@pipefy/pipefy-process-coder 0.1.1 → 0.1.3

package/AGENTS.md

@@ -83,6 +83,23 @@ webhooks", and conflating them licenses deleting a client's live integrations.
 Applies to iPaaS flows identically: a pipe whose iPaaS is off gets `unknown`, and
 its flows are not compared at all.
 
+**Rows and columns are covered separately.** `coverage` says whether every *row*
+of a group was read; `columns` (in `_meta.json`) whether every *column* was. A
+GraphQL reconstruction reads every phase, field and label and still lacks
+`color_uuid` or a label's `uuid`, so its rows are `complete` and its columns
+`partial`. The diff reads them for different questions: a missing column on a
+partial side is "unseen", never "set to null"; a missing *row* is only unseen
+when the rows are partial, and only then is a create or delete held back. These
+were once one flag, and a reconstruction marked everything `partial` — which,
+while the snapshot download was failing on every pipe, left every pull able to
+update and unable to create or delete anything.
+
+**And a held-back create or delete stops the plan.** Between a workspace and its
+own baseline each one is an edit someone made, so `plan` and `apply` refuse,
+naming them, rather than apply the rest (`suppressedEdits`, `--force` to apply
+the rest anyway). Applying 20 updates without the 2 phase creates they pointed
+at would have left a pipe with no final phase.
+
 ### Refuse rather than guess, per column
 
 `src/apply/registry.ts` records, for every entity and operation, whether a write
@@ -250,6 +267,11 @@ live running. Do not re-derive them. The shapes that bite most often:
 | a field condition testing the field it hides | stored happily, and the **phase form stops opening**. The API validates none of this — not the self-reference, not the operation, not even `not_a_real_operation` |
 | `automationVariables.active` | omitted for the life of the tool, so disabling an automation was a no-op that reported success |
 | `updateAutomation` | works, across every field map dimension. The recipes' delete-and-recreate was inherited, not measured |
+| internal `AutomationActionParams.aiBehaviorParams` | an **object** (`AiBehaviorParams`), the same type the public `aiAgents` read selects. Selected bare, the whole `loadAutomation` document fails validation — so *every* automation in the pipe loads without `action_params`, not only the AI ones. One selection, `AI_BEHAVIOR_PARAMS_SELECTION`, serves both reads |
+| a snapshot's `signedUrl` | `app.pipefy.com/storage/v1/signed/…`, and it can answer **HTTP 500** with Pipefy's own error page while `createRepoSnapshot` and the `UPLOADED` status both succeed — measured on two unrelated pipes, old snapshots and new. A pull falls back to reconstruction rather than write a workspace with no pipe in it; `--no-fallback` refuses instead |
+| internal `automations(organizationId:, repoId:)` | the organization must be **the pipe's own**. Asked under another organization the credential also belongs to, it answers `Couldn't find Repo with 'id'=…` about a pipe that exists — so a saved default org silently left every automation unknown on pipes from other orgs. The repo's `organization_id` wins; the default is only the fallback |
+| `Pipe.pipe_relations` | **does not exist** publicly. The relations are `parentsRelations` and `childrenRelations`, and their `parent` / `child` are a **union** (`RepoTypes`: Pipe \| Table) — `{ id }` is refused until spread with `... on Pipe { id } ... on Table { id }`. The reconstruction asked for the missing field for its whole life, so pipe_relations was always `unknown` without a snapshot |
+| reconstruction without a snapshot | every group the compiler can write now has a public read: `Phase.teamMembers`, `Pipe.preferences`, `Pipe.publicForm` (its `submitterEmailCollectionMethod` is the payload's `submitter_email_required`). With rows `complete`, a pull whose snapshot download fails supports the whole loop. Only read-only groups stay `unknown` |
 | iPaaS `IMPORT_FLOW` | migrates the tree it is given; never use it |
 | iPaaS connections | the host marks any credential `ACTIVE` **without validating it** |
 | `POST /app-connections/{id}` | accepts `scope` and `projectIds` and returns 200 ignoring both |
@@ -308,11 +330,20 @@ way `pipe pull` would notice.
 
 All three automation mutations are **public** and were being sent to the internal
 endpoint — inherited from the Change Migrator recipes and never re-checked, which
-made automations the one entity written through an unversioned endpoint with no
-introspection, for no reason. Before adding anything to `registry.ts` with
+made automations the one entity written through an unversioned endpoint, for
+no reason. Before adding anything to `registry.ts` with
 `transport: 'internal'`, introspect the public schema for it. If it genuinely is
 not there, say which public mutation is missing and how that was verified.
 
+The internal endpoint is unversioned, but it **does** answer introspection
+(`__type(name:)` worked on it live) — this file used to say it did not. So a
+query sent there can be checked against its schema like any other. Every read
+query the internal adapter sends lives in `READ_QUERIES` (internal.ts), and
+`pipe doctor` validates each one with ids that match nothing: a document the
+schema refuses comes back with `errors` and no `data`, a valid one with `data`
+and a not-found. That is how the bare-`aiBehaviorParams` drift would have shown
+up before a user's pull did. Add a new internal read there, never a write.
+
 ### Probing is not free on this platform
 
 Two separate incidents from the same wrong assumption — that schema validation

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,11 @@
+Pipefy Process Coder
+Copyright 2026 Pipefy, Inc.
+
+This product includes software developed at Pipefy (https://www.pipefy.com).
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not
+use the files in this repository except in compliance with the License.
+
+The "Pipefy" name, logo, and brand assets are trademarks of Pipefy, Inc.
+and are NOT licensed under the Apache License 2.0. Use of the Pipefy
+trademarks is subject to Pipefy's brand guidelines and prior authorization.

package/README.md

@@ -697,7 +697,7 @@ research/snap.json  the pipe <pipeId> fixture every test runs against
 | `pipe doctor` | capabilities, missing mutations, internal-API status |
 | `pipe skills` | the agent skills this install ships with; `install` hands off to `npx skills add` |
 | `pipe create <name>` | create an empty pipe and pull it, ready to be built from files |
-| `pipe pull <id>` | pull into a workspace; `--depth`, `--reuse-snapshot`, `--from-file` |
+| `pipe pull <id>` | pull into a workspace; `--depth`, `--reuse-snapshot`, `--no-fallback`, `--from-file` |
 | `pipe export <id>` | one repo as a single payload, no workspace, no token needed to consume |
 | `pipe validate` | offline shape + integrity |
 | `pipe diff` | baseline, live, or cross-repo; `--html`, `--open`, `--json` |
@@ -823,4 +823,8 @@ A successful pipe apply rewrites your files. It adopts each created entity's rea
 [] - Check the baseline is not stale before planning: compare the pulled version id against the live one, and refuse to propose deletions when the pipe has moved since the pull. A stale baseline turns someone else's changes into a diff — seen live, where a verification diff listed five changes made elsewhere as deletions the workspace wanted
 [] - pipe pull inside a workspace pulls the pipes automatically
 [] - One design point worth stating
-Each repo still applies independently — own plan file, own pre-apply snapshot, own verify. That's deliberate: they're separate repos with separate baselines, and a failure in one must not roll back or abandon another that already succeeded. So it's a loop over the real thing, not a merged mega-plan. Exit code is the worst of them. --plan and --resume stay single-repo, since a saved plan belongs to exactly one.
+Each repo still applies independently — own plan file, own pre-apply snapshot, own verify. That's deliberate: they're separate repos with separate baselines, and a failure in one must not roll back or abandon another that already succeeded. So it's a loop over the real thing, not a merged mega-plan. Exit code is the worst of them. --plan and --resume stay single-repo, since a saved plan belongs to exactly one.
+
+## License
+
+Apache-2.0 — see [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE). Copyright 2026 Pipefy, Inc. The Pipefy name, logo and brand assets are trademarks of Pipefy, Inc. and are not covered by the license.

package/dist/apply/adopt.js

@@ -126,3 +126,55 @@ export const renderAdopted = (adopted) => {
         lines.push(`   …and ${adopted.length - 8} more`);
     return lines;
 };
+/**
+ * The baseline after an apply that verified, when the read-back was not a
+ * snapshot: the workspace for every group the baseline could see, the old
+ * baseline for every group it could not.
+ *
+ * Without this only created ids reached the baseline (mergeAdoptedIntoBaseline),
+ * so every update and delete an apply had just made stayed "pending" in the
+ * next diff. An update resent is harmless; a delete resent is refused by the
+ * API, about a field the apply itself removed. Found on the first real apply
+ * after snapshot downloads started failing, when this became the only path.
+ *
+ * Why the workspace is safe to adopt here, when a reconstruction is not (see
+ * the post-snapshot branch in apply.ts): verify has just confirmed that the
+ * live pipe satisfies everything the workspace states, and the workspace
+ * carries every row the baseline did unless the author removed it — which the
+ * apply has also done. A group `unknown` on the baseline was never diffed, so
+ * an edit there was never applied, and adopting it would mark unapplied work
+ * done. Those groups keep the baseline's copy.
+ */
+/**
+ * Phases carry two folded groups that may be unknown on their own. The phase
+ * and field rows come from the workspace; a folded list the baseline could not
+ * see keeps the baseline's copy, matched by phase id.
+ */
+const advancePhases = (baseline, applied, jumpsSeen, teamSeen) => {
+    if (jumpsSeen && teamSeen)
+        return applied.phases;
+    const before = new Map(baseline.phases.map((ph) => [String(ph['id']), ph]));
+    return applied.phases.map((ph) => {
+        const old = before.get(String(ph['id']));
+        return {
+            ...ph,
+            jump_target_ids: jumpsSeen ? ph.jump_target_ids : (old?.jump_target_ids ?? []),
+            team_member_ids: teamSeen ? ph.team_member_ids : (old?.team_member_ids ?? []),
+        };
+    });
+};
+export const advanceBaseline = (baseline, applied) => {
+    const seen = (...groups) => groups.every((g) => (baseline.meta.coverage[g] ?? 'unknown') !== 'unknown');
+    return {
+        ...baseline,
+        repo: applied.repo,
+        phases: seen('phases', 'fields') ? advancePhases(baseline, applied, seen('phase_jumps'), seen('phase_team_memberships')) : baseline.phases,
+        automations: seen('automations') ? applied.automations : baseline.automations,
+        field_conditions: seen('field_conditions') ? applied.field_conditions : baseline.field_conditions,
+        labels: seen('labels') ? applied.labels : baseline.labels,
+        webhooks: seen('webhooks') ? applied.webhooks : baseline.webhooks,
+        pipe_relations: seen('pipe_relations') ? applied.pipe_relations : baseline.pipe_relations,
+        public_form: seen('public_forms') ? applied.public_form : baseline.public_form,
+        preferences: seen('repo_preferences') ? applied.preferences : baseline.preferences,
+    };
+};

package/dist/cli.js

@@ -129,12 +129,9 @@ const main = async () => {
      * question behind the version check.
      */
     if (parsed.command === '--version' || parsed.command === '-V' || parsed.command === 'version') {
-        const { readFile } = await import('node:fs/promises');
         const { fileURLToPath } = await import('node:url');
-        const { dirname, join } = await import('node:path');
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkg = JSON.parse(await readFile(join(here, '..', 'package.json'), 'utf8'));
-        out(`${pkg.name} ${pkg.version}`);
+        const { PACKAGE_NAME, TOOL_VERSION } = await import("./version.js");
+        out(`${PACKAGE_NAME} ${TOOL_VERSION}`);
         out(dim(`  node    ${process.version} (needs >=22.18 for native type stripping)`));
         out(dim(`  running ${fileURLToPath(import.meta.url)}`));
         return 0;
@@ -164,6 +161,18 @@ const main = async () => {
     const code = await cmd.run(parsed);
     return typeof code === 'number' ? code : 0;
 };
+/**
+ * A reader that stops early — `pipe doctor | head`, a pager quit — closes the
+ * pipe, and the next write raised an unhandled EPIPE with a Node stack trace.
+ * The reader has what it wanted; there is no one left to tell.
+ */
+for (const stream of [process.stdout, process.stderr]) {
+    stream.on('error', (e) => {
+        if (e.code === 'EPIPE')
+            process.exit(process.exitCode ?? 0);
+        throw e;
+    });
+}
 main()
     .then((code) => {
     process.exitCode = code;

package/dist/codec/pack.js

@@ -83,6 +83,8 @@ export const packEnvelope = (tree) => ({
     readAt: tree.meta.readAt,
     repoKind: tree.meta.repoKind,
     coverage: tree.meta.coverage,
+    ...(tree.meta.columns ? { columns: tree.meta.columns } : {}),
+    repo_columns: tree.meta.repo_columns,
     notes: tree.meta.notes,
     payload: pack(tree),
 });

package/dist/codec/unpack.js

@@ -155,6 +155,7 @@ export const unpack = (env) => {
             readAt: env.readAt,
             repoKind: env.repoKind,
             coverage: env.coverage,
+            ...(env.columns ? { columns: env.columns } : {}),
             repo_columns: env.repo_columns ?? 'complete',
             notes: env.notes,
         },

package/dist/commands/apply.js

@@ -10,7 +10,7 @@ import { unpack } from "../codec/unpack.js";
 import { packEnvelope } from "../codec/pack.js";
 import { upsertRepo, writeLock } from "../workspace/lock.js";
 import { renderStamp, stampCreated } from "../workspace/stamp.js";
-import { adoptCreatedIds, mergeAdoptedIntoBaseline, renderAdopted } from "../apply/adopt.js";
+import { adoptCreatedIds, advanceBaseline, mergeAdoptedIntoBaseline, renderAdopted } from "../apply/adopt.js";
 import { baselineFile, planFile, planFileFor, findPlanFile } from "../workspace/layout.js";
 import { diffTrees } from "../diff/diff.js";
 import { compile } from "../apply/compile.js";
@@ -19,7 +19,7 @@ import { execute } from "../apply/execute.js";
 import { validateTree, blockingErrors } from "../validate/index.js";
 import { connect, openWorkspace, resolveWorkspace } from "./context.js";
 import { checkGit } from "../util/git.js";
-import { loadBaseline, loadBaselineEnvelope, refFor } from "./diff.js";
+import { loadBaseline, loadBaselineEnvelope, refFor, refuseSuppressedEdits } from "./diff.js";
 import { loadPlan, renderPlan, warnUnverifiedSteps } from "./plan.js";
 import { verifyRepo } from "./verify.js";
 import { restoreToVersion } from "./misc.js";
@@ -438,6 +438,7 @@ const applyOneRepo = async (p) => {
         }
         rec?.before(await loadBaselineEnvelope(root, repo.id));
         const changeSet = diffTrees(baseline, edited);
+        refuseSuppressedEdits(changeSet, bool(p, 'force'));
         if (!changeSet.changes.length) {
             /**
              * The pipe half is clean. That is not the same as nothing to apply: flows
@@ -702,6 +703,7 @@ const applyOneRepo = async (p) => {
          */
         const takeSnapshot = caps.snapshots && (bool(p, 'post-snapshot') || (await confirmPostSnapshot(p)));
         const verified = await verifyRepo({
+            parsed: p,
             net,
             root,
             lock,
@@ -710,8 +712,15 @@ const applyOneRepo = async (p) => {
             idMap: result.idMap,
             preferReconstruct: !takeSnapshot,
         });
+        /**
+         * What was actually read, not what was asked for. A requested snapshot can
+         * come back as a reconstruction when the download fails (readLive), and
+         * everything below that adopts the read-back wholesale is only safe on a
+         * real snapshot — so it keys on this, never on takeSnapshot.
+         */
+        const realRead = verified.envelope.source === 'snapshot';
         if (!verified.ok) {
-            warn(takeSnapshot
+            warn(realRead
                 ? 'verification found differences between what was applied and what the workspace asks for:'
                 : 'a free, GraphQL-reconstructed comparison found differences — coverage gaps may hide more (see below):');
             out(verified.render);
@@ -730,7 +739,7 @@ const applyOneRepo = async (p) => {
              * GraphQL reconstruction's partial coverage risks the same "adopt an
              * absence as a deletion" mistake the coverage doctrine exists to avoid.
              */
-            if (takeSnapshot) {
+            if (realRead) {
                 const authored = await readTree(dir);
                 const previous = await loadBaselineEnvelope(root, repo.id);
                 const stamp = stampCreated(authored, unpack(verified.envelope), previous ? unpack(previous) : null);
@@ -754,10 +763,20 @@ const applyOneRepo = async (p) => {
             await reportRun(rec, 'partial', `all ${result.done} steps applied, but verification found differences`);
             return 1;
         }
-        ok(takeSnapshot ? 'verified — the pipe now matches the workspace' : 'verified against a free GraphQL reconstruction — the pipe matches the workspace');
+        ok(realRead ? 'verified — the pipe now matches the workspace' : 'verified against a free GraphQL reconstruction — the pipe matches the workspace');
         rec?.after(verified.envelope);
         rec?.verified(true);
-        if (takeSnapshot) {
+        if (!realRead) {
+            // The read-back is not adopted (see advanceBaseline); the verified
+            // workspace is, for every group the baseline could see.
+            const previousEnvelope = await loadBaselineEnvelope(root, repo.id);
+            if (previousEnvelope) {
+                const next = advanceBaseline(unpack(previousEnvelope), await readTree(dir));
+                await writeJson(baselineFile(root, repo.id), { ...packEnvelope(next), readAt: new Date().toISOString() });
+                info(dim('   baseline advanced to the applied workspace — the next diff starts from what is now live'));
+            }
+        }
+        if (realRead) {
             /**
              * Adopt the live state as both the workspace and the baseline —
              * strictly more complete than the id-only adoption above, since it also

package/dist/commands/context.js

@@ -1,7 +1,7 @@
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { LIMITS, credentialProvider, readOrgId } from "../config.js";
 import { exists } from "../util/fsx.js";
-import { UserError, debug } from "../util/log.js";
+import { UserError, debug, warn } from "../util/log.js";
 import { PipefyClient } from "../pipefy/client.js";
 import { InternalApi } from "../pipefy/internal.js";
 import { SnapshotClient } from "../pipefy/snapshot.js";
@@ -10,7 +10,8 @@ import { IpaasClient } from "../pipefy/ipaas.js";
 import { detect } from "../pipefy/capability.js";
 import { paths } from "../workspace/layout.js";
 import { readLock } from "../workspace/lock.js";
-import { str } from "../cli/args.js";
+import { bool, str } from "../cli/args.js";
+import { fullCoverage } from "../model/payload.js";
 export const connect = async (p) => {
     /**
      * One credential, shared by the public client and the internal adapter, and
@@ -77,3 +78,40 @@ export const openWorkspace = async (p, positionalIndex = 0) => {
     return { root, lock, repo, repoDir: join(root, repo.dir) };
 };
 export const readConcurrency = () => LIMITS.readConcurrency;
+/**
+ * Read one repo live: a snapshot when the endpoint has them and the caller
+ * wants one, a GraphQL reconstruction otherwise — and a reconstruction when
+ * the snapshot read fails.
+ *
+ * The fallback is the point. Pipefy's storage answered every signed snapshot
+ * URL with HTTP 500 for days while creation and the UPLOADED status were
+ * fine, and every command that read live through a snapshot — verify, diff
+ * --against live, a cross-repo diff, export — failed outright, after `pull`
+ * had already learned to carry on. Reconstruction says per group what it
+ * could not see, so falling back never makes absence look like deletion.
+ * `--no-fallback` keeps the old refusal.
+ */
+export const readLive = async (net, p, repoId, opts = {}) => {
+    const caps = await net.capabilities();
+    const reconstruct = () => net.reconstructor.reconstruct(repoId, { organizationId: opts.organizationId ?? net.organizationId, noInternal: opts.noInternal });
+    if (!caps.snapshots || opts.preferSnapshot === false)
+        return reconstruct();
+    try {
+        const { payload, versionId } = await net.snapshots.pull(repoId, opts.label);
+        return {
+            source: 'snapshot',
+            versionId,
+            readAt: new Date().toISOString(),
+            repoKind: opts.kind ?? 'pipe',
+            coverage: fullCoverage('complete'),
+            notes: [],
+            payload,
+        };
+    }
+    catch (e) {
+        if (bool(p, 'no-fallback'))
+            throw e;
+        warn(`snapshot read failed for repo ${repoId}: ${e.message} — reading it over GraphQL instead (--no-fallback to stop here)`);
+        return reconstruct();
+    }
+};

package/dist/commands/diff.js

@@ -6,10 +6,10 @@ import { UserError, bold, dim, info, ok, out, warn } from "../util/log.js";
 import { unpack } from "../codec/unpack.js";
 import { readTree } from "../workspace/read.js";
 import { baselineFile, repoDir } from "../workspace/layout.js";
-import { diffTrees } from "../diff/diff.js";
+import { diffTrees, suppressedEdits } from "../diff/diff.js";
 import { renderChangeSet, toJson } from "../diff/render.js";
 import { renderHtml } from "../diff/html.js";
-import { connect, openWorkspace } from "./context.js";
+import { connect, openWorkspace, readLive } from "./context.js";
 import { diffFlowsFor } from "./flows.js";
 import { renderFlowChanges } from "../diff/flow.js";
 import { diffAgentsFor } from "./agents.js";
@@ -43,9 +43,7 @@ export const run = async (p) => {
         const net = await connect(p);
         const caps = await net.capabilities();
         info(dim(`re-reading pipe ${repo.id} (${caps.snapshots ? 'snapshot' : 'GraphQL reconstruction'})`));
-        const env = caps.snapshots
-            ? await liveSnapshot(net, repo.id)
-            : await net.reconstructor.reconstruct(repo.id, { organizationId: lock.organizationId });
+        const env = await readLive(net, p, repo.id, { kind: repo.kind, organizationId: lock.organizationId });
         baseline = unpack(env);
     }
     else if (against !== 'baseline') {
@@ -61,9 +59,9 @@ export const run = async (p) => {
         }
         else {
             const net = await connect(p);
-            const caps = await net.capabilities();
             info(dim(`reading pipe ${otherId} live for a cross-repo diff`));
-            const env = caps.snapshots ? await liveSnapshot(net, otherId) : await net.reconstructor.reconstruct(otherId, { organizationId: lock.organizationId });
+            // The other pipe's own organization, not this workspace's (readLive -> reconstruct).
+            const env = await readLive(net, p, otherId, { organizationId: null });
             baseline = unpack(env);
         }
     }
@@ -219,6 +217,23 @@ export const run = async (p) => {
  * report does not: a report keeps the payload verbatim so the run folder is a
  * usable copy of the pipe, not a reshaped one.
  */
+/**
+ * Refuse a plan that would apply only part of what the workspace asks for.
+ * See suppressedEdits. `--force` keeps its meaning elsewhere — apply what can
+ * be applied — and says out loud what it is leaving behind.
+ */
+export const refuseSuppressedEdits = (cs, force) => {
+    const left = suppressedEdits(cs);
+    if (!left.length)
+        return;
+    const list = left.map((s) => `  ${s.op} ${s.entity}: ${s.label}`).join('\n');
+    if (force) {
+        warn(`--force: ${left.length} create/delete(s) in the workspace are left out of this plan:\n${list}`);
+        return;
+    }
+    throw new UserError(`${left.length} create/delete(s) in the workspace cannot be planned, because the baseline read those rows only partially:\n${list}\n` +
+        'Planning the rest without them would apply part of what was asked for.', 're-pull to refresh the baseline, or pass --force to apply the rest anyway');
+};
 export const loadBaselineEnvelope = async (root, repoId) => {
     try {
         return await readJson(baselineFile(root, repoId));
@@ -246,19 +261,6 @@ export const loadBaselineQuiet = async (root, repoId) => {
         return null;
     }
 };
-const liveSnapshot = async (net, repoId) => {
-    const { payload, versionId } = await net.snapshots.pull(repoId);
-    const { fullCoverage } = await import("../model/payload.js");
-    return {
-        source: 'snapshot',
-        versionId,
-        readAt: new Date().toISOString(),
-        repoKind: 'pipe',
-        coverage: fullCoverage('complete'),
-        notes: [],
-        payload,
-    };
-};
 export const writeHtml = async (path, changeSet, workspace, plan) => {
     const html = renderHtml({ changeSet, plan, workspace, generatedAt: new Date().toISOString() });
     await writeFile(path, html);