@impetik/xeer-mcp 0.2.30 → 0.2.32

package/README.md

@@ -76,7 +76,7 @@ The generated registry is the complete MCP tool and exclusion surface:
 | `xeer_dev_stop` | `dev.stop` | `author` / `operator` | Stop a local development session and release its lease. | `sessionId?`: `string`<br>`cursor?`: `integer` [0..9007199254740991]; default `0` | `run-local` | writes; idempotent; reversible; non-destructive | `none` | `xeer.dev.v0` | none |
 | `xeer_diagnostics` | `diagnostics` | `author` / `operator` | Explain one emitted diagnostic code. | `code`: `string` | none | read-only; idempotent; reversible; non-destructive | `none` | `xeer.command.v0` | none |
 
-**CLI actions intentionally excluded from MCP (37).**
+**CLI actions intentionally excluded from MCP (39).**
 
 | CLI action | Action | Summary | Effects | Safety | Path policy | Output | Why no MCP tool |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -116,7 +116,9 @@ The generated registry is the complete MCP tool and exclusion surface:
 | `xeer actions` | `actions` | Print the machine-readable action and safety catalogue. | none | read-only; idempotent; reversible; non-destructive | `none` | `xeer.command.v0` | Not exposed through MCP v0; use the CLI deliberately. |
 | `xeer db tables` | `db.tables` | List the tables of a running application database. | `read-state` | read-only; idempotent; reversible; non-destructive | `project-relative` | `xeer.command.v0` | Not exposed through MCP v0; use the CLI deliberately. |
 | `xeer db schema` | `db.schema` | Print the declared schema of a running application database. | `read-state` | read-only; idempotent; reversible; non-destructive | `project-relative` | `xeer.command.v0` | Not exposed through MCP v0; use the CLI deliberately. |
-| `xeer db exec` | `db.exec` | Run one SQL statement against a running application database. | `read-state`<br>`write-state` | writes; non-idempotent; irreversible; non-destructive | `project-relative` | `xeer.command.v0` | Destructive state replacement requires an explicit CLI invocation. |
+| `xeer db exec` | `db.exec` | Run SQL against a running or deployed application database. | `read-state`<br>`write-state`<br>`network-read`<br>`network-write` | writes; non-idempotent; irreversible; destructive | `project-relative` | `xeer.command.v0` | Destructive state replacement requires an explicit CLI invocation. |
+| `xeer db bookmark` | `db.bookmark` | Print the current Time Travel bookmark of a deployed application database. | `network-read` | read-only; idempotent; reversible; non-destructive | `project-relative` | `xeer.command.v0` | Not exposed through MCP v0; use the CLI deliberately. |
+| `xeer db restore` | `db.restore` | Restore a deployed application database to a bookmark or a time. | `network-write`<br>`write-state` | writes; non-idempotent; reversible; destructive | `project-relative` | `xeer.command.v0` | Destructive state replacement requires an explicit CLI invocation. |
 <!-- xeer-action-reference:end -->
 
 Every tool returns `{ protocol: "xeer.mcp-result.v0", action, ok, result?, error? }` both as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impetik/xeer-mcp",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "type": "module",
   "description": "Model Context Protocol server for Xeer project context, diagnostics, scaffold, check, test, dev, build, and preview deployment.",
   "license": "MIT",
@@ -47,7 +47,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.0.10",
-    "@impetik/xeer": "0.2.30"
+    "@impetik/xeer": "0.2.32"
   },
   "devDependencies": {
     "@types/node": "^24.1.0"

package/vendor/spec/actions.d.ts

@@ -1265,15 +1265,52 @@ declare const actions: readonly [{
 }, {
     readonly id: "db.exec";
     readonly command: readonly ["db", "exec"];
-    readonly summary: "Run one SQL statement against a running application database.";
-    readonly usage: readonly ["db exec [directory] <sql> [--state <dev|preview>] [--write] [--json]"];
+    readonly summary: "Run SQL against a running or deployed application database.";
+    readonly description: string;
+    readonly usage: readonly ["db exec [directory] <sql> [--state <dev|preview>] [--write] [--json]", "db exec [directory] <sql> --remote --environment <prod|preview> [--param <value>]... [--control-url <url>] [--json]", "db exec [directory] --remote --environment <prod|preview> --file <batch.json> [--control-url <url>] [--json]"];
     readonly helpOrder: 340;
     readonly outputProtocol: "xeer.command.v0";
-    readonly effects: readonly ["read-state", "write-state"];
+    readonly effects: readonly ["read-state", "write-state", "network-read", "network-write"];
     readonly idempotent: false;
     readonly reversible: false;
+    readonly destructive: true;
+    readonly humanPrerequisites: readonly ["Locally, a human must pass --write before any statement that modifies rows.", string];
+    readonly pathPolicy: "project-relative";
+    readonly surfaces: {
+        readonly cli: true;
+        readonly mcpExclusion: "Destructive state replacement requires an explicit CLI invocation.";
+    };
+}, {
+    readonly id: "db.bookmark";
+    readonly command: readonly ["db", "bookmark"];
+    readonly summary: "Print the current Time Travel bookmark of a deployed application database.";
+    readonly description: string;
+    readonly usage: readonly ["db bookmark [directory] --remote --environment <prod|preview> [--control-url <url>] [--json]"];
+    readonly helpOrder: 345;
+    readonly outputProtocol: "xeer.command.v0";
+    readonly effects: readonly ["network-read"];
+    readonly idempotent: true;
+    readonly reversible: true;
     readonly destructive: false;
-    readonly humanPrerequisites: readonly ["A human must pass --write before any statement that modifies rows."];
+    readonly humanPrerequisites: readonly [string];
+    readonly pathPolicy: "project-relative";
+    readonly surfaces: {
+        readonly cli: true;
+        readonly mcpExclusion: "Not exposed through MCP v0; use the CLI deliberately.";
+    };
+}, {
+    readonly id: "db.restore";
+    readonly command: readonly ["db", "restore"];
+    readonly summary: "Restore a deployed application database to a bookmark or a time.";
+    readonly description: string;
+    readonly usage: readonly ["db restore [directory] --remote --environment <prod|preview> --to <bookmark|time> [--control-url <url>] [--json]"];
+    readonly helpOrder: 346;
+    readonly outputProtocol: "xeer.command.v0";
+    readonly effects: readonly ["network-write", "write-state"];
+    readonly idempotent: false;
+    readonly reversible: true;
+    readonly destructive: true;
+    readonly humanPrerequisites: readonly [string];
     readonly pathPolicy: "project-relative";
     readonly surfaces: {
         readonly cli: true;

package/vendor/spec/actions.js

@@ -17,7 +17,7 @@ export const XEER_CLI_COMMAND_GROUPS = Object.freeze([
     { command: 'state', summary: 'Inspect running application state or reset local state.' },
     { command: 'env', summary: 'Manage application environment values and secrets.' },
     { command: 'token', summary: 'Manage service builder tokens.' },
-    { command: 'db', summary: 'Inspect and query a running application database.' },
+    { command: 'db', summary: 'Inspect, query and restore a running or deployed application database.' },
 ]);
 const NOT_EXPOSED_V0 = 'Not exposed through MCP v0; use the CLI deliberately.';
 const HUMAN_IDENTITY = 'Human identity and project ownership decisions are not delegated through MCP.';
@@ -771,16 +771,48 @@ const actions = [
     {
         // Not idempotent and not reversible, because `--write` admits UPDATE and DELETE and the action
         // catalogue describes what an invocation may do rather than what a particular statement does.
-        // `destructive: false` all the same: a destructive action here is one that discards state
-        // wholesale, and this refuses DDL outright — the worst a statement can do is edit rows the
-        // schema still constrains.
-        id: 'db.exec', command: ['db', 'exec'], summary: 'Run one SQL statement against a running application database.',
-        usage: ['db exec [directory] <sql> [--state <dev|preview>] [--write] [--json]'], helpOrder: 340,
-        outputProtocol: 'xeer.command.v0', effects: ['read-state', 'write-state'], idempotent: false,
-        reversible: false, destructive: false,
-        humanPrerequisites: ['A human must pass --write before any statement that modifies rows.'],
+        // Destructive because `--remote` runs any SQL the owner sends, DDL included: on a deployed
+        // database the owner may do anything to their own data, and `db restore` is the undo.
+        id: 'db.exec', command: ['db', 'exec'], summary: 'Run SQL against a running or deployed application database.',
+        description: 'Locally (`--state`), runs one statement against a running `xeer dev` or `xeer preview`: '
+            + 'reads by default, row writes with --write, and never DDL. With --remote it runs as the owner '
+            + 'against the D1 database of a deployed framework project, in the --environment named (there is no '
+            + 'default), through the control plane: any SQL, one statement or a --file batch (a JSON array of '
+            + '{"sql","params"}) that runs as one transaction, so a failing statement rolls every statement '
+            + 'back. Undo with `xeer db restore --remote`.',
+        usage: ['db exec [directory] <sql> [--state <dev|preview>] [--write] [--json]',
+            'db exec [directory] <sql> --remote --environment <prod|preview> [--param <value>]... [--control-url <url>] [--json]',
+            'db exec [directory] --remote --environment <prod|preview> --file <batch.json> [--control-url <url>] [--json]'],
+        helpOrder: 340,
+        outputProtocol: 'xeer.command.v0', effects: ['read-state', 'write-state', 'network-read', 'network-write'],
+        idempotent: false, reversible: false, destructive: true,
+        humanPrerequisites: ['Locally, a human must pass --write before any statement that modifies rows.',
+            BUILDER_CREDENTIAL],
         pathPolicy: 'project-relative', surfaces: { cli: true, mcpExclusion: DESTRUCTIVE_STATE },
     },
+    {
+        id: 'db.bookmark', command: ['db', 'bookmark'],
+        summary: 'Print the current Time Travel bookmark of a deployed application database.',
+        description: 'The bookmark names the database as it is now; `xeer db restore --remote --to <bookmark>` '
+            + 'returns to it for 30 days (7 on the Workers Free plan).',
+        usage: ['db bookmark [directory] --remote --environment <prod|preview> [--control-url <url>] [--json]'], helpOrder: 345,
+        outputProtocol: 'xeer.command.v0', effects: ['network-read'], idempotent: true, reversible: true,
+        destructive: false, humanPrerequisites: [BUILDER_CREDENTIAL], pathPolicy: 'project-relative',
+        surfaces: { cli: true, mcpExclusion: NOT_EXPOSED_V0 },
+    },
+    {
+        // Reversible although destructive: the answer carries previousBookmark, and restoring to it
+        // brings back everything this restore discarded.
+        id: 'db.restore', command: ['db', 'restore'],
+        summary: 'Restore a deployed application database to a bookmark or a time.',
+        description: 'Replaces the whole database in --environment with its state at the bookmark or ISO time '
+            + '(with a zone) given to --to. Every later write is discarded, including the owner writes; uploaded '
+            + 'media, code and sessions are not touched. The previousBookmark in the result undoes the restore.',
+        usage: ['db restore [directory] --remote --environment <prod|preview> --to <bookmark|time> [--control-url <url>] [--json]'],
+        helpOrder: 346, outputProtocol: 'xeer.command.v0', effects: ['network-write', 'write-state'], idempotent: false,
+        reversible: true, destructive: true, humanPrerequisites: [BUILDER_CREDENTIAL], pathPolicy: 'project-relative',
+        surfaces: { cli: true, mcpExclusion: DESTRUCTIVE_STATE },
+    },
 ];
 export const XEER_ACTIONS = Object.freeze(actions);
 export function actionDefinition(id) {

package/vendor/spec/admin-sql.js

@@ -24,8 +24,13 @@
  * change enforcement at all.
  */
 import { ADMIN_PROTOCOL } from './admin.js';
-/** Statements that only read. `EXPLAIN` is here because it plans a statement without running it. */
-const READ_VERBS = new Set(['SELECT', 'WITH', 'VALUES', 'EXPLAIN']);
+/**
+ * Statements that only read. A strict allowlist of leading verbs: `WITH` and `EXPLAIN` are not here
+ * because the verb after them decides what they do — `WITH x AS (SELECT 1) UPDATE posts …` writes
+ * without `--write`, and `EXPLAIN PRAGMA ignore_check_constraints=ON` sets the pragma while the
+ * statement is prepared.
+ */
+const READ_VERBS = new Set(['SELECT', 'VALUES']);
 const WRITE_VERBS = new Set(['INSERT', 'UPDATE', 'DELETE', 'REPLACE']);
 /**
  * Pragmas that only report. An allowlist rather than a denylist, because the case that must never

package/vendor/spec/diagnostics.js

@@ -357,6 +357,12 @@ export const DIAGNOSTIC_DEFINITIONS = [
     define('XE1841', 'The running server published no admin session secret, so its database surface is '
         + 'not reachable. The secret is minted per run and shared through the state lease.', 'Restart the server with a build that publishes one; a server older than this CLI does not.', ['db']),
     define('XE1842', 'The server answered the database request with a protocol this CLI does not know.', 'The CLI and the running server are different versions. Restart the server from this checkout.', ['db']),
+    define('XE1843', 'The control plane refused, or did not complete, a `xeer db --remote` request.', 'Read `message` and `hint`: they carry the refusal verbatim. `sql_error` means the whole batch was '
+        + 'rolled back; an unknown outcome means it may have been applied, so read before running writes again.', ['db']),
+    define('XE1844', 'The control plane returned a database response the CLI will not trust.', 'Retry the read; if it persists the control plane and CLI versions are incompatible.', ['db']),
+    define('XE1845', 'A `xeer db --remote` invocation is wrong: no --remote, no --environment, a --state '
+        + 'alongside it, an unreadable --file, a bad --to, or no linked application.', 'Pass --remote --environment prod|preview in the project directory. A --file batch is a JSON array '
+        + 'of {"sql","params"}; --to takes a bookmark or an ISO time with a zone.', ['db']),
     define('XE1821', 'The export file could not be read or written.', 'Read `message`: usually a missing path or permissions. `--out` creates parent directories.', ['export', 'import']),
     define('XE1822', 'The document is not a usable xeer.state-export.v0 export: wrong protocol, or it '
         + 'contradicts itself (counts, schema, or an encoded value).', 'Import the unmodified file `xeer export --out` produced. `detail.code` names the exact defect.', ['export', 'import']),

package/vendor/spec/template-distribution.d.ts

@@ -34,6 +34,15 @@ export declare const templateDistributionEntrySchema: z.ZodObject<{
         url: z.ZodString;
         sha256: z.ZodString;
     }, z.core.$strict>;
+    admin: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        signIn: z.ZodEnum<{
+            code: "code";
+            owner: "owner";
+        }>;
+        codeSecret: z.ZodOptional<z.ZodString>;
+        tasks: z.ZodString;
+    }, z.core.$strict>>;
     author: z.ZodObject<{
         name: z.ZodString;
         url: z.ZodOptional<z.ZodString>;
@@ -66,6 +75,9 @@ export declare const templateDistributionEntrySchema: z.ZodObject<{
             astro: "astro";
             sveltekit: "sveltekit";
         }>>;
+        integration: z.ZodOptional<z.ZodEnum<{
+            emdash: "emdash";
+        }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type TemplateDistributionEntryV0 = z.infer<typeof templateDistributionEntrySchema>;
@@ -87,6 +99,15 @@ export declare const templateDistributionCatalogSchema: z.ZodObject<{
             url: z.ZodString;
             sha256: z.ZodString;
         }, z.core.$strict>;
+        admin: z.ZodOptional<z.ZodObject<{
+            path: z.ZodString;
+            signIn: z.ZodEnum<{
+                code: "code";
+                owner: "owner";
+            }>;
+            codeSecret: z.ZodOptional<z.ZodString>;
+            tasks: z.ZodString;
+        }, z.core.$strict>>;
         author: z.ZodObject<{
             name: z.ZodString;
             url: z.ZodOptional<z.ZodString>;
@@ -119,6 +140,9 @@ export declare const templateDistributionCatalogSchema: z.ZodObject<{
                 astro: "astro";
                 sveltekit: "sveltekit";
             }>>;
+            integration: z.ZodOptional<z.ZodEnum<{
+                emdash: "emdash";
+            }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/vendor/spec/template-distribution.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { FRAMEWORK_NAMES } from './scaffold-names.js';
-import { checkTemplateMetadataUniqueness, templateAltTextSchema, templateIdentityShape, templateMetadataShape, templateSlugSchema, } from './template.js';
+import { FRAMEWORK_NAMES, INTEGRATION_NAMES } from './scaffold-names.js';
+import { checkTemplateMetadataUniqueness, templateAdminPathSchema, templateAdminTasksSchema, templateAltTextSchema, templateIdentityShape, templateMetadataShape, templateSlugSchema, } from './template.js';
 export const TEMPLATE_DISTRIBUTION_CATALOG_FORMAT = 'xeer.template-distribution-catalog.v0';
 export const TEMPLATE_DISTRIBUTION_CATALOG_SCHEMA_URL = 'https://docs.xeer.run/template-distribution-catalog-v0.schema.json';
 /** Exact semantic version: no range operator, no `v` prefix, no wildcard. */
@@ -40,7 +40,12 @@ export const TEMPLATE_PROJECT_KINDS = ['xeer-application', 'framework'];
 const templateProjectSchema = z.strictObject({
     kind: z.enum(TEMPLATE_PROJECT_KINDS),
     framework: z.enum(FRAMEWORK_NAMES).optional(),
+    /** Copied from the framework configuration; EmDash is the only integration, and it runs on Astro. */
+    integration: z.enum(INTEGRATION_NAMES).optional(),
 }).superRefine((project, ctx) => {
+    if (project.integration === 'emdash' && project.framework !== 'astro') {
+        ctx.addIssue({ code: 'custom', path: ['integration'], message: 'the emdash integration runs on the astro framework' });
+    }
     if ((project.framework !== undefined) === (project.kind === 'framework'))
         return;
     ctx.addIssue({
@@ -51,6 +56,17 @@ const templateProjectSchema = z.strictObject({
             : `only a framework project names a framework; a ${project.kind} project does not`,
     });
 });
+/**
+ * The Site admin an entry resolves to: an owner dashboard unlocked by one of the entry's invite codes
+ * (`code`), or EmDash's admin, which the owner opens through the platform's owner sign-in (`owner`).
+ * Authored in `template.json` for the first, derived from the EmDash integration for the second.
+ */
+const distributedAdminSchema = z.strictObject({
+    path: templateAdminPathSchema,
+    signIn: z.enum(['code', 'owner']),
+    codeSecret: z.string().optional(),
+    tasks: templateAdminTasksSchema,
+});
 /**
  * One published template. The authored metadata is copied verbatim from `template.json`; everything
  * else is produced by the release job that packed, deployed, and verified this exact artifact.
@@ -77,7 +93,29 @@ export const templateDistributionEntrySchema = z.strictObject({
     /** Release version of the template artifact itself, independent of the platform version. */
     artifactVersion: exactVersion,
     sourceArchive: sourceArchiveSchema,
-}).superRefine(checkTemplateMetadataUniqueness);
+    /** Absent for a template without an admin, and on every entry published before the field existed. */
+    admin: distributedAdminSchema.optional(),
+}).superRefine((entry, ctx) => {
+    checkTemplateMetadataUniqueness(entry, ctx);
+    const { admin } = entry;
+    const emdash = entry.project?.integration === 'emdash';
+    if (emdash && admin?.signIn !== 'owner') {
+        ctx.addIssue({ code: 'custom', path: ['admin'], message: 'an emdash project carries the owner admin' });
+    }
+    if (!admin)
+        return;
+    if (admin.signIn === 'owner' && !emdash) {
+        ctx.addIssue({ code: 'custom', path: ['admin', 'signIn'], message: 'the owner sign-in belongs to an emdash project' });
+    }
+    if ((admin.codeSecret !== undefined) !== (admin.signIn === 'code')) {
+        ctx.addIssue({ code: 'custom', path: ['admin', 'codeSecret'],
+            message: 'a code admin names its codeSecret, and only a code admin does' });
+    }
+    else if (admin.codeSecret !== undefined && !entry.requiredSecrets.some((secret) => secret.name === admin.codeSecret)) {
+        ctx.addIssue({ code: 'custom', path: ['admin', 'codeSecret'],
+            message: 'admin codeSecret must name one of the entry requiredSecrets' });
+    }
+});
 /**
  * Versioned distribution catalog published atomically after a platform release. Entries are keyed by
  * template id, sorted by codepoint so a regenerated catalog is byte-stable, and a template with no

package/vendor/spec/template.d.ts

@@ -3,6 +3,13 @@ export declare const TEMPLATE_FORMAT: "xeer.template.v0";
 export declare const TEMPLATE_MANIFEST_SCHEMA_URL: "https://docs.xeer.run/template-v0.schema.json";
 /** Catalog identifier shape shared by template directory names and categories. */
 export declare const templateSlugSchema: z.ZodString;
+/**
+ * Where a template's own admin lives, relative to the site's origin: one absolute path, nothing that
+ * could leave the origin (`//host`) or carry a query or fragment.
+ */
+export declare const templateAdminPathSchema: z.ZodString;
+/** What the owner does in the admin, shown next to its button: one short sentence. */
+export declare const templateAdminTasksSchema: z.ZodString;
 /** Alt text carried by a gallery image in either the source or the distribution catalog. */
 export declare const templateAltTextSchema: z.ZodString;
 /**
@@ -50,6 +57,12 @@ export declare function checkTemplateMetadataUniqueness(metadata: {
     }[];
 }, ctx: z.RefinementCtx): void;
 export declare const templateManifestSchema: z.ZodObject<{
+    admin: z.ZodOptional<z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        signIn: z.ZodOptional<z.ZodLiteral<"code">>;
+        codeSecret: z.ZodOptional<z.ZodString>;
+        tasks: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     author: z.ZodObject<{
         name: z.ZodString;
         url: z.ZodOptional<z.ZodString>;

package/vendor/spec/template.js

@@ -18,6 +18,27 @@ const requiredSecretSchema = z.strictObject({
     name: environmentName,
     description: trimmed(200),
 });
+/**
+ * Where a template's own admin lives, relative to the site's origin: one absolute path, nothing that
+ * could leave the origin (`//host`) or carry a query or fragment.
+ */
+export const templateAdminPathSchema = z.string().max(200)
+    .regex(/^\/(?!\/)[^\s?#\\]*$/u, 'admin path must be a plain site path starting with one "/"');
+/** What the owner does in the admin, shown next to its button: one short sentence. */
+export const templateAdminTasksSchema = trimmed(140)
+    .regex(/^[^.!?]*(?:[.!?](?! )[^.!?]*)*\.$/u, 'admin tasks must be one short sentence ending in a full stop');
+/**
+ * The Site admin a template offers. An application template authors all of it: the path of its owner
+ * dashboard, and the invite code (one of its `requiredSecrets`) that unlocks it. An EmDash template's
+ * admin is derived from its integration by the catalog, so there only `tasks` may be authored; which
+ * of the two applies is known only to the catalog generator, which reads the root contract.
+ */
+const templateAdminSchema = z.strictObject({
+    path: templateAdminPathSchema.optional(),
+    signIn: z.literal('code').optional(),
+    codeSecret: environmentName.optional(),
+    tasks: templateAdminTasksSchema.optional(),
+});
 /** Alt text carried by a gallery image in either the source or the distribution catalog. */
 export const templateAltTextSchema = trimmed(200);
 const screenshotSchema = z.strictObject({
@@ -70,7 +91,21 @@ export const templateManifestSchema = z.strictObject({
     ...templateMetadataShape,
     screenshots: z.array(screenshotSchema).min(1).max(8),
     ...templateIdentityShape,
-}).superRefine(checkTemplateMetadataUniqueness);
+    admin: templateAdminSchema.optional(),
+}).superRefine((manifest, ctx) => {
+    checkTemplateMetadataUniqueness(manifest, ctx);
+    const { admin } = manifest;
+    if (!admin)
+        return;
+    const code = [admin.path, admin.signIn, admin.codeSecret];
+    if (code.some((value) => value !== undefined) && code.some((value) => value === undefined)) {
+        ctx.addIssue({ code: 'custom', path: ['admin'], message: 'admin needs path, signIn, and codeSecret together' });
+    }
+    if (admin.codeSecret !== undefined && !manifest.requiredSecrets.some((secret) => secret.name === admin.codeSecret)) {
+        ctx.addIssue({ code: 'custom', path: ['admin', 'codeSecret'],
+            message: 'admin codeSecret must name one of the template requiredSecrets' });
+    }
+});
 const generatedTemplateManifestJsonSchema = z.toJSONSchema(templateManifestSchema);
 const generatedProperties = generatedTemplateManifestJsonSchema.properties;
 export const templateManifestJsonSchema = Object.freeze({