@open-mercato/cli 0.7.1-develop.7179.1.e8c03264b6 → 0.7.1-develop.7181.1.702cedc42c

package/dist/agentic/guides/upstream/BACKWARD_COMPATIBILITY.md

@@ -415,3 +415,18 @@ Issue #3852 removed the non-cryptographic passkey verification shape from `Passk
 **Why the deprecation protocol does not apply.** The protocol exists to give downstream authors a bridge release. Here the request shape being removed *is* the vulnerability: both values it compared are disclosed by the server, so a bridge would keep the passkey second factor bypassable for a minor version in both login MFA and sudo step-up. A security fix that leaves the hole open is not a fix.
 
 **Migration path.** Send `startAuthentication()` output as `payload.response`. The first-party `PasskeyChallengeVerify` component already does, so shipped UIs are unaffected. Credentials enrolled through the setup path's client-supplied `publicKey` shortcut are **not** reliably rendered unusable by this change — depending on what the client supplied, such a row holds either a key nobody can sign with or a keypair the enroller controls, and the second kind produces assertions this change accepts. That shortcut is a separate open surface (#5296); operator-facing remediation is in [`UPGRADE_NOTES.md`](UPGRADE_NOTES.md).
+
+## Data Sync Start Control Applicability (2026-09-02)
+
+[`.ai/specs/2026-09-02-data-sync-adapter-start-controls.md`](.ai/specs/2026-09-02-data-sync-adapter-start-controls.md) lets a `DataSyncAdapter` declare, per entity type, which of the Data Sync dashboard's manual-start controls apply, so the dashboard stops offering controls that cannot mean anything for the selected entity type. **All changes are additive** and pass the contract-surface checks above:
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| Type definitions (§2) | New optional method `DataSyncAdapter.supportsStartControl?(control, entityType)`; new exported type `DataSyncStartControl = 'fullSync' \| 'batchSize'` | ✓ ADDITIVE (optional member, new type — same shape as the `persistsSharedCursor` and `runParameters` additions before it) |
+| Import paths (§4) | New module `data_sync/lib/start-controls.ts` exporting `resolveStartControlMap`, `applicableStartControls`, `StartControlMap`, `StartControlApplicability`, `DATA_SYNC_START_CONTROLS` | ✓ ADDITIVE (new path; nothing moved or re-exported) |
+| API route URLs (§7) | `GET /api/data_sync/options` items gain a `startControls` object; `POST /api/data_sync/run` is unchanged and keeps honouring `fullSync` and `batchSize` whatever an adapter declares | ✓ ADDITIVE (new optional response field, no request-shape change) |
+| Auto-discovery, function signatures, event IDs, widget spot IDs, DB schema, DI names, ACL features, notification IDs, CLI commands, generated files | No change | ✓ n/a |
+
+**Contract commitments**: only an explicit `false` removes a control, so an adapter that declares nothing — or whose predicate returns anything else — renders the same form and sends the same request body as before. A predicate that throws is treated as *applies*, because `api/options.ts` resolves every registered adapter in one response and one broken predicate must not take the dashboard down for the rest. The `startControls` map is sparse and keyed only by the adapter's own `supportedEntities`; a missing entry means every control applies, so a client that ignores the field behaves exactly as today. The declaration governs what the dashboard **offers**, never what the run API **accepts** — that separation MUST hold for any future change here, or an API client posting `fullSync: true` would silently stop getting a full run.
+
+**Migration path for existing adapters**: none. The method is optional and defaults to prior behaviour.

package/dist/agentic/guides/upstream/manifest.json

@@ -1,8 +1,8 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.7.1-develop.7179.1.e8c03264b6",
+  "generator": "@open-mercato/cli@0.7.1-develop.7181.1.702cedc42c",
   "files": {
     "AGENTS.md": "1f54610cebc4fd7e42b56d1c18859edc7ed7d3165c9af72c4530b6feaf76e457",
-    "BACKWARD_COMPATIBILITY.md": "f038b782e63818968de8bc1da67645a1f59b1e762066e7dc989010df46050e57"
+    "BACKWARD_COMPATIBILITY.md": "cf387f5407340082f2915119c35fda86420eb9687ee0269d21a374d4bd1ec8de"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.7.1-develop.7179.1.e8c03264b6",
+  "version": "0.7.1-develop.7181.1.702cedc42c",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,9 +60,9 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/queue": "0.7.1-develop.7179.1.e8c03264b6",
-    "@open-mercato/shared": "0.7.1-develop.7179.1.e8c03264b6",
-    "@open-mercato/telemetry": "0.7.1-develop.7179.1.e8c03264b6",
+    "@open-mercato/queue": "0.7.1-develop.7181.1.702cedc42c",
+    "@open-mercato/shared": "0.7.1-develop.7181.1.702cedc42c",
+    "@open-mercato/telemetry": "0.7.1-develop.7181.1.702cedc42c",
     "cross-spawn": "^7.0.6",
     "pg": "8.23.0",
     "semver": "^7.8.5",
@@ -73,10 +73,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7179.1.e8c03264b6"
+    "@open-mercato/shared": "0.7.1-develop.7181.1.702cedc42c"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7179.1.e8c03264b6",
+    "@open-mercato/shared": "0.7.1-develop.7181.1.702cedc42c",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"