never the command line. An " + `agent key cannot approve. Keep the secret key out of the environment the agent runs in.
+
+` + "Exit codes: 0 approved and carried out, 1 anything else (declined, expired, already " + `approved, not carried out, an error).
+
+` + "What an agent can propose: banning a user, lifting a ban, ending one session, switching " + "one OAuth provider off. A production environment accepts proposals only where its " + "settings say so (agents.proposalsInProduction, off by default).",
+  maxPositionals: 1,
+  options: {
+    env: {
+      type: "string",
+      short: "e",
+      value: "<name>",
+      description: "Read TULA_SECRET_KEY_<NAME> and TULA_API_URL_<NAME> first."
+    },
+    "api-url": {
+      type: "string",
+      value: "<url>",
+      description: "The Tula API. Default: TULA_API_URL_<NAME>, then TULA_API_URL."
+    },
+    "insecure-http": {
+      type: "boolean",
+      description: "Allow a plain http API URL that is not localhost: the secret key then crosses the network in clear text."
+    },
+    "secret-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the secret key from a file (never - for standard input: the answer is typed there). Default: TULA_SECRET_KEY_<NAME>, then TULA_SECRET_KEY."
+    },
+    json: {
+      type: "boolean",
+      description: "Print the proposal as it stands after the run as JSON. The question is still asked, and the proposal shown first, on standard error."
+    }
+  },
+  run
+};
+
+// src/dev.ts
+import { createAdminClient as createAdminClient2, isTulaAdminError as isTulaAdminError7 } from "@tula-tech/admin";
+import { environmentIssuer } from "@tula-tech/contract/issuer";
+
+// src/tunnel.ts
+var FUNNEL_PORT = "443";
+var TAILNET_HOST = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*\.ts\.net$/;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hostOnFunnelPort(key) {
+  const at = key.lastIndexOf(":");
+  return at > 0 && key.slice(at + 1) === FUNNEL_PORT ? key.slice(0, at).toLowerCase() : null;
+}
+function usesFunnelPort(config) {
+  const tcp = isRecord2(config.TCP) ? config.TCP : {};
+  const web = isRecord2(config.Web) ? config.Web : {};
+  return Object.hasOwn(tcp, FUNNEL_PORT) || Object.keys(web).some((key) => hostOnFunnelPort(key) !== null);
+}
+var tailscaleFunnel = {
+  name: "Tailscale Funnel",
+  binary: "tailscale",
+  missing: "`tailscale` was not found. `tula dev --tunnel` opens the tunnel with Tailscale Funnel: install Tailscale (https://tailscale.com/download), sign this machine in to your tailnet (`tailscale up`), and run this again. Nothing was started, and .env.local was not changed.",
+  noAddress: "Tailscale did not report a public address for the tunnel in time. Funnel may not be switched on for this machine yet: run `tailscale funnel 443` once by hand (a tailnet needs HTTPS certificates, MagicDNS and the funnel attribute for it), stop it with Ctrl-C, and run this again.",
+  inspect: "tailscale funnel status",
+  closeByHand: `tailscale funnel --https=${FUNNEL_PORT} off`,
+  statusCommand: () => ["tailscale", "funnel", "status", "--json"],
+  openCommand: (route) => [
+    "tailscale",
+    "funnel",
+    "--bg",
+    "--yes",
+    `--https=${FUNNEL_PORT}`,
+    ...route.path === "/" ? [] : [`--set-path=${route.path}`],
+    route.target
+  ],
+  closeCommand: () => ["tailscale", "funnel", "--yes", `--https=${FUNNEL_PORT}`, "off"],
+  readStatus(stdout) {
+    let config;
+    try {
+      config = JSON.parse(stdout.trim() === "" ? "{}" : stdout);
+    } catch {
+      return null;
+    }
+    if (!isRecord2(config)) {
+      return null;
+    }
+    const web = isRecord2(config.Web) ? config.Web : {};
+    const funnel = isRecord2(config.AllowFunnel) ? config.AllowFunnel : {};
+    const endpoints = [];
+    let unreadable = false;
+    for (const key of Object.keys(web)) {
+      const host = hostOnFunnelPort(key);
+      const entry = web[key];
+      const handlers = isRecord2(entry) && isRecord2(entry.Handlers) ? entry.Handlers : {};
+      if (host === null || Object.keys(handlers).length === 0) {
+        continue;
+      }
+      if (!TAILNET_HOST.test(host)) {
+        unreadable = true;
+        continue;
+      }
+      const routes = {};
+      for (const path of Object.keys(handlers)) {
+        const handler = handlers[path];
+        routes[path] = isRecord2(handler) && typeof handler.Proxy === "string" ? handler.Proxy : null;
+      }
+      endpoints.push({ host, public: funnel[key] === true, routes });
+    }
+    const tcp = isRecord2(config.TCP) ? config.TCP : {};
+    const foreground = isRecord2(config.Foreground) ? Object.values(config.Foreground) : [];
+    return {
+      endpoints,
+      taken: unreadable || Object.hasOwn(tcp, FUNNEL_PORT) && endpoints.length === 0 || foreground.some((session) => isRecord2(session) && usesFunnelPort(session))
+    };
+  }
+};
+var STATUS_MS = 30000;
+var CHANGE_MS = 90000;
+var ADDRESS_TRIES = 15;
+var sameTarget = (a, b) => a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
+function judgeTunnel(status, routes) {
+  if (status.taken || status.endpoints.length > 1) {
+    return { kind: "foreign" };
+  }
+  const [endpoint] = status.endpoints;
+  if (!endpoint) {
+    return { kind: "absent" };
+  }
+  for (const [path, target] of Object.entries(endpoint.routes)) {
+    const wanted = routes.find((route) => route.path === path);
+    if (!wanted || target === null || !sameTarget(wanted.target, target)) {
+      return { kind: "foreign" };
+    }
+  }
+  return {
+    kind: "ours",
+    host: endpoint.host,
+    public: endpoint.public,
+    missing: routes.filter((route) => !Object.hasOwn(endpoint.routes, route.path))
+  };
+}
+function said(result) {
+  return (result.stderr || result.stdout).trim().split(`
+`).slice(-6).map((line) => `    ${printable2(line, 300)}`).join(`
+`);
+}
+async function run2(context, command, timeoutMs) {
+  try {
+    return await context.host.run(command, {
+      cwd: context.cwd,
+      timeoutMs,
+      ...context.shielded && { shielded: true }
+    });
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new UsageError2(context.service.missing);
+    }
+    throw error;
+  }
+}
+async function tunnelStatus(context) {
+  const { service } = context;
+  const result = await run2(context, service.statusCommand(), STATUS_MS);
+  if (result.timedOut) {
+    throw new UsageError2(`\`${service.inspect}\` did not answer in ${STATUS_MS / 1000}s. Is ${service.binary} running on this machine?`);
+  }
+  if (result.code !== 0) {
+    throw new UsageError2(`\`${service.inspect}\` failed (exit ${String(result.code)}). Is this machine signed in to ${service.name}?
+${said(result)}`);
+  }
+  const status = service.readStatus(result.stdout);
+  if (!status) {
+    throw new UsageError2(`\`${service.inspect}\` printed something \`tula dev\` cannot read. Nothing was changed.`);
+  }
+  return status;
+}
+async function closeTunnel(context, routes) {
+  try {
+    const before = judgeTunnel(await tunnelStatus(context), routes);
+    if (before.kind !== "ours") {
+      return before.kind === "absent" ? "gone" : "foreign";
+    }
+    await run2(context, context.service.closeCommand(), CHANGE_MS);
+    const after = judgeTunnel(await tunnelStatus(context), routes);
+    return after.kind === "absent" ? "closed" : "failed";
+  } catch (error) {
+    if (error.code === "ABORT") {
+      throw error;
+    }
+    return "failed";
+  }
+}
+async function openTunnel(context, routes, beforeOpening) {
+  const { service } = context;
+  const before = judgeTunnel(await tunnelStatus(context), routes);
+  if (before.kind === "foreign") {
+    throw new UsageError2(portInUse(service));
+  }
+  if (before.kind === "ours" && before.public && before.missing.length === 0) {
+    return { host: before.host, opened: false };
+  }
+  const missing = before.kind === "ours" ? before.missing : [...routes];
+  const toOpen = missing.length > 0 ? missing : routes.slice(0, 1);
+  await beforeOpening?.();
+  for (const route of toOpen) {
+    const result = await run2(context, service.openCommand(route), CHANGE_MS);
+    if (result.timedOut) {
+      throw new UsageError2(service.noAddress);
+    }
+    if (result.code !== 0) {
+      throw new UsageError2(`${service.name} refused to open the tunnel (exit ${String(result.code)}). It said:
+${said(result)}`);
+    }
+  }
+  for (let attempt = 0;attempt < ADDRESS_TRIES; attempt += 1) {
+    const now = judgeTunnel(await tunnelStatus(context), routes);
+    if (now.kind === "ours" && now.public && now.missing.length === 0) {
+      return { host: now.host, opened: true };
+    }
+    await context.host.sleep(1000);
+    context.halt?.();
+  }
+  throw new UsageError2(service.noAddress);
+}
+function portInUse(service) {
+  return `${service.name} already serves something else on this machine's port ${FUNNEL_PORT}, which \`tula dev --tunnel\` would use. It was left alone. \`${service.inspect}\` shows it; \`${service.closeByHand}\` removes it.`;
+}
+
+// src/dev.ts
+var DEV_ENV_FILE2 = ".env.local";
+var BLOCK_START = "# tula:dev:start";
+var BLOCK_END = "# tula:dev:end";
+var BLOCK_NOTE = "# Written by `tula dev`: the local stack\u2019s URL and keys. Lines outside this block are yours.";
+var API_CONTAINER_PORT = "3003";
+var MAILPIT_UI_PORT = "8025";
+var QUICK_MS = 30000;
+var PUBLIC_URL_VARIABLE = "TULA_PUBLIC_URL";
+var TUNNEL_VARIABLES = [
+  PUBLIC_URL_VARIABLE,
+  "TULA_ISSUER",
+  "TULA_TUNNEL_TARGET"
+];
+var PROBE_PUBLIC_URL = "https://tula-dev-tunnel-probe.invalid";
+var COMPOSE_LINE = `PUBLIC_URL: \${${PUBLIC_URL_VARIABLE}:-http://localhost:\${API_PORT:-3003}}`;
+var TUNNEL_TARGET = /^http:\/\/127\.0\.0\.1:([0-9]{1,5})$/;
+var ASSOCIATION_FILES = ["apple-app-site-association", "assetlinks.json"];
+var UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+var KEY = {
+  publishable: /^tula_pk_[a-z]+_[A-Za-z0-9_-]{16,}$/,
+  secret: /^tula_sk_[a-z]+_[A-Za-z0-9_-]{16,}$/
+};
+function findBlock(text) {
+  const start = /^# tula:dev:start[ \t\r]*$/m.exec(text);
+  if (!start) {
+    return null;
+  }
+  const from = start.index + BLOCK_START.length;
+  const end = /^# tula:dev:end[ \t]*$/m.exec(text.slice(from));
+  if (!end) {
+    return null;
+  }
+  return { start: start.index, end: from + end.index + BLOCK_END.length };
+}
+function parseDevBlock2(text) {
+  const block = findBlock(text);
+  if (!block) {
+    return null;
+  }
+  const vars = {};
+  for (const line of text.slice(block.start, block.end).split(`
+`)) {
+    const match = /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line.trim());
+    if (match) {
+      vars[match[1]] = match[2];
+    }
+  }
+  return vars;
+}
+function withoutDevBlock2(text) {
+  const found = findBlock(text);
+  if (!found) {
+    return text;
+  }
+  const after = text.slice(found.end).replace(/^\r?\n/, "");
+  return `${text.slice(0, found.start)}${after}`;
+}
+function withDevBlock2(text, vars) {
+  const block = [
+    BLOCK_START,
+    BLOCK_NOTE,
+    ...Object.entries(vars).map(([name, value]) => `${name}=${value}`),
+    BLOCK_END
+  ].join(`
+`);
+  const found = findBlock(text);
+  if (found) {
+    return `${text.slice(0, found.start)}${block}${text.slice(found.end)}`;
+  }
+  const separator = text === "" || text.endsWith(`
+`) ? "" : `
+`;
+  return `${text}${separator}${block}
+`;
+}
+function userValue(text, name) {
+  for (const line of withoutDevBlock2(text).split(`
+`)) {
+    const match = /^(?:export\s+)?([A-Z][A-Z0-9_]*)=(.*)$/.exec(line.trim());
+    if (match && match[1] === name && match[2].trim() !== "") {
+      return match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+    }
+  }
+  return;
+}
+function tunnelContext(options) {
+  return {
+    host: options.host,
+    cwd: options.io.cwd,
+    service: options.tunnelService ?? tailscaleFunnel
+  };
+}
+function tunnelRoutes(target, environmentId) {
+  return [
+    { path: "/", target },
+    ...ASSOCIATION_FILES.map((file) => ({
+      path: `/.well-known/${file}`,
+      target: `${target}/v1/environments/${environmentId}/.well-known/${file}`
+    }))
+  ];
+}
+function recordedTunnel(block) {
+  const target = block.TULA_TUNNEL_TARGET ?? "";
+  const environmentId = UUID.exec(block.TULA_ENVIRONMENT_ID ?? "")?.[0];
+  if (!TUNNEL_TARGET.test(target) || !environmentId) {
+    return null;
+  }
+  return tunnelRoutes(target, environmentId);
+}
+function servesAnother(status, target, block, previous) {
+  const named = status.endpoints.flatMap((endpoint) => Object.values(endpoint.routes)).map((route) => UUID.exec(route ?? "")?.[0]);
+  const environments = [UUID.exec(block.TULA_ENVIRONMENT_ID ?? "")?.[0], ...named, NO_ENVIRONMENT];
+  const candidates = [
+    ...previous ? [previous] : [],
+    ...environments.flatMap((id) => id ? [tunnelRoutes(target, id)] : [])
+  ];
+  return candidates.every((routes) => judgeTunnel(status, routes).kind === "foreign");
+}
+var NO_ENVIRONMENT = "00000000-0000-0000-0000-000000000000";
+async function closeRecorded(options, routes) {
+  const { output } = options;
+  const context = tunnelContext(options);
+  const outcome = await closeTunnel(context, routes);
+  const warning = output.errorStyle.yellow("warning:");
+  if (outcome === "closed") {
+    output.line(`${output.style.dim("\u203A")} The tunnel was closed: the public address no longer reaches this machine.`);
+  } else if (outcome === "foreign") {
+    output.error(`${warning} ${context.service.name} now serves something \`tula dev\` did not set up where its tunnel was. It was left alone: \`${context.service.inspect}\` shows it. The tunnel's record stays in ${DEV_ENV_FILE2} until a run finds the port free.`);
+  } else if (outcome === "failed") {
+    output.error(`${warning} the tunnel \`tula dev --tunnel\` opened could not be closed. Close it yourself: \`${context.service.closeByHand}\`. Its record stays in ${DEV_ENV_FILE2}, so \`tula dev down\` tries again.`);
+  }
+  return outcome;
+}
+function composeValue(environment, name) {
+  const value = typeof environment === "object" && environment !== null ? environment[name] : undefined;
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value).trim() : "";
+}
+function compose(options, ...args) {
+  return ["docker", "compose", ...options.projectName ? ["-p", options.projectName] : [], ...args];
+}
+function tail(result, lines = 12) {
+  const clean = (text) => text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
+  return clean(result.stderr || result.stdout).trim().split(`
+`).slice(-lines).map((line) => `    ${line}`).join(`
+`);
+}
+async function step(options, what, command, run) {
+  let result;
+  try {
+    result = await options.host.run(command, {
+      cwd: options.io.cwd,
+      timeoutMs: run.timeoutMs,
+      ...run.env && { env: run.env }
+    });
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new UsageError2("Docker was not found. `tula dev` runs the local stack with Docker Compose: install Docker (https://docs.docker.com/get-docker/) and run it again.");
+    }
+    if (error.code === "ABORT") {
+      throw new UsageError2("Interrupted. The stack may be partly started: `tula dev` continues it, `tula dev down` stops it.");
+    }
+    throw error;
+  }
+  if (result.timedOut) {
+    throw new UsageError2(`${what} timed out after ${Math.round(run.timeoutMs / 1000)}s. Run it again (pulled images are kept), or raise --timeout.`);
+  }
+  if (result.code !== 0) {
+    const said = `${result.stderr}
+${result.stdout}`;
+    if (/cannot connect to the docker daemon|docker daemon is not running|error during connect/i.test(said)) {
+      throw new UsageError2("Docker is not running. Start Docker Desktop (or the Docker daemon) and run `tula dev` again.");
+    }
+    if (/no configuration file provided|no such file or directory.*compose|can't find a suitable configuration file/i.test(said)) {
+      throw new UsageError2("There is no Compose file here. Run `tula dev` in a project made by `create-tula` (or in a directory with a compose.yaml that has `api` and `migrate` services).");
+    }
+    throw new UsageError2(run.quiet ? `${what} failed (exit ${String(result.code)}).` : `${what} failed (exit ${String(result.code)}):
+${tail(result)}`);
+  }
+  return result;
+}
+async function tunnelTarget(options) {
+  const result = await step(options, "Reading the Compose file", compose(options, "config", "--format", "json"), { timeoutMs: QUICK_MS, quiet: true, env: { [PUBLIC_URL_VARIABLE]: PROBE_PUBLIC_URL } });
+  const untouched = "Nothing was started, and .env.local was not changed.";
+  let api;
+  try {
+    api = JSON.parse(result.stdout).services?.api;
+  } catch {
+    api = undefined;
+  }
+  if (typeof api !== "object" || api === null) {
+    throw new UsageError2(`The resolved Compose file could not be read (\`docker compose config --format json\`). \`tula dev --tunnel\` needs it to see how the API is started. ${untouched}`);
+  }
+  const { environment, ports } = api;
+  if (composeValue(environment, "PUBLIC_URL") !== PROBE_PUBLIC_URL) {
+    throw new UsageError2(`The Compose file here gives the API a fixed PUBLIC_URL, so it cannot be started under a public address, and \`tula dev\` does not edit the file. In the \`api\` service, change that line to:
+
+    ${COMPOSE_LINE}
+
+and run this again. ${untouched}`);
+  }
+  const on = [];
+  if (/^(true|1|yes)$/i.test(composeValue(environment, "OAUTH_MOCK_PROVIDER"))) {
+    on.push("the mock OAuth provider (OAUTH_MOCK_PROVIDER)");
+  }
+  if (composeValue(environment, "SMS_PROVIDER").toLowerCase() === "dev") {
+    on.push("the development SMS inbox (SMS_PROVIDER=dev)");
+  }
+  if (on.length > 0) {
+    throw new UsageError2(`This stack has ${on.join(" and ")} switched on. The API refuses to start with that under a public address: it hands a sign-in, or every texted code, to whoever asks, and is for this machine only. \`tula dev\` does not change your lines. Switch it off in .env (or the Compose file) and run this again, or run \`tula dev\` without --tunnel to keep it. ${untouched}`);
+  }
+  const published = (Array.isArray(ports) ? ports : []).filter((port) => typeof port === "object" && port !== null).find((port) => String(port.target) === API_CONTAINER_PORT)?.published;
+  const port = /^[0-9]{1,5}$/.exec(String(published ?? ""))?.[0];
+  if (!port || Number(port) < 1 || Number(port) > 65535) {
+    throw new UsageError2(`The \`api\` service does not publish its port 3003 on a fixed port of this machine, which is where a tunnel sends requests. Publish it in the Compose file (e.g. \`127.0.0.1:3003:3003\`). ${untouched}`);
+  }
+  return `http://127.0.0.1:${port}`;
+}
+async function publishedUrl(options, service, port) {
+  const result = await options.host.run(compose(options, "port", service, port), { cwd: options.io.cwd, timeoutMs: QUICK_MS }).catch(() => null);
+  const match = /:(\d{1,5})\s*$/.exec(result?.code === 0 ? result.stdout.trim() : "");
+  return match ? `http://localhost:${match[1]}` : null;
+}
+async function waitUntilReady(options, apiUrl, halt) {
+  const send = options.io.fetch ?? ((url, init) => fetch(url, init));
+  const attempts = Math.max(1, Math.ceil(options.timeoutMs / 1000));
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    halt();
+    const ready = await send(`${apiUrl}/v1/ready`, { signal: AbortSignal.timeout(5000) }).then((response) => response.status === 200, () => false);
+    if (ready) {
+      return;
+    }
+    await options.host.sleep(1000);
+  }
+  throw new UsageError2(`The API did not become ready at ${apiUrl}. Look at what it says: \`${compose(options, "logs", "api").join(" ")}\`, then \`tula doctor\`.`);
+}
+async function mint(options, environmentId, kind) {
+  const result = await step(options, `Minting the ${kind} key`, compose(options, "exec", "-T", "api", "bun", "run", "src/scripts/create-api-key.ts", "--environment", environmentId, "--kind", kind, "--name", "tula dev"), { timeoutMs: 60000, quiet: true });
+  const key = result.stdout.trim().split(`
+`).at(-1)?.trim() ?? "";
+  if (!KEY[kind].test(key)) {
+    throw new UsageError2(`Minting the ${kind} key did not answer with a key.`);
+  }
+  if (kind === "secret" && !options.showKeys) {
+    options.output.redact(key);
+  }
+  return key;
+}
+async function accepts(options, apiUrl, secretKey) {
+  try {
+    const admin = createAdminClient2({
+      baseUrl: apiUrl,
+      secretKey,
+      fetch: options.io.fetch,
+      userAgent: `tula-cli/${VERSION2}`
+    });
+    await admin.call("getEnvironmentSettings");
+    return true;
+  } catch (error) {
+    if (isTulaAdminError7(error) && (error.code === "auth.invalid_key" || error.code === "client.invalid_key")) {
+      return false;
+    }
+    throw error;
+  }
+}
+async function startDev2(options) {
+  const { io, output, host } = options;
+  const say = (text) => output.line(`${output.style.dim("\u203A")} ${text}`);
+  await step(options, "Checking Docker Compose", ["docker", "compose", "version"], {
+    timeoutMs: QUICK_MS
+  });
+  const services = (await step(options, "Reading the Compose file", compose(options, "config", "--services"), {
+    timeoutMs: QUICK_MS
+  })).stdout.split(`
+`).map((line) => line.trim());
+  for (const service of ["api", "migrate"]) {
+    if (!services.includes(service)) {
+      throw new UsageError2(`The Compose file here has no \`${service}\` service. \`tula dev\` runs a project made by \`create-tula\`: a Compose file with \`api\` and \`migrate\` services built from the Tula API image.`);
+    }
+  }
+  const path = `${io.cwd.replace(/\/+$/, "")}/${DEV_ENV_FILE2}`;
+  const raw = await host.readFile(path);
+  const existing = raw ?? "";
+  const block = parseDevBlock2(existing) ?? {};
+  const previous = recordedTunnel(block);
+  const tunnel = tunnelContext(options);
+  let target;
+  if (options.tunnel) {
+    say("A tunnel gives this stack a public address. Under one the API refuses to start with the mock OAuth provider (OAUTH_MOCK_PROVIDER) or the development SMS inbox (SMS_PROVIDER=dev): both are for this machine only.");
+    target = await tunnelTarget(options);
+    const status = await tunnelStatus(tunnel);
+    if (servesAnother(status, target, block, previous)) {
+      throw new UsageError2(`${portInUse(tunnel.service)} Nothing was started.`);
+    }
+  }
+  say("Starting the database and running migrations (the first run pulls images)\u2026");
+  await step(options, "Running the migrations", compose(options, "run", "--rm", "migrate"), {
+    timeoutMs: options.timeoutMs
+  });
+  say("Seeding the default project and its environments\u2026");
+  const seed = await step(options, "Seeding", compose(options, "run", "--rm", "--no-deps", "api", "bun", "run", "../../packages/db/src/scripts/seed.ts"), { timeoutMs: options.timeoutMs });
+  const environmentId = UUID.exec(/development environment\s+(\S+)/.exec(seed.stdout)?.[1] ?? "")?.[0];
+  if (!environmentId) {
+    throw new UsageError2("The seed did not report a development environment.");
+  }
+  if (target !== undefined) {
+    await serveThroughTunnel(options, { path, raw, block, previous, target, environmentId });
+    return;
+  }
+  const outcome = previous ? await closeRecorded(options, previous) : "gone";
+  const still = outcome === "failed" || outcome === "foreign";
+  await serve(options, {
+    path,
+    existing,
+    block,
+    environmentId,
+    tunnel: null,
+    ...still && block.TULA_TUNNEL_TARGET && { record: block.TULA_TUNNEL_TARGET },
+    halt: () => {}
+  });
+}
+var STOP_MS = 300000;
+async function serveThroughTunnel(options, run) {
+  const { host, output } = options;
+  const { path, raw, block, previous, target, environmentId } = run;
+  const existing = raw ?? "";
+  const tunnel = tunnelContext(options);
+  const { service } = tunnel;
+  const routes = tunnelRoutes(target, environmentId);
+  const same = previous !== null && JSON.stringify(previous) === JSON.stringify(routes);
+  let signals = 0;
+  let closing = false;
+  const release = host.onInterrupt(() => {
+    signals += 1;
+    if (closing) {
+      output.error("The tunnel is being closed. That is not cut short: one moment.");
+    }
+  });
+  const halt = () => {
+    if (signals > 0) {
+      throw Object.assign(new Error("interrupted"), { code: "ABORT" });
+    }
+  };
+  let pending = null;
+  const record = async (vars) => {
+    const text = withDevBlock2(existing, {
+      ...vars,
+      TULA_ENVIRONMENT_ID: environmentId,
+      TULA_TUNNEL_TARGET: target
+    });
+    if (text !== existing) {
+      await host.writeSecretFile(path, text);
+      pending = text;
+    }
+  };
+  let staleClosed = false;
+  let stopped = false;
+  let started = false;
+  let begun = false;
+  let stopping = false;
+  let adopted = "no";
+  try {
+    if (previous && !same) {
+      const outcome = await closeRecorded(options, previous);
+      if (outcome === "failed" || outcome === "foreign") {
+        throw new UsageError2("The tunnel an earlier run opened, for another port or environment, is still recorded in .env.local and was not closed, so no new one was opened. The API was not touched.");
+      }
+      staleClosed = true;
+    }
+    halt();
+    output.line(`${output.style.dim("\u203A")} Opening the tunnel (${service.name})\u2026`);
+    const answer = await openTunnel({ ...tunnel, halt }, routes, async () => {
+      halt();
+      stopping = true;
+      await step(options, "Stopping the API", compose(options, "stop", "api"), {
+        timeoutMs: STOP_MS
+      });
+      stopped = true;
+      halt();
+      await record(same ? block : withoutTunnelVariables(block));
+      begun = true;
+      halt();
+    });
+    if (!begun) {
+      adopted = "unrecorded";
+      await record(same ? block : withoutTunnelVariables(block));
+      adopted = "recorded";
+    }
+    halt();
+    const now = pending ?? existing;
+    await serve(options, {
+      path,
+      existing: now,
+      block: parseDevBlock2(now) ?? {},
+      environmentId,
+      tunnel: { publicUrl: `https://${answer.host}`, target },
+      halt,
+      started: () => {
+        started = true;
+      }
+    });
+  } catch (error) {
+    closing = true;
+    const interrupted = signals > 0 || error.code === "ABORT";
+    const outcome = begun ? await closeTunnel({ ...tunnel, shielded: true }, routes).catch(() => "failed") : null;
+    const closed = outcome === "closed" || outcome === "gone";
+    let dropped = false;
+    if (begun ? closed : staleClosed) {
+      dropped = await dropRecord(host, path, { raw, pending }).catch(() => false);
+    }
+    if (begun) {
+      output.error(closed ? `The tunnel this run opened was closed again${dropped ? ", and its record was taken out of .env.local" : ". Its record could not be taken out of .env.local: `tula dev down` does that"}.` : outcome === "foreign" ? `${service.name} now serves something else where this run was opening its tunnel. It was left alone (\`${service.inspect}\` shows it), and the tunnel's record stays in .env.local until a run finds the port free.` : `The tunnel this run opened could not be closed, and may still reach this machine. Its record stays in .env.local: \`tula dev down\` tries again, and \`${service.closeByHand}\` closes it by hand.`);
+    } else if (adopted === "recorded") {
+      output.error("The tunnel was open before this run and was left open; it is recorded in .env.local. `tula dev down` closes it.");
+    } else if (adopted === "unrecorded") {
+      output.error(`The tunnel was open before this run and was left open. It could not be recorded in .env.local, so \`tula dev down\` does not know of it: \`${service.closeByHand}\` closes it by hand.`);
+    }
+    if (stopped && !started) {
+      output.error("The API was stopped before the tunnel was opened and was not started again: `tula dev` starts it.");
+    } else if (stopping && !stopped) {
+      output.error("The API may have been stopped (the stop did not end as expected): `tula dev` starts it.");
+    }
+    if (interrupted && !(error instanceof UsageError2)) {
+      throw new UsageError2("Interrupted. `tula dev` continues where this stopped, `tula dev down` stops the stack.");
+    }
+    throw error;
+  } finally {
+    release();
+  }
+}
+function withoutTunnelVariables(block) {
+  return Object.fromEntries(Object.entries(block).filter(([name]) => !TUNNEL_VARIABLES.includes(name)));
+}
+function withoutTunnelRecord(text) {
+  const block = parseDevBlock2(text);
+  if (!block) {
+    return text;
+  }
+  const kept = withoutTunnelVariables(block);
+  if (Object.keys(kept).length === Object.keys(block).length) {
+    return text;
+  }
+  return Object.keys(kept).every((name) => name === "TULA_ENVIRONMENT_ID") ? withoutDevBlock2(text) : withDevBlock2(text, kept);
+}
+async function dropRecord(host, path, was) {
+  const now = await host.readFile(path);
+  if (now === null) {
+    return true;
+  }
+  const next = withoutTunnelRecord(now === was.pending ? was.raw ?? "" : now);
+  if (next === "" && was.raw === null) {
+    await host.removeFile(path);
+  } else if (next !== now) {
+    await host.writeSecretFile(path, next);
+  }
+  return true;
+}
+async function serve(options, state) {
+  const { io, output, host } = options;
+  const { path, existing, block, environmentId, tunnel, halt } = state;
+  const say = (text) => output.line(`${output.style.dim("\u203A")} ${text}`);
+  halt();
+  say("Starting the API\u2026");
+  await step(options, "Starting the API", compose(options, "up", "-d", "api"), {
+    timeoutMs: options.timeoutMs,
+    ...tunnel && { env: { [PUBLIC_URL_VARIABLE]: tunnel.publicUrl } }
+  });
+  state.started?.();
+  const apiUrl = await publishedUrl(options, "api", API_CONTAINER_PORT);
+  if (!apiUrl) {
+    throw new UsageError2("The `api` service does not publish its port 3003, so its URL is unknown. Publish it in the Compose file (e.g. `127.0.0.1:3003:3003`).");
+  }
+  if (tunnel && new URL(apiUrl).port !== new URL(tunnel.target).port) {
+    throw new UsageError2("The API is published on another port than the Compose file said, so the tunnel would not reach it.");
+  }
+  await waitUntilReady(options, apiUrl, halt);
+  halt();
+  const own = {
+    secret: userValue(existing, "TULA_SECRET_KEY"),
+    publishable: userValue(existing, "TULA_PUBLISHABLE_KEY")
+  };
+  for (const value of [own.secret, options.showKeys ? undefined : block.TULA_SECRET_KEY]) {
+    if (value) {
+      output.redact(value);
+    }
+  }
+  let secretKey = options.rotateKeys ? undefined : block.TULA_SECRET_KEY;
+  let publishableKey = options.rotateKeys ? undefined : block.TULA_PUBLISHABLE_KEY;
+  let minted = false;
+  if (own.secret) {
+    if (!await accepts(options, apiUrl, own.secret)) {
+      output.error(`${output.errorStyle.yellow("warning:")} the TULA_SECRET_KEY you set in ${DEV_ENV_FILE2} is not accepted by this stack. \`tula dev\` does not change your lines: remove that line to have a key minted.`);
+    }
+    secretKey = undefined;
+  } else if (secretKey && publishableKey) {
+    if (!await accepts(options, apiUrl, secretKey)) {
+      throw new UsageError2(`The keys in ${DEV_ENV_FILE2} are not accepted by this stack (was its database wiped?). Nothing was changed. Run \`tula dev --rotate-keys\` to mint new ones.`);
+    }
+  } else {
+    say("Minting development keys\u2026");
+    publishableKey = await mint(options, environmentId, "publishable");
+    secretKey = await mint(options, environmentId, "secret");
+    minted = true;
+  }
+  if (!publishableKey && !own.publishable) {
+    publishableKey = await mint(options, environmentId, "publishable");
+    minted = true;
+  }
+  const vars = { TULA_API_URL: apiUrl, TULA_ENVIRONMENT_ID: environmentId };
+  if (publishableKey) {
+    vars.TULA_PUBLISHABLE_KEY = publishableKey;
+  }
+  if (secretKey) {
+    vars.TULA_SECRET_KEY = secretKey;
+  }
+  vars.VITE_TULA_API_URL = apiUrl;
+  const shownKey = publishableKey ?? own.publishable;
+  if (shownKey) {
+    vars.VITE_TULA_PUBLISHABLE_KEY = shownKey;
+    vars.NEXT_PUBLIC_TULA_PUBLISHABLE_KEY = shownKey;
+  }
+  if (tunnel) {
+    vars[PUBLIC_URL_VARIABLE] = tunnel.publicUrl;
+    vars.TULA_ISSUER = environmentIssuer(tunnel.publicUrl, environmentId);
+    vars.TULA_TUNNEL_TARGET = tunnel.target;
+  } else if (state.record) {
+    vars.TULA_TUNNEL_TARGET = state.record;
+  }
+  halt();
+  const next = withDevBlock2(existing, vars);
+  if (next !== existing) {
+    await host.writeSecretFile(path, next);
+  } else if (await host.restrictFile(path)) {
+    output.error(`${output.errorStyle.yellow("warning:")} ${DEV_ENV_FILE2} holds a secret key and was readable by other users of this machine. It is now readable by you only (mode 0600).`);
+  }
+  const ignored = await host.run(["git", "check-ignore", "-q", DEV_ENV_FILE2], { cwd: io.cwd, timeoutMs: QUICK_MS }).then((result) => result.code, () => null);
+  if (ignored === 1) {
+    output.error(`${output.errorStyle.yellow("warning:")} ${DEV_ENV_FILE2} holds a secret key and is not ignored by git. Add it to .gitignore before you commit.`);
+  }
+  const mailUrl = await publishedUrl(options, "mailpit", MAILPIT_UI_PORT);
+  halt();
+  const { style } = output;
+  output.line();
+  output.line(style.bold("Tula is running."));
+  output.line(`  API              ${apiUrl}`);
+  if (tunnel) {
+    output.line(`  Public address   ${tunnel.publicUrl}`);
+  }
+  output.line(`  API reference    ${apiUrl}/v1/docs`);
+  if (mailUrl) {
+    output.line(`  Mail (Mailpit)   ${mailUrl}`);
+  }
+  output.line(`  Environment      ${environmentId} (development)`);
+  if (shownKey) {
+    output.line(`  Publishable key  ${shownKey}`);
+  }
+  output.line(secretKey && options.showKeys ? `  Secret key       ${secretKey}` : `  Secret key       in ${DEV_ENV_FILE2}${own.secret ? " (your own line)" : ""}; --show-keys prints it`);
+  output.line();
+  output.line(minted ? `Keys were minted and written to ${DEV_ENV_FILE2} (readable by you only).` : `Keys in ${DEV_ENV_FILE2} were reused: nothing was minted.`);
+  if (tunnel) {
+    const name = new URL(tunnel.publicUrl).host;
+    const { service } = tunnelContext(options);
+    output.line();
+    output.line(style.bold(`The tunnel is open (${service.name}).`));
+    output.line(`  ${tunnel.publicUrl} reaches this machine's API, and so does anyone who has that address: the sign-in routes, the dashboard's sign-in and the API reference included. \`tula dev\` without --tunnel, or \`tula dev down\`, closes it.`);
+    output.line(`  The address is in ${DEV_ENV_FILE2} as ${PUBLIC_URL_VARIABLE}, and the issuer of this stack's tokens as TULA_ISSUER. TULA_API_URL is still the local address.`);
+    output.line("  The mock OAuth provider and the development SMS inbox are off under a public address, and their routes answer a local request only.");
+    output.line();
+    output.line("No setting of the environment was changed. For passkeys and a native app at this address, put this in tula.config.ts and run `tula apply`:");
+    output.line(`    passkeys: { rpId: '${name}' },`);
+    output.line(`    urls: { allowedOrigins: ['${tunnel.publicUrl}' /* and the origins you already allow */] },`);
+    output.line(`  Register the app under \`nativeApps\`; its associated domain is ${name}. /.well-known/apple-app-site-association and /.well-known/assetlinks.json at that address answer with this environment's files.`);
+    output.line("  A redirect URL or an app link at this address goes in `urls.allowedRedirectUrls`, written out in full.");
+    output.line();
+    output.line("Not checked: that the address answers from the internet, or from a phone. Open its /v1/status in the phone\u2019s browser to see.");
+  }
+  output.line("Next: `tula doctor` checks the stack, `tula apply` applies tula.config.ts, `tula dev down` stops it.");
+}
+async function stopDev2(options) {
+  const { io, output, host } = options;
+  const path = `${io.cwd.replace(/\/+$/, "")}/${DEV_ENV_FILE2}`;
+  const existing = await host.readFile(path);
+  const block = existing === null ? null : parseDevBlock2(existing);
+  const tunnel = block ? recordedTunnel(block) : null;
+  const outcome = tunnel ? await closeRecorded(options, tunnel) : "gone";
+  const still = block !== null && (outcome === "failed" || outcome === "foreign");
+  await step(options, "Stopping the stack", compose(options, "down", ...options.volumes ? ["--volumes"] : []), { timeoutMs: STOP_MS });
+  if (options.volumes) {
+    if (existing !== null && block !== null) {
+      await host.writeSecretFile(path, still ? withDevBlock2(existing, {
+        TULA_ENVIRONMENT_ID: block.TULA_ENVIRONMENT_ID ?? "",
+        TULA_TUNNEL_TARGET: block.TULA_TUNNEL_TARGET ?? ""
+      }) : withoutDevBlock2(existing));
+    }
+    output.line(`Stopped, and the data is deleted. The keys \`tula dev\` wrote were removed from ${DEV_ENV_FILE2}.`);
+  } else {
+    if (existing !== null && !still) {
+      const next = withoutTunnelRecord(existing);
+      if (next !== existing) {
+        await host.writeSecretFile(path, next);
+      }
+    }
+    output.line("Stopped. The data is kept: `tula dev` starts it again.");
+  }
+}
+
+// src/commands/dev.ts
+var USAGE = `tula dev [--tunnel] [--project-name <name>] [--show-keys] [--rotate-keys] [--timeout <seconds>]
+` + "       tula dev down [--volumes [--yes]] [--project-name <name>]";
+var DEFAULT_TIMEOUT_SECONDS = 900;
+var devCommand2 = {
+  name: "dev",
+  summary: "Start the local stack: Compose, migrations, seed, development keys.",
+  usage: USAGE,
+  description: "Runs in a project made by create-tula (a directory with a Compose file that has `api` " + "and `migrate` services). Starts the services, runs the migrations and the seed with the " + "commands the API image ships, mints a publishable and a secret development key, writes " + "them to its own block of .env.local (your own lines are never changed) and prints the " + `URLs. A second run reuses the keys. The secret key is printed only with --show-keys.
+
+` + "`tula dev down` stops the stack and keeps the data; `--volumes` deletes the database " + `after a confirmation (--yes without a terminal).
+
+` + "`--tunnel` gives the stack a public https address a phone can reach, through Tailscale " + "Funnel (the machine\u2019s own name under ts.net, the same on every run). The Tailscale client " + "and its sign-in are your own setup: tula passes it no credential and reads none. The " + "address goes into the block of .env.local and the API is started under it; no setting " + "of the environment is changed, the changes to make are printed. Under a public address " + "the mock OAuth provider and the development SMS inbox cannot be on: with either, " + "--tunnel stops before anything is started. `tula dev` without --tunnel, and `tula dev " + `down\`, close the tunnel.
+
+` + "The Compose project name comes from --project-name, else COMPOSE_PROJECT_NAME, else " + `Compose\u2019s default (the directory\u2019s name). Ports come from the Compose file and its .env.
+
+` + "Exit codes: 0 done, 1 an error.",
+  maxPositionals: 1,
+  options: {
+    "project-name": {
+      type: "string",
+      short: "p",
+      value: "<name>",
+      description: "The Compose project name. Default: COMPOSE_PROJECT_NAME, then the directory."
+    },
+    tunnel: {
+      type: "boolean",
+      description: "Open a public https address for the stack (Tailscale Funnel)."
+    },
+    "show-keys": { type: "boolean", description: "Print the secret key too." },
+    "rotate-keys": {
+      type: "boolean",
+      description: "Mint new keys and replace the ones tula dev wrote."
+    },
+    timeout: {
+      type: "string",
+      value: "<seconds>",
+      description: `How long one step may take. Default: ${DEFAULT_TIMEOUT_SECONDS}.`
+    },
+    volumes: { type: "boolean", description: "With `down`: delete the database too." },
+    yes: { type: "boolean", short: "y", description: "With `down --volumes`: do not ask." }
+  },
+  run: async ({ flags, positionals, io, output }) => {
+    const [subcommand] = positionals;
+    if (subcommand !== undefined && subcommand !== "down") {
+      throw new UsageError2(`Usage: ${USAGE}`);
+    }
+    const { host } = io;
+    if (!host) {
+      throw new UsageError2("tula dev cannot run processes here.");
+    }
+    const projectName = typeof flags["project-name"] === "string" ? flags["project-name"] : undefined;
+    if (projectName !== undefined && !/^[a-z0-9][a-z0-9_-]*$/.test(projectName)) {
+      throw new UsageError2("--project-name must be lowercase letters, digits, dashes and underscores, starting with a letter or digit.");
+    }
+    if (subcommand === "down" && flags.tunnel === true) {
+      throw new UsageError2("--tunnel belongs to `tula dev`: `tula dev down` closes the tunnel.");
+    }
+    if (subcommand === "down") {
+      const volumes = flags.volumes === true;
+      if (volumes && flags.yes !== true) {
+        if (!io.isTTY || !io.prompt) {
+          throw new UsageError2("`tula dev down --volumes` deletes the database. Pass --yes to do that without a terminal to confirm on.");
+        }
+        const answer = await io.prompt("Delete this project\u2019s database and every user in it? [y/N] ");
+        if (!/^y(es)?$/i.test(answer.trim())) {
+          output.error("Nothing was stopped or deleted.");
+          return EXIT2.error;
+        }
+      }
+      await stopDev2({ io, output, host, projectName, volumes });
+      return EXIT2.ok;
+    }
+    if (flags.volumes === true || flags.yes === true) {
+      throw new UsageError2("--volumes and --yes belong to `tula dev down`.");
+    }
+    const seconds = flags.timeout === undefined ? DEFAULT_TIMEOUT_SECONDS : Number(flags.timeout);
+    if (!Number.isInteger(seconds) || seconds < 1 || seconds > 7200) {
+      throw new UsageError2("--timeout is a number of seconds, from 1 to 7200.");
+    }
+    await startDev2({
+      io,
+      output,
+      host,
+      projectName,
+      timeoutMs: seconds * 1000,
+      showKeys: flags["show-keys"] === true,
+      rotateKeys: flags["rotate-keys"] === true,
+      tunnel: flags.tunnel === true
+    });
+    return EXIT2.ok;
+  }
+};
+
+// src/commands/diff.ts
+var diffCommand2 = {
+  name: "diff",
+  summary: "Show what `tula apply` would change. Writes nothing.",
+  usage: "tula diff [--env <name>] [--config <path>] [--prune] [--rotate-secrets] [--json]",
+  description: "Compares tula.config.ts with the environment\u2019s settings, OAuth providers and (when the " + "file lists them) webhook endpoints and hooks, and prints the plan: what would be added, changed " + `and removed, by path. Secrets are never shown.
+
+` + "Exit codes: 0 no changes, 2 changes pending, 1 an error. A plan that cannot be " + "applied (a webhook address the server has twice, too many endpoints) is an error.",
+  options: PLAN_OPTIONS,
+  run: async (context) => {
+    const { name, target, plan } = await prepare(context);
+    const header = { environment: name, apiUrl: target.apiUrl };
+    if (context.flags.json) {
+      context.output.line(JSON.stringify(planToJson2(header, plan), null, 2));
+    } else {
+      renderPlan2(context.output, header, plan);
+      context.output.line(plan.changes ? "Changes pending. Run `tula apply` to make them." : "No changes: the environment is as the config says.");
+      const needs = applyRequirements2(plan);
+      if (needs.allowUnknown) {
+        context.output.line("`tula apply` refuses this plan without --allow-unknown: it would reset settings this version does not know.");
+      }
+      if (needs.allowWeaker) {
+        context.output.line("`tula apply --yes` refuses this plan without --allow-weaker: it weakens security.");
+      }
+      if (needs.allowWebhookRemoval) {
+        context.output.line("`tula apply --yes` refuses this plan without --allow-webhook-removal: it removes a webhook endpoint and its delivery log.");
+      }
+    }
+    const blockers = planBlockers(plan);
+    for (const blocker of blockers) {
+      const advice = plan.webhooks.overLimit !== null && blocker.includes("may have") ? ` ${OVER_LIMIT_ADVICE}` : "";
+      context.output.error(`${context.output.errorStyle.red("error:")} ${blocker}${advice}`);
+    }
+    if (blockers.length > 0) {
+      return EXIT2.error;
+    }
+    return plan.changes ? EXIT2.changes : EXIT2.ok;
+  }
+};
+
+// src/commands/doctor.ts
+var doctorCommand2 = {
+  name: "doctor",
+  summary: "Check a deployment: database, migrations, master key, mail, Redis, URLs.",
+  usage: "tula doctor [--api-url <url>] [--admin-token-file <path>] [--strict] [--json]",
+  description: "Checks what actually goes wrong in a deployment and prints the fix under each check that " + "is not ok. The API URL comes from --api-url or TULA_API_URL; the instance admin token " + "(the server\u2019s TULA_ADMIN_TOKEN) from TULA_ADMIN_TOKEN or --admin-token-file, never from " + `the command line. Without a token only the checks this machine can make are run.
+
+` + "Exit codes: 0 nothing failed, 1 a check failed (or warned, with --strict) or an error.",
+  options: {
+    "api-url": {
+      type: "string",
+      value: "<url>",
+      description: "The Tula API. Default: TULA_API_URL."
+    },
+    "admin-token-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the instance admin token from a file (- for standard input, piped). Default: TULA_ADMIN_TOKEN."
+    },
+    "insecure-http": {
+      type: "boolean",
+      description: "Allow a plain http API URL that is not localhost: the admin token then crosses the network in clear text."
+    },
+    strict: { type: "boolean", description: "Exit 1 on a warning too." },
+    json: { type: "boolean", description: "Print the report as JSON." }
+  },
+  run: async ({ flags, io, output }) => {
+    const apiUrl = resolveApiUrl2(flags, io);
+    const instance = await resolveInstance2({ apiUrl, flags, io, output });
+    const report = await examine2({ apiUrl, instance, io });
+    const strict = flags.strict === true;
+    if (flags.json) {
+      output.line(JSON.stringify(reportToJson2(report, strict), null, 2));
+    } else {
+      renderReport2(output, report);
+    }
+    return exitCode2(report, strict);
+  }
+};
+
+// src/commands/mcp.ts
+import { isTulaAdminError as isTulaAdminError8 } from "@tula-tech/admin";
+function suffix(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function reason(error) {
+  if (error instanceof UsageError2) {
+    return error.message.replace(/ \(or TULA_[A-Z_]+_DEFAULT\)/g, "");
+  }
+  if (isTulaAdminError8(error)) {
+    return `The configured credential or API URL is not usable (${error.code}).`;
+  }
+  throw error;
+}
+async function buildMcpServer2(context) {
+  const { flags, io } = context;
+  for (const option of ["secret-key-file", "admin-token-file", "agent-key-file"]) {
+    if (flags[option] === "-") {
+      throw new UsageError2(`--${option} - would read from standard input, which carries the protocol. Use a file or the environment.`);
+    }
+  }
+  const { createTulaMcpServer, TOOL_NAMES } = await import("@tula-tech/mcp");
+  const secrets = [];
+  const output = {
+    ...context.output,
+    redact: (value, scope) => {
+      secrets.push(value);
+      context.output.redact(value, scope);
+    }
+  };
+  const name = typeof flags.env === "string" ? flags.env : "default";
+  const unavailable = {};
+  let agentConfigured = false;
+  const agent = await resolveAgent2({ name, flags, io, output }).then((target) => {
+    agentConfigured = target !== null;
+    return target?.admin ?? null;
+  }, (error) => {
+    agentConfigured = true;
+    unavailable.agent = reason(error);
+    unavailable.admin = unavailable.agent;
+    return null;
+  });
+  const admin = agentConfigured ? null : await resolveTarget2({ name, environment: {}, flags, io, output }).then((target) => target.admin, (error) => {
+    unavailable.admin = reason(error);
+    return null;
+  });
+  const secretKeyLeftUnread = agentConfigured && (flags["secret-key-file"] !== undefined || Boolean(io.env[`TULA_SECRET_KEY_${suffix(name)}`]?.trim()) || Boolean(io.env.TULA_SECRET_KEY?.trim()));
+  let doctor = null;
+  try {
+    const named = io.env[`TULA_API_URL_${suffix(name)}`]?.trim();
+    const apiUrl = resolveApiUrl2(flags["api-url"] === undefined && named ? { ...flags, "api-url": named } : flags, io);
+    const instance = await resolveInstance2({ apiUrl, flags, io, output });
+    doctor = ({ signal }) => examine2({ apiUrl, instance, io, signal });
+  } catch (error) {
+    unavailable.doctor = reason(error);
+  }
+  context.output.error(`tula mcp: ${TOOL_NAMES.length} tools; one changes live data while it runs (test_signin, where the environment allows it). Read tools: ${agent ? "configured (agent key)" : admin ? "configured" : "not configured"}. Propose tools: ${agent ? "configured" : "not configured"}. Doctor: ${doctor ? "configured" : "not configured"}.`);
+  if (secretKeyLeftUnread) {
+    context.output.error("tula mcp: an agent key is configured, so the secret key was not read. Keep the secret key out of the environment an agent runs in: it is what approves a proposal.");
+  }
+  if (agentConfigured && doctor && io.env.TULA_ADMIN_TOKEN?.trim()) {
+    context.output.error("tula mcp: the instance admin token is set beside an agent key. No tool can use it for anything but the deployment checks, but it is a credential of a person: prefer to " + "leave it out of an agent\u2019s environment.");
+  }
+  for (const why of new Set(Object.values(unavailable))) {
+    context.output.error(`tula mcp: ${why}`);
+  }
+  return createTulaMcpServer({
+    admin,
+    agent,
+    doctor,
+    cwd: io.cwd,
+    secrets,
+    log: (line) => context.output.error(line),
+    unavailable,
+    version: VERSION2
+  });
+}
+var mcpCommand2 = {
+  name: "mcp",
+  summary: "Serve the MCP server (it reads, and proposes) on standard input and output.",
+  usage: "tula mcp [--env <name>] [--api-url <url>] [--agent-key-file <path>] [--secret-key-file <path>] [--admin-token-file <path>]",
+  description: "Serves Tula\u2019s Model Context Protocol server over standard input and output, for an MCP " + "client to start. Read tools: users, sessions, audit entries, settings, OAuth providers " + "and the doctor\u2019s checks. One draft tool: a change to the settings or the providers, " + "returned as an edit to tula.config.ts for a person to review and apply with `tula apply`; it writes no file and calls no route that writes. Scaffold tools: the provider, a protected route and a sign-in page, returned as files for the client to write. Propose tools (with an agent key): ask for a change, which a person approves with `tula approve <proposal id>` and their own secret key. One test tool, test_signin: the server signs a throwaway user up and in " + "through the environment\u2019s real flow and deletes it, and the tool reports each step. It " + "runs only where the environment\u2019s setting agents.testSignIn allows it (on by default " + "in a development environment, off in production); while it runs the environment\u2019s " + `hooks are asked and its events are delivered. No other tool changes live data, and no tool returns a secret.
+
+` + "For an AI agent, give it an agent key (tula_ak_\u2026): --agent-key-file, " + `TULA_AGENT_KEY_<NAME> or TULA_AGENT_KEY. It reads what a secret key reads, proposes, and runs a sign-in test where the environment allows one; it changes nothing else. With it the secret key is not read at all.
+
+The API URL comes from --api-url, TULA_API_URL_<NAME> or TULA_API_URL; the secret key from --secret-key-file, TULA_SECRET_KEY_<NAME> or TULA_SECRET_KEY; the instance admin token (run_doctor only) from --admin-token-file or TULA_ADMIN_TOKEN. None is required: without a key the read tools answer "not configured" and the scaffold tools still work. Standard output carries only the protocol; everything else is written to standard error.`,
+  options: {
+    env: {
+      type: "string",
+      short: "e",
+      value: "<name>",
+      description: "Read TULA_API_URL_<NAME> and TULA_SECRET_KEY_<NAME> first."
+    },
+    "api-url": {
+      type: "string",
+      value: "<url>",
+      description: "The Tula API. Default: TULA_API_URL_<NAME>, then TULA_API_URL."
+    },
+    "agent-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the agent key from a file. Default: TULA_AGENT_KEY_<NAME>, then TULA_AGENT_KEY. With one, the secret key is not read."
+    },
+    "secret-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the secret key from a file. Default: TULA_SECRET_KEY_<NAME>, then TULA_SECRET_KEY."
+    },
+    "admin-token-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the instance admin token from a file. Default: TULA_ADMIN_TOKEN."
+    },
+    "insecure-http": {
+      type: "boolean",
+      description: "Allow a plain http API URL that is not localhost: the credentials then cross the network in clear text."
+    }
+  },
+  run: async (context) => {
+    const { serve } = context.io;
+    if (!serve) {
+      throw new UsageError2("tula mcp needs the process\u2019s standard input and output.");
+    }
+    const server = await buildMcpServer2(context);
+    const { serveOverStdio } = await import("@tula-tech/mcp");
+    await serveOverStdio(server, serve);
+    return EXIT2.ok;
+  }
+};
+
+// src/commands/policy.ts
+import {
+  evaluatePassword
+} from "@tula-tech/contract/password-rules";
+var USAGE2 = "tula policy test [--env <name>] [--email <address>] [--name <full name>] [--json]";
+function describeRule(check) {
+  const params = check.params ?? {};
+  switch (check.rule) {
+    case "min_length":
+      return `at least ${String(params.min)} characters`;
+    case "max_length":
+      return `at most ${String(params.max)} characters`;
+    case "lowercase":
+      return "a lowercase letter";
+    case "uppercase":
+      return "an uppercase letter";
+    case "number":
+      return "a digit";
+    case "special":
+      return "a special character";
+    case "character_classes":
+      return `at least ${String(params.min)} of: lowercase, uppercase, digit, special character`;
+    case "user_info":
+      return "does not contain the user\u2019s name or email";
+    case "common":
+      return "not a commonly used password";
+    case "repeated_characters":
+      return `no character more than ${String(params.max)} times in a row`;
+    case "sequence":
+      return "no run of consecutive characters (abcd, 4321)";
+    default:
+      return check.code;
+  }
+}
+async function readPassword(context) {
+  const { io, output, positionals } = context;
+  const argument = positionals[1];
+  if (argument !== undefined) {
+    output.redact(argument, "errors");
+    output.error(`${output.errorStyle.yellow("warning:")} a password on the command line is recorded in shell history and visible in process lists. Leave it out to be asked for it, or pipe it in.`);
+    return argument;
+  }
+  if (io.stdinIsTTY) {
+    if (!io.promptSecret) {
+      throw new UsageError2('The password cannot be asked for without showing it here. Pipe it in on standard input: `printf %s "$PW" | tula policy test`.');
+    }
+    return io.promptSecret("Password to test (not shown): ");
+  }
+  if (!io.readStdin) {
+    throw new UsageError2("The password cannot be read from standard input here.");
+  }
+  return (await io.readStdin()).replace(/\r?\n$/, "");
+}
+var policyCommand2 = {
+  name: "policy",
+  summary: "Test a password against an environment\u2019s password policy.",
+  usage: USAGE2,
+  description: "Shows which rules of the environment\u2019s password policy a password passes. The password " + "is asked for without being shown, or read from standard input when it is piped. It is " + "checked on this machine and never sent anywhere; the breached-password check, which only " + "the server makes, is reported as not run. A password given as an argument works too, with " + `a warning: a command line is recorded in shell history.
+
+` + "The secret key decides the environment (TULA_SECRET_KEY, or TULA_SECRET_KEY_<NAME> with " + `--env <name>).
+
+` + "Exit codes: 0 the password would be accepted, 2 it would be refused, 1 an error.",
+  maxPositionals: 2,
+  options: {
+    env: {
+      type: "string",
+      short: "e",
+      value: "<name>",
+      description: "Read TULA_SECRET_KEY_<NAME> and TULA_API_URL_<NAME> first."
+    },
+    "api-url": {
+      type: "string",
+      value: "<url>",
+      description: "The Tula API. Default: TULA_API_URL_<NAME>, then TULA_API_URL."
+    },
+    "insecure-http": {
+      type: "boolean",
+      description: "Allow a plain http API URL that is not localhost."
+    },
+    "secret-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the secret key from a file. Default: TULA_SECRET_KEY_<NAME>, then TULA_SECRET_KEY."
+    },
+    email: {
+      type: "string",
+      value: "<address>",
+      description: 'The user\u2019s email, for the "does not contain your name or email" rule.'
+    },
+    name: {
+      type: "string",
+      value: "<full name>",
+      description: "The user\u2019s name, for the same rule."
+    },
+    json: { type: "boolean", description: "Print the result as JSON." }
+  },
+  run: async (context) => {
+    const { flags, io, output, positionals } = context;
+    if (positionals[0] !== "test") {
+      throw new UsageError2(`Usage: ${USAGE2}`);
+    }
+    if (flags["secret-key-file"] === "-") {
+      throw new UsageError2("--secret-key-file - would read the key from standard input, which is where the password comes from. Use a file or TULA_SECRET_KEY.");
+    }
+    const name = typeof flags.env === "string" ? flags.env : "default";
+    const target = await resolveTarget2({ name, environment: {}, flags, io, output });
+    const password = await readPassword(context);
+    output.redact(password, "errors");
+    if (password === "") {
+      throw new UsageError2("No password was given.");
+    }
+    const { data } = await target.admin.call("getEnvironmentSettings");
+    const policy = data.settings.password;
+    if (!policy) {
+      throw new UsageError2("The API did not answer with a password policy.");
+    }
+    const [firstName, ...rest] = typeof flags.name === "string" ? flags.name.trim().split(/\s+/) : [];
+    const userInfo = {
+      email: typeof flags.email === "string" ? flags.email : undefined,
+      firstName,
+      lastName: rest.length > 0 ? rest.join(" ") : undefined
+    };
+    const hasUserInfo = userInfo.email !== undefined || firstName !== undefined;
+    const evaluation = evaluatePassword(policy, password, userInfo);
+    const failed = evaluation.checks.filter((check) => !check.passed);
+    const breach = { policy: policy.breachCheck, ran: false };
+    if (flags.json) {
+      output.line(JSON.stringify({
+        apiUrl: target.apiUrl,
+        preset: policy.preset,
+        accepted: evaluation.ok,
+        rules: evaluation.checks.map((check) => ({
+          rule: check.rule,
+          code: check.code,
+          passed: check.passed,
+          description: describeRule(check)
+        })),
+        breachCheck: breach,
+        userInfoGiven: hasUserInfo
+      }, null, 2));
+      return evaluation.ok ? EXIT2.ok : EXIT2.refused;
+    }
+    const { style } = output;
+    output.line(style.bold(`Password policy at ${target.apiUrl} (preset: ${policy.preset})`));
+    output.line();
+    const width = Math.max(...evaluation.checks.map((check) => check.rule.length), "breach".length);
+    for (const check of evaluation.checks) {
+      const label = check.passed ? style.green("pass   ") : style.red("FAIL   ");
+      const note = check.rule === "user_info" && !hasUserInfo ? " (nothing to compare with: pass --email or --name)" : "";
+      output.line(`  ${label}  ${check.rule.padEnd(width)}  ${describeRule(check)}${note}`);
+    }
+    output.line(`  ${style.dim("not run")}  ${"breach".padEnd(width)}  ${policy.breachCheck === "off" ? "the breached-password check is off in this environment" : `the breached-password check (policy: ${policy.breachCheck}) is made by the server when a password is set, not here`}`);
+    output.line();
+    output.line(evaluation.ok ? "This password would be accepted by the rules above." : `This password would be refused: it breaks ${failed.length} rule${failed.length === 1 ? "" : "s"}.`);
+    output.line("It was checked on this machine and was not sent anywhere.");
+    return evaluation.ok ? EXIT2.ok : EXIT2.refused;
+  }
+};
+
+// src/process-io.ts
+import { readFile, stat } from "fs/promises";
+import { isAbsolute, resolve as resolve2 } from "path";
+import { createInterface } from "readline/promises";
+
+// src/process-host.ts
+import { constants } from "fs";
+import { lstat, open, rename, rm, unlink } from "fs/promises";
+import { basename as basename2 } from "path";
+function linkRefusal(path) {
+  return new UsageError2(`${basename2(path)} is a symbolic link. \`tula\` does not write a secret or change a mode through a link: replace it with a regular file.`);
+}
+function kindRefusal(path) {
+  return new UsageError2(`${basename2(path)} is not a regular file. \`tula\` keeps its keys in a regular file only: move it away and run the command again.`);
+}
+async function refuseIrregular(path) {
+  try {
+    const found = await lstat(path);
+    if (found.isSymbolicLink()) {
+      throw linkRefusal(path);
+    }
+    if (!found.isFile()) {
+      throw kindRefusal(path);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function existsRefusal(path) {
+  return new UsageError2(`${basename2(path)} already exists. \`tula\` writes these secrets to a new file only and never replaces one: name a file that does not exist.`);
+}
+async function openRegular(path) {
+  if (!await refuseIrregular(path)) {
+    return null;
+  }
+  let file;
+  try {
+    file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT") {
+      return null;
+    }
+    throw code === "ELOOP" ? linkRefusal(path) : error;
+  }
+  if (!(await file.stat()).isFile()) {
+    await file.close();
+    throw kindRefusal(path);
+  }
+  return file;
+}
+function unguessable() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function createProcessHost(env) {
+  const stoppable = new Set;
+  return {
+    async run(command, options) {
+      const child = Bun.spawn([...command], {
+        cwd: options.cwd,
+        env: { ...env, ...options.env },
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: options.stderr === "inherit" ? "inherit" : "pipe",
+        ...options.shielded && { detached: true }
+      });
+      let timedOut = false;
+      let interrupted = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGKILL");
+      }, options.timeoutMs);
+      const onInterrupt = () => {
+        interrupted = true;
+        child.kill("SIGINT");
+      };
+      if (!options.shielded) {
+        process.once("SIGINT", onInterrupt);
+        stoppable.add(onInterrupt);
+      }
+      try {
+        const [stdout, stderr] = await Promise.all([
+          new Response(child.stdout).text(),
+          child.stderr ? new Response(child.stderr).text() : "",
+          child.exited
+        ]);
+        if (interrupted) {
+          throw Object.assign(new Error("interrupted"), { code: "ABORT" });
+        }
+        return { code: timedOut ? null : child.exitCode, stdout, stderr, timedOut };
+      } finally {
+        clearTimeout(timer);
+        process.off("SIGINT", onInterrupt);
+        stoppable.delete(onInterrupt);
+      }
+    },
+    onInterrupt(listener) {
+      const interrupt = () => listener();
+      const terminate = () => {
+        for (const stop of [...stoppable]) {
+          stop();
+        }
+        listener();
+      };
+      process.on("SIGINT", interrupt);
+      process.on("SIGTERM", terminate);
+      process.on("SIGHUP", terminate);
+      return () => {
+        process.off("SIGINT", interrupt);
+        process.off("SIGTERM", terminate);
+        process.off("SIGHUP", terminate);
+      };
+    },
+    async readFile(path) {
+      const file = await openRegular(path);
+      if (!file) {
+        return null;
+      }
+      try {
+        return await file.readFile("utf8");
+      } finally {
+        await file.close();
+      }
+    },
+    async createSecretFile(path, text) {
+      let file;
+      try {
+        file = await open(path, "wx", 384);
+      } catch (error) {
+        if (error.code === "EEXIST") {
+          throw existsRefusal(path);
+        }
+        throw error;
+      }
+      try {
+        await file.writeFile(text);
+        await file.chmod(384);
+      } finally {
+        await file.close();
+      }
+    },
+    async removeFile(path) {
+      try {
+        await unlink(path);
+        return true;
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          return false;
+        }
+        throw error;
+      }
+    },
+    async writeSecretFile(path, text) {
+      await refuseIrregular(path);
+      const temporary = `${path}.${unguessable()}.tmp`;
+      try {
+        const file = await open(temporary, "wx", 384);
+        try {
+          await file.writeFile(text);
+          await file.chmod(384);
+        } finally {
+          await file.close();
+        }
+        await rename(temporary, path);
+      } catch (error) {
+        await rm(temporary, { force: true }).catch(() => {
+          return;
+        });
+        throw error;
+      }
+    },
+    async restrictFile(path) {
+      const file = await openRegular(path);
+      if (!file) {
+        return false;
+      }
+      try {
+        if (((await file.stat()).mode & 63) === 0) {
+          return false;
+        }
+        await file.chmod(384);
+        return ((await file.stat()).mode & 63) === 0;
+      } finally {
+        await file.close();
+      }
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+  };
+}
+
+// src/process-io.ts
+function readHidden(parts, question) {
+  const { stdin, stderr } = parts;
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const finish = (settle) => {
+      stdin.off("data", onData);
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      stderr.write(`
+`);
+      settle();
+    };
+    function onData(chunk) {
+      for (const character of String(chunk)) {
+        if (character === "\r" || character === `
+` || character === "\x04") {
+          finish(() => resolve(value));
+          return;
+        }
+        if (character === "\x03") {
+          finish(() => reject(new UsageError2("Cancelled.")));
+          return;
+        }
+        if (character === "\x7F" || character === "\b") {
+          value = [...value].slice(0, -1).join("");
+        } else if (character >= " ") {
+          value += character;
+        }
+      }
+    }
+    stderr.write(question);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+function createProcessIo(parts) {
+  let warned = false;
+  async function checkMode(path) {
+    if (warned || parts.platform === "win32") {
+      return;
+    }
+    const mode = await parts.stat(path).then((stats) => stats.mode, () => {
+      return;
+    });
+    if (mode !== undefined && (mode & 63) !== 0) {
+      warned = true;
+      parts.stderr.write(`warning: the file given as --secret-key-file is readable by other users (mode ${(mode & 511).toString(8).padStart(4, "0")}). Restrict it: chmod 600 <file>.
+`);
+    }
+  }
+  return {
+    stdout: parts.stdout,
+    stderr: parts.stderr,
+    env: parts.env,
+    cwd: parts.cwd,
+    isTTY: parts.stdin.isTTY === true && parts.stderr.isTTY === true,
+    stdinIsTTY: parts.stdin.isTTY === true,
+    prompt: async (question) => {
+      const reader = createInterface({ input: parts.stdin, output: parts.stderr });
+      try {
+        return await reader.question(question);
+      } finally {
+        reader.close();
+      }
+    },
+    now: () => new Date,
+    host: createProcessHost(parts.env),
+    serve: {
+      input: parts.stdin,
+      output: parts.stdout,
+      ...parts.onTerminate ? { onTerminate: parts.onTerminate } : {}
+    },
+    ...parts.stdin.isTTY === true && typeof parts.stdin.setRawMode === "function" ? { promptSecret: (question) => readHidden(parts, question) } : {},
+    readStdin: async () => {
+      let text = "";
+      for await (const chunk of parts.stdin) {
+        text += String(chunk);
+      }
+      return text;
+    },
+    readFile: async (path) => {
+      const absolute = isAbsolute(path) ? path : resolve2(parts.cwd, path);
+      await checkMode(absolute);
+      return parts.readFile(absolute);
+    }
+  };
+}
+function processIo() {
+  return createProcessIo({
+    stdin: process.stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    env: process.env,
+    cwd: process.cwd(),
+    platform: process.platform,
+    readFile: (path) => readFile(path, "utf8"),
+    stat: (path) => stat(path),
+    onTerminate: (stop) => {
+      process.once("SIGTERM", stop);
+      process.once("SIGINT", stop);
+      return () => {
+        process.off("SIGTERM", stop);
+        process.off("SIGINT", stop);
+      };
+    }
+  });
+}
+
+// src/index.ts
+var COMMANDS2 = [
+  diffCommand2,
+  applyCommand2,
+  doctorCommand2,
+  policyCommand2,
+  devCommand2,
+  mcpCommand2,
+  approveCommand2
+];
+async function main2(argv, overrides = {}) {
+  return runCli2(argv, { ...processIo(), ...overrides }, COMMANDS2);
+}
+
+export { UsageError2, parseArgs2, MANAGING_TOOL2, SET_PATHS2, diffValues2, DEPENDENTS_UNREAD2, readDependentCount2, planProviders2, providersGoingOff2, buildPlan2, orderOperations2, VERSION2, printable2, examine2, exitCode2, reportToJson2, renderReport2, shouldUseColor2, createOutput2, EXIT2, reportError2, runCli2, planWarnings2, applyRequirements2, describeOperation2, renderPlan2, planToJson2, resolveTarget2, resolveAgent2, resolveApiUrl2, readSecretFile2, resolveInstance2, applyCommand2, approveCommand2, DEV_ENV_FILE2, parseDevBlock2, withoutDevBlock2, withDevBlock2, startDev2, stopDev2, devCommand2, diffCommand2, doctorCommand2, buildMcpServer2, mcpCommand2, policyCommand2, COMMANDS2, main2 };