checkly 9.5.0 → 10.0.0-rc.1

package/dist/services/write-back/plan.js

@@ -0,0 +1,968 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { ApiCheck } from '../../constructs/api-check.js';
+import { BrowserCheck } from '../../constructs/browser-check.js';
+import { CheckGroupV1 } from '../../constructs/check-group-v1.js';
+import { CheckGroupV2 } from '../../constructs/check-group-v2.js';
+import { Dashboard } from '../../constructs/dashboard.js';
+import { EmailAlertChannel } from '../../constructs/email-alert-channel.js';
+import { IncidentioAlertChannel } from '../../constructs/incidentio-alert-channel.js';
+import { MaintenanceWindow } from '../../constructs/maintenance-window.js';
+import { MSTeamsAlertChannel } from '../../constructs/msteams-alert-channel.js';
+import { OpsgenieAlertChannel } from '../../constructs/opsgenie-alert-channel.js';
+import { PagerdutyAlertChannel } from '../../constructs/pagerduty-alert-channel.js';
+import { PhoneCallAlertChannel } from '../../constructs/phone-call-alert-channel.js';
+import { PrivateLocation } from '../../constructs/private-location.js';
+import { SlackAlertChannel } from '../../constructs/slack-alert-channel.js';
+import { SlackAppAlertChannel } from '../../constructs/slack-app-alert-channel.js';
+import { SmsAlertChannel } from '../../constructs/sms-alert-channel.js';
+import { StatusPage } from '../../constructs/status-page.js';
+import { StatusPageService } from '../../constructs/status-page-service.js';
+import { StatusPageV3, } from '../../constructs/status-page-v3.js';
+import { StatusPageV3AutomationRule, } from '../../constructs/status-page-v3-automation-rule.js';
+import { StatusPageV3Component, } from '../../constructs/status-page-v3-component.js';
+import { TelegramAlertChannel } from '../../constructs/telegram-alert-channel.js';
+import { WebhookAlertChannel } from '../../constructs/webhook-alert-channel.js';
+import { DnsMonitor } from '../../constructs/dns-monitor.js';
+import { GrpcMonitor } from '../../constructs/grpc-monitor.js';
+import { HeartbeatMonitor } from '../../constructs/heartbeat-monitor.js';
+import { IcmpMonitor } from '../../constructs/icmp-monitor.js';
+import { MultiStepCheck } from '../../constructs/multi-step-check.js';
+import { PlaywrightCheck } from '../../constructs/playwright-check.js';
+import { SslMonitor } from '../../constructs/ssl-monitor.js';
+import { TcpMonitor } from '../../constructs/tcp-monitor.js';
+import { TracerouteMonitor } from '../../constructs/traceroute-monitor.js';
+import { UrlMonitor } from '../../constructs/url-monitor.js';
+import { hasEscalationPolicy } from '../../constructs/alert-escalation-policy-codegen.js';
+import { PLAYWRIGHT_CHECK_OMITTED_PROPS } from '../../constructs/playwright-check-codegen.js';
+import { blankRedacted, nodeAt, pointerSegments, UnshapeableError } from '../deploy-diff/import-shape.js';
+import { applyEdits, readsBack } from './apply-edits.js';
+import { exportedNamesOf, findConstructOptions, parseSource, WriteBackSkipped } from './source-file.js';
+/** The whole lines of `text` that the range `[start, end)` touches. */
+function linesSpanning(text, [start, end]) {
+    const from = text.lastIndexOf('\n', start - 1) + 1;
+    const to = text.indexOf('\n', end);
+    return text.slice(from, to === -1 ? text.length : to);
+}
+const identity = (...segments) => ({ pointer: segments, target: segments });
+const set = (segment) => ({ pointer: [segment], target: [segment], set: true });
+const under = (parent, keys) => keys.map(key => identity(...(typeof parent === 'string' ? [parent] : parent), key));
+const assertions = (builder, ...parent) => ({ pointer: [...parent, 'assertions'], target: [...parent, 'assertions'], helper: { kind: 'assertions', builder } });
+// The offset only means something for a sub-minute schedule; for any other
+// the backend assigns one of its own and never reports it as a change.
+const FREQUENCY_RULES = [
+    { pointer: ['frequency'], target: ['frequency'], helper: { kind: 'frequency' }, reads: [['frequencyOffset']] },
+    {
+        pointer: ['frequencyOffset'],
+        target: ['frequency'],
+        companion: true,
+        refuse: before => nodeAt(before, ['frequency']) === 0 ? undefined : 'the offset of a whole-minute schedule is assigned by Checkly',
+    },
+];
+const RETRY_RULES = [
+    { pointer: ['retryStrategy'], target: ['retryStrategy'], helper: { kind: 'retryStrategy' }, unless: ['doubleCheck'] },
+    { pointer: ['doubleCheck'], target: ['retryStrategy'], companion: true },
+];
+const GLOBAL_POLICY = 'Checkly uses the global alert policy; remove alertEscalationPolicy from the code by hand';
+const alertRules = (policy) => [
+    {
+        pointer: ['alertSettings'],
+        target: ['alertEscalationPolicy'],
+        helper: { kind: 'alertEscalation', policy },
+        reads: [['useGlobalAlertSettings']],
+    },
+    {
+        pointer: ['useGlobalAlertSettings'],
+        target: ['alertEscalationPolicy'],
+        companion: true,
+        refuse: before => policy !== 'group-v2' && nodeAt(before, ['useGlobalAlertSettings']) === true ? GLOBAL_POLICY : undefined,
+    },
+];
+// The keys each class writes are `as const` lists typed against the class's
+// props, so that `_everyPropIsListed` below can hold the build to them: a
+// key added to a props type has to be written or named as left out.
+const CHECK_KEYS = ['name', 'description', 'activated', 'muted'];
+const CHECK_SET_KEYS = ['tags', 'locations'];
+const CHECK_HELPER_KEYS = ['frequency', 'retryStrategy', 'alertEscalationPolicy'];
+const CHECK_WRITTEN = [...CHECK_KEYS, ...CHECK_SET_KEYS, ...CHECK_HELPER_KEYS];
+// Every check class takes these; a class whose props omit some (as its
+// codegen's omitted props say) gets the rest.
+const CHECK_RULES = [
+    ...CHECK_KEYS.map(key => identity(key)), ...CHECK_SET_KEYS.map(set),
+    ...FREQUENCY_RULES, ...RETRY_RULES, ...alertRules('check'),
+];
+const omitting = (rules, props) => rules.filter(rule => !props.includes(rule.target[0]));
+const omit = (keys, omitted) => keys.filter((key) => !omitted.includes(key));
+// Only the classes extending RuntimeCheck take a runtime and environment
+// variables; a monitor would drop them when synthesized.
+const RUNTIME_CHECK_KEYS = ['runtimeId', 'environmentVariables'];
+const RUNTIME_CHECK_RULES = RUNTIME_CHECK_KEYS.map(key => identity(key));
+// Only ApiCheck, UrlMonitor and TcpMonitor take `shouldFail`.
+const SHOULD_FAIL_KEYS = ['shouldFail'];
+const SHOULD_FAIL_RULES = SHOULD_FAIL_KEYS.map(key => identity(key));
+const RESPONSE_TIME_KEYS = ['degradedResponseTime', 'maxResponseTime'];
+const RESPONSE_TIME_RULES = RESPONSE_TIME_KEYS.map(key => identity(key));
+const PACKET_LOSS_KEYS = [
+    'degradedPacketLossThreshold', 'maxPacketLossThreshold',
+];
+const BROWSER_KEYS = ['sslCheckDomain', 'aiAutoRepairEnabled'];
+const MULTI_STEP_KEYS = ['aiAutoRepairEnabled'];
+// The keys of each request type the account reports under the same name
+// the construct uses, typed against the construct's interface so a renamed
+// property fails the build; `Covers` below fails it for a key added to the
+// interface but listed nowhere. `assertions` has its own helper rule.
+const API_REQUEST_KEYS = [
+    'url', 'method', 'ipFamily', 'followRedirects', 'skipSSL', 'body', 'bodyType', 'headers', 'queryParameters', 'basicAuth',
+];
+const URL_REQUEST_KEYS = ['url', 'ipFamily', 'followRedirects', 'skipSSL'];
+const TCP_REQUEST_KEYS = ['hostname', 'port', 'data', 'ipFamily'];
+const DNS_REQUEST_KEYS = [
+    'recordType', 'query', 'nameServer', 'port', 'protocol',
+];
+const ICMP_REQUEST_KEYS = ['hostname', 'ipFamily', 'pingCount'];
+const GRPC_REQUEST_KEYS = ['url', 'port', 'ipFamily', 'skipSSL', 'timeout'];
+// `metadata` is never written — the account blanks every metadata value —
+// but with a rule the refusal names that reason rather than a generic one.
+const GRPC_CONFIG_KEYS = [
+    'mode', 'tls', 'metadata', 'encoding', 'serviceDefinition', 'method', 'protoContent', 'bfbsContent', 'message',
+    'service',
+];
+const TRACEROUTE_REQUEST_KEYS = [
+    'url', 'protocol', 'port', 'ipFamily', 'maxHops', 'maxUnknownHops', 'ptrLookup', 'timeout',
+];
+// A DNS monitor refuses a name server without a port and a port without a
+// name server, so the two are written together or not at all.
+const DNS_REQUEST_RULES = DNS_REQUEST_KEYS.map(key => key === 'nameServer' || key === 'port' ? { ...identity('request', key), group: 'nameServer' } : identity('request', key));
+/**
+ * The SSL request is the one the account spells differently from the
+ * construct: the wire shape nests the host, port and IP family under
+ * `sslConfig`, names the handshake timeout in milliseconds, and lifts the
+ * client certificate id to the request level.
+ */
+const SSL_NESTED_KEYS = ['hostname', 'port', 'ipFamily'];
+const SSL_CONFIG_KEYS = [
+    'serverName', 'skipChainValidation', 'alertDaysBeforeExpiry', 'clientCertificateMode', 'securityBaseline',
+];
+const SSL_REQUEST_RULES = [
+    ...SSL_NESTED_KEYS.map(key => ({ pointer: ['request', 'sslConfig', key], target: ['request', key] })),
+    ...under(['request', 'sslConfig'], SSL_CONFIG_KEYS),
+    { pointer: ['request', 'sslConfig', 'handshakeTimeoutMs'], target: ['request', 'sslConfig', 'handshakeTimeout'] },
+    { pointer: ['request', 'sslClientCertificateId'], target: ['request', 'sslConfig', 'sslClientCertificateId'] },
+];
+// A build-time assertion only; nothing reads it.
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const _everyRequestKeyIsListed = [true, true, true, true, true, true, true, true, true, true];
+const HEARTBEAT_KEYS = ['period', 'periodUnit', 'grace', 'graceUnit'];
+const GROUP_KEYS = [
+    'name', 'activated', 'muted', 'concurrency', 'environmentVariables', 'runtimeId',
+];
+const GROUP_SET_KEYS = ['tags', 'locations'];
+const GROUP_HELPER_KEYS = [
+    'apiCheckDefaults', 'retryStrategy', 'alertEscalationPolicy',
+];
+const API_DEFAULT_KEYS = ['url', 'headers', 'queryParameters', 'basicAuth'];
+const GROUP_RULES = [
+    ...GROUP_KEYS.map(key => identity(key)), ...GROUP_SET_KEYS.map(set),
+    ...under('apiCheckDefaults', API_DEFAULT_KEYS), assertions('AssertionBuilder', 'apiCheckDefaults'),
+    ...RETRY_RULES,
+];
+/**
+ * A rule that refuses every change at its pointer with `reason` and writes
+ * nothing: a companion with no primary, for a leaf the construct fixes or
+ * builds from other props, so the refusal names why rather than saying
+ * the property is unknown.
+ */
+const refusing = (pointer, reason) => ({ pointer, target: pointer, companion: true, refuse: () => reason });
+const FIXED = 'fixed by the construct; it cannot be changed in the code';
+// An alert channel's own props are flat in the code and nested under
+// `config` on the wire (`synthesize` moves them), so their rules map
+// `config/<key>` onto the top-level prop. A credential key (`url`, `apiKey`,
+// `serviceKey`, `webhookSecret`, the values of `headers` and
+// `queryParameters`) is listed like any other: the account blanks it, so
+// the redaction check refuses it by name, and a change at the leaf itself
+// arrives flagged as a secret and never reaches a rule.
+const config = (keys) => keys.map(key => ({ pointer: ['config', key], target: [key] }));
+const ALERT_CHANNEL_KEYS = [
+    'sendRecovery', 'sendFailure', 'sendDegraded', 'sslExpiry', 'sslExpiryThreshold',
+];
+const ALERT_CHANNEL_RULES = [
+    ...ALERT_CHANNEL_KEYS.map(key => identity(key)),
+    refusing(['type'], 'the channel type is the construct\'s class; change the class by hand'),
+];
+const EMAIL_KEYS = ['address'];
+const SLACK_KEYS = ['url', 'channel'];
+const SLACK_APP_KEYS = ['slackChannels'];
+const WEBHOOK_KEYS = [
+    'name', 'webhookType', 'url', 'template', 'method', 'headers', 'queryParameters', 'webhookSecret',
+];
+const OPSGENIE_KEYS = ['name', 'apiKey', 'region', 'priority'];
+const PAGERDUTY_KEYS = ['account', 'serviceName', 'serviceKey'];
+// SMS and phone call channels spell the number as `phoneNumber`; the wire has `number`.
+const PHONE_KEYS = ['name'];
+const PHONE_RULES = [...config(PHONE_KEYS), { pointer: ['config', 'number'], target: ['phoneNumber'] }];
+// The webhook-based channels fix the webhook type and method, and spell the
+// template as `payload`; Telegram packs its chat id, thread and payload
+// into the template and its API key into the URL, and incident.io sends
+// its API key as a header, none of which this module unpacks.
+const WEBHOOK_FIXED_RULES = [refusing(['config', 'webhookType'], FIXED), refusing(['config', 'method'], FIXED)];
+const TEMPLATE_RULE = { pointer: ['config', 'template'], target: ['payload'] };
+const MSTEAMS_KEYS = ['name', 'url'];
+const MSTEAMS_RULES = [...config(MSTEAMS_KEYS), TEMPLATE_RULE, ...WEBHOOK_FIXED_RULES];
+const TELEGRAM_KEYS = ['name'];
+const TELEGRAM_RULES = [
+    ...config(TELEGRAM_KEYS),
+    refusing(['config', 'template'], 'built from chatId, messageThreadId and payload; edit them by hand'),
+    ...WEBHOOK_FIXED_RULES,
+];
+const INCIDENTIO_KEYS = ['name', 'url'];
+const INCIDENTIO_RULES = [
+    ...config(INCIDENTIO_KEYS), TEMPLATE_RULE,
+    refusing(['config', 'headers'], 'built from apiKey; edit it by hand'),
+    ...WEBHOOK_FIXED_RULES,
+];
+const PRIVATE_LOCATION_KEYS = ['name', 'slugName', 'icon', 'proxyUrl'];
+// `customCSS` is a stylesheet the bundle sends as one string, which the
+// construct takes as a file or content; it is refused, never written.
+const DASHBOARD_KEYS = [
+    'customUrl', 'customDomain', 'logo', 'favicon', 'link', 'header', 'description', 'width', 'refreshRate', 'paginate',
+    'paginationRate', 'checksPerPage', 'useTagsAndOperator', 'hideTags', 'enableIncidents', 'expandChecks', 'showHeader',
+    'isPrivate', 'showP95', 'showP99',
+];
+const DASHBOARD_SET_KEYS = ['tags'];
+const DASHBOARD_RULES = [
+    ...DASHBOARD_KEYS.map(key => identity(key)), ...DASHBOARD_SET_KEYS.map(set),
+    refusing(['customCSS'], 'a stylesheet, not a property; edit the file or the content by hand'),
+];
+// The dates are `Date` objects in the code, written as `new Date('<iso>')`
+// from the ISO string the account reports. The repeat settings only mean
+// something together: an interval written without its unit, or without
+// the date the repetition ends on, would be a different schedule.
+const MAINTENANCE_WINDOW_KEYS = [
+    'name', 'timezone', 'pauseAllChecks', 'silenceAllAlerts',
+];
+const MAINTENANCE_WINDOW_SET_KEYS = ['tags', 'silenceAlertsTags'];
+const MAINTENANCE_WINDOW_DATE_KEYS = ['startsAt', 'endsAt'];
+const REPEAT_KEYS = ['repeatInterval', 'repeatUnit'];
+const REPEAT_DATE_KEYS = ['repeatEndsAt'];
+const date = (key) => ({ ...identity(key), helper: { kind: 'date' } });
+const MAINTENANCE_WINDOW_RULES = [
+    ...MAINTENANCE_WINDOW_KEYS.map(key => identity(key)), ...MAINTENANCE_WINDOW_SET_KEYS.map(set),
+    ...MAINTENANCE_WINDOW_DATE_KEYS.map(date),
+    ...REPEAT_KEYS.map(key => ({ ...identity(key), group: 'repeat' })),
+    ...REPEAT_DATE_KEYS.map(key => ({ ...date(key), group: 'repeat' })),
+];
+// A v2 status page's cards hold references to its services.
+const STATUS_PAGE_KEYS = [
+    'name', 'url', 'customDomain', 'logo', 'redirectTo', 'favicon', 'defaultTheme',
+];
+const STATUS_PAGE_RULES = [
+    ...STATUS_PAGE_KEYS.map(key => identity(key)),
+    refusing(['cards'], 'cards hold status page services; edit them by hand'),
+];
+const STATUS_PAGE_V3_KEYS = [
+    'name', 'url', 'customDomain', 'description', 'logo', 'logoDark', 'redirectTo', 'favicon', 'defaultTheme',
+    'privacyPolicyLink', 'termsOfServiceLink', 'supportLink', 'footerText', 'googleAnalyticsTag', 'allowIndexing',
+];
+const THEMES = ['light', 'dark'];
+const THEME_COLOR_KEYS = [
+    'bodyBackgroundColor', 'headerBackgroundColor', 'headerFontColor', 'titleFontColor', 'bodyFontColor',
+    'bodyFontColorMuted', 'navigationFontColor', 'linkFontColor', 'cardBackgroundColor', 'borderColor',
+    'primaryButtonBackgroundColor', 'primaryButtonFontColor',
+];
+// The account reports each colour as its own leaf; the code holds it under
+// `themeColors.light` or `.dark`, which has to exist for a colour to be added.
+const STATUS_PAGE_V3_RULES = [
+    ...STATUS_PAGE_V3_KEYS.map(key => identity(key)),
+    ...THEMES.flatMap(theme => under(['themeColors', theme], THEME_COLOR_KEYS)),
+    refusing(['version'], FIXED),
+];
+const STATUS_PAGE_SERVICE_KEYS = ['name'];
+// A component's `showHistoricalData` and `expandedByDefault` travel inside
+// `configuration`; its page and parent are references.
+const COMPONENT_KEYS = [
+    'type', 'name', 'description', 'hidden', 'displayOrder',
+];
+const COMPONENT_CONFIGURATION_KEYS = [
+    'showHistoricalData', 'expandedByDefault',
+];
+const COMPONENT_RULES = [
+    ...COMPONENT_KEYS.map(key => identity(key)),
+    ...COMPONENT_CONFIGURATION_KEYS.map(key => ({ pointer: ['configuration', key], target: [key] })),
+];
+const AUTOMATION_RULE_KEYS = [
+    'name', 'enabled', 'firstUpdate', 'lastUpdate', 'notifySubscribers',
+];
+const AUTOMATION_RULE_SET_KEYS = ['tags'];
+const AUTOMATION_RULE_RULES = [
+    ...AUTOMATION_RULE_KEYS.map(key => identity(key)), ...AUTOMATION_RULE_SET_KEYS.map(set),
+    { pointer: ['coolDownWindowMinutes'], target: ['coolDownMinutes'] },
+];
+// What each class writes, at the top level of its props. `request`,
+// `apiCheckDefaults` and `themeColors` stand for every rule under them.
+const API_WRITTEN = [...CHECK_WRITTEN, ...SHOULD_FAIL_KEYS, ...RUNTIME_CHECK_KEYS, ...RESPONSE_TIME_KEYS, 'request'];
+const BROWSER_WRITTEN = [...CHECK_WRITTEN, ...RUNTIME_CHECK_KEYS, ...BROWSER_KEYS];
+const MULTI_STEP_WRITTEN = [...CHECK_WRITTEN, ...RUNTIME_CHECK_KEYS, ...MULTI_STEP_KEYS];
+const PLAYWRIGHT_WRITTEN = [...omit(CHECK_WRITTEN, PLAYWRIGHT_CHECK_OMITTED_PROPS), ...RUNTIME_CHECK_KEYS];
+// The monitors with a request and response-time thresholds share one list.
+const MONITOR_WRITTEN = [...CHECK_WRITTEN, ...RESPONSE_TIME_KEYS, 'request'];
+const SHOULD_FAIL_MONITOR_WRITTEN = [...MONITOR_WRITTEN, ...SHOULD_FAIL_KEYS];
+const ICMP_WRITTEN = [...CHECK_WRITTEN, ...PACKET_LOSS_KEYS, 'request'];
+const HEARTBEAT_WRITTEN = [...CHECK_WRITTEN, ...HEARTBEAT_KEYS];
+const GROUP_WRITTEN = [...GROUP_KEYS, ...GROUP_SET_KEYS, ...GROUP_HELPER_KEYS];
+const EMAIL_WRITTEN = [...ALERT_CHANNEL_KEYS, ...EMAIL_KEYS];
+const SLACK_WRITTEN = [...ALERT_CHANNEL_KEYS, ...SLACK_KEYS];
+const SLACK_APP_WRITTEN = [...ALERT_CHANNEL_KEYS, ...SLACK_APP_KEYS];
+const WEBHOOK_WRITTEN = [...ALERT_CHANNEL_KEYS, ...WEBHOOK_KEYS];
+const OPSGENIE_WRITTEN = [...ALERT_CHANNEL_KEYS, ...OPSGENIE_KEYS];
+const PAGERDUTY_WRITTEN = [...ALERT_CHANNEL_KEYS, ...PAGERDUTY_KEYS];
+const PHONE_WRITTEN = [...ALERT_CHANNEL_KEYS, ...PHONE_KEYS, 'phoneNumber'];
+const MSTEAMS_WRITTEN = [...ALERT_CHANNEL_KEYS, ...MSTEAMS_KEYS, 'payload'];
+const TELEGRAM_WRITTEN = [...ALERT_CHANNEL_KEYS, ...TELEGRAM_KEYS];
+const INCIDENTIO_WRITTEN = [...ALERT_CHANNEL_KEYS, ...INCIDENTIO_KEYS, 'payload'];
+const DASHBOARD_WRITTEN = [...DASHBOARD_KEYS, ...DASHBOARD_SET_KEYS];
+const MAINTENANCE_WINDOW_WRITTEN = [
+    ...MAINTENANCE_WINDOW_KEYS, ...MAINTENANCE_WINDOW_SET_KEYS, ...MAINTENANCE_WINDOW_DATE_KEYS,
+    ...REPEAT_KEYS, ...REPEAT_DATE_KEYS,
+];
+const STATUS_PAGE_V3_WRITTEN = [...STATUS_PAGE_V3_KEYS, 'themeColors'];
+const COMPONENT_WRITTEN = [...COMPONENT_KEYS, ...COMPONENT_CONFIGURATION_KEYS];
+const AUTOMATION_RULE_WRITTEN = [...AUTOMATION_RULE_KEYS, ...AUTOMATION_RULE_SET_KEYS, 'coolDownMinutes'];
+// A build-time assertion only; nothing reads it. When it fails, the props
+// type named at the failing position gained or lost a key: add it to the
+// class's written list and a rule, or to the reasons above.
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const _everyPropIsListed = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+// The same for the other resource types.
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const _everyResourcePropIsListed = [
+    true, true, true, true, true, true, true, true, true, true, true, true,
+    true, true, true, true, true, true, true, true, true, true, true, true,
+];
+export const RULES_BY_CLASS = new Map([
+    [ApiCheck, [
+            ...CHECK_RULES, ...SHOULD_FAIL_RULES, ...RUNTIME_CHECK_RULES, ...RESPONSE_TIME_RULES,
+            ...under('request', API_REQUEST_KEYS), assertions('AssertionBuilder', 'request'),
+        ]],
+    [BrowserCheck, [...CHECK_RULES, ...RUNTIME_CHECK_RULES, ...BROWSER_KEYS.map(key => identity(key))]],
+    [MultiStepCheck, [...CHECK_RULES, ...RUNTIME_CHECK_RULES, ...MULTI_STEP_KEYS.map(key => identity(key))]],
+    [PlaywrightCheck, [...omitting(CHECK_RULES, PLAYWRIGHT_CHECK_OMITTED_PROPS), ...RUNTIME_CHECK_RULES]],
+    [UrlMonitor, [
+            ...CHECK_RULES, ...SHOULD_FAIL_RULES, ...RESPONSE_TIME_RULES, ...under('request', URL_REQUEST_KEYS), assertions('UrlAssertionBuilder', 'request'),
+        ]],
+    [TcpMonitor, [
+            ...CHECK_RULES, ...SHOULD_FAIL_RULES, ...RESPONSE_TIME_RULES, ...under('request', TCP_REQUEST_KEYS), assertions('TcpAssertionBuilder', 'request'),
+        ]],
+    [DnsMonitor, [...CHECK_RULES, ...RESPONSE_TIME_RULES, ...DNS_REQUEST_RULES, assertions('DnsAssertionBuilder', 'request')]],
+    [GrpcMonitor, [
+            ...CHECK_RULES, ...RESPONSE_TIME_RULES, ...under('request', GRPC_REQUEST_KEYS),
+            ...under(['request', 'grpcConfig'], GRPC_CONFIG_KEYS), assertions('GrpcAssertionBuilder', 'request'),
+        ]],
+    [SslMonitor, [...CHECK_RULES, ...RESPONSE_TIME_RULES, ...SSL_REQUEST_RULES, assertions('SslAssertionBuilder', 'request')]],
+    [TracerouteMonitor, [
+            ...CHECK_RULES, ...RESPONSE_TIME_RULES, ...under('request', TRACEROUTE_REQUEST_KEYS),
+            assertions('TracerouteAssertionBuilder', 'request'),
+        ]],
+    [IcmpMonitor, [
+            ...CHECK_RULES, ...PACKET_LOSS_KEYS.map(key => identity(key)),
+            ...under('request', ICMP_REQUEST_KEYS), assertions('IcmpAssertionBuilder', 'request'),
+        ]],
+    [HeartbeatMonitor, [
+            ...CHECK_RULES,
+            ...HEARTBEAT_KEYS.map(key => ({ pointer: ['heartbeat', key], target: [key], group: key.startsWith('period') ? 'period' : 'grace' })),
+        ]],
+    [CheckGroupV1, [...GROUP_RULES, ...alertRules('group')]],
+    [CheckGroupV2, [...GROUP_RULES, ...alertRules('group-v2')]],
+    [EmailAlertChannel, [...ALERT_CHANNEL_RULES, ...config(EMAIL_KEYS)]],
+    [SlackAlertChannel, [...ALERT_CHANNEL_RULES, ...config(SLACK_KEYS)]],
+    [SlackAppAlertChannel, [...ALERT_CHANNEL_RULES, ...config(SLACK_APP_KEYS)]],
+    [WebhookAlertChannel, [...ALERT_CHANNEL_RULES, ...config(WEBHOOK_KEYS)]],
+    [OpsgenieAlertChannel, [...ALERT_CHANNEL_RULES, ...config(OPSGENIE_KEYS)]],
+    [PagerdutyAlertChannel, [...ALERT_CHANNEL_RULES, ...config(PAGERDUTY_KEYS)]],
+    [SmsAlertChannel, [...ALERT_CHANNEL_RULES, ...PHONE_RULES]],
+    [PhoneCallAlertChannel, [...ALERT_CHANNEL_RULES, ...PHONE_RULES]],
+    [MSTeamsAlertChannel, [...ALERT_CHANNEL_RULES, ...MSTEAMS_RULES]],
+    [TelegramAlertChannel, [...ALERT_CHANNEL_RULES, ...TELEGRAM_RULES]],
+    [IncidentioAlertChannel, [...ALERT_CHANNEL_RULES, ...INCIDENTIO_RULES]],
+    [PrivateLocation, PRIVATE_LOCATION_KEYS.map(key => identity(key))],
+    [Dashboard, DASHBOARD_RULES],
+    [MaintenanceWindow, MAINTENANCE_WINDOW_RULES],
+    [StatusPage, STATUS_PAGE_RULES],
+    [StatusPageV3, STATUS_PAGE_V3_RULES],
+    [StatusPageService, STATUS_PAGE_SERVICE_KEYS.map(key => identity(key))],
+    [StatusPageV3Component, COMPONENT_RULES],
+    [StatusPageV3AutomationRule, AUTOMATION_RULE_RULES],
+]);
+/** The top-level props keys each class's rules write, as the build-time assertion above knows them; the spec holds `RULES_BY_CLASS` to it. */
+export const WRITTEN_BY_CLASS = new Map([
+    [ApiCheck, API_WRITTEN], [BrowserCheck, BROWSER_WRITTEN], [MultiStepCheck, MULTI_STEP_WRITTEN],
+    [PlaywrightCheck, PLAYWRIGHT_WRITTEN],
+    [UrlMonitor, SHOULD_FAIL_MONITOR_WRITTEN], [TcpMonitor, SHOULD_FAIL_MONITOR_WRITTEN], [DnsMonitor, MONITOR_WRITTEN],
+    [GrpcMonitor, MONITOR_WRITTEN], [SslMonitor, MONITOR_WRITTEN], [TracerouteMonitor, MONITOR_WRITTEN],
+    [IcmpMonitor, ICMP_WRITTEN],
+    [HeartbeatMonitor, HEARTBEAT_WRITTEN], [CheckGroupV1, GROUP_WRITTEN], [CheckGroupV2, GROUP_WRITTEN],
+    [EmailAlertChannel, EMAIL_WRITTEN], [SlackAlertChannel, SLACK_WRITTEN], [SlackAppAlertChannel, SLACK_APP_WRITTEN],
+    [WebhookAlertChannel, WEBHOOK_WRITTEN], [OpsgenieAlertChannel, OPSGENIE_WRITTEN],
+    [PagerdutyAlertChannel, PAGERDUTY_WRITTEN], [SmsAlertChannel, PHONE_WRITTEN],
+    [PhoneCallAlertChannel, PHONE_WRITTEN],
+    [MSTeamsAlertChannel, MSTEAMS_WRITTEN], [TelegramAlertChannel, TELEGRAM_WRITTEN],
+    [IncidentioAlertChannel, INCIDENTIO_WRITTEN],
+    [PrivateLocation, PRIVATE_LOCATION_KEYS], [Dashboard, DASHBOARD_WRITTEN],
+    [MaintenanceWindow, MAINTENANCE_WINDOW_WRITTEN], [StatusPage, STATUS_PAGE_KEYS],
+    [StatusPageV3, STATUS_PAGE_V3_WRITTEN], [StatusPageService, STATUS_PAGE_SERVICE_KEYS],
+    [StatusPageV3Component, COMPONENT_WRITTEN], [StatusPageV3AutomationRule, AUTOMATION_RULE_WRITTEN],
+]);
+/**
+ * Paths that name another resource or a relation rather than a value of this
+ * one, by the property the construct spells them as. A refused reference is
+ * reported under that property, since the plan above the note names it that
+ * way too: Checkly reports a check's group as `groupId`, the construct takes
+ * `group`.
+ */
+const REFERENCE_PROPERTIES = new Map([
+    ['alertChannels', 'alertChannels'],
+    ['privateLocations', 'privateLocations'],
+    ['alertChannelSubscriptions', 'alertChannelSubscriptions'],
+    ['privateLocationAssignments', 'privateLocationAssignments'],
+    ['groupId', 'group'],
+    ['statusPageId', 'statusPage'],
+    ['parentId', 'parent'],
+    ['components', 'components'],
+]);
+/** Properties a remote change to is reported rather than written, with the reason. */
+const NOT_WRITTEN = new Map([
+    // Dropped again at the end of `planWriteBack` for a resource whose retry
+    // strategy was written: the advice would be wrong there.
+    ['doubleCheck', 'replaced by retryStrategy; set the retry strategy in the code by hand'],
+    ['runParallel', 'not a property this tool can update'],
+    ['triggerIncident', 'Checkly does not report the incident trigger\'s settings; edit it by hand'],
+    ['playwrightConfig', 'this tool does not update the Playwright config yet; set it in checkly.config.ts or on the check by hand'],
+    ['engine', 'this tool does not update the engine yet; set it by hand'],
+    ['engineVersion', 'this tool does not update the engine yet; set it by hand'],
+]);
+/** Whether a reported value is one of the API's stand-ins (`{ $hash }`, `{ $masked }`, `{ $json }`, `{ $ref }`) or holds one. */
+function withheld(value) {
+    if (Array.isArray(value)) {
+        return value.some(withheld);
+    }
+    if (value !== null && typeof value === 'object') {
+        const keys = Object.keys(value);
+        if (keys.some(key => key === '$hash' || key === '$masked' || key === '$json' || key === '$ref')) {
+            return true;
+        }
+        return Object.values(value).some(withheld);
+    }
+    return false;
+}
+const startsWith = (segments, prefix) => prefix.length <= segments.length && prefix.every((segment, i) => segments[i] === segment);
+/**
+ * The account-side value a change reports, if it reports one: `after` is the
+ * current value and `before` the one at the last deploy, read from `remote`
+ * when both sides moved. A missing key means the element is absent on that
+ * side.
+ */
+function reported(change, side) {
+    const holder = change.origin === 'both' ? change.remote : change;
+    return { present: holder !== undefined && side in holder, value: holder?.[side] };
+}
+/**
+ * Whether the change's own report of the account value agrees with what
+ * `before` holds at the write path — the one guard on the assumption that
+ * `before` is the live resource. A set element is checked by membership:
+ * an element the change says is there must be in the list, one it says is
+ * gone must not be. A withheld value cannot be compared and passes.
+ */
+function agrees(change, rule, remaining, raw) {
+    const current = reported(change, 'after');
+    if (rule.set && remaining.length > 0) {
+        if (!Array.isArray(raw)) {
+            return false;
+        }
+        const previous = reported(change, 'before');
+        const holds = (value) => raw.some(element => isDeepStrictEqual(element, value));
+        const added = !current.present || withheld(current.value) || holds(current.value);
+        const removed = !previous.present || withheld(previous.value) || !holds(previous.value);
+        return added && removed;
+    }
+    // A path into a list that is not an index names an element by key, which
+    // only a set does; nothing can be checked against it.
+    if (remaining.length > 0 && Array.isArray(raw) && !/^\d+$/.test(remaining[0])) {
+        return false;
+    }
+    if (!current.present) {
+        // A leaf the account no longer holds is either gone, or — when it was a
+        // scalar or null — became a subtree whose leaves the sibling changes
+        // report (a retry strategy where there was null, a policy that gained
+        // its reminders). An object that is gone is gone.
+        const held = nodeAt(raw, remaining);
+        const previous = reported(change, 'before').value;
+        const wasLeaf = previous === null || typeof previous !== 'object';
+        return held === undefined || (wasLeaf && held !== null && typeof held === 'object');
+    }
+    const held = nodeAt(raw, remaining);
+    // The import format leaves out an optional key the account cleared
+    // (`serverName`, `nameServer`, `data`, …), which the change reports as
+    // null: at the rule's own leaf that is the same absence, and the writer
+    // then refuses it as a value Checkly does not hold. Below the leaf the
+    // parent would be written without the key, so the disagreement stands.
+    const cleared = remaining.length === 0 && held === undefined && current.value === null;
+    return withheld(current.value) || cleared || isDeepStrictEqual(held, current.value);
+}
+/** A reason a change cannot be written, or undefined when it may be. */
+function refusal(change, segments) {
+    if (change.cause !== undefined) {
+        return `${change.cause}: content, not a property`;
+    }
+    if (change.secret === true) {
+        return 'a secret changed; Checkly does not return its value';
+    }
+    if (REFERENCE_PROPERTIES.has(segments[0])) {
+        return 'references another resource';
+    }
+    const notWritten = NOT_WRITTEN.get(segments[0]);
+    if (notWritten !== undefined) {
+        return notWritten;
+    }
+    if (segments[0] === 'intent') {
+        return 'the intent is ordered by the author; edit it by hand';
+    }
+    return undefined;
+}
+/**
+ * The property a refused change is reported under: a reference as the
+ * construct spells it, anything else as the path Checkly reports.
+ */
+function refusedProperty(change, segments) {
+    const reference = REFERENCE_PROPERTIES.get(segments[0]);
+    return reference === undefined ? change.path : [reference, ...segments.slice(1)].join('.');
+}
+class EntryContext {
+    entry;
+    skipped;
+    constructor(entry, skipped) {
+        this.entry = entry;
+        this.skipped = skipped;
+    }
+    skip(reason, property) {
+        const { type, logicalId } = this.entry;
+        this.skipped.push(property === undefined ? { type, logicalId, reason } : { type, logicalId, property, reason });
+    }
+}
+/** The remote changes of an entry grouped by the construct path they write, or the reasons they cannot be. */
+function candidates(context, rules) {
+    const byPath = new Map();
+    const segmentsOf = (change) => {
+        try {
+            return pointerSegments(change.path);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const ruleFor = (segments) => rules.find(rule => startsWith(segments, rule.pointer));
+    const primaryOf = (rule) => rule.companion === undefined
+        ? rule
+        : rules.find(other => other.companion === undefined && isDeepStrictEqual(other.target, rule.target));
+    for (const change of context.entry.changes ?? []) {
+        if (change.origin !== 'remote' && change.origin !== 'both') {
+            continue;
+        }
+        const segments = segmentsOf(change);
+        if (segments === undefined) {
+            context.skip('not a property path', change.path);
+            continue;
+        }
+        const reason = refusal(change, segments);
+        if (reason !== undefined) {
+            context.skip(reason, refusedProperty(change, segments));
+            continue;
+        }
+        const rule = ruleFor(segments);
+        // A refusing rule has a reason of its own and may have no primary.
+        const refused = rule?.refuse?.(context.entry.before);
+        if (refused !== undefined) {
+            context.skip(refused, change.path);
+            continue;
+        }
+        const primary = rule === undefined ? undefined : primaryOf(rule);
+        if (rule === undefined || primary === undefined) {
+            context.skip('not a property this tool can update', change.path);
+            continue;
+        }
+        const key = primary.target.join('.');
+        const candidate = byPath.get(key) ?? { rule: primary, changes: [], local: [] };
+        candidate.changes.push({ change, rule });
+        byPath.set(key, candidate);
+    }
+    // A list is written whole from `before`, which knows nothing of an element
+    // the code added and has not deployed; such an edit must not be erased.
+    // A property written together with others (`group`) is local when any of
+    // them is: an interval written next to a unit the code changed would be a
+    // schedule nobody set.
+    for (const change of context.entry.changes ?? []) {
+        if (change.origin !== 'code') {
+            continue;
+        }
+        const segments = segmentsOf(change);
+        const rule = segments === undefined ? undefined : ruleFor(segments);
+        if (rule === undefined) {
+            continue;
+        }
+        for (const candidate of byPath.values()) {
+            if (candidate.rule === primaryOf(rule) || (rule.group !== undefined && candidate.rule.group === rule.group)) {
+                candidate.local.push(change);
+            }
+        }
+    }
+    return [...byPath.values()];
+}
+function valueFor(context, candidate, before, blanked) {
+    const { rule } = candidate;
+    const property = rule.target.join('.');
+    if (candidate.local.length > 0) {
+        context.skip('your code also changed it since the last deploy; merge by hand', property);
+        return undefined;
+    }
+    for (const segments of [rule.pointer, ...(rule.reads ?? [])]) {
+        const held = nodeAt(before, segments);
+        if (!isDeepStrictEqual(held, nodeAt(blanked, segments))) {
+            context.skip('contains a locked or secret value that Checkly does not return', property);
+            return undefined;
+        }
+        if (withheld(held)) {
+            context.skip('contains a value Checkly does not return in full', property);
+            return undefined;
+        }
+    }
+    for (const { change, rule: own } of candidate.changes) {
+        if (change.origin === 'both' && change.remote === undefined) {
+            context.skip('Checkly did not report the value it holds', property);
+            return undefined;
+        }
+        const remaining = pointerSegments(change.path).slice(own.pointer.length);
+        if (!agrees(change, own, remaining, nodeAt(before, own.pointer))) {
+            context.skip('Checkly reported two different current values', property);
+            return undefined;
+        }
+    }
+    const raw = nodeAt(before, rule.pointer);
+    const found = { value: raw, helper: rule.helper, unless: rule.unless };
+    switch (rule.helper?.kind) {
+        case 'frequency':
+            // A whole-minute schedule stays a number where the code spells it as
+            // one; the helper form is for a sub-minute schedule, or a code that
+            // uses the helper already.
+            found.value = { frequency: raw, frequencyOffset: nodeAt(before, ['frequencyOffset']) };
+            found.literalAlternative = typeof raw === 'number' && raw > 0 ? raw : undefined;
+            break;
+        case 'alertEscalation': {
+            const { policy } = rule.helper;
+            if (nodeAt(before, ['useGlobalAlertSettings']) === true) {
+                if (policy !== 'group-v2') {
+                    context.skip(GLOBAL_POLICY, property);
+                    return undefined;
+                }
+                found.value = 'global';
+                break;
+            }
+            if (!hasEscalationPolicy(raw)) {
+                // A group can have no policy of its own while its checks keep
+                // theirs, which the construct spells by having none.
+                context.skip(policy === 'check'
+                    ? 'Checkly did not report an alert policy'
+                    : 'the group has no alert policy of its own; remove alertEscalationPolicy from the code by hand', property);
+                return undefined;
+            }
+            break;
+        }
+        default:
+            break;
+    }
+    return found;
+}
+/** The edit for a found value: a literal one, or the helper one the rule asks for. */
+function editFor(path, found) {
+    const { value, helper, unless, literalAlternative } = found;
+    if (helper === undefined) {
+        return { path, value };
+    }
+    return helper.kind === 'assertions'
+        ? { path, value, helper: 'assertions', builder: helper.builder, unless, literalAlternative }
+        : { path, value, helper: helper.kind, unless, literalAlternative };
+}
+/**
+ * Whether the plan holds at least one change the planner would try to
+ * write: a remote change on a construct of a known class, at a path the
+ * class's table covers. Cheap enough to decide whether to offer the
+ * write-back at all, without reading any file.
+ */
+export function hasWritableChanges(diff, project) {
+    return diff.some(entry => {
+        if (entry.foldedInto !== undefined || entry.before === undefined) {
+            return false;
+        }
+        const construct = project.data[entry.type]?.[entry.logicalId];
+        const rules = construct === undefined ? undefined : RULES_BY_CLASS.get(construct.constructor);
+        if (rules === undefined || construct?.checkFileAbsolutePath === undefined) {
+            return false;
+        }
+        return candidates(new EntryContext(entry, []), rules).length > 0;
+    });
+}
+export async function planWriteBack({ diff, project, cwd }) {
+    const skipped = [];
+    const byFile = new Map();
+    for (const entry of diff) {
+        if (entry.foldedInto !== undefined || !(entry.changes ?? []).some(c => c.origin === 'remote' || c.origin === 'both')) {
+            continue;
+        }
+        const context = new EntryContext(entry, skipped);
+        const construct = project.data[entry.type]?.[entry.logicalId];
+        if (construct === undefined) {
+            // A resource the deploy removes has no construct to edit; only one the
+            // code still declares is worth a line.
+            if (String(entry.action).toUpperCase() === 'UPDATE') {
+                context.skip('not found in the project');
+            }
+            continue;
+        }
+        const rules = RULES_BY_CLASS.get(construct.constructor);
+        if (rules === undefined) {
+            // A reference to a resource of another project, or a relation, has
+            // no properties of its own; a class of the user's own is not known.
+            context.skip(exportedNamesOf(construct).size === 0
+                ? `${construct.constructor.name} is not a class from checkly/constructs`
+                : `${construct.constructor.name} has no properties this tool can update`);
+            continue;
+        }
+        if (construct.checkFileAbsolutePath === undefined) {
+            context.skip('the file that declares it is not known');
+            continue;
+        }
+        if (entry.before === undefined) {
+            context.skip('Checkly did not report its current state');
+            continue;
+        }
+        let blanked;
+        try {
+            blanked = blankRedacted(entry.before, entry.redactions);
+        }
+        catch (err) {
+            if (err instanceof UnshapeableError) {
+                context.skip('Checkly did not report which of its values are secret');
+                continue;
+            }
+            throw err;
+        }
+        const found = candidates(context, rules).map(candidate => ({
+            candidate, found: valueFor(context, candidate, entry.before, blanked),
+        }));
+        // A member of a group refused here takes the rest of its group with it,
+        // as one the splicer refuses does below.
+        const refusedGroups = new Set(found.filter(entry => entry.found === undefined)
+            .map(entry => entry.candidate.rule.group));
+        const edits = [];
+        for (const { candidate, found: value } of found) {
+            const { group, target } = candidate.rule;
+            if (value === undefined) {
+                continue;
+            }
+            if (group !== undefined && refusedGroups.has(group)) {
+                const others = found.filter(entry => entry.candidate.rule.group === group && entry.candidate !== candidate);
+                context.skip(`written together with ${others.map(entry => entry.candidate.rule.target.join('.')).join(', ')}`, target.join('.'));
+                continue;
+            }
+            edits.push({
+                ...editFor(target, value),
+                replacesLocalEdit: candidate.changes.some(({ change }) => change.origin === 'both'),
+                group,
+            });
+        }
+        if (edits.length === 0) {
+            continue;
+        }
+        const work = byFile.get(construct.checkFileAbsolutePath) ?? [];
+        work.push({ names: exportedNamesOf(construct), context, edits });
+        byFile.set(construct.checkFileAbsolutePath, work);
+    }
+    const files = [];
+    const applied = [];
+    const constructs = [];
+    const imports = [];
+    for (const [filePath, work] of byFile) {
+        const file = path.relative(cwd, filePath);
+        let text;
+        try {
+            text = await fs.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            for (const { context } of work) {
+                context.skip(`could not read ${file}: ${err.message}`);
+            }
+            continue;
+        }
+        const original = text;
+        const lines = [];
+        const edited = [];
+        const added = new Set();
+        // Constructs of one file are edited one after another, each against a
+        // fresh parse of the text the previous one produced, so no range is stale.
+        for (const { names, context, edits } of work) {
+            const logicalId = context.entry.logicalId;
+            let source;
+            let options;
+            try {
+                source = parseSource(filePath, text);
+                options = findConstructOptions(source, logicalId, names);
+            }
+            catch (err) {
+                if (!(err instanceof WriteBackSkipped)) {
+                    throw err;
+                }
+                context.skip(`${file}: ${err.message}`);
+                continue;
+            }
+            try {
+                // A member of a group the splicer refuses takes the rest of its group
+                // with it: a period without its unit would mean something else.
+                let attempt = edits;
+                let result = applyEdits(source, options, attempt);
+                for (;;) {
+                    const refused = new Set(result.skipped.map(skip => attempt.find(edit => edit.path === skip.path)?.group)
+                        .filter((group) => group !== undefined));
+                    const dropped = attempt.filter(edit => edit.group !== undefined && refused.has(edit.group)
+                        && !result.skipped.some(skip => skip.path === edit.path));
+                    if (dropped.length === 0) {
+                        break;
+                    }
+                    for (const edit of dropped) {
+                        context.skip(`written together with ${attempt.filter(e => e.group === edit.group && e !== edit).map(e => e.path.join('.')).join(', ')}`, edit.path.join('.'));
+                    }
+                    attempt = attempt.filter(edit => !dropped.includes(edit));
+                    result = applyEdits(source, options, attempt);
+                }
+                for (const skip of result.skipped) {
+                    context.skip(skip.reason, skip.path.join('.'));
+                }
+                if (result.applied.length === 0) {
+                    continue;
+                }
+                // What was written must read back as what was meant, or the file is
+                // left alone: a splice that produced something else is a bug, and the
+                // user's source is not the place to find out.
+                const reparsed = findConstructOptions(parseSource(filePath, result.text), logicalId, names);
+                for (const edit of result.applied) {
+                    if (!readsBack(reparsed, edit)) {
+                        throw new WriteBackSkipped(`the edited file did not read back as expected at ${edit.path.join('.')}`);
+                    }
+                }
+                edited.push({
+                    file,
+                    type: context.entry.type,
+                    logicalId,
+                    before: linesSpanning(source.text, options.range),
+                    after: linesSpanning(result.text, reparsed.range),
+                });
+                text = result.text;
+                result.imports.forEach(name => added.add(name));
+                for (const edit of result.applied) {
+                    lines.push({
+                        file,
+                        type: context.entry.type,
+                        logicalId,
+                        property: edit.path.join('.'),
+                        previous: edit.previous,
+                        rendered: edit.rendered,
+                        replacesLocalEdit: edits.find(e => e.path === edit.path)?.replacesLocalEdit ?? false,
+                    });
+                }
+            }
+            catch (err) {
+                if (!(err instanceof WriteBackSkipped)) {
+                    throw err;
+                }
+                // A file that cannot be trusted after one construct's edits is not
+                // written at all, whatever the others produced.
+                for (const { context: other } of work) {
+                    other.skip(`${file}: ${err.message}`);
+                }
+                text = original;
+                lines.length = 0;
+                edited.length = 0;
+                added.clear();
+                break;
+            }
+        }
+        if (text !== original) {
+            files.push({ path: filePath, text, original });
+            applied.push(...lines);
+            constructs.push(...edited);
+            if (added.size > 0) {
+                imports.push({ file, names: [...added] });
+            }
+        }
+    }
+    // Saving a retry strategy in Checkly also moves the legacy `doubleCheck`
+    // flag it replaced. Once the strategy itself is written, telling the user
+    // to set it by hand would be wrong.
+    const wroteRetryStrategy = (skip) => applied.some(line => line.type === skip.type && line.logicalId === skip.logicalId && line.property === 'retryStrategy');
+    const reported = skipped.filter(skip => !(skip.property === '/doubleCheck' && wroteRetryStrategy(skip)));
+    return { files, applied, constructs, skipped: reported, imports };
+}
+/**
+ * Writes every planned file through a temporary file in the same directory,
+ * flushed to disk and then renamed over the target, so an interrupted write
+ * leaves the old file or the new one rather than a torn one. The target is
+ * the file itself, not a symlink to it, and it keeps its mode.
+ *
+ * @throws Error naming the files already rewritten when a later one fails.
+ */
+export async function applyWriteBack(plan) {
+    const written = [];
+    for (const file of plan.files) {
+        let temporary;
+        try {
+            const target = await fs.realpath(file.path);
+            // The plan was made from what the file held then; a file edited since
+            // is not overwritten with a rewrite of its older self.
+            if (await fs.readFile(target, 'utf8') !== file.original) {
+                throw new Error('the file changed since the plan was made');
+            }
+            const { mode } = await fs.stat(target);
+            temporary = `${target}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+            const handle = await fs.open(temporary, 'wx');
+            let failed = false;
+            try {
+                // Set after opening, since the mode passed to open is filtered by
+                // the umask; a filesystem without modes keeps its own.
+                await handle.chmod(mode).catch(() => undefined);
+                await handle.writeFile(file.text, 'utf8');
+                await handle.sync();
+            }
+            catch (err) {
+                failed = true;
+                throw err;
+            }
+            finally {
+                // On the way out with an error, the error is the one to report; on
+                // success, a close that fails is the write failing late.
+                await handle.close().catch(err => {
+                    if (!failed) {
+                        throw err;
+                    }
+                });
+            }
+            await fs.rename(temporary, target);
+            written.push(file.path);
+        }
+        catch (err) {
+            if (temporary !== undefined) {
+                await fs.rm(temporary, { force: true }).catch(() => undefined);
+            }
+            const done = written.length === 0 ? 'No file was changed.' : `Already updated: ${written.join(', ')}.`;
+            throw new Error(`Could not write ${file.path}: ${err.message} ${done}`, { cause: err });
+        }
+    }
+}
+//# sourceMappingURL=plan.js.map