@opencrvs/toolkit 2.0.0-rc.fdc585a → 2.0.0-rc.ff04b30

package/dist/migrations/v2.0/merge-infrastructure-directory.d.ts

@@ -1,3 +1,13 @@
-declare function main(): Promise<void>;
+interface MergeInfrastructureOptions {
+    /**
+     * Top-level subdirectories of `infrastructure/` to scope the merge to.
+     * When omitted or empty, the entire `infrastructure/` tree is merged
+     * (legacy behavior). Each name is relative to `infrastructure/` —
+     * e.g. `['postgres', 'metabase']` merges only
+     * `infrastructure/postgres/` and `infrastructure/metabase/`.
+     */
+    subdirs?: string[];
+}
+declare function main({ subdirs }?: MergeInfrastructureOptions): Promise<void>;
 export { main };
 //# sourceMappingURL=merge-infrastructure-directory.d.ts.map

package/dist/migrations/v2.0/merge-infrastructure-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-infrastructure-directory.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/merge-infrastructure-directory.ts"],"names":[],"mappings":"AAsHA,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAkInC;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}
+{"version":3,"file":"merge-infrastructure-directory.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/merge-infrastructure-directory.ts"],"names":[],"mappings":"AAsHA,UAAU,0BAA0B;IAClC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAID,iBAAe,IAAI,CAAC,EAClB,OAAY,EACb,GAAE,0BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoIjD;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}

package/dist/migrations/v2.0/merge-infrastructure-directory.js

@@ -22,7 +22,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 /**
  * Codemod: Merge upstream changes into the local `infrastructure/` directory
- * from opencrvs/opencrvs-countryconfig.
+ * (or selected subdirectories of it) from opencrvs/opencrvs-countryconfig.
  *
  * Usage:
  *   ts-node -r tsconfig-paths/register src/migrations/v2.0/merge-infrastructure-directory.ts
@@ -33,8 +33,10 @@ exports.main = main;
  *        - the upstream "theirs" branch (v2.0) → `UPSTREAM_BRANCH`
  *        - the synthetic merge-base branch (latest 1.9 release line)
  *          → `BASE_BRANCH`
- *   2. For every file under `infrastructure/` on upstream "theirs", performs
- *      a file-scoped 3-way merge:
+ *   2. For every file under `infrastructure/` on upstream "theirs" (or, when
+ *      `subdirs` is provided, only files under
+ *      `infrastructure/<subdir>/` for each requested subdir), performs a
+ *      file-scoped 3-way merge:
  *        - new file on upstream → checked out and staged
  *        - existing file       → 3-way merged in place via `git merge-file`,
  *                                using the BASE_BRANCH version of the file
@@ -116,8 +118,14 @@ function gitShowBytes(ref, path) {
 }
 // ─── Entry point ─────────────────────────────────────────────────────────────
 function main() {
-    return __awaiter(this, void 0, void 0, function* () {
-        console.log(`Merging '${INFRASTRUCTURE_DIR}/' from ${checkout_upstream_files_1.UPSTREAM_URL}@${checkout_upstream_files_1.UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...\n`);
+    return __awaiter(this, arguments, void 0, function* ({ subdirs = [] } = {}) {
+        // Build the pathspec list passed to `git ls-tree`. Trailing slashes make
+        // git treat them as tree paths (recurse into them).
+        const pathspecs = subdirs.length > 0
+            ? subdirs.map((s) => `${INFRASTRUCTURE_DIR}/${s}/`)
+            : [`${INFRASTRUCTURE_DIR}/`];
+        const scopeLabel = pathspecs.map((p) => `'${p}'`).join(', ');
+        console.log(`Merging ${scopeLabel} from ${checkout_upstream_files_1.UPSTREAM_URL}@${checkout_upstream_files_1.UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...\n`);
         (0, checkout_upstream_files_1.assertIsGitRepo)();
         // Best-effort cleanup of a stale temp remote from a previous aborted run.
         (0, checkout_upstream_files_1.tryGit)(['remote', 'remove', TEMP_REMOTE]);
@@ -131,20 +139,13 @@ function main() {
             const ref = `${TEMP_REMOTE}/${checkout_upstream_files_1.UPSTREAM_BRANCH}`;
             const baseRef = `${TEMP_REMOTE}/${BASE_BRANCH}`;
             // -z gives NUL-separated paths so filenames with spaces or newlines
-            // survive the round-trip.
-            const upstreamFiles = (0, checkout_upstream_files_1.runGit)([
-                'ls-tree',
-                '-r',
-                '--name-only',
-                '-z',
-                ref,
-                '--',
-                `${INFRASTRUCTURE_DIR}/`
-            ], { silent: true })
+            // survive the round-trip. Multiple pathspecs after `--` are unioned
+            // by git, which scopes the listing to the requested subdirectories.
+            const upstreamFiles = (0, checkout_upstream_files_1.runGit)(['ls-tree', '-r', '--name-only', '-z', ref, '--', ...pathspecs], { silent: true })
                 .split('\0')
                 .filter(Boolean);
             if (upstreamFiles.length === 0) {
-                console.log(`  No files found under '${INFRASTRUCTURE_DIR}/' on ${ref}. Nothing to merge.`);
+                console.log(`  No files found under ${scopeLabel} on ${ref}. Nothing to merge.`);
                 return;
             }
             const tmpDir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'opencrvs-merge-infra-'));

package/dist/migrations/v2.0/migrate-scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-scopes.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/migrate-scopes.ts"],"names":[],"mappings":"AAyVA,iBAAe,IAAI,kBAmDlB;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}
+{"version":3,"file":"migrate-scopes.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/migrate-scopes.ts"],"names":[],"mappings":"AAoXA,iBAAe,IAAI,kBAmDlB;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}

package/dist/migrations/v2.0/migrate-scopes.js

@@ -25,7 +25,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 const ts_morph_1 = require("ts-morph");
 const path_1 = __importDefault(require("path"));
-const scopes_1 = require("../commons/scopes");
 const scopes_deprecated_do_not_use_1 = require("../commons/scopes.deprecated.do-not-use");
 const ROLES_FILE_RELATIVE_PATH = 'src/data-seeding/roles/roles.ts';
 const SCOPES_PROPERTY_NAME = 'scopes';
@@ -65,60 +64,85 @@ function resolveLegacyScopeFromElement(element) {
     }
     return null;
 }
+/**
+ * Walks each `scopes: [...]` array in the roles file, classifies elements,
+ * and rewrites the whole array using `migrateLegacyScopesArrayToV2Scopes`
+ * (which preserves v1.9 AND semantics by merging pairs of legacy scopes
+ * that targeted the same v2 type). See issue #12489.
+ *
+ * Elements are partitioned into three kinds:
+ *   - drop: `SCOPES.X` references where X is not in the SCOPES map (warned
+ *     and removed, matching pre-refactor behavior).
+ *   - raw: non-literal expressions we cannot statically resolve (e.g.
+ *     `...sharedScopes` spreads). Preserved verbatim in output so authoring
+ *     intent isn't lost.
+ *   - legacy: literal strings or resolvable `SCOPES.X` references.
+ *     Collected and passed as a batch to the merge function.
+ *
+ * The output array text is `[...rawTexts, ...mergedScopesAsJson]`. Order of
+ * legacy entries relative to raw expressions is not preserved — scopes in a
+ * v2 array compose with OR, so position is semantically irrelevant.
+ */
 function migrateScopesArrays(rolesFilePath, project) {
     const sourceFile = project.getSourceFile(rolesFilePath);
-    if (!sourceFile)
-        return { migratedCount: 0, removedCount: 0 };
+    if (!sourceFile) {
+        return { migratedCount: 0, removedCount: 0, mergedCount: 0 };
+    }
     let migratedCount = 0;
     let removedCount = 0;
+    let mergedCount = 0;
     const scopesProperties = sourceFile
         .getDescendantsOfKind(ts_morph_1.SyntaxKind.PropertyAssignment)
         .filter((prop) => prop.getName() === SCOPES_PROPERTY_NAME);
+    const relPath = path_1.default.relative(process.cwd(), rolesFilePath);
     for (const scopesProp of scopesProperties) {
         const initializer = scopesProp.getInitializer();
         if (!initializer || !ts_morph_1.Node.isArrayLiteralExpression(initializer))
             continue;
-        const elements = initializer.getElements();
-        for (let index = elements.length - 1; index >= 0; index--) {
-            const element = elements[index];
-            if (!ts_morph_1.Node.isExpression(element))
-                continue;
+        const rawTexts = [];
+        const legacyStrings = [];
+        let anyChange = false;
+        for (const element of initializer.getElements()) {
             const scopeKey = resolveScopeKeyFromElementAccess(element);
             if (scopeKey && !(scopeKey in scopes_deprecated_do_not_use_1.SCOPES)) {
                 // eslint-disable-next-line no-console
-                console.warn(`  [${path_1.default.relative(process.cwd(), rolesFilePath)}] Removing unknown scope reference: SCOPES.${scopeKey}`);
-                initializer.removeElement(index);
+                console.warn(`  [${relPath}] Removing unknown scope reference: SCOPES.${scopeKey}`);
                 removedCount++;
+                anyChange = true;
                 continue;
             }
             const legacyScope = resolveLegacyScopeFromElement(element);
             if (!legacyScope) {
                 // eslint-disable-next-line no-console
-                console.warn(`  [${path_1.default.relative(process.cwd(), rolesFilePath)}] Skipping non-literal scope expression: ${element.getText()}`);
+                console.warn(`  [${relPath}] Preserving non-literal scope expression verbatim: ${element.getText()}`);
+                rawTexts.push(element.getText());
                 continue;
             }
-            try {
-                const migratedScope = (0, scopes_deprecated_do_not_use_1.legacyScopeToV2Scope)(legacyScope);
-                const scope = (0, scopes_1.decodeScope)(migratedScope);
-                if (!scope) {
-                    // eslint-disable-next-line no-console
-                    console.warn(`  [${path_1.default.relative(process.cwd(), rolesFilePath)}] Could not decode migrated scope '${migratedScope}'.`);
-                    continue;
-                }
-                element.replaceWithText(JSON.stringify(scope));
-                migratedCount++;
-            }
-            catch (error) {
-                // eslint-disable-next-line no-console
-                console.warn(`  [${path_1.default.relative(process.cwd(), rolesFilePath)}] Could not migrate scope '${legacyScope}': ${error}`);
-            }
+            legacyStrings.push(legacyScope);
+            anyChange = true;
+        }
+        if (!anyChange)
+            continue;
+        let mergedScopes;
+        try {
+            mergedScopes = (0, scopes_deprecated_do_not_use_1.migrateLegacyScopesArrayToV2Scopes)(legacyStrings);
+        }
+        catch (error) {
+            throw new Error(`[${relPath}] Failed to migrate scopes for role: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
         }
+        migratedCount += legacyStrings.length;
+        mergedCount += legacyStrings.length - mergedScopes.length;
+        const outputElements = [
+            ...rawTexts,
+            ...mergedScopes.map((s) => JSON.stringify(s))
+        ];
+        scopesProp.setInitializer(`[${outputElements.join(', ')}]`);
     }
     if (removedCount > 0) {
         // eslint-disable-next-line no-console
-        console.log(`  Removed ${removedCount} unknown SCOPES reference(s) from '${path_1.default.relative(process.cwd(), rolesFilePath)}'.`);
+        console.log(`  Removed ${removedCount} unknown SCOPES reference(s) from '${relPath}'.`);
     }
-    return { migratedCount, removedCount };
+    return { migratedCount, removedCount, mergedCount };
 }
 function ensureScopesHelpersImport(rolesFilePath, project) {
     const sourceFile = project.getSourceFile(rolesFilePath);
@@ -262,7 +286,7 @@ function main() {
             return;
         }
         const importChanged = ensureScopesHelpersImport(rolesFilePath, project);
-        const { migratedCount, removedCount } = migrateScopesArrays(rolesFilePath, project);
+        const { migratedCount, removedCount, mergedCount } = migrateScopesArrays(rolesFilePath, project);
         const wrappedScopesCount = wrapScopesArraysWithDefineScopes(rolesFilePath, project);
         const wrappedRoles = wrapRolesWithDefineRoles(rolesFilePath, project);
         const removedRoleType = removeRoleTypeDefinitionAndUnusedImports(rolesFilePath, project);
@@ -276,6 +300,6 @@ function main() {
             return;
         }
         yield sourceFile.save();
-        console.log(`Done. Migrated ${migratedCount} legacy scope(s), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ', wrapped roles with defineRoles()' : ''}${removedRoleType ? ', and removed Role type definition' : ''}${importChanged ? '. Updated toolkit/scopes imports.' : '.'}`);
+        console.log(`Done. Migrated ${migratedCount} legacy scope(s), merged ${mergedCount} AND-paired scope(s) into single v2 objects (privilege-escalation fix, see issue #12489), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ', wrapped roles with defineRoles()' : ''}${removedRoleType ? ', and removed Role type definition' : ''}${importChanged ? '. Updated toolkit/scopes imports.' : '.'}`);
     });
 }

package/dist/migrations/v2.0/migrate-workqueue-configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-workqueue-configs.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/migrate-workqueue-configs.ts"],"names":[],"mappings":"AA+OA,iBAAe,IAAI,kBAqDlB;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}
+{"version":3,"file":"migrate-workqueue-configs.d.ts","sourceRoot":"","sources":["../../../src/migrations/v2.0/migrate-workqueue-configs.ts"],"names":[],"mappings":"AAgVA,iBAAe,IAAI,kBAqDlB;AAED,OAAO,EAAE,IAAI,EAAE,CAAA"}

package/dist/migrations/v2.0/migrate-workqueue-configs.js

@@ -39,6 +39,10 @@ exports.main = main;
  *       - `actions: [{...}, {...}, ...]`     -> keeps first as `action`, warns about dropped extras
  *   - If `action` already exists, removes deprecated `actions` and keeps `action`
  *   - Removes unsupported `action.type` values (`DEFAULT`, `VALIDATE`, etc.)
+ *   - Ensures every workqueue ends up with a valid `action`. When none is
+ *     present (or the existing one is unsupported), falls back to
+ *     `action: { type: ActionType.READ }` and ensures `ActionType` is imported
+ *     from `@opencrvs/toolkit/events` in the file.
  *   - Saves modified files in-place
  */
 const ts_morph_1 = require("ts-morph");
@@ -49,6 +53,10 @@ const ACTION_PROPERTY_NAME = 'action';
 const CONDITIONALS_PROPERTY_NAME = 'conditionals';
 const TYPE_PROPERTY_NAME = 'type';
 const SLUG_PROPERTY_NAME = 'slug';
+const READ_ACTION_TYPE = 'READ';
+const ACTION_TYPE_IMPORT_NAME = 'ActionType';
+const TOOLKIT_EVENTS_MODULE = '@opencrvs/toolkit/events';
+const READ_ACTION_FALLBACK_INITIALIZER = `{ type: ${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE} }`;
 const SUPPORTED_WORKQUEUE_ACTION_TYPES = new Set([
     'READ',
     'DELETE',
@@ -96,80 +104,146 @@ function isUnsupportedActionType(action) {
     }
     return !SUPPORTED_WORKQUEUE_ACTION_TYPES.has(typeName);
 }
-function migrateWorkqueueActions(workqueue, relPath) {
-    const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME);
-    if (!actionsProperty || !ts_morph_1.Node.isPropertyAssignment(actionsProperty)) {
-        return 0;
-    }
-    const actionsInitializer = actionsProperty.getInitializer();
-    if (!actionsInitializer || !ts_morph_1.Node.isArrayLiteralExpression(actionsInitializer)) {
-        return 0;
+/**
+ * Ensures the workqueue has a valid singular `action` property. When the
+ * existing `action` is missing or has an unsupported type, replaces it with
+ * `action: { type: ActionType.READ }`.
+ *
+ * Returns whether anything was changed and whether the READ fallback was
+ * applied (so the caller can ensure `ActionType` is imported in the file).
+ */
+function ensureValidAction(workqueue, relPath) {
+    const workqueueLabel = getWorkqueueLabel(workqueue);
+    const actionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME);
+    if (actionProperty && ts_morph_1.Node.isPropertyAssignment(actionProperty)) {
+        const initializer = actionProperty.getInitializer();
+        if (initializer && ts_morph_1.Node.isObjectLiteralExpression(initializer)) {
+            if (!isUnsupportedActionType(initializer)) {
+                return { changed: false, usedReadFallback: false };
+            }
+            actionProperty.set({
+                name: ACTION_PROPERTY_NAME,
+                initializer: READ_ACTION_FALLBACK_INITIALIZER
+            });
+            // eslint-disable-next-line no-console
+            console.log(`  [${relPath}] Replaced unsupported 'action' type with '${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE}' on workqueue '${workqueueLabel}'`);
+            return { changed: true, usedReadFallback: true };
+        }
     }
+    workqueue.addPropertyAssignment({
+        name: ACTION_PROPERTY_NAME,
+        initializer: READ_ACTION_FALLBACK_INITIALIZER
+    });
+    // eslint-disable-next-line no-console
+    console.log(`  [${relPath}] Added default 'action: ${READ_ACTION_FALLBACK_INITIALIZER}' to workqueue '${workqueueLabel}'`);
+    return { changed: true, usedReadFallback: true };
+}
+function migrateWorkqueueActions(workqueue, relPath) {
     const workqueueLabel = getWorkqueueLabel(workqueue);
-    const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME);
-    if (existingActionProperty) {
-        if (ts_morph_1.Node.isPropertyAssignment(existingActionProperty)) {
-            const existingActionInitializer = existingActionProperty.getInitializer();
-            if (existingActionInitializer && ts_morph_1.Node.isObjectLiteralExpression(existingActionInitializer)) {
-                const conditionalsProperty = existingActionInitializer.getProperty(CONDITIONALS_PROPERTY_NAME);
-                if (conditionalsProperty) {
-                    conditionalsProperty.remove();
-                    // eslint-disable-next-line no-console
-                    console.log(`  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`);
+    const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME);
+    let actionsArrayMigrated = false;
+    if (actionsProperty && ts_morph_1.Node.isPropertyAssignment(actionsProperty)) {
+        const actionsInitializer = actionsProperty.getInitializer();
+        if (actionsInitializer &&
+            ts_morph_1.Node.isArrayLiteralExpression(actionsInitializer)) {
+            const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME);
+            if (existingActionProperty) {
+                if (ts_morph_1.Node.isPropertyAssignment(existingActionProperty)) {
+                    const existingActionInitializer = existingActionProperty.getInitializer();
+                    if (existingActionInitializer &&
+                        ts_morph_1.Node.isObjectLiteralExpression(existingActionInitializer)) {
+                        const conditionalsProperty = existingActionInitializer.getProperty(CONDITIONALS_PROPERTY_NAME);
+                        if (conditionalsProperty) {
+                            conditionalsProperty.remove();
+                            // eslint-disable-next-line no-console
+                            console.log(`  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`);
+                        }
+                    }
                 }
-                if (isUnsupportedActionType(existingActionInitializer)) {
-                    existingActionProperty.remove();
+                actionsProperty.remove();
+                // eslint-disable-next-line no-console
+                console.log(`  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`);
+                actionsArrayMigrated = true;
+            }
+            else {
+                const actionCandidates = actionsInitializer
+                    .getElements()
+                    .filter((element) => ts_morph_1.Node.isObjectLiteralExpression(element));
+                if (actionCandidates.length === 0) {
+                    actionsProperty.remove();
                     // eslint-disable-next-line no-console
-                    console.log(`  [${relPath}] Removed unsupported 'action' type on workqueue '${workqueueLabel}'`);
+                    console.log(`  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`);
+                    actionsArrayMigrated = true;
+                }
+                else {
+                    if (actionCandidates.length > 1) {
+                        const droppedCount = actionCandidates.length - 1;
+                        // eslint-disable-next-line no-console
+                        console.warn(`  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`);
+                    }
+                    const conditionalsProperty = actionCandidates[0].getProperty(CONDITIONALS_PROPERTY_NAME);
+                    if (conditionalsProperty) {
+                        conditionalsProperty.remove();
+                        // eslint-disable-next-line no-console
+                        console.log(`  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`);
+                    }
+                    if (isUnsupportedActionType(actionCandidates[0])) {
+                        actionsProperty.remove();
+                        // eslint-disable-next-line no-console
+                        console.log(`  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`);
+                        actionsArrayMigrated = true;
+                    }
+                    else {
+                        const firstActionText = actionCandidates[0].getText();
+                        workqueue.addPropertyAssignment({
+                            name: ACTION_PROPERTY_NAME,
+                            initializer: firstActionText
+                        });
+                        actionsProperty.remove();
+                        // eslint-disable-next-line no-console
+                        console.log(`  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`);
+                        actionsArrayMigrated = true;
+                    }
                 }
             }
         }
-        actionsProperty.remove();
-        // eslint-disable-next-line no-console
-        console.log(`  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`);
-        return 1;
-    }
-    const actionCandidates = actionsInitializer
-        .getElements()
-        .filter((element) => ts_morph_1.Node.isObjectLiteralExpression(element));
-    if (actionCandidates.length === 0) {
-        actionsProperty.remove();
-        // eslint-disable-next-line no-console
-        console.log(`  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`);
-        return 1;
-    }
-    if (actionCandidates.length > 1) {
-        const droppedCount = actionCandidates.length - 1;
-        // eslint-disable-next-line no-console
-        console.warn(`  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`);
-    }
-    const conditionalsProperty = actionCandidates[0].getProperty(CONDITIONALS_PROPERTY_NAME);
-    if (conditionalsProperty) {
-        conditionalsProperty.remove();
-        // eslint-disable-next-line no-console
-        console.log(`  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`);
     }
-    if (isUnsupportedActionType(actionCandidates[0])) {
-        actionsProperty.remove();
-        // eslint-disable-next-line no-console
-        console.log(`  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`);
-        return 1;
+    // Always ensure the workqueue ends up with a valid `action`. This both
+    // covers workqueues that never had an `actions` array, and patches up
+    // workqueues whose existing/migrated action type is unsupported.
+    const fallback = ensureValidAction(workqueue, relPath);
+    return {
+        changed: actionsArrayMigrated || fallback.changed,
+        usedReadFallback: fallback.usedReadFallback
+    };
+}
+/**
+ * Ensures `import { ActionType } from '@opencrvs/toolkit/events'` exists in
+ * the source file, merging into any existing import declaration from the
+ * same module specifier.
+ */
+function ensureActionTypeImport(sourceFile) {
+    const existingImport = sourceFile.getImportDeclaration((decl) => decl.getModuleSpecifierValue() === TOOLKIT_EVENTS_MODULE);
+    if (existingImport) {
+        const alreadyImported = existingImport
+            .getNamedImports()
+            .some((ni) => ni.getName() === ACTION_TYPE_IMPORT_NAME);
+        if (!alreadyImported) {
+            existingImport.addNamedImport(ACTION_TYPE_IMPORT_NAME);
+        }
+        return;
     }
-    const firstActionText = actionCandidates[0].getText();
-    workqueue.addPropertyAssignment({
-        name: ACTION_PROPERTY_NAME,
-        initializer: firstActionText
+    sourceFile.addImportDeclaration({
+        moduleSpecifier: TOOLKIT_EVENTS_MODULE,
+        namedImports: [ACTION_TYPE_IMPORT_NAME]
     });
-    actionsProperty.remove();
-    // eslint-disable-next-line no-console
-    console.log(`  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`);
-    return 1;
 }
 function processFile(filePath, project) {
     const sourceFile = project.getSourceFile(filePath);
     if (!sourceFile)
         return 0;
     let migratedWorkqueues = 0;
+    let needsActionTypeImport = false;
     const relPath = path_1.default.relative(process.cwd(), filePath);
     const callExpressions = sourceFile.getDescendantsOfKind(ts_morph_1.SyntaxKind.CallExpression);
     for (const call of callExpressions) {
@@ -187,9 +261,16 @@ function processFile(filePath, project) {
         for (const element of workqueuesArg.getElements()) {
             if (!ts_morph_1.Node.isObjectLiteralExpression(element))
                 continue;
-            migratedWorkqueues += migrateWorkqueueActions(element, relPath);
+            const result = migrateWorkqueueActions(element, relPath);
+            if (result.changed)
+                migratedWorkqueues++;
+            if (result.usedReadFallback)
+                needsActionTypeImport = true;
         }
     }
+    if (needsActionTypeImport) {
+        ensureActionTypeImport(sourceFile);
+    }
     return migratedWorkqueues;
 }
 function main() {