@formigio/fazemos-cli 0.10.67 → 0.10.74

package/dist/preflight/row5_workerLambdaWakeConfig.js

@@ -0,0 +1,113 @@
+/**
+ * F53 Row 5 — Worker Lambda wake config check.
+ *
+ * For each Lambda in PREFLIGHT_WORKER_LAMBDAS, verifies that the function's
+ * environment variables include the required wake/SSM config keys
+ * (WAKE_ALLOWLIST_PARAM, etc.) — the BUG153 gap.
+ *
+ * Uses `aws lambda get-function-configuration --function-name <name>`
+ * (shells out via execSync, consistent with existing CLI pattern).
+ *
+ * D2: enumeration is hard-coded with visible staleness (printed on every run).
+ *
+ * Fix line for row 5 FAILs: honest docs-link (no fake executable command —
+ * Ollie A3, rul_f53_fix_command_honesty).
+ */
+import { execSync } from 'child_process';
+import { PREFLIGHT_WORKER_LAMBDAS, workerEnumerationSummary } from './workerLambdas.js';
+/**
+ * Required env var keys that every dispatch-reaching worker Lambda must have.
+ */
+const REQUIRED_ENV_KEYS = ['WAKE_ALLOWLIST_PARAM', 'AUTO_WAKEABLE_ROLES_PARAM'];
+function getLambdaEnvVars(functionName, region) {
+    const regionFlag = region ? `--region ${region}` : '';
+    try {
+        const output = execSync(`aws lambda get-function-configuration --function-name "${functionName}" --query 'Environment.Variables' --output json ${regionFlag}`.trim(), { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        if (output === 'null' || !output)
+            return {};
+        return JSON.parse(output);
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? err.message ?? '');
+        if (stderr.includes('ResourceNotFoundException') ||
+            stderr.includes('Function not found') ||
+            stderr.includes('does not exist')) {
+            return 'not_found';
+        }
+        if (stderr.includes('Unable to locate credentials') ||
+            stderr.includes('ExpiredToken') ||
+            stderr.includes('NoCredentialProviders') ||
+            stderr.includes('AccessDenied') ||
+            stderr.includes('not authorized')) {
+            return 'tooling_error';
+        }
+        return 'tooling_error';
+    }
+}
+export async function checkRow5WorkerLambdaWakeConfig(opts) {
+    const { env, region } = opts;
+    const enumSummary = workerEnumerationSummary();
+    const failures = [];
+    const toolingErrors = [];
+    for (const worker of PREFLIGHT_WORKER_LAMBDAS) {
+        // Lambda function names: typically `fazemos-<env>-<suffix>`
+        const functionName = `fazemos-${env}-${worker.functionNameSuffix}`;
+        const envVars = getLambdaEnvVars(functionName, region);
+        if (envVars === 'tooling_error') {
+            toolingErrors.push(`${functionName}: AWS credential or access error`);
+            continue;
+        }
+        if (envVars === 'not_found') {
+            failures.push(`${functionName}: function not found`);
+            continue;
+        }
+        const missing = REQUIRED_ENV_KEYS.filter((k) => !envVars[k]);
+        if (missing.length > 0) {
+            failures.push(`${functionName}: missing env vars [${missing.join(', ')}]`);
+        }
+    }
+    if (toolingErrors.length > 0) {
+        return {
+            id: '5',
+            name: `worker Lambda wake config (${enumSummary})`,
+            status: 'tooling_error',
+            detail: toolingErrors.join('; '),
+            fix_command: null,
+            fix_instruction: 'Run: aws sso login --profile AdministratorAccess-047982206554',
+            enumerated: {
+                count: PREFLIGHT_WORKER_LAMBDAS.length,
+                last_audited: PREFLIGHT_WORKER_LAMBDAS[0]?.lastAudited ?? '2026-08-06',
+                entries: PREFLIGHT_WORKER_LAMBDAS.map((w) => ({ function_name_suffix: w.functionNameSuffix })),
+            },
+        };
+    }
+    if (failures.length > 0) {
+        return {
+            id: '5',
+            name: `worker Lambda wake config (${enumSummary})`,
+            status: 'fail',
+            detail: failures.join('; '),
+            fix_command: null,
+            fix_instruction: `fix: infra — see docs/guides/agent-provisioning-runbook.md §5 and BUG153. ` +
+                `Add WAKE_ALLOWLIST_PARAM + AUTO_WAKEABLE_ROLES_PARAM env vars to the Lambda via template.yaml update + deploy.`,
+            enumerated: {
+                count: PREFLIGHT_WORKER_LAMBDAS.length,
+                last_audited: PREFLIGHT_WORKER_LAMBDAS[0]?.lastAudited ?? '2026-08-06',
+                entries: PREFLIGHT_WORKER_LAMBDAS.map((w) => ({ function_name_suffix: w.functionNameSuffix })),
+            },
+        };
+    }
+    return {
+        id: '5',
+        name: `worker Lambda wake config (${enumSummary})`,
+        status: 'pass',
+        detail: `All ${PREFLIGHT_WORKER_LAMBDAS.length} enumerated worker(s) have required env vars.`,
+        fix_command: null,
+        enumerated: {
+            count: PREFLIGHT_WORKER_LAMBDAS.length,
+            last_audited: PREFLIGHT_WORKER_LAMBDAS[0]?.lastAudited ?? '2026-08-06',
+            entries: PREFLIGHT_WORKER_LAMBDAS.map((w) => ({ function_name_suffix: w.functionNameSuffix })),
+        },
+    };
+}
+//# sourceMappingURL=row5_workerLambdaWakeConfig.js.map

package/dist/preflight/row5_workerLambdaWakeConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row5_workerLambdaWakeConfig.js","sourceRoot":"","sources":["../../src/preflight/row5_workerLambdaWakeConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAExF;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;AAEhF,SAAS,gBAAgB,CACvB,YAAoB,EACpB,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,0DAA0D,YAAY,mDAAmD,UAAU,EAAE,CAAC,IAAI,EAAE,EAC5I,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACvD,IACE,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EACjC,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EACjC,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAGrD;IACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,4DAA4D;QAC5D,MAAM,YAAY,GAAG,WAAW,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAEvD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,GAAG,YAAY,kCAAkC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,sBAAsB,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,8BAA8B,WAAW,GAAG;YAClD,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,+DAA+D;YAChF,UAAU,EAAE;gBACV,KAAK,EAAE,wBAAwB,CAAC,MAAM;gBACtC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,YAAY;gBACtE,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;aAC/F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,8BAA8B,WAAW,GAAG;YAClD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,4EAA4E;gBAC5E,gHAAgH;YAClH,UAAU,EAAE;gBACV,KAAK,EAAE,wBAAwB,CAAC,MAAM;gBACtC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,YAAY;gBACtE,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;aAC/F;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG;QACP,IAAI,EAAE,8BAA8B,WAAW,GAAG;QAClD,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,OAAO,wBAAwB,CAAC,MAAM,+CAA+C;QAC7F,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE;YACV,KAAK,EAAE,wBAAwB,CAAC,MAAM;YACtC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,YAAY;YACtE,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;SAC/F;KACF,CAAC;AACJ,CAAC"}

package/dist/preflight/row6_ingest.d.ts

@@ -0,0 +1,20 @@
+/**
+ * F53 Rows 6a/6b/6c — Email ingest checks.
+ *
+ * Row 6 SKIP trigger (D4): if the project has no known_senders (empty sender-map),
+ * ingest isn't configured for it — the whole row 6 SKIPs (not fails).
+ *
+ * When row 6 runs:
+ *   6a — global email_ingest_personas table has ≥1 active row
+ *        via GET /api/email-ingest/personas (global, no project scope)
+ *   6b — project has ≥1 known_senders entry
+ *        via enriched project response email_ingest.known_senders
+ *   6c — project has intake_worksheet_id set (not null)
+ *        via enriched project response email_ingest.intake_worksheet_id
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow6Ingest(opts: {
+    orgId: string;
+    projectId: string;
+    projectSlug: string;
+}): Promise<PreflightRow[]>;

package/dist/preflight/row6_ingest.js

@@ -0,0 +1,178 @@
+/**
+ * F53 Rows 6a/6b/6c — Email ingest checks.
+ *
+ * Row 6 SKIP trigger (D4): if the project has no known_senders (empty sender-map),
+ * ingest isn't configured for it — the whole row 6 SKIPs (not fails).
+ *
+ * When row 6 runs:
+ *   6a — global email_ingest_personas table has ≥1 active row
+ *        via GET /api/email-ingest/personas (global, no project scope)
+ *   6b — project has ≥1 known_senders entry
+ *        via enriched project response email_ingest.known_senders
+ *   6c — project has intake_worksheet_id set (not null)
+ *        via enriched project response email_ingest.intake_worksheet_id
+ */
+import { api } from '../api.js';
+export async function checkRow6Ingest(opts) {
+    const { orgId, projectId, projectSlug } = opts;
+    // ── Fetch enriched project response for 6b/6c ─────────────────────────────
+    let emailIngest = null;
+    let projectFetchError = null;
+    try {
+        const projectData = (await api('GET', `/api/organizations/${orgId}/projects/${projectId}`, undefined, { noProjectHeader: true }));
+        emailIngest = projectData.project?.email_ingest ?? null;
+    }
+    catch (err) {
+        projectFetchError = err?.message ?? String(err);
+    }
+    const knownSenders = emailIngest?.known_senders ?? [];
+    // ── SKIP trigger: no known_senders → row 6 not applicable ────────────────
+    if (!projectFetchError && knownSenders.length === 0) {
+        const skipMsg = `Project '${projectSlug}' has no sender-map entries — email ingest not configured for this project.`;
+        return [
+            {
+                id: '6a',
+                name: 'email ingest personas (global)',
+                status: 'skip',
+                detail: skipMsg,
+                fix_command: null,
+            },
+            {
+                id: '6b',
+                name: 'email ingest sender map',
+                status: 'skip',
+                detail: skipMsg,
+                fix_command: null,
+            },
+            {
+                id: '6c',
+                name: 'email ingest intake worksheet',
+                status: 'skip',
+                detail: skipMsg,
+                fix_command: null,
+            },
+        ];
+    }
+    const rows = [];
+    // ── 6a — global email_ingest_personas presence ───────────────────────────
+    try {
+        const data = (await api('GET', '/api/email-ingest/personas', undefined, {
+            noProjectHeader: true,
+        }));
+        const personas = data.personas ?? [];
+        if (personas.length === 0) {
+            rows.push({
+                id: '6a',
+                name: 'email ingest personas (global)',
+                status: 'fail',
+                detail: 'email_ingest_personas table is empty (global check — no personas configured).',
+                fix_command: null,
+                fix_instruction: 'Add at least one email ingest persona via the Fazemos admin UI or API. See docs/guides/agent-provisioning-runbook.md §6a.',
+            });
+        }
+        else {
+            rows.push({
+                id: '6a',
+                name: 'email ingest personas (global)',
+                status: 'pass',
+                detail: `${personas.length} global persona(s) configured.`,
+                fix_command: null,
+            });
+        }
+    }
+    catch (err) {
+        rows.push({
+            id: '6a',
+            name: 'email ingest personas (global)',
+            status: 'tooling_error',
+            detail: `API call failed: ${err?.message ?? String(err)}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials (owner/admin required) and retry.',
+        });
+    }
+    // ── 6b — per-project known_senders ───────────────────────────────────────
+    if (projectFetchError) {
+        rows.push({
+            id: '6b',
+            name: 'email ingest sender map',
+            status: 'tooling_error',
+            detail: `Project fetch failed: ${projectFetchError}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active project, then retry.',
+        });
+    }
+    else if (emailIngest === null) {
+        // email_ingest block absent entirely — treat as no ingest configured
+        rows.push({
+            id: '6b',
+            name: 'email ingest sender map',
+            status: 'skip',
+            detail: `Project '${projectSlug}' has no email_ingest block — ingest not configured.`,
+            fix_command: null,
+        });
+    }
+    else if (knownSenders.length === 0) {
+        rows.push({
+            id: '6b',
+            name: 'email ingest sender map',
+            status: 'fail',
+            detail: `Project '${projectSlug}' has no known_senders entries.`,
+            fix_command: null,
+            fix_instruction: 'Add sender-map entries for this project via the Fazemos admin UI or API.',
+        });
+    }
+    else {
+        rows.push({
+            id: '6b',
+            name: 'email ingest sender map',
+            status: 'pass',
+            detail: `${knownSenders.length} known sender(s): ${knownSenders.slice(0, 3).join(', ')}${knownSenders.length > 3 ? ' …' : ''}`,
+            fix_command: null,
+        });
+    }
+    // ── 6c — intake worksheet ─────────────────────────────────────────────────
+    if (projectFetchError) {
+        rows.push({
+            id: '6c',
+            name: 'email ingest intake worksheet',
+            status: 'tooling_error',
+            detail: `Project fetch failed: ${projectFetchError}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active project, then retry.',
+        });
+    }
+    else if (emailIngest === null) {
+        rows.push({
+            id: '6c',
+            name: 'email ingest intake worksheet',
+            status: 'skip',
+            detail: `Project '${projectSlug}' has no email_ingest block — ingest not configured.`,
+            fix_command: null,
+        });
+    }
+    else {
+        const wsId = emailIngest.intake_worksheet_id ?? null;
+        if (!wsId) {
+            rows.push({
+                id: '6c',
+                name: 'email ingest intake worksheet',
+                status: 'fail',
+                detail: `Project '${projectSlug}' has no intake_worksheet_id set (null).`,
+                fix_command: null,
+                fix_instruction: `Set an intake worksheet for project '${projectSlug}' via the Fazemos admin UI or: ` +
+                    `fazemos projects update --intake-worksheet <worksheet-id>`,
+            });
+        }
+        else {
+            rows.push({
+                id: '6c',
+                name: 'email ingest intake worksheet',
+                status: 'pass',
+                detail: `intake_worksheet_id=${wsId}`,
+                fix_command: null,
+            });
+        }
+    }
+    return rows;
+}
+//# sourceMappingURL=row6_ingest.js.map

package/dist/preflight/row6_ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row6_ingest.js","sourceRoot":"","sources":["../../src/preflight/row6_ingest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAmBhC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAIrC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAE/C,6EAA6E;IAC7E,IAAI,WAAW,GAAgF,IAAI,CAAC;IACpG,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,GAAG,CAC5B,KAAK,EACL,sBAAsB,KAAK,aAAa,SAAS,EAAE,EACnD,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAAoB,CAAC;QACtB,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,EAAE,aAAa,IAAI,EAAE,CAAC;IAEtD,4EAA4E;IAC5E,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,YAAY,WAAW,6EAA6E,CAAC;QACrH,OAAO;YACL;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO;gBACf,WAAW,EAAE,IAAI;aAClB;YACD;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO;gBACf,WAAW,EAAE,IAAI;aAClB;YACD;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO;gBACf,WAAW,EAAE,IAAI;aAClB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,4BAA4B,EAAE,SAAS,EAAE;YACtE,eAAe,EAAE,IAAI;SACtB,CAAC,CAAqB,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,+EAA+E;gBACvF,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,2HAA2H;aAC7I,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,gCAAgC;gBAC1D,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,oBAAoB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;YACzD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,sEAAsE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,yBAAyB,iBAAiB,EAAE;YACpD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,oEAAoE;SACtF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAChC,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,WAAW,sDAAsD;YACrF,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,WAAW,iCAAiC;YAChE,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,0EAA0E;SAC5F,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,qBAAqB,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9H,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,yBAAyB,iBAAiB,EAAE;YACpD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,oEAAoE;SACtF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,WAAW,sDAAsD;YACrF,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,WAAW,CAAC,mBAAmB,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,YAAY,WAAW,0CAA0C;gBACzE,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,wCAAwC,WAAW,iCAAiC;oBACpF,2DAA2D;aAC9D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,uBAAuB,IAAI,EAAE;gBACrC,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/preflight/schema.d.ts

@@ -0,0 +1,175 @@
+/**
+ * F53 — Preflight verifier TypeScript types.
+ *
+ * schema_version "1.2" (bumped from 1.1):
+ *   - Added `indeterminate` status value (r3.2). Any --json consumer switching
+ *     exhaustively on `status` must handle this value or may break on unknown input.
+ *   - schema_version "1.1" → "1.2" signals this addition.
+ * schema_version "1.1" (bumped from 1.0):
+ *   - Added `xws_deferred` status value (r3). Any --json consumer switching
+ *     exhaustively on `status` must handle this value or may break on unknown input.
+ *   - schema_version "1.0" → "1.1" signals this addition.
+ * Structural field removals or renames bump the major version.
+ */
+export type PreflightStatus = 'pass' | 'fail' | 'skip' | 'tooling_error' | 'xws_deferred' | 'indeterminate';
+/** Row 2 FAIL variants (r3 penta-state). */
+export type Row2Variant = 'no_registration' | 'bound_elsewhere' | 'resolver_ambiguous' | 'resolver_mismatch';
+export interface ResolverCandidate {
+    id: string;
+    workspace: string;
+    role_slug: string;
+    org_id: string;
+    org_slug: string;
+    project_id: string | null;
+    project_slug: string | null;
+    active: boolean;
+}
+/**
+ * Result of a single preflight row check.
+ * `fix_command` is an executable shell string, or null when `fix_instruction` is used.
+ */
+export interface PreflightRow {
+    id: string;
+    name: string;
+    status: PreflightStatus;
+    detail: string;
+    fix_command: string | null;
+    fix_instruction?: string;
+    variant?: Row2Variant;
+    bound_to?: {
+        org_slug: string;
+        org_id: string;
+        project_slug: string | null;
+        project_id: string | null;
+    };
+    resolver_candidates?: ResolverCandidate[];
+    resolver_deterministic?: boolean;
+    /** True when the API is pre-r3 and didn't return resolver_candidates. Degrades to r2 tri-state. */
+    resolver_parity_unavailable?: boolean;
+    enumerated?: {
+        count: number;
+        last_audited: string;
+        entries: Array<{
+            function_name_suffix: string;
+        }>;
+    };
+}
+/**
+ * XWS_DEFERRED result for a whole target that is cross-workspace.
+ * Appears at the top-level for single-project cross-workspace targets,
+ * or in the cross_workspace array for fan-out shapes.
+ */
+export interface XwsDeferredResult {
+    verdict: 'xws_deferred';
+    role_slug: string;
+    cross_workspace_source: {
+        workspace_path: string;
+        registry_path: string;
+    };
+    fix_instruction: string;
+}
+export interface PreflightSummary {
+    pass: number;
+    fail: number;
+    skip: number;
+    tooling_error: number;
+    xws_deferred: number;
+    indeterminate: number;
+    ok: boolean;
+}
+/**
+ * `--json` output schema (schema_version "1.2").
+ *
+ * Single-project form: org + project + role + rows + summary present.
+ * Fan-out `<org>/<role>` form: roster + projects present; org + role present; project absent.
+ * Fan-out `<org>/<project>` form: roster + roles present; org + project present; role absent.
+ * Cross-workspace single-project: xws_deferred present; rows absent.
+ */
+export interface PreflightJsonOutput {
+    schema_version: '1.2';
+    target: string;
+    env: string;
+    exit_code: number;
+    /** Present when a tooling error prevented the run from completing. */
+    error?: string;
+    org?: {
+        slug: string;
+        id: string;
+    };
+    project?: {
+        slug: string;
+        id: string;
+    };
+    role?: string;
+    agent?: string | null;
+    workspace_repo?: string;
+    workspace_ref?: string;
+    /** Present when the whole single-project target is cross-workspace. */
+    xws_deferred?: XwsDeferredResult;
+    rows?: PreflightRow[];
+    summary?: PreflightSummary;
+    roster?: {
+        source_files: string[];
+        declared_projects?: string[];
+        undeclared_projects?: string[];
+        cross_workspace_roles?: Array<{
+            role_slug: string;
+            workspace_path: string;
+            registry_path: string;
+            fix_instruction: string;
+        }>;
+    };
+    /** Fan-out `<org>/<role>`: array of projects (declared, undeclared, xws_deferred). */
+    projects?: Array<{
+        project: {
+            slug: string;
+            id: string;
+        };
+        declared: boolean;
+        declared_cross_workspace?: boolean;
+        reason?: string;
+        role?: string;
+        agent?: string | null;
+        rows?: PreflightRow[];
+        summary?: PreflightSummary;
+        fix_instruction?: string;
+    }>;
+    /** Fan-out `<org>/<project>`: array of roles (declared, xws_deferred). */
+    roles?: Array<{
+        role: string;
+        declared: boolean;
+        declared_cross_workspace?: boolean;
+        agent?: string | null;
+        rows?: PreflightRow[];
+        summary?: PreflightSummary;
+        fix_instruction?: string;
+    }>;
+    org_summary?: {
+        total_projects?: number;
+        declared_projects?: number;
+        undeclared_projects?: number;
+        all_declared_pass?: boolean;
+        failing_projects?: string[];
+        xws_deferred_count?: number;
+    };
+    project_summary?: {
+        total_roles_declared_here?: number;
+        cross_workspace_count?: number;
+        all_declared_here_pass?: boolean;
+        failing_roles?: string[];
+    };
+}
+/**
+ * Summarize a set of row results.
+ */
+export declare function summarizeRows(rows: PreflightRow[]): PreflightSummary;
+/**
+ * Compute the exit code for a set of row results.
+ * Precedence: 2 (tooling_error) > 1 (fail) > 3 (xws_deferred | indeterminate) > 0 (all clear).
+ */
+export declare function computeExitCode(rows: PreflightRow[], hasXwsDeferred: boolean): number;
+/**
+ * Merge exit codes from multiple row-sets.
+ * Precedence: 2 > 1 > 3 > 0.
+ */
+export declare function mergeExitCodes(codes: number[]): number;

package/dist/preflight/schema.js

@@ -0,0 +1,62 @@
+/**
+ * F53 — Preflight verifier TypeScript types.
+ *
+ * schema_version "1.2" (bumped from 1.1):
+ *   - Added `indeterminate` status value (r3.2). Any --json consumer switching
+ *     exhaustively on `status` must handle this value or may break on unknown input.
+ *   - schema_version "1.1" → "1.2" signals this addition.
+ * schema_version "1.1" (bumped from 1.0):
+ *   - Added `xws_deferred` status value (r3). Any --json consumer switching
+ *     exhaustively on `status` must handle this value or may break on unknown input.
+ *   - schema_version "1.0" → "1.1" signals this addition.
+ * Structural field removals or renames bump the major version.
+ */
+/**
+ * Summarize a set of row results.
+ */
+export function summarizeRows(rows) {
+    const counts = { pass: 0, fail: 0, skip: 0, tooling_error: 0, xws_deferred: 0, indeterminate: 0 };
+    for (const r of rows) {
+        if (r.status === 'pass')
+            counts.pass++;
+        else if (r.status === 'fail')
+            counts.fail++;
+        else if (r.status === 'skip')
+            counts.skip++;
+        else if (r.status === 'tooling_error')
+            counts.tooling_error++;
+        else if (r.status === 'xws_deferred')
+            counts.xws_deferred++;
+        else if (r.status === 'indeterminate')
+            counts.indeterminate++;
+    }
+    return { ...counts, ok: counts.fail === 0 && counts.tooling_error === 0 };
+}
+/**
+ * Compute the exit code for a set of row results.
+ * Precedence: 2 (tooling_error) > 1 (fail) > 3 (xws_deferred | indeterminate) > 0 (all clear).
+ */
+export function computeExitCode(rows, hasXwsDeferred) {
+    const summary = summarizeRows(rows);
+    if (summary.tooling_error > 0)
+        return 2;
+    if (summary.fail > 0)
+        return 1;
+    if (hasXwsDeferred || summary.xws_deferred > 0 || summary.indeterminate > 0)
+        return 3;
+    return 0;
+}
+/**
+ * Merge exit codes from multiple row-sets.
+ * Precedence: 2 > 1 > 3 > 0.
+ */
+export function mergeExitCodes(codes) {
+    if (codes.includes(2))
+        return 2;
+    if (codes.includes(1))
+        return 1;
+    if (codes.includes(3))
+        return 3;
+    return 0;
+}
+//# sourceMappingURL=schema.js.map

package/dist/preflight/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/preflight/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4JH;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAClC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACvC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACvC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,aAAa,EAAE,CAAC;aACzD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;YAAE,MAAM,CAAC,YAAY,EAAE,CAAC;aACvD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB,EAAE,cAAuB;IAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,cAAc,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/preflight/workerLambdas.d.ts

@@ -0,0 +1,22 @@
+/**
+ * F53 D2 — Hard-coded enumeration of dispatch-reaching worker Lambdas.
+ *
+ * v1 set: one entry, the email-ingest parse worker (BUG153 audit sweep, 2026-08-06).
+ *
+ * When adding a new dispatch-reaching Lambda:
+ *   1. Append to PREFLIGHT_WORKER_LAMBDAS below.
+ *   2. Update lastAudited to today.
+ *   3. The worker must also be in WAKE_ALLOWLIST_PARAM + AUTO_WAKEABLE_ROLES_PARAM (row 4).
+ */
+export interface WorkerLambdaEntry {
+    /** Suffix of the Lambda function name (without env prefix). */
+    functionNameSuffix: string;
+    /** ISO date of the last audit sweep that confirmed this is the complete set. */
+    lastAudited: string;
+    note: string;
+}
+export declare const PREFLIGHT_WORKER_LAMBDAS: WorkerLambdaEntry[];
+/**
+ * Human-readable enumeration summary for row 5 output.
+ */
+export declare function workerEnumerationSummary(): string;

package/dist/preflight/workerLambdas.js

@@ -0,0 +1,25 @@
+/**
+ * F53 D2 — Hard-coded enumeration of dispatch-reaching worker Lambdas.
+ *
+ * v1 set: one entry, the email-ingest parse worker (BUG153 audit sweep, 2026-08-06).
+ *
+ * When adding a new dispatch-reaching Lambda:
+ *   1. Append to PREFLIGHT_WORKER_LAMBDAS below.
+ *   2. Update lastAudited to today.
+ *   3. The worker must also be in WAKE_ALLOWLIST_PARAM + AUTO_WAKEABLE_ROLES_PARAM (row 4).
+ */
+export const PREFLIGHT_WORKER_LAMBDAS = [
+    {
+        functionNameSuffix: 'email-ingest-parse-worker',
+        lastAudited: '2026-08-06',
+        note: 'BUG153 landed 2026-08-06 — parse worker is the only dispatch-reaching worker per audit sweep.',
+    },
+];
+/**
+ * Human-readable enumeration summary for row 5 output.
+ */
+export function workerEnumerationSummary() {
+    const lastAudited = PREFLIGHT_WORKER_LAMBDAS.reduce((acc, e) => (e.lastAudited > acc ? e.lastAudited : acc), '0000-00-00');
+    return `enumerated set: ${PREFLIGHT_WORKER_LAMBDAS.length} worker(s), last audited ${lastAudited}`;
+}
+//# sourceMappingURL=workerLambdas.js.map

package/dist/preflight/workerLambdas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerLambdas.js","sourceRoot":"","sources":["../../src/preflight/workerLambdas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,CAAC,MAAM,wBAAwB,GAAwB;IAC3D;QACE,kBAAkB,EAAE,2BAA2B;QAC/C,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,+FAA+F;KACtG;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EACvD,YAAY,CACb,CAAC;IACF,OAAO,mBAAmB,wBAAwB,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC;AACrG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formigio/fazemos-cli",
-  "version": "0.10.67",
+  "version": "0.10.74",
   "description": "CLI for the Fazemos Team Accomplishment Platform",
   "type": "module",
   "license": "MIT",