@apilift/cli 1.4.39 → 1.4.40-dev.1792138042.e8a4f6750dc5d2eba58515d30b501f737c2846dc

package/dist/apilift-collector.js

@@ -27953,7 +27953,7 @@ function parseUrl(value) {
 function loopback(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "[::1]";
 }
-var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, requestSchema, responseSchema, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
+var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, requestSchema, responseSchema, proofPointer, proofComparison, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
 var init_schema = __esm({
   "../../packages/core/dist/definitions/schema.js"() {
     "use strict";
@@ -28011,9 +28011,13 @@ var init_schema = __esm({
       if (v2.generated && (v2.path !== void 0 || v2.fields !== void 0))
         ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
     });
-    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), equals: external_exports.array(external_exports.union([external_exports.strictObject({ path: pointerSchema, input: inputNameSchema }), external_exports.strictObject({ path: pointerSchema, result: pointerSchema }), external_exports.strictObject({ path: pointerSchema, value: valueSchema })])).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
+    proofPointer = pointerSchema.refine((value) => !/\{(?:input|result|generated)\.[^{}]*\}/u.test(value), "JSON Pointers are literal; use proof.select to find an item by input or result");
+    proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: proofPointer }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
+    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
       if (!!v2.equals === !!v2.absent)
         ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
+      if (v2.select && v2.absent)
+        ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
       if (!v2.effect && !["GET", "HEAD"].includes(v2.request.method))
         ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
     });
@@ -28350,7 +28354,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);
@@ -28454,6 +28458,9 @@ var init_baselines = __esm({
       startPreparation(sessionId, appSlug, at = /* @__PURE__ */ new Date()) {
         this.ledger.db.prepare("INSERT OR IGNORE INTO baseline_preparation_start (session_id,app_slug,started_at) VALUES (?,?,?)").run(sessionId, appSlug, at.toISOString());
       }
+      clearPreparation(sessionId, appSlug) {
+        this.ledger.db.prepare("DELETE FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").run(sessionId, appSlug);
+      }
       finishPreparation(sessionId, appSlug, appId, method, at = /* @__PURE__ */ new Date()) {
         const row = this.ledger.db.prepare("SELECT started_at FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").get(sessionId, appSlug);
         if (!row || this.ledger.db.prepare("SELECT 1 FROM baseline_candidate WHERE draft_id=?").get(`preparation:${sessionId}:${appId}:${method}`)) return;

package/dist/apilift-native-host.js

@@ -29457,9 +29457,13 @@ var responseSchema = external_exports.strictObject({ schema: jsonSchema.optional
   if (v.generated && (v.path !== void 0 || v.fields !== void 0))
     ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
 });
-var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), equals: external_exports.array(external_exports.union([external_exports.strictObject({ path: pointerSchema, input: inputNameSchema }), external_exports.strictObject({ path: pointerSchema, result: pointerSchema }), external_exports.strictObject({ path: pointerSchema, value: valueSchema })])).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
+var proofPointer = pointerSchema.refine((value) => !/\{(?:input|result|generated)\.[^{}]*\}/u.test(value), "JSON Pointers are literal; use proof.select to find an item by input or result");
+var proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: proofPointer }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
+var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
   if (!!v.equals === !!v.absent)
     ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
+  if (v.select && v.absent)
+    ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
   if (!v.effect && !["GET", "HEAD"].includes(v.request.method))
     ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
 });
@@ -29559,7 +29563,7 @@ function inspectRequest(request2, inputs, generated, proof, base2, issues) {
         continue;
       if (proof && token.startsWith("result.") && pointerSchema.safeParse(token.slice(7)).success)
         continue;
-      issues.push({ path: path2, message: `Unknown template ${match[0]}` });
+      issues.push({ path: path2, message: `Unknown template ${match[0]}${proof ? '; result URLs use {result./id}, and JSON values use {"$result":"/id"}' : ""}` });
     }
   };
   const walk = (value, path2) => {
@@ -29630,6 +29634,9 @@ function validateDefinition(kind, name, value) {
     for (const [i, comparison] of (definition2.proof?.equals ?? []).entries())
       if ("input" in comparison && !names2.includes(comparison.input))
         issues.push({ path: `/proof/equals/${i}/input`, message: "Unknown input" });
+    for (const [i, comparison] of (definition2.proof?.select?.where ?? []).entries())
+      if ("input" in comparison && !names2.includes(comparison.input))
+        issues.push({ path: `/proof/select/where/${i}/input`, message: "Unknown input" });
     if (definition2.response?.generated && !generated.has(definition2.response.generated))
       issues.push({ path: "/response/generated", message: "Unknown generated value" });
   }
@@ -29814,7 +29821,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);

package/dist/apilift.js

@@ -28017,7 +28017,7 @@ function parseUrl(value) {
 function loopback(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "[::1]";
 }
-var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, requestSchema, responseSchema, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
+var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, requestSchema, responseSchema, proofPointer, proofComparison, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
 var init_schema = __esm({
   "../../packages/core/dist/definitions/schema.js"() {
     "use strict";
@@ -28075,9 +28075,13 @@ var init_schema = __esm({
       if (v.generated && (v.path !== void 0 || v.fields !== void 0))
         ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
     });
-    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), equals: external_exports.array(external_exports.union([external_exports.strictObject({ path: pointerSchema, input: inputNameSchema }), external_exports.strictObject({ path: pointerSchema, result: pointerSchema }), external_exports.strictObject({ path: pointerSchema, value: valueSchema })])).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
+    proofPointer = pointerSchema.refine((value) => !/\{(?:input|result|generated)\.[^{}]*\}/u.test(value), "JSON Pointers are literal; use proof.select to find an item by input or result");
+    proofComparison = external_exports.union([external_exports.strictObject({ path: proofPointer, input: inputNameSchema }), external_exports.strictObject({ path: proofPointer, result: proofPointer }), external_exports.strictObject({ path: proofPointer, value: valueSchema })]);
+    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: external_exports.strictObject({ path: proofPointer, where: external_exports.array(proofComparison).min(1) }).optional(), equals: external_exports.array(proofComparison).min(1).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
       if (!!v.equals === !!v.absent)
         ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
+      if (v.select && v.absent)
+        ctx.addIssue({ code: "custom", path: ["select"], message: "Collection selection cannot prove absence; use a targeted HTTP-404 read" });
       if (!v.effect && !["GET", "HEAD"].includes(v.request.method))
         ctx.addIssue({ code: "custom", path: ["request", "method"], message: "Proof request must be GET or HEAD unless effect is read" });
     });
@@ -28411,7 +28415,7 @@ function inspectRequest(request2, inputs, generated, proof, base2, issues) {
         continue;
       if (proof && token.startsWith("result.") && pointerSchema.safeParse(token.slice(7)).success)
         continue;
-      issues.push({ path: path2, message: `Unknown template ${match[0]}` });
+      issues.push({ path: path2, message: `Unknown template ${match[0]}${proof ? '; result URLs use {result./id}, and JSON values use {"$result":"/id"}' : ""}` });
     }
   };
   const walk = (value, path2) => {
@@ -28482,6 +28486,9 @@ function validateDefinition(kind, name, value) {
     for (const [i, comparison] of (definition2.proof?.equals ?? []).entries())
       if ("input" in comparison && !names2.includes(comparison.input))
         issues.push({ path: `/proof/equals/${i}/input`, message: "Unknown input" });
+    for (const [i, comparison] of (definition2.proof?.select?.where ?? []).entries())
+      if ("input" in comparison && !names2.includes(comparison.input))
+        issues.push({ path: `/proof/select/where/${i}/input`, message: "Unknown input" });
     if (definition2.response?.generated && !generated.has(definition2.response.generated))
       issues.push({ path: "/response/generated", message: "Unknown generated value" });
   }
@@ -28806,7 +28813,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);
@@ -28961,7 +28968,7 @@ var init_registry = __esm({
       contextClear: { path: ["context", "clear"], min: 0, max: 0, values: ["app"] },
       discoverDraft: { path: ["discover", "draft"], min: 1, max: 2 },
       discoverCheck: { path: ["discover", "check"], min: 0, max: 0 },
-      discoverRun: { path: ["discover", "run"], min: 0, max: 0 },
+      discoverRun: { path: ["discover", "run"], min: 0, max: 0, flags: ["proof-only"] },
       discoverPublish: { path: ["discover", "publish"], min: 0, max: 0 },
       discoverStatus: { path: ["discover", "status"], min: 0, max: 0 },
       discoverDefer: { path: ["discover", "defer"], min: 0, max: 0 },
@@ -29230,6 +29237,9 @@ var init_baselines = __esm({
       startPreparation(sessionId, appSlug, at = /* @__PURE__ */ new Date()) {
         this.ledger.db.prepare("INSERT OR IGNORE INTO baseline_preparation_start (session_id,app_slug,started_at) VALUES (?,?,?)").run(sessionId, appSlug, at.toISOString());
       }
+      clearPreparation(sessionId, appSlug) {
+        this.ledger.db.prepare("DELETE FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").run(sessionId, appSlug);
+      }
       finishPreparation(sessionId, appSlug, appId, method, at = /* @__PURE__ */ new Date()) {
         const row = this.ledger.db.prepare("SELECT started_at FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").get(sessionId, appSlug);
         if (!row || this.ledger.db.prepare("SELECT 1 FROM baseline_candidate WHERE draft_id=?").get(`preparation:${sessionId}:${appId}:${method}`)) return;
@@ -30784,7 +30794,7 @@ function draftTemplate(kind) {
     ""
   ].join("\n") : "";
   const tabGuidance = ["action", "transport"].includes(kind) ? "// capture.tab is a selector returned by browser tabs; it selects the same signed-in Chrome tab for capture and discover run, including connection probes. Leave other sessions' tabs untouched.\n" : "";
-  const captureGuidance = kind === "action" ? '// Public descriptions explain behavior, consequences and limits; do not instruct consumers to repeat runtime proof or browser checks. Author verification is separate from consumer judgment.\n// Request JSON/query uses typed {"$input":"name"} bindings; URL segments use {input.name}. Resolve every {unresolved.N} marker from retained evidence before running.\n// Mutation proof compares a readback path with exactly one input, primary result path or internal JSON value: equals: [{"path":"/ready","value":true}]. Public literals require semantic review; fixed proof expectations are not caller flags.\n// After selecting a captured request, discover capture auth runs a bounded default search without authField or authScope. Set either only to narrow an observed field or location; browser-managed cookies need no locator.\n' : "";
+  const captureGuidance = kind === "action" ? '// Public descriptions explain behavior, consequences and limits; do not instruct consumers to repeat runtime proof or browser checks. Author verification is separate from consumer judgment.\n// Request JSON/query uses typed {"$input":"name"} bindings; URL segments use {input.name}. Resolve every {unresolved.N} marker from retained evidence before running.\n// Discovery-only mutation proof compares a readback path with exactly one input, primary result path or internal JSON value: equals: [{"path":"/ready","value":true}]. Public literals require semantic review; fixed proof expectations are not caller flags.\n// Proof URLs bind returned identifiers with {result./id}; JSON bodies/query use {"$result":"/id"}. Pointers are literal, never templates.\n// For one member of a nested list: select: {"path":"/ticket/fields","where":[{"path":"/id","result":"/id"}]}; equals paths then refer to the single matching member. Compare identity and meaningful changed fields, not entire objects.\n// Repair a failed response/proof with discover run --proof-only; it reuses the saved primary response and sends only the readback. Publication still needs a successful test and accepted semantic review.\n// For large collections, investigate native search/filter/detail routes before enumeration. Search saved results locally and inspect only matching records; preserve structured dynamic fields.\n// After selecting a captured request, discover capture auth runs a bounded default search without authField or authScope. Set either only to narrow an observed field or location; browser-managed cookies need no locator.\n' : "";
   return `${head}${probeGuidance}${tabGuidance}${captureGuidance}${JSON.stringify(templates[kind], null, 2)}
 `;
 }
@@ -30803,8 +30813,8 @@ var init_envelope = __esm({
 
 // src/discovery/drafts.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync4, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename, dirname as dirname2, join as join5 } from "node:path";
 function pathFor(root, appSlug, kind, name) {
   if (!slugPattern.test(appSlug)) throw new Error("App slug is invalid");
   if (kind === "action" ? !actionPattern.test(name) : kind !== "app" && !resourcePattern.test(name)) throw new Error("Resource name is invalid");
@@ -30860,12 +30870,65 @@ var init_drafts = __esm({
         if (!slugPattern.test(appSlug)) throw new Error("App slug is invalid");
         const current = this.session(sessionId);
         if (current && current.appSlug !== appSlug) throw new DraftConflict("selected-draft", `Discovery is open for ${current.appSlug}; close it before opening another app`);
-        this.state.db.prepare("INSERT INTO discovery_session (session_id,app_slug,app_id,title) VALUES (?,?,?,?) ON CONFLICT(session_id) DO UPDATE SET app_id=excluded.app_id,title=excluded.title").run(sessionId, appSlug, appId, title2);
-        return this.session(sessionId);
+        const moved = [];
+        this.state.db.exec("BEGIN IMMEDIATE");
+        try {
+          const stale = this.retained(appSlug).filter((draft) => draft.appId !== appId);
+          for (const draft of stale) {
+            if (draft.ownerSessionId && draft.ownerSessionId !== sessionId) throw new DraftConflict("owned-draft", `The previous app's ${draft.kind} ${draft.name} is owned by another agent; that agent must finish or defer it before reopening this slug`);
+            if (this.publication(draft.id)) throw new DraftConflict("selected-draft", "A previous app publication may have been sent; its owner must reconcile discover publish before reopening this slug");
+            if (this.hasTable("discovery_capture")) {
+              const capture = this.state.db.prepare("SELECT scope_id FROM discovery_capture WHERE draft_id=?").get(draft.id);
+              if (capture?.scope_id) throw new DraftConflict("selected-draft", "A previous app recording is still active or unconfirmed; its owner must settle discover capture cancel before reopening this slug");
+            }
+          }
+          const previousSessions = this.state.db.prepare("SELECT session_id FROM discovery_session WHERE app_slug=? AND app_id IS NOT ?").all(appSlug, appId);
+          const changed = stale.length > 0 || previousSessions.length > 0;
+          const archivedDrafts = changed ? join5(this.root, "retired-drafts", randomUUID4()) : void 0;
+          if (archivedDrafts) mkdirSync5(archivedDrafts, { recursive: true, mode: 448 });
+          for (const draft of stale) {
+            if (existsSync2(draft.filePath)) {
+              const archived = join5(archivedDrafts, paths[draft.kind], basename(draft.filePath));
+              mkdirSync5(dirname2(archived), { recursive: true, mode: 448 });
+              renameSync(draft.filePath, archived);
+              moved.push({ from: draft.filePath, to: archived });
+            }
+            for (const table of ["selected_discovery_draft", "discovery_publication", "discovery_evidence", "discovery_attempt", "discovery_capture"]) {
+              if (this.hasTable(table)) this.state.db.prepare(`DELETE FROM ${table} WHERE draft_id=?`).run(draft.id);
+            }
+            this.state.db.prepare("DELETE FROM discovery_draft WHERE id=?").run(draft.id);
+          }
+          if (changed && this.hasTable("discovery_research")) {
+            const research = this.state.db.prepare("SELECT file_path FROM discovery_research WHERE app_slug=?").all(appSlug);
+            for (const row of research) if (existsSync2(row.file_path)) {
+              const archived = join5(archivedDrafts, "api", basename(row.file_path));
+              mkdirSync5(dirname2(archived), { recursive: true, mode: 448 });
+              renameSync(row.file_path, archived);
+              moved.push({ from: row.file_path, to: archived });
+            }
+            if (this.hasTable("selected_discovery_research")) this.state.db.prepare("DELETE FROM selected_discovery_research WHERE app_slug=?").run(appSlug);
+            this.state.db.prepare("DELETE FROM discovery_research WHERE app_slug=?").run(appSlug);
+          }
+          this.state.db.prepare("DELETE FROM discovery_session WHERE app_slug=? AND app_id IS NOT ?").run(appSlug, appId);
+          this.state.db.prepare("INSERT INTO discovery_session (session_id,app_slug,app_id,title) VALUES (?,?,?,?) ON CONFLICT(session_id) DO UPDATE SET app_id=excluded.app_id,title=excluded.title").run(sessionId, appSlug, appId, title2);
+          this.state.db.exec("COMMIT");
+          if (changed) withBaselines(this.root, (baselines) => {
+            for (const draft of stale) baselines.closeObservation(draft.id, "app-identity-changed");
+            for (const id2 of /* @__PURE__ */ new Set([sessionId, ...previousSessions.map((row) => row.session_id)])) baselines.clearPreparation(id2, appSlug);
+          });
+          return { ...this.session(sessionId), ...archivedDrafts ? { archivedDrafts } : {} };
+        } catch (error62) {
+          this.state.db.exec("ROLLBACK");
+          for (const { from, to } of moved.reverse()) renameSync(to, from);
+          throw error62;
+        }
+      }
+      hasTable(name) {
+        return Boolean(this.state.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name));
       }
       setAppId(appSlug, appId) {
-        this.state.db.prepare("UPDATE discovery_session SET app_id=? WHERE app_slug=?").run(appId, appSlug);
-        this.state.db.prepare("UPDATE discovery_draft SET app_id=? WHERE app_slug=?").run(appId, appSlug);
+        this.state.db.prepare("UPDATE discovery_session SET app_id=? WHERE app_slug=? AND app_id IS NULL").run(appId, appSlug);
+        this.state.db.prepare("UPDATE discovery_draft SET app_id=? WHERE app_slug=? AND app_id IS NULL").run(appId, appSlug);
       }
       close(sessionId) {
         const current = this.session(sessionId);
@@ -30909,6 +30972,18 @@ var init_drafts = __esm({
       saveAttempt(draftId, fingerprint2, state) {
         this.state.db.prepare("INSERT INTO discovery_attempt (draft_id,fingerprint,state,recorded_at) VALUES (?,?,?,?) ON CONFLICT(draft_id) DO UPDATE SET fingerprint=excluded.fingerprint,state=excluded.state,recorded_at=excluded.recorded_at").run(draftId, fingerprint2, state, (/* @__PURE__ */ new Date()).toISOString());
       }
+      requestAttempts() {
+        this.state.db.exec("CREATE TABLE IF NOT EXISTS discovery_request_attempt (draft_id TEXT NOT NULL REFERENCES discovery_draft(id) ON DELETE CASCADE, fingerprint TEXT NOT NULL, state TEXT NOT NULL, response_path TEXT, response_digest TEXT, PRIMARY KEY(draft_id,fingerprint))");
+      }
+      requestAttempt(draftId, fingerprint2) {
+        this.requestAttempts();
+        const row = this.state.db.prepare("SELECT state,response_path,response_digest FROM discovery_request_attempt WHERE draft_id=? AND fingerprint=?").get(draftId, fingerprint2);
+        return row ? { state: row.state, responsePath: row.response_path, responseDigest: row.response_digest } : null;
+      }
+      saveRequestAttempt(draftId, fingerprint2, state, responsePath, responseDigest) {
+        this.requestAttempts();
+        this.state.db.prepare("INSERT INTO discovery_request_attempt (draft_id,fingerprint,state,response_path,response_digest) VALUES (?,?,?,?,?) ON CONFLICT(draft_id,fingerprint) DO UPDATE SET state=excluded.state,response_path=COALESCE(excluded.response_path,discovery_request_attempt.response_path),response_digest=COALESCE(excluded.response_digest,discovery_request_attempt.response_digest)").run(draftId, fingerprint2, state, responsePath ?? null, responseDigest ?? null);
+      }
       discard(sessionId) {
         const draft = this.selected(sessionId);
         if (!draft) return null;
@@ -30958,6 +31033,7 @@ var init_drafts = __esm({
           if (selected && (selected.appSlug !== input2.appSlug || selected.kind !== input2.kind || selected.name !== name)) throw new DraftConflict("selected-draft", `This agent already selected ${selected.kind} ${selected.name}; defer or finish it before opening another resource`);
           const existing = this.state.db.prepare("SELECT * FROM discovery_draft WHERE app_slug=? AND kind=? AND name=?").get(input2.appSlug, input2.kind, name);
           if (existing?.owner_session_id && existing.owner_session_id !== input2.sessionId) throw new DraftConflict("owned-draft", `${input2.kind} ${name} is owned by another agent session; its file was preserved`);
+          if (existing && existing.app_id !== (input2.appId ?? null)) throw new DraftConflict("selected-draft", "The retained draft belongs to a different app; reopen the app from its current registry identity before editing");
           if (existing) filePath = String(existing.file_path);
           const id2 = existing ? String(existing.id) : randomUUID4();
           if (!existing) this.state.db.prepare("INSERT INTO discovery_draft (id,app_slug,app_id,kind,name,owner_session_id,file_path,base_version) VALUES (?,?,?,?,?,?,?,?)").run(id2, input2.appSlug, input2.appId ?? null, input2.kind, name, input2.sessionId, filePath, input2.baseVersion ?? null);
@@ -32367,7 +32443,7 @@ var init_vault = __esm({
 
 // src/commands/run.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { readFileSync as readFileSync7, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8 } from "node:fs";
+import { readFileSync as readFileSync7, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8 } from "node:fs";
 import { dirname as dirname5, resolve as resolve4, join as join10 } from "node:path";
 function pointer2(value, path2) {
   if (path2 === "") return value;
@@ -32375,7 +32451,7 @@ function pointer2(value, path2) {
   let current = value;
   for (const raw of path2.slice(1).split("/")) {
     const name = raw.replaceAll("~1", "/").replaceAll("~0", "~");
-    if (typeof current !== "object" || current === null || !(name in current)) throw new Error(`Result path ${path2} is missing`);
+    if (typeof current !== "object" || current === null || !Object.hasOwn(current, name)) throw new Error(`Result path ${path2} is missing`);
     current = current[name];
   }
   return current;
@@ -32584,7 +32660,7 @@ function writeOutput(path2, content) {
   const pending = join10(dirname5(path2), `.apilift-output-${randomUUID7()}`);
   try {
     writeFileSync6(pending, content, { flag: "wx", mode: 384 });
-    renameSync(pending, path2);
+    renameSync2(pending, path2);
   } catch (error62) {
     try {
       unlinkSync3(pending);
@@ -32611,7 +32687,19 @@ function projectResponse(body, action, generated) {
   }
   if (response?.schema) {
     const validate2 = ajv3.compile(response.schema);
-    if (!validate2(value)) throw new Error("The app response does not match this action's output contract");
+    if (!validate2(value)) {
+      const issues = (validate2.errors ?? []).slice(0, 5).map((error62) => {
+        let actual;
+        try {
+          actual = pointer2(value, error62.instancePath);
+        } catch {
+          actual = void 0;
+        }
+        const type = actual === null ? "null" : Array.isArray(actual) ? "array" : typeof actual;
+        return `${error62.instancePath || "/"}: ${error62.message ?? "schema mismatch"}; actual type ${type}`;
+      });
+      throw new Error(`Response contract mismatch: ${issues.join("; ")}`);
+    }
   }
   return value;
 }
@@ -32688,14 +32776,34 @@ async function sendBrowser(root, appId, contextName, pageOrigin, effect2, transp
     if (!selection.execution) await client.closeScope(scope2.id);
   }
 }
-function proofPassed(proof, body, primary, inputs, status) {
-  if (proof.absent) return status === 404;
-  if (status < 200 || status >= 300 || !proof.equals) return false;
-  return proof.equals.every((comparison) => {
-    const actual = pointer2(body, comparison.path);
+function confirmProof(proof, body, primary, inputs, status) {
+  if (proof.absent) {
+    if (status !== 404) throw new ResponseContractFailure(`Absence proof expected HTTP 404; received HTTP ${status}`);
+    return;
+  }
+  if (status < 200 || status >= 300) throw new ResponseContractFailure(`Readback returned HTTP ${status}`);
+  const matches = (comparison, selected2, missingIsMismatch = false) => {
     const expected = "input" in comparison ? inputs[comparison.input] : "result" in comparison ? pointer2(primary, comparison.result) : comparison.value;
+    let actual;
+    try {
+      actual = pointer2(selected2, comparison.path);
+    } catch (error62) {
+      if (missingIsMismatch) return false;
+      throw error62;
+    }
     return actual !== void 0 && expected !== void 0 && canonicalJson(actual) === canonicalJson(expected);
-  });
+  };
+  let selected = body;
+  if (proof.select) {
+    const collection = pointer2(body, proof.select.path);
+    if (!Array.isArray(collection)) throw new ResponseContractFailure(`Readback selection ${proof.select.path || "/"} must be an array`);
+    const found = collection.filter((item) => proof.select.where.every((comparison) => matches(comparison, item, true)));
+    if (found.length !== 1) throw new ResponseContractFailure(`Readback selection matched ${found.length} items; expected exactly one`);
+    selected = found[0];
+  }
+  for (const comparison of proof.equals ?? []) {
+    if (!matches(comparison, selected)) throw new ResponseContractFailure(`Readback comparison failed at ${comparison.path || "/"}`);
+  }
 }
 async function handleRun(invocation, api, state, session, fetcher, root, stdin = () => readFileSync7(0, "utf8"), onReport) {
   const [appName, actionName] = invocation.positionals;
@@ -32768,7 +32876,7 @@ No app request was sent.
   const transportVersion = bundle2.closure.versions.find((item) => item.kind === "transport" && item.name === (action && "transport" in action ? action.transport : ""));
   const transport = transportVersion?.definition;
   if (!action || !("request" in action) || !transport) return fail2("execution-bundle-invalid \u2014 The selected action or transport is missing. No app request was sent.\n", 5);
-  if (action.effect !== "read" && !action.proof) return fail2("execution-bundle-invalid \u2014 A mutating action has no readback proof. No app request was sent.\n", 5);
+  if (action.effect !== "read" && !action.proof) return fail2("execution-bundle-invalid \u2014 A mutating action has no discovery proof specification. No app request was sent.\n", 5);
   const selectedCredential = state.useSession(session.id, bundle2.app.id)?.credentials[action.transport];
   if (transport.credentials?.length && !selectedCredential) return fail2(`credential-required \u2014 ${actionName} needs a selected credential for ${action.transport}. Run ${prefix(`credentials list ${appName} ${action.transport}`)}, then credentials use or add. No app request was sent.
 `, 5);
@@ -32840,7 +32948,6 @@ Inspect current action documentation: ${prefix(`actions show ${appName} ${action
   let outcome = "network-error";
   let diagnostic;
   let output2;
-  let verified;
   try {
     const primary = await sendRequest(prepared, action.effect);
     if (!primary.response.ok) {
@@ -32849,29 +32956,9 @@ Inspect current action documentation: ${prefix(`actions show ${appName} ${action
 ${action.effect !== "read" && primary.response.status >= 500 ? readRecovery : ""}`, 4, true);
     } else {
       const value = projected(primary.body, action, generated);
-      if (action.effect !== "read" && action.proof) {
-        const preparedProof = prepareRequest(action.proof.request, transport, inputs.values, generated, value);
-        const proof = await timed(timings, "proofMs", () => sendRequest(preparedProof, "read"));
-        let passed = false;
-        try {
-          passed = proofPassed(action.proof, proof.body, value, inputs.values, proof.response.status);
-        } catch {
-        }
-        if (!passed) {
-          outcome = "interface-error";
-          diagnostic = "proof-failed";
-          output2 = fail2(`proof-failed \u2014 ${actionName} was sent, but its readback did not confirm success. ${readRecovery}`, 12, true);
-        } else {
-          outcome = "success";
-          verified = action.proof.absent ? "absence" : "readback";
-          output2 = result(`${JSON.stringify(value, null, 2)}
-`, true);
-        }
-      } else {
-        outcome = "success";
-        output2 = result(`${JSON.stringify(value, null, 2)}
+      outcome = "success";
+      output2 = result(`${JSON.stringify(value, null, 2)}
 `, true);
-      }
     }
   } catch (error62) {
     if (error62 instanceof ResponseContractFailure && dispatchedAt) {
@@ -32890,7 +32977,7 @@ Inspect saved entries: ${prefix(`credentials list ${appName} ${action.transport}
   }
   if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
   });
-  const report = { id: reportId, connectionFingerprint: await hashJson({ transport: transportVersion.executableHash, credential: selectedCredential ?? null, browser: browserPage?.pageOrigin ?? null }), ...bundle2.receipt ? { receiptId: bundle2.receipt.id } : {}, ...outcome === "success" && action.effect !== "read" ? { proof: "passed" } : {}, appId: bundle2.app.id, actionName, actionVersion: actionVersion.version, closureHash: bundle2.closure.hash, purpose: "run", clientFamily: "cli", agent: session.agent, outcome, ...diagnostic ? { diagnostic } : {}, startedAt, ...dispatchedAt ? { dispatchedAt } : {}, finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const report = { id: reportId, connectionFingerprint: await hashJson({ transport: transportVersion.executableHash, credential: selectedCredential ?? null, browser: browserPage?.pageOrigin ?? null }), ...bundle2.receipt ? { receiptId: bundle2.receipt.id } : {}, appId: bundle2.app.id, actionName, actionVersion: actionVersion.version, closureHash: bundle2.closure.hash, purpose: "run", clientFamily: "cli", agent: session.agent, outcome, ...diagnostic ? { diagnostic } : {}, startedAt, ...dispatchedAt ? { dispatchedAt } : {}, finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
   try {
     state.queueExecutionReport(reportId, report);
     onReport?.(reportId);
@@ -32921,21 +33008,33 @@ Inspect saved entries: ${prefix(`credentials list ${appName} ${action.transport}
         saved = readFileSync7(recoveryPath, "utf8") === completeResult;
       } catch {
       }
-      output2 = { ...fail2(`output-failed \u2014 The app request completed, but the result could not be saved or selected: ${error62 instanceof Error ? error62.message : "unknown error"}. ${saved ? `Complete result: ${recoveryPath}. Read that local JSON file to recover the returned identifiers` : "The complete result is on stdout"}.${verified ? ` The ${verified} proof completed, but result delivery failed.` : ""} Do not repeat the app mutation.
+      output2 = { ...fail2(`output-failed \u2014 The app request completed, but the result could not be saved or selected: ${error62 instanceof Error ? error62.message : "unknown error"}. ${saved ? `Complete result: ${recoveryPath}. Read that local JSON file to recover the returned identifiers` : "The complete result is on stdout"}. Do not repeat the app mutation.
 `, 12, true), ...saved ? {} : { stdout: completeResult, stdoutJson: true } };
     }
   }
-  if (verified && output2.exitCode === 0) {
-    output2.stderr += `Verified: ${verified}.
-`;
-    output2.verification = verified;
-  }
   if (bundle2.selection.fallback && !["prefer-verified", "pinned-selection"].includes(bundle2.selection.replaced?.reason ?? "")) output2.stderr += `Using a previously working revision (${bundle2.selection.replaced?.reason ?? "compatible-fallback"}). Selection recovers automatically when an eligible revision is available.${bundle2.selection.replaced?.until ? ` Protective pause ends ${bundle2.selection.replaced.until}.` : ""} Inspect distribution with ${prefix(`apps history ${appName}`)}.
 `;
   output2.dispatched = Boolean(dispatchedAt);
   saveTimings(timings, performance.now() - commandStarted);
   return output2;
 }
+function privateEvidence(value, credentials) {
+  const secrets = new Set(credentials.filter(Boolean));
+  const sensitive2 = /^(?:password|secret|access[_-]?token|refresh[_-]?token|token|authorization|cookie|api[_-]?key)$/iu;
+  JSON.stringify(value, (key, child) => {
+    if (sensitive2.test(key) && typeof child === "string" && child) secrets.add(child);
+    return child;
+  });
+  let redacted = false;
+  const text2 = JSON.stringify(value, (_key, child) => {
+    if (typeof child === "string" && (secrets.has(child) || credentials.some((secret) => secret && child.includes(secret)))) {
+      redacted = true;
+      return "[REDACTED]";
+    }
+    return child;
+  });
+  return { value: JSON.parse(text2), redacted };
+}
 async function executeDraftVerification(input2) {
   const { transport } = input2;
   const probe = input2.kind === "transport" ? transport.probes[input2.probeOrigin ?? ""] : void 0;
@@ -32945,9 +33044,9 @@ async function executeDraftVerification(input2) {
   const schema = input2.kind === "action" ? action.inputs ?? { type: "object", properties: {}, additionalProperties: false } : probe.inputs ?? { type: "object", properties: {}, additionalProperties: false };
   let values;
   let prepared;
-  const generated = input2.kind === "action" && action && "generated" in action ? Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID7()}`])) : {};
+  const generated = input2.primaryEvidence?.generated ?? (input2.kind === "action" && action && "generated" in action ? Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID7()}`])) : {});
   try {
-    values = effectiveInputs(schema, input2.sampleInputs, {}, true).values;
+    values = effectiveInputs(schema, input2.primaryEvidence?.inputs ?? input2.sampleInputs, {}, true).values;
     const request2 = input2.kind === "action" ? action.request : probe.request;
     prepared = prepareRequest(request2, input2.kind === "transport" && input2.probeOrigin ? { ...transport, baseUrl: input2.probeOrigin } : transport, values, generated);
   } catch (error62) {
@@ -32965,11 +33064,12 @@ async function executeDraftVerification(input2) {
       return { ok: false, message: error62 instanceof Error ? error62.message : "Browser page is unavailable", exitCode: 5, dispatched: false };
     }
   }
-  let dispatched = false;
+  let dispatched = Boolean(input2.primaryEvidence);
   let dispatchStarted = 0;
   let dispatchAt = null;
   const browserExecution = {};
   let liveBrowser;
+  const knownCredentials = [];
   const sendConfigured = async (request2, effect2) => {
     const allowNonJsonProbe = input2.kind === "transport" && probe?.response.schema === void 0 && probe?.response.path === void 0;
     let credentialDraftId;
@@ -33009,6 +33109,7 @@ async function executeDraftVerification(input2) {
         const installation = input2.state.installation();
         if (!installation) throw new CredentialError("installation-required", "Installation is no longer linked");
         const values2 = await store.read(credential2, { workspaceId: installation.workspaceId, ...credentialDraftId ? { draftId: credentialDraftId } : {}, appId: input2.appId, appTitle: input2.appSlug, transportName: input2.kind === "action" && action && "transport" in action ? action.transport : input2.name, requirements: transport.credentials ?? [], credentialContract: credentialContractKey(transport), destinations: transport.allowedOrigins });
+        knownCredentials.push(...Object.values(values2));
         const headers = new Headers(request2.init.headers);
         for (const requirement2 of transport.credentials ?? []) headers.set(requirement2.header, `${requirement2.prefix ?? ""}${values2[requirement2.name]}`);
         request2 = { ...request2, init: { ...request2.init, headers } };
@@ -33023,9 +33124,13 @@ async function executeDraftVerification(input2) {
     return send(input2.fetcher, request2, allowNonJsonProbe);
   };
   try {
-    const primary = await sendConfigured(prepared, input2.kind === "action" ? action.effect : "read");
-    if (!primary.response.ok) return { ok: false, message: `The app returned HTTP ${primary.response.status}${input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "" : ". Inspect its state before retrying a mutation"}`, exitCode: 4, dispatched };
-    if (input2.kind === "action" && transport.mode === "direct" && dispatchStarted) input2.onDirectBaseline?.(Math.max(0, performance.now() - dispatchStarted), JSON.stringify({ method: prepared.init.method, url: prepared.url.toString(), body: prepared.init.body ?? null }), JSON.stringify(primary.body), dispatchAt, (/* @__PURE__ */ new Date()).toISOString());
+    const primary = input2.primaryEvidence ? { response: new Response(null, { status: input2.primaryEvidence.status }), body: input2.primaryEvidence.body } : await sendConfigured(prepared, input2.kind === "action" ? action.effect : "read");
+    if (!primary.response.ok) return { ok: false, message: `The app returned HTTP ${primary.response.status}${input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "" : ". Inspect its state before retrying a mutation"}`, exitCode: 4, dispatched, clientRejected: primary.response.status >= 400 && primary.response.status < 500 };
+    if (!input2.primaryEvidence && input2.kind === "action" && transport.mode === "direct" && dispatchStarted) input2.onDirectBaseline?.(Math.max(0, performance.now() - dispatchStarted), JSON.stringify({ method: prepared.init.method, url: prepared.url.toString(), body: prepared.init.body ?? null }), JSON.stringify(primary.body), dispatchAt, (/* @__PURE__ */ new Date()).toISOString());
+    if (!input2.primaryEvidence && input2.onPrimary) {
+      const saved = privateEvidence({ status: primary.response.status, body: primary.body, inputs: values, generated }, knownCredentials);
+      input2.onPrimary({ ...saved.value, redacted: saved.redacted });
+    }
     if (input2.kind === "transport") {
       const selected = probe.response.path !== void 0 ? pointer2(primary.body, probe.response.path) : primary.body;
       if (probe.response.schema && !ajv3.compile(probe.response.schema)(selected)) return { ok: false, message: "Probe response does not match its declared schema", exitCode: 12, dispatched };
@@ -33036,12 +33141,17 @@ async function executeDraftVerification(input2) {
     if (executable.effect !== "read" && executable.proof) {
       const preparedProof = prepareRequest(executable.proof.request, transport, values, generated, value);
       const proof = await sendConfigured(preparedProof, "read");
-      if (!proofPassed(executable.proof, proof.body, value, values, proof.response.status)) return { ok: false, message: "The mutation was sent, but its readback did not confirm success; inspect the app before another mutation", exitCode: 12, dispatched: true };
+      input2.onReadback?.(privateEvidence(proof.body, knownCredentials).value);
+      try {
+        confirmProof(executable.proof, proof.body, value, values, proof.response.status);
+      } catch (error62) {
+        throw new ResponseContractFailure(error62 instanceof Error ? error62.message : "Readback did not confirm success");
+      }
       return { ok: true, output: value, proof: "passed", dispatched: true };
     }
     return { ok: true, output: value, proof: "not-applicable", dispatched: true };
   } catch (error62) {
-    return { ok: false, message: `${(error62 instanceof Error ? error62.message : "The test did not return").replace(/[.\s]+$/u, "")}. ${dispatched ? input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "The read did not return complete evidence" : "The request may have reached the app; inspect its state before another mutation" : "No app request was sent"}`, exitCode: dispatched || error62 instanceof BrowserControlError || ["extension-unavailable", "capture-server-unavailable", "native-host-upgrade-required"].includes(error62?.code ?? "") ? 5 : 2, dispatched };
+    return { ok: false, message: `${(error62 instanceof Error ? error62.message : "The test did not return").replace(/[.\s]+$/u, "")}. ${dispatched ? input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "The read did not return complete evidence" : "The request may have reached the app; inspect its state before another mutation" : "No app request was sent"}`, exitCode: error62 instanceof ResponseContractFailure ? 12 : dispatched || error62 instanceof BrowserControlError || ["extension-unavailable", "capture-server-unavailable", "native-host-upgrade-required"].includes(error62?.code ?? "") ? 5 : 2, dispatched };
   } finally {
     if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
     });
@@ -33497,7 +33607,7 @@ Investigate: ${prefix(`apps update ${appName}`)}
       const flags = inputs.requiredNames.map((name) => ` --${name.replaceAll("_", "-")} <chosen-value>`).join("");
       return `${doc.name} \u2014 ${doc.title}
 ${doc.description}
-Effect: ${doc.effect ?? "unknown"}. ${doc.transport ? `Connection: ${doc.transport.mode}${doc.transport.credentials.length ? `; saved fields: ${doc.transport.credentials.map((f) => f.name).join(", ")}` : "; no saved credential required"}. ` : ""}${doc.proof ? `Execution verifies ${doc.proof}; additional validation is your decision.` : ""}
+Effect: ${doc.effect ?? "unknown"}. ${doc.transport ? `Connection: ${doc.transport.mode}${doc.transport.credentials.length ? `; saved fields: ${doc.transport.credentials.map((f) => f.name).join(", ")}` : "; no saved credential required"}. ` : ""}${doc.proof ? `Discovery tested ${doc.proof}; this run checks the response without automatic readback. Use a published read when the task needs state confirmation.` : ""}
 ${inputs.required.length ? `Required inputs
 ${inputs.required.join("\n")}
 ` : "No required caller inputs.\n"}${inputs.optional.length ? `Optional inputs
@@ -33872,8 +33982,8 @@ var init_capture_derivation = __esm({
 });
 
 // src/commands/discover.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "node:fs";
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, renameSync as renameSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { createHash as createHash5, randomUUID as randomUUID9 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname6, join as join12 } from "node:path";
 async function currentResource(api, appId, kind, name) {
@@ -34028,6 +34138,7 @@ Edit: ${draft.filePath}
 Publish entity ${draft.name.split(".")[0]} and the selected connection before this action. Fill the action meaning, effect, public input descriptions and their value sources. Select a published connection under dependencies.transport; put representative values in verification.inputs. For browser discovery, declare the intended operation before recording, then capture selection will fill observed structure.
 
 ${local}When ready to test the configured request: ${command4(invocation, "discover run")}
+For a mutation already sent, repair its response/proof and check only readback: ${command4(invocation, "discover run --proof-only")}
 For browser observation: ${command4(invocation, "discover capture start")}
 `;
   if (draft.kind === "transport") {
@@ -34211,26 +34322,32 @@ async function handleDiscover(invocation, api, state, session, fetcher, root, in
       } catch (error62) {
         if (!(error62 instanceof ApiClientError && error62.status === 404)) throw error62;
       }
+      let current;
       try {
-        store.start(session.id, slug, null, slug);
+        current = store.start(session.id, slug, null, slug);
       } catch (error62) {
         return fail5(`${error62 instanceof Error ? error62.message : "Could not start discovery"}.
+Retry: ${command4(invocation, `apps new ${slug}`)}
 `);
       }
       withBaselines(root, (baselines) => baselines.startPreparation(session.id, slug));
-      return await openDraft(invocation, api, store, session, root, "app");
+      const opened = await openDraft(invocation, api, store, session, root, "app");
+      if (current.archivedDrafts) opened.stdout = `Drafts for the previous app were archived: ${current.archivedDrafts}
+${opened.stdout}`;
+      return opened;
     }
     if (invocation.key === "appsUpdate") {
       const app2 = await api.call("getApp", { params: { app: invocation.positionals[0] } });
       const selected = store.selected(session.id);
-      if (selected) return fail5(`This agent is already editing ${selected.kind} ${selected.name} for ${selected.appSlug}. Its draft is preserved. Finish, defer or discard it before opening another app. Inspect ${command4(invocation, "discover status")}.
+      if (selected && (selected.appSlug !== app2.slug || selected.appId === app2.id)) return fail5(`This agent is already editing ${selected.kind} ${selected.name} for ${selected.appSlug}. Its draft is preserved. Finish, defer or discard it before opening another app. Inspect ${command4(invocation, "discover status")}.
 `, 8);
-      store.start(session.id, app2.slug, app2.id, app2.title);
+      const current = store.start(session.id, app2.slug, app2.id, app2.title);
       withBaselines(root, (baselines) => baselines.startPreparation(session.id, app2.slug));
       const accessGuidance = app2.transports.some((item) => item.mode === "direct" && Array.isArray(item.credentials) && item.credentials.length) ? `
 For another user's key, inspect the published connection first: ${command4(invocation, `transports show ${app2.slug}`)}. If its issuance steps or permissions are missing, research the app's official access documentation, then revise that same connection with ${command4(invocation, "discover draft transport <published-name>")}. Keep its mode, destination, credential fields and probe unless the official contract changed. Draft an action only when the requested operation itself is missing.
 ` : "";
-      return ok4(`Opened ${app2.title} for changes. No draft is selected.
+      return ok4(`${current.archivedDrafts ? `Drafts for the previous app were archived: ${current.archivedDrafts}
+` : ""}Opened ${app2.title} for changes. No draft is selected.
 ${accessGuidance}First check whether the requested operation exists: ${command4(invocation, `actions search ${app2.slug} "<keyword>"`)}
 
 Create or edit one resource. ${actionNameHelp}
@@ -34310,7 +34427,7 @@ Keep for later: ${command4(invocation, "discover defer")}
 Abandon unpublished edits: ${command4(invocation, "discover discard")}
 `);
       }
-      const retained = store.retained(current.appSlug);
+      const retained = store.retained(current.appSlug).filter((draft2) => draft2.appId === current.appId);
       return ok4(`Editing ${current.title}. No draft is selected.
 ${retained.length ? `Retained files:
 ${retained.map((item) => `  ${item.kind} ${item.name}: ${item.filePath}
@@ -34430,7 +34547,8 @@ async function verificationIdentity(api, checked) {
     }
     const closure = await closureHash(executable, deps);
     const fingerprint3 = await hashJson({ executable, closure, inputs: checked.envelope?.verification?.inputs ?? {} });
-    return { executable, closure, fingerprint: fingerprint3 };
+    const primary = await hashJson({ appId: checked.draft.appId, name: checked.draft.name, effect: "effect" in action ? action.effect : null, request: "request" in action ? action.request : null, inputs: "inputs" in action ? action.inputs ? semanticSchema(action.inputs) : null : null, generated: "generated" in action ? action.generated ?? null : null, samples: checked.envelope?.verification?.inputs ?? {}, deps });
+    return { executable, closure, fingerprint: fingerprint3, primary };
   }
   const fingerprint2 = await hashJson({ executable, inputs: checked.envelope?.verification?.inputs ?? {} });
   return { executable, fingerprint: fingerprint2 };
@@ -34485,6 +34603,8 @@ File: ${draft.filePath}
       if (parsed.success && error62.status < 500) {
         store.clearPublication(draft.id);
         const issue2 = parsed.data.error;
+        if (issue2.code === "app-not-found") return fail5(`${issue2.code} \u2014 The published app is no longer accessible. Recheck its current registry identity with ${command4(invocation, `apps new ${draft.appSlug}`)}. Local drafts are preserved.
+`, cliExitForError(issue2), true);
         if (issue2.code === "version-conflict") return fail5(`The published resource changed after this draft was opened. Your edits are retained. Reconcile with ${command4(invocation, "discover rebase")}. No new version was published.
 `, 8, true);
         if (removing && issue2.code === "dependents-exist" && Array.isArray(issue2.details.dependents)) {
@@ -34577,7 +34697,7 @@ async function rebaseDraft(invocation, api, store, session) {
     const updated = applyEdits(source, modify(source, ["expectedVersion"], current.version, { formattingOptions: { insertSpaces: true, tabSize: 2 } }));
     const temporary = `${draft.filePath}.${randomUUID9()}.tmp`;
     writeFileSync8(temporary, updated, { flag: "wx", mode: 384 });
-    renameSync2(temporary, draft.filePath);
+    renameSync3(temporary, draft.filePath);
     store.setBaseVersion(draft.id, current.version);
     return ok4(`The published ${label(draft.kind)} ${draft.name} changed. The removal now targets version ${current.version}.
 Review the current definition: ${comparisonPath}
@@ -34618,28 +34738,59 @@ async function verifyDraft(invocation, api, state, store, session, fetcher, root
   const installation = state.installation();
   if (installation) await api.call("acquireSession", { params: { id: apiSessionId(installation.id, session) }, body: { purpose: "discovery", appId: draft.appId } });
   const write = Boolean(action && "effect" in action && action.effect !== "read");
-  const previous = store.attempt(draft.id);
-  if (write && previous?.fingerprint === identity2.fingerprint && previous.state === "success") {
-    const evidence = store.evidence(draft.id);
-    return evidence?.fingerprint === identity2.fingerprint ? ok4(`This configured mutation was already tested successfully. Saved output: ${evidence.resultPath}
+  const proofOnly = invocation.flags.includes("proof-only");
+  if (proofOnly && !write) return fail5("--proof-only requires a mutation draft with a saved successful primary response. No app request was sent.\n");
+  const primaryFingerprint = await hashJson({ primary: "primary" in identity2 ? identity2.primary : identity2.fingerprint, browserTab: transport.mode === "browser" ? envelope.capture?.tab || state.browserTab(session.id, draft.appId) || null : null, credential: state.useSession(session.id, draft.appId)?.credentials[action && "transport" in action ? action.transport : draft.name] ?? null });
+  const previous = store.requestAttempt(draft.id, primaryFingerprint);
+  const legacy = store.attempt(draft.id);
+  const proofCommand = command4(invocation, "discover run --proof-only");
+  const evidence = store.evidence(draft.id);
+  if (write && !proofOnly && evidence?.fingerprint === identity2.fingerprint && (previous?.state === "success" || legacy?.fingerprint === identity2.fingerprint && legacy.state === "success")) return ok4(`This configured mutation was already tested successfully. Saved output: ${evidence.resultPath}
 Review it and publish; no app request was sent.
-`) : fail5(`This configured mutation was already sent. Its result is unavailable, so do not repeat it. Inspect the app before any new test.
+`);
+  if (write && !proofOnly && (previous && previous.state !== "client-rejected" || !previous && legacy && legacy.state !== "client-rejected")) return fail5(`This mutation was already sent or may have reached the app. Do not repeat it. ${previous?.responsePath ? `Inspect the saved response: ${previous.responsePath}. After repairing response/proof, check without repeating the write: ${proofCommand}` : "No reusable response is available; inspect the app through an authorized read before choosing another test."}
 `, 12);
+  let primaryEvidence;
+  if (proofOnly) {
+    if (!previous?.responsePath) return fail5("No saved primary response matches this request, inputs and connection. No app request was sent. Restore the original test definition or inspect the app through a read; do not repeat an uncertain write.\n", 12);
+    try {
+      const saved = readFileSync8(previous.responsePath, "utf8");
+      if (createHash5("sha256").update(saved).digest("hex") !== previous.responseDigest) throw new Error("Saved response changed");
+      primaryEvidence = JSON.parse(saved);
+      if (primaryEvidence.redacted) return fail5("Saved evidence contains redacted credentials and cannot be reused as proof. No app request was sent; inspect the intended state through an authorized read.\n", 12);
+    } catch {
+      return fail5("The saved primary response is unavailable. No app request was sent; inspect the app through a read.\n", 12);
+    }
   }
-  if (write && previous?.fingerprint === identity2.fingerprint && previous.state === "possibly-dispatched") return fail5(`This configured mutation may already have reached the app. Do not repeat it. Inspect the app and use a changed, authorized test request before running again.
-`, 12);
-  if (write) store.saveAttempt(draft.id, identity2.fingerprint, "possibly-dispatched");
-  const executed = await executeDraftVerification({ api, state, session, root, fetcher, appId: draft.appId, appSlug: draft.appSlug, kind: draft.kind, name: draft.name, action, transport, commandPrefix: command4(invocation, "").trim(), browserTab: envelope.capture?.tab || void 0, probeOrigin: envelope.verification?.probeOrigin, sampleInputs: envelope.verification?.inputs ?? {}, onDispatch: () => withBaselines(root, (baselines) => baselines.closeObservation(draft.id, "dispatch")), onDirectBaseline: (durationMs, request2, response, startedAt, finishedAt) => {
+  let responsePath = previous?.responsePath;
+  let readbackPath;
+  const savePrivate = (value, name) => {
+    const directory = mkdtempSync2(join12(tmpdir2(), "apilift-discover-"));
+    const path2 = join12(directory, name);
+    writeFileSync8(path2, `${JSON.stringify(value, null, 2)}
+`, { flag: "wx", mode: 384 });
+    return path2;
+  };
+  if (write && !proofOnly) store.saveRequestAttempt(draft.id, primaryFingerprint, "possibly-dispatched");
+  const executed = await executeDraftVerification({ api, state, session, root, fetcher, appId: draft.appId, appSlug: draft.appSlug, kind: draft.kind, name: draft.name, action, transport, commandPrefix: command4(invocation, "").trim(), browserTab: envelope.capture?.tab || void 0, probeOrigin: envelope.verification?.probeOrigin, sampleInputs: envelope.verification?.inputs ?? {}, primaryEvidence, onPrimary: (saved) => {
+    responsePath = savePrivate(saved, "primary.json");
+    store.saveRequestAttempt(draft.id, primaryFingerprint, "possibly-dispatched", responsePath, createHash5("sha256").update(readFileSync8(responsePath)).digest("hex"));
+  }, onReadback: (body) => {
+    readbackPath = savePrivate(body, "readback.json");
+  }, onDispatch: () => withBaselines(root, (baselines) => baselines.closeObservation(draft.id, "dispatch")), onDirectBaseline: (durationMs, request2, response, startedAt, finishedAt) => {
     if (draft.kind === "action") withBaselines(root, (baselines) => baselines.recordDirect({ draftId: draft.id, appId: draft.appId, sessionId: session.id, durationMs, request: request2, response, invocationId, startedAt, finishedAt }));
   } });
   if (!executed.ok) {
-    if (write && !executed.dispatched) store.saveAttempt(draft.id, identity2.fingerprint, "client-rejected");
+    if (write && !proofOnly && (!executed.dispatched || executed.clientRejected)) store.saveRequestAttempt(draft.id, primaryFingerprint, "client-rejected");
     return fail5(`discover-run-failed \u2014 ${executed.message}.
 File: ${draft.filePath}
-`, executed.exitCode, executed.dispatched);
+${responsePath ? `Saved primary response and test inputs: ${responsePath}
+` : ""}${readbackPath ? `Saved readback: ${readbackPath}
+` : ""}${write && responsePath ? `Repair the response/proof, then check without repeating the write: ${proofCommand}
+` : ""}`, executed.exitCode, executed.dispatched);
   }
   withBaselines(root, (baselines) => baselines.finishPreparation(session.id, draft.appSlug, draft.appId, transport.mode));
-  if (write) store.saveAttempt(draft.id, identity2.fingerprint, "success");
+  if (write) store.saveRequestAttempt(draft.id, primaryFingerprint, "success");
   const dir = mkdtempSync2(join12(tmpdir2(), "apilift-discover-"));
   const resultPath = join12(dir, "verification.json");
   writeFileSync8(resultPath, `${JSON.stringify(executed.output, null, 2)}
@@ -34647,8 +34798,10 @@ File: ${draft.filePath}
   const prior = store.evidence(draft.id);
   const probes = draft.kind === "transport" ? [...((prior?.fingerprint === identity2.fingerprint ? prior.data.probes : []) ?? []).filter((item) => item.origin !== envelope.verification?.probeOrigin), { origin: envelope.verification.probeOrigin, verifiedAt: (/* @__PURE__ */ new Date()).toISOString() }] : void 0;
   store.saveEvidence(draft.id, identity2.fingerprint, resultPath, probes ? { probes } : { proof: executed.proof });
+  const source = readFileSync8(draft.filePath, "utf8");
+  writeFileSync8(draft.filePath, applyEdits(source, modify(source, ["verification", "review"], "pending", { formattingOptions: { insertSpaces: true, tabSize: 2 } })), { mode: 384 });
   return { stdout: `${JSON.stringify(executed.output, null, 2)}
-`, stderr: `Executed the configured ${draft.kind === "transport" ? "probe" : "action"} ${draft.name} and checked its response contract.
+`, stderr: `${proofOnly ? "Checked the saved primary response and executed only its readback" : `Executed the configured ${draft.kind === "transport" ? "probe" : "action"} ${draft.name} and checked its response contract`}.${write ? " Discovery readback confirmed the intended state." : ""}
 Saved output: ${resultPath}
 
 Review the actual objects and field meanings against the official docs or UI.
@@ -35207,6 +35360,8 @@ async function finalizeOutput(output2, sink, directory = tmpdir3()) {
       if (size() > displayBudget) {
         throw new Error("output notices exceed display budget");
       }
+      const guidance = "Search the saved file for the needed identifier or name, then extract matching records with jq or focused file reads. Do not load the entire file into context; it contains only fetched data.\n";
+      if (size() + Buffer.byteLength(guidance) <= displayBudget) stderr += guidance;
     }
     if (stdout) sink.stdout(stdout);
     if (stderr) sink.stderr(stderr);
@@ -35229,7 +35384,7 @@ var init_output = __esm({
 // ../../node_modules/.pnpm/tinyexec@1.3.1/node_modules/tinyexec/dist/main.mjs
 import { spawn as spawn2, spawnSync } from "node:child_process";
 import { cwd } from "node:process";
-import { basename, delimiter, dirname as dirname7, normalize, resolve as resolve6 } from "node:path";
+import { basename as basename2, delimiter, dirname as dirname7, normalize, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { pipeline } from "node:stream/promises";
 import { PassThrough } from "node:stream";
@@ -35299,7 +35454,7 @@ function normalizeSpawnCommand(command6, args = [], options2 = {}) {
       const separatorIndex = line.indexOf(" ");
       const path2 = separatorIndex !== -1 ? line.slice(0, separatorIndex) : line;
       const argument = separatorIndex !== -1 ? line.slice(separatorIndex + 1) : "";
-      const binary = basename(path2);
+      const binary = basename2(path2);
       shebang = binary === "env" ? argument || null : binary;
     }
   }
@@ -35627,8 +35782,8 @@ var init_main2 = __esm({
 });
 
 // src/plugin.ts
-import { createHash as createHash5 } from "node:crypto";
-import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync10, readFileSync as readFileSync9, readdirSync, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync10, readFileSync as readFileSync9, readdirSync, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname8, join as join14, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -35645,7 +35800,7 @@ function files(root, relative = "") {
   }).sort();
 }
 function digest(root) {
-  const hash4 = createHash5("sha256");
+  const hash4 = createHash6("sha256");
   for (const path2 of files(root)) hash4.update(path2).update("\0").update(readFileSync9(join14(root, path2))).update("\0");
   return hash4.digest("hex");
 }
@@ -35740,11 +35895,11 @@ function ensureAgentPlugin(agent2, env, sourceOverride) {
     writeJson(manifestPath, manifest);
     writeJson(join14(staging, markerName), { schema: "apilift.plugin-install/v1", package: "apilift", version: version2, bundleDigest });
     const backup = `${plugin}.backup-${process.pid}`;
-    if (existsSync5(plugin)) renameSync3(plugin, backup);
+    if (existsSync5(plugin)) renameSync4(plugin, backup);
     try {
-      renameSync3(staging, plugin);
+      renameSync4(staging, plugin);
     } catch (error62) {
-      if (existsSync5(backup)) renameSync3(backup, plugin);
+      if (existsSync5(backup)) renameSync4(backup, plugin);
       throw error62;
     }
     rmSync4(backup, { recursive: true, force: true });
@@ -35974,8 +36129,8 @@ var init_analytics2 = __esm({
 });
 
 // src/usage/ownership.ts
-import { mkdirSync as mkdirSync11, chmodSync as chmodSync7, existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync10, renameSync as renameSync4, unlinkSync as unlinkSync4, statSync as statSync3 } from "node:fs";
-import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
+import { mkdirSync as mkdirSync11, chmodSync as chmodSync7, existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync10, renameSync as renameSync5, unlinkSync as unlinkSync4, statSync as statSync3 } from "node:fs";
+import { createHash as createHash7, randomUUID as randomUUID12 } from "node:crypto";
 import { join as join15, dirname as dirname9, isAbsolute as isAbsolute2 } from "node:path";
 import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
 function requestCollectorTarget(root, entry2, env) {
@@ -35985,7 +36140,7 @@ function requestCollectorTarget(root, entry2, env) {
   try {
     const target = { owner: owner.id, entry: entry2, interpreter: process.execPath, fingerprint: sourceFingerprint(entry2), env: Object.fromEntries(runtimeKeys.map((key) => [key, env[key] ?? null])) };
     writeFileSync10(pending, JSON.stringify(target), { mode: 384 });
-    renameSync4(pending, targetFile(root));
+    renameSync5(pending, targetFile(root));
   } finally {
     try {
       unlinkSync4(pending);
@@ -36031,7 +36186,7 @@ var init_ownership = __esm({
     "use strict";
     ownerLifetimeMs = 6e4;
     targetFile = (root) => join15(root, "usage", "collector-target.json");
-    sourceFingerprint = (entry2) => createHash6("sha256").update(readFileSync10(entry2)).digest("hex");
+    sourceFingerprint = (entry2) => createHash7("sha256").update(readFileSync10(entry2)).digest("hex");
     runtimeKeys = ["APILIFT_URL", "CODEX_HOME", "CLAUDE_CONFIG_DIR", "APILIFT_BIN", "APILIFT_DEV_PLUGIN_ROOT"];
     ownerFile = (root) => join15(root, "usage", "collector-owner.json");
   }
@@ -38102,7 +38257,7 @@ var init_compat2 = __esm({
 });
 
 // src/native-host/registration.ts
-import { createHash as createHash7, randomUUID as randomUUID13 } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID13 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir3, platform as platform2 } from "node:os";
@@ -38249,7 +38404,7 @@ var fingerprint, hostNames, validId, posixQuote, absoluteEnv;
 var init_registration = __esm({
   "src/native-host/registration.ts"() {
     "use strict";
-    fingerprint = (bytes) => createHash7("sha256").update(bytes).digest("hex");
+    fingerprint = (bytes) => createHash8("sha256").update(bytes).digest("hex");
     hostNames = /* @__PURE__ */ new Set(["com.apilift.browser", "com.apilift.browser.dev"]);
     validId = /^[a-p]{32}$/;
     posixQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
@@ -38422,7 +38577,7 @@ var init_update = __esm({
 });
 
 // src/setup-check.ts
-import { createHash as createHash8, randomUUID as randomUUID14 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID14 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync12, realpathSync as realpathSync3, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname12, join as join18 } from "node:path";
 async function setupCheckBody(client, scopeId, value) {
@@ -38432,7 +38587,7 @@ async function setupCheckBody(client, scopeId, value) {
   if (!artifact || typeof artifact.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(artifact.sha256) || !Number.isInteger(artifact.bytes) || Number(artifact.bytes) < 1 || Number(artifact.bytes) > maxCheckBodyBytes || artifact.encoding !== "utf-8") return null;
   try {
     const bytes = await client.blob(scopeId, artifact.sha256);
-    if (!bytes || bytes.length !== artifact.bytes || createHash8("sha256").update(bytes).digest("hex") !== artifact.sha256) return null;
+    if (!bytes || bytes.length !== artifact.bytes || createHash9("sha256").update(bytes).digest("hex") !== artifact.sha256) return null;
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     return null;

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.4.39",
+  "version": "1.4.40-dev.1792138042.e8a4f6750dc5d2eba58515d30b501f737c2846dc",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.4.39",
+  "version": "1.4.40-dev.1792138042.e8a4f6750dc5d2eba58515d30b501f737c2846dc",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/dist/plugin/skills/discover/SKILL.md

@@ -17,10 +17,10 @@ For every requested action, assess current first-party operation and access docu
 
 Use `apilift discover draft <kind> [name]` for `app`, `entity`, `transport`, `browser-page`, or `action`. Its response gives a private JSONC path; edit that file. The file contains the published `definition` and local `dependencies`, `verification`, and `capture` settings. App origin is its primary UI location, not every request destination. Publish missing entity and connection resources before an action that depends on them; a browser connection also needs a published browser page. Keep credential values and recurring local context values out of every definition. Read [operation-contract.md](references/operation-contract.md) before defining an action.
 
-Check the selected file with `apilift discover check`; it sends no app request and reports independent field errors. An executable connection or action needs an explicit `apilift discover run` with representative values in `verification.inputs`; a connection also selects `verification.probeOrigin`. Inspect saved output against official documentation or observed app state and set `verification.review` to `accepted` only when its meaning is correct. A schema match or HTTP success alone is insufficient. For a mutation, assess its separate readback proof and never repeat the write merely to improve evidence. Metadata resources need no app execution. `apilift discover publish` publishes the exact selected version after its gates and sends no app request.
+Check the selected file with `apilift discover check`; it sends no app request and reports independent field errors. An executable connection or action needs an explicit `apilift discover run` with representative values in `verification.inputs`; a connection also selects `verification.probeOrigin`. Inspect saved output against official documentation or observed app state and set `verification.review` to `accepted` only when its meaning is correct. A schema match or HTTP success alone is insufficient. For a mutation, assess its separate readback proof and never repeat the write merely to improve evidence. After repairing a failed response or proof, `apilift discover run --proof-only` checks the saved response and sends only the readback. Metadata resources need no app execution. `apilift discover publish` publishes the exact selected version after its gates and sends no app request.
 
 ## Recover and finish
 
 Use `apilift discover status` to recover the selected draft, result path, recording phase, or pending publication. A lost publication response is reconciled with the exact retained `discover publish` request before editing, deferring, or discarding. `discover rebase` is for a version conflict after reviewing the current resource. `discover defer` retains owned work, `discover discard` abandons only its unpublished draft, and `discover close` leaves the app when owned in-flight work has settled. A stopped recording must be confirmed or canceled before changing drafts or tabs. Follow [recovery.md](references/recovery.md) before treating a failed route as a terminal blocker.
 
-Completion means the requested actions are published and the original authorized outcome is handled, or a specific human-only or external prerequisite is identified. Review consumer descriptions for behavior, consequences and limits: do not turn author verification or automatic runtime proofs into instructions for consumers to repeat readbacks or browser inspection. Consumers decide whether their task needs additional verification. Inspect published consumer help from a fresh session and obtain required values through its published source actions; the author's local verification inputs are not consumer coverage. Do not send an extra mutation merely to demonstrate publication. Report actual verification, authorized test state, one optional cleanup attempt if relevant, and remaining gaps.
+Completion means the requested actions are published and the original authorized outcome is handled, or a specific human-only or external prerequisite is identified. Review consumer descriptions for behavior, consequences and limits: author verification establishes publication evidence, while published execution validates its response without automatic readback. Do not prescribe routine browser inspection. Consumers decide whether their task needs additional verification. Inspect published consumer help from a fresh session and obtain required values through its published source actions; the author's local verification inputs are not consumer coverage. Do not send an extra mutation merely to demonstrate publication. Report actual verification, authorized test state, one optional cleanup attempt if relevant, and remaining gaps.

package/dist/plugin/skills/discover/references/operation-contract.md

@@ -4,13 +4,17 @@ Name a precise domain `entity.verb` for the requested outcome. Before transport
 
 An action's published `definition` describes its effect, JSON Schema `inputs`, request, response and, for a mutation, readback proof. `dependencies.transport` selects one published connection and is translated to the action's selected transport at publication. Request fields include method, URL, optional headers, query and JSON body. Use typed `{"$input":"name"}` and encoded `{input.name}` bindings for caller values. Public protocol literals are allowed; captured account identifiers, credential values and local defaults are not. Use generated bindings for fresh request identifiers, never a caller flag invented from a captured identifier.
 
-Public action descriptions state behavior, consequences and limits. Author verification establishes publication evidence; runtime proofs execute automatically; consumers decide whether their task needs additional validation. Do not instruct consumers to repeat those proofs or inspect the browser routinely.
+Public action descriptions state behavior, consequences and limits. Author verification establishes publication evidence; published execution validates the response without automatic readback. Consumers decide whether their task needs state confirmation through a published read; do not prescribe routine browser inspection.
 
 Each visible input and response field needs a semantic description; caller inputs also need synthetic examples. A value owned by the app needs a published source action with a compatible selected result path. Producers never run implicitly: the consumer runs the documented source and supplies its selected value. Do not use a prose-only dependency, a published context-variable resource, or the author's local verification value as a source. Per-app scalar `context` defaults are a consumer convenience with exact input-name matching, not an action contract or account model. Ambiguous generic names are passed explicitly.
 
 Select the useful response subtree with `response.path` when needed and validate it with `response.schema`; projected fields use paths relative to the selected subtree or array member. Preserve meaningful variants and nullable fields observed in real results. If verification reports a mismatch, inspect the selected value and correct its type or projection rather than weakening the contract to pass. Keep identity and relationship fields needed for further discovery.
 
-A mutation needs a separate read-only proof request and meaningful comparisons to the intended state. A proof failure leaves the write possibly applied; inspect state through an authorized read and never repeat a possibly sent write just to get stronger proof. For a delete, an explicit absence proof may establish success. A readback or probe using POST may declare semantic `effect: "read"`; method alone is not the effect.
+During discovery, a mutation needs a separate read-only proof request and meaningful comparisons to the intended state. A proof failure leaves the write possibly applied. Repair the proof and use `apilift discover run --proof-only` against the saved primary response; this sends only the readback. Never repeat a possibly sent write just to get stronger proof. For a delete, an explicit absence proof may establish success. A readback or probe using POST may declare semantic `effect: "read"`; method alone is not the effect.
+
+Bind a returned identifier in the proof URL with `{result./id}`, or in its JSON body/query with `{"$result":"/id"}`; result pointers refer to the projected primary result. For a nested collection, use `proof.select: {"path":"/ticket/fields","where":[{"path":"/id","result":"/id"}]}` and compare `equals` paths relative to its single matching member. The selector must match exactly one item. Check identity and the fields that establish the intended effect, not an entire server-maintained object or a fixed array position. JSON Pointers are literal, not templates. Prefer a targeted detail or search read; absence from a partial list does not prove deletion.
+
+When the task needs a few records from a large collection, look for native search, filters or a detail endpoint in documentation or observed UI requests before enumerating the list. Expose observed parameters and verify that they narrow the results. If only a full response is available, search its saved file and extract matching records or fields; do not load the entire catalog into context. Keep stable identity and summary fields in list results; inspect variable configuration only for the selected item. Preserve dynamic configuration as structured JSON with an appropriate schema, rather than enumerating catalog entries or removing validation to pass.
 
 Put representative local values in `verification.inputs`, run `apilift discover check`, then explicitly `apilift discover run`. Judge the saved output against documentation or observed UI state. Set `verification.review` to `accepted` only after that judgment and `rejected` with notes otherwise; `discover publish` does not execute the app operation again. After publication, inspect `actions show` as a fresh consumer, obtain every required value through published source actions and finish the originally authorized outcome. Do not send a second mutation merely to test publication.
 

package/dist/plugin/skills/use/SKILL.md

@@ -13,6 +13,6 @@ Use explicit flags for ambiguous values. `apilift context set <name> <scalar> --
 
 For a direct connection requiring a saved credential, use the exact `credentials list`, `use`, or `add` continuation printed for that app and connection. Selection belongs to this agent session and does not switch browser login. Only the person uses the secure credential form; never ask for a secret in chat, shell arguments, environment variables, files, or a generic dashboard field. `credentials unbound` and `attach` are explicit recovery paths after a registry reset, never an invitation to match a secret by app name or origin. Run published browser actions directly: Apilift manages its browser connection and selected tab internally. Do not run browser preflight or use agent browser tools during covered app work unless the user requests browser work or a CLI failure explicitly requires it. Follow returned CLI tab-selection commands when needed; ask the user to sign in only on the returned authentication recovery. An unusable Chrome connection is a local blocker, not evidence that the app lacks an action.
 
-Respect policy, entitlement, effect, cost, and unavailable boundaries before dispatch. A refusal does not authorize direct HTTP or a new interface around it. Do not automatically retry a mutation that may have reached the app, including one whose result or readback proof was lost. Follow the retained invocation's recovery instruction and inspect state through a documented CLI read. A successful runtime proof is already verification; decide whether the user's outcome requires additional checks, without routinely repeating it or inspecting the UI. Check returned objects against the requested domain meaning, traverse pagination and containers where needed, and do not claim completion from a title or status code alone. Read only the selected result fields needed for the decision; oversized output is saved to the path printed by the CLI.
+Respect policy, entitlement, effect, cost, and unavailable boundaries before dispatch. A refusal does not authorize direct HTTP or a new interface around it. Do not automatically retry a mutation that may have reached the app, including one whose result was lost. Follow the retained invocation's recovery instruction and inspect state through a documented CLI read. Published execution checks the response without automatic readback. Decide whether the user's outcome needs state confirmation through a published read; do not routinely inspect the UI. Check returned objects against the requested domain meaning, traverse pagination and containers where needed, and do not claim completion from a title or status code alone. Prefer published search, filter and detail actions when only a few records are needed. Read only the selected result fields needed for the decision; oversized output is saved to the path printed by the CLI. Search that file for relevant names or identifiers and extract matching records with ordinary file tools instead of loading the whole file into context. A saved response contains only fetched data, not unfetched upstream pages.
 
 If the app, action, required input source, or result field is absent, tell the discovery owner the user outcome, the precise missing consumer capability, semantic input sources, required result, official documentation supplied by the user, and which published actions must remain intact. One owner should extend the app with the `discover` skill, then the consumer should read the newly published action help and complete the original task. Ask about test-state effects only when they are outside existing authorization. `apilift apps release <app>` ends this use session and clears its local selections and defaults when the work is done.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apilift/cli",
-  "version": "1.4.39",
+  "version": "1.4.40-dev.1792138042.e8a4f6750dc5d2eba58515d30b501f737c2846dc",
   "private": false,
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
   "engines": {
     "node": ">=24.16.0 <27"
   },
-  "gitHead": "f81711fbaca403338ca7ecb4695d27d684c09fe1",
+  "gitHead": "e8a4f6750dc5d2eba58515d30b501f737c2846dc",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/egor-sergeev/apilift.git",