@pipefy/pipefy-process-coder 0.1.1 → 0.1.3

package/dist/pipefy/internal.js

@@ -1,6 +1,120 @@
 import { ENDPOINTS } from "../config.js";
 import { debug, warn } from "../util/log.js";
 import { retry } from "../util/pool.js";
+import { AI_BEHAVIOR_PARAMS_SELECTION } from "./agents.js";
+/**
+ * The internal-API adapter. PLAN.md §2.1 flags this as an unversioned endpoint
+ * with no compatibility contract, so it is isolated here, behind one module,
+ * and every entry point degrades to `null`/`unsupported` rather than throwing.
+ *
+ * Two things live only here — both taken from the Change Migrator recipes,
+ * which have been running them in production:
+ *
+ *  1. Automations. Public `getAutomations` returns a summary; the recipes use
+ *     `loadAutomationToEdit` to get `action_params.field_map`, `searchFor`,
+ *     `responseSchema`, `schedulerCron` and `aiParams` — everything a
+ *     round trip needs and the summary omits.
+ *  2. Phase jumps. `GET/PUT /internal_api/settings/phases/:id`, set-replacing.
+ *
+ * Both accept the same personal API token as the public endpoint, so there is
+ * no session-cookie or CSRF subsystem here.
+ */
+/** Sent by `listAutomations`; module-level so `checkQueries` validates the same text. */
+const LIST_AUTOMATIONS_QUERY = `
+  query getAutomations($orgId: ID!, $repoId: ID) {
+    automations(organizationId: $orgId, repoId: $repoId) {
+      id
+      name
+      action_id
+      event_id
+      created_at
+      active
+      action_repo: action_repo_v2 {
+        __typename
+        ... on Pipe { id }
+        ... on Table { id }
+      }
+      event_repo { __typename id }
+    }
+  }`;
+/** Sent by `loadAutomation`; module-level so `checkQueries` validates the same text. */
+const LOAD_AUTOMATION_QUERY = `
+  query loadAutomationToEdit($id: ID!) {
+    automation(id: $id) {
+      name
+      event_id
+      active
+      event_repo { id }
+      event_params {
+        toPhaseId: to_phase_id
+        fromPhaseId
+        inPhaseId
+        triggerFieldIds
+        kindOfSla
+        triggerAutomationId
+      }
+      action_id
+      action_repo: action_repo_v2 {
+        ... on Pipe { id uuid }
+        ... on Table { id uuid }
+      }
+      scheduler_frequency
+      schedulerCron { minute hour dayOfWeek dayOfMonth month }
+      searchFor { id field operation value }
+      responseSchema
+      action_params {
+        toPhaseId: to_phase_id
+        fieldsMapOrder: fields_map_order
+        email_template_id
+        fieldMap: field_map { fieldId value inputMode }
+        cardId: card_id
+        headers
+        body
+        url
+        httpMethod
+        authenticationKey
+        hasAuthenticationValue
+        authenticationAddTo
+        authenticationType
+        strategy
+        # taskParams is not in the recipe's query, and the omission is not
+        # cosmetic: every send_a_task automation came back with an empty
+        # action_params, so a reconstructed read lost its recipients and
+        # title, and a recreate would have rebuilt it blank. Introspected
+        # from AutomationActionParams on the internal endpoint.
+        taskParams { recipients title }
+        aiParams { fieldIds value skillsIds }
+        aiBehaviorParams ${AI_BEHAVIOR_PARAMS_SELECTION}
+        slaParams {
+          monday { startHour endHour enabled }
+          tuesday { startHour endHour enabled }
+          wednesday { startHour endHour enabled }
+          thursday { startHour endHour enabled }
+          friday { startHour endHour enabled }
+          saturday { startHour endHour enabled }
+          sunday { startHour endHour enabled }
+          timezone
+          holidays { date recurrence description }
+        }
+      }
+      condition {
+        expressions_structure
+        expressions { id field_address operation value structure_id }
+      }
+    }
+  }`;
+/**
+ * Every read query document this adapter sends over GraphQL, with variables
+ * that match nothing. GraphQL validates the document before resolving any of
+ * it, so a query that has drifted from the schema is refused the same way
+ * whichever id it names — and a valid one answers `data` with a not-found
+ * error. No write is in this list, and none may be added: probing is not free
+ * on this platform (AGENTS.md §4).
+ */
+const READ_QUERIES = [
+    { label: 'listAutomations', query: LIST_AUTOMATIONS_QUERY, variables: { orgId: '0', repoId: '0' } },
+    { label: 'loadAutomation', query: LOAD_AUTOMATION_QUERY, variables: { id: '0' } },
+];
 export class InternalApi {
     tokenProvider;
     status = 'unknown';
@@ -14,15 +128,83 @@ export class InternalApi {
         return this.tokenProvider();
     }
     markUnavailable(reason) {
-        this.status = 'unavailable';
+        if (this.status !== 'incompatible')
+            this.status = 'unavailable';
         if (!this.warned) {
             this.warned = true;
-            warn(`internal API unavailable (${reason}). Automation details and phase jumps ` +
+            warn(
+            // "Unavailable" read as an outage for answers like "Permission denied"
+            // or "Couldn't find Repo", which are the endpoint answering about this
+            // pipe and this credential. The reason says which.
+            `internal API call failed (${reason}). Automation details and phase jumps ` +
                 `will be reported as unknown rather than empty — see PLAN.md §2.1.`);
         }
     }
-    /** GraphQL over the internal endpoint. Returns null when the endpoint fails. */
-    async gql(query, variables, label) {
+    /** One answered call does not clear a refused query: that stays visible. */
+    markOk() {
+        if (this.status !== 'incompatible')
+            this.status = 'ok';
+    }
+    markIncompatible(label, reason) {
+        this.status = 'incompatible';
+        if (!this.warned) {
+            this.warned = true;
+            warn(`internal API rejected this tool's ${label} query as invalid (${reason}). ` +
+                `That is a bug in pipe, not an outage — the endpoint changed under it. Automation ` +
+                `details will be reported as unknown rather than empty; \`pipe doctor\` checks every internal query.`);
+        }
+    }
+    /**
+     * Validate every read query against the live schema without reading anything
+     * real. Null when the endpoint itself could not be reached, which says
+     * nothing about the queries.
+     */
+    async checkQueries() {
+        const results = [];
+        for (const { label, query, variables } of READ_QUERIES) {
+            let body;
+            try {
+                this.requestCount++;
+                const res = await fetch(ENDPOINTS.internal, {
+                    method: 'POST',
+                    headers: {
+                        authorization: `Bearer ${await this.bearer()}`,
+                        'content-type': 'application/json',
+                        accept: 'application/json',
+                    },
+                    body: JSON.stringify({ query, variables }),
+                });
+                if (!res.ok) {
+                    debug(`internal query check ${label}: HTTP ${res.status}`);
+                    return null;
+                }
+                body = JSON.parse(await res.text());
+            }
+            catch (e) {
+                debug(`internal query check ${label}: ${e.message}`);
+                return null;
+            }
+            if ('data' in body)
+                results.push({ label, ok: true });
+            else
+                results.push({ label, ok: false, message: (body.errors ?? []).map((e) => e.message).join('; ') || 'no data' });
+        }
+        this.status = results.every((r) => r.ok) ? 'ok' : 'incompatible';
+        return results;
+    }
+    /** The message of the last failed `gql` call, for a caller that reports it itself. */
+    lastError = null;
+    /**
+     * GraphQL over the internal endpoint. Returns null when the endpoint fails.
+     *
+     * `soft` is for a call whose failure is an answer about this pipe rather than
+     * about the endpoint — the iPaaS token, refused with "iPaaS is disabled for
+     * your organization". It used to mark the adapter unavailable and print that
+     * automation details and phase jumps would be unknown, on a pull where both
+     * had just been read. The caller reports it, from `lastError`.
+     */
+    async gql(query, variables, label, opts = {}) {
+        this.lastError = null;
         try {
             const data = await retry(async () => {
                 this.requestCount++;
@@ -45,41 +227,33 @@ export class InternalApi {
                 if (body.errors?.length) {
                     const err = new Error(body.errors.map((e) => e.message).join('; '));
                     err.retryable = false;
+                    // No `data` key at all is a document the schema refused, not a
+                    // resolver failing on this one id — see InternalStatus.
+                    err.invalidQuery = !('data' in body);
                     throw err;
                 }
                 return body.data ?? null;
             }, { label });
             if (data)
-                this.status = 'ok';
+                this.markOk();
             return data;
         }
         catch (e) {
             debug(`internal gql ${label} failed: ${e.message}`);
-            this.markUnavailable(`${label}: ${e.message}`);
+            this.lastError = e.message;
+            if (opts.soft && !e.invalidQuery)
+                return null;
+            if (e.invalidQuery)
+                this.markIncompatible(label, e.message);
+            else
+                this.markUnavailable(`${label}: ${e.message}`);
             return null;
         }
     }
     // ── Automations ────────────────────────────────────────────────────────────
     /** Recipe `Pipe Data Treatment` step 156. */
     async listAutomations(orgId, repoId) {
-        const q = `
-      query getAutomations($orgId: ID!, $repoId: ID) {
-        automations(organizationId: $orgId, repoId: $repoId) {
-          id
-          name
-          action_id
-          event_id
-          created_at
-          active
-          action_repo: action_repo_v2 {
-            __typename
-            ... on Pipe { id }
-            ... on Table { id }
-          }
-          event_repo { __typename id }
-        }
-      }`;
-        const data = await this.gql(q, { orgId: String(orgId), repoId: String(repoId) }, 'listAutomations');
+        const data = await this.gql(LIST_AUTOMATIONS_QUERY, { orgId: String(orgId), repoId: String(repoId) }, 'listAutomations');
         return data?.automations ?? null;
     }
     /**
@@ -89,72 +263,7 @@ export class InternalApi {
      * cannot avoid the internal API for automations.
      */
     async loadAutomation(id) {
-        const q = `
-      query loadAutomationToEdit($id: ID!) {
-        automation(id: $id) {
-          name
-          event_id
-          active
-          event_repo { id }
-          event_params {
-            toPhaseId: to_phase_id
-            fromPhaseId
-            inPhaseId
-            triggerFieldIds
-            kindOfSla
-            triggerAutomationId
-          }
-          action_id
-          action_repo: action_repo_v2 {
-            ... on Pipe { id uuid }
-            ... on Table { id uuid }
-          }
-          scheduler_frequency
-          schedulerCron { minute hour dayOfWeek dayOfMonth month }
-          searchFor { id field operation value }
-          responseSchema
-          action_params {
-            toPhaseId: to_phase_id
-            fieldsMapOrder: fields_map_order
-            email_template_id
-            fieldMap: field_map { fieldId value inputMode }
-            cardId: card_id
-            headers
-            body
-            url
-            httpMethod
-            authenticationKey
-            hasAuthenticationValue
-            authenticationAddTo
-            authenticationType
-            strategy
-            # taskParams is not in the recipe's query, and the omission is not
-            # cosmetic: every send_a_task automation came back with an empty
-            # action_params, so a reconstructed read lost its recipients and
-            # title, and a recreate would have rebuilt it blank. Introspected
-            # from AutomationActionParams on the internal endpoint.
-            taskParams { recipients title }
-            aiParams { fieldIds value skillsIds }
-            aiBehaviorParams
-            slaParams {
-              monday { startHour endHour enabled }
-              tuesday { startHour endHour enabled }
-              wednesday { startHour endHour enabled }
-              thursday { startHour endHour enabled }
-              friday { startHour endHour enabled }
-              saturday { startHour endHour enabled }
-              sunday { startHour endHour enabled }
-              timezone
-              holidays { date recurrence description }
-            }
-          }
-          condition {
-            expressions_structure
-            expressions { id field_address operation value structure_id }
-          }
-        }
-      }`;
-        const data = await this.gql(q, { id: String(id) }, `loadAutomation ${id}`);
+        const data = await this.gql(LOAD_AUTOMATION_QUERY, { id: String(id) }, `loadAutomation ${id}`);
         return data?.automation ?? null;
     }
     /** Recipe `Apply Changes` step 121. `input` is the AutomationInput variable set. */
@@ -236,7 +345,7 @@ export class InternalApi {
             const d = res.data ?? {};
             const attrs = d.attributes ?? {};
             const targets = attrs.jump_targets ?? d.jump_targets ?? [...(d.next_phase_ids ?? []), ...(d.back_phase_ids ?? [])];
-            this.status = 'ok';
+            this.markOk();
             return {
                 jump_targets: [...new Set(targets.map(Number).filter((n) => Number.isFinite(n)))],
                 phases: (attrs.phases ?? []).map(([id, name, done]) => ({ id: Number(id), name: String(name), done: Boolean(done) })),
@@ -302,7 +411,7 @@ export class InternalApi {
             const want = [...new Set(targetPhaseIds.map(Number))].sort((a, b) => a - b);
             const got = [...new Set(echoed)].sort((a, b) => a - b);
             const ok = want.length === got.length && want.every((v, i) => v === got[i]);
-            this.status = 'ok';
+            this.markOk();
             return ok
                 ? { ok, echoed }
                 : { ok, echoed, error: `echo mismatch: wanted [${want.join(',')}], endpoint reports [${got.join(',')}]` };

package/dist/pipefy/ipaas.js

@@ -86,11 +86,12 @@ export class IpaasClient {
             return hit.session;
         const minted = await this.internal.gql(`query GetAdvancedAutomationsToken($repoId: ID!) {
          advancedAutomationsToken(repoId: $repoId) { token }
-       }`, { repoId: String(pipeId) }, 'GetAdvancedAutomationsToken');
+       }`, { repoId: String(pipeId) }, 'GetAdvancedAutomationsToken', { soft: true });
         const token = minted?.advancedAutomationsToken?.token;
         if (!token) {
-            throw new IpaasUnavailable(pipeId, `no advanced-automations token for pipe ${pipeId} — iPaaS may be off for this organization, ` +
-                'or this credential may not be allowed to create automations on the pipe');
+            const said = this.internal.lastError;
+            throw new IpaasUnavailable(pipeId, `no advanced-automations token for pipe ${pipeId} — ` +
+                (said ?? 'iPaaS may be off for this organization, or this credential may not be allowed to create automations on the pipe'));
         }
         const res = await fetch(`${this.base}/managed-authn/external-token`, {
             method: 'POST',

package/dist/pipefy/reconstruct.js

@@ -236,7 +236,8 @@ export class Reconstructor {
                 p['index'] = i;
         });
         relations.phases = phaseRows;
-        mark('phases', phase.missing ? 'partial' : 'complete');
+        // Every phase comes back; what can be missing is columns, recorded below.
+        mark('phases', 'complete');
         /**
          * `Phase.next_phase_ids` is public, but it is **not** the payload's
          * `phase_jumps`. Checked against a snapshot of the same pipe:
@@ -291,7 +292,7 @@ export class Reconstructor {
         for (const p of gqlPhases)
             pushFields(p['fields'] ?? [], numOrNull(p['id']));
         relations.fields = fieldRows;
-        mark('fields', field.missing ? 'partial' : 'complete');
+        mark('fields', 'complete');
         if (field.missing)
             notes.push(`field columns not in this schema: ${field.skipped.join(', ')}`);
         // ── labels ──────────────────────────────────────────────────────────────
@@ -303,9 +304,9 @@ export class Reconstructor {
                 color: l['color'],
                 repo_id: root['id'],
             }));
-            // No `uuid` over the public API, and uuid is how labels are identified in
-            // a snapshot — so this is partial, not complete.
-            mark('labels', 'partial');
+            // Every label comes back. No `uuid` over the public API — and uuid is how
+            // a snapshot identifies labels — but that is a column, recorded below.
+            mark('labels', 'complete');
         }
         else {
             notes.push('labels: not readable over this endpoint');
@@ -329,27 +330,115 @@ export class Reconstructor {
             notes.push('webhooks: not readable over this endpoint');
         }
         // ── pipe_relations ──────────────────────────────────────────────────────
-        const prSel = await this.client.prune('Pipe', [
-            ['pipe_relations', '{ id name parent { id } child { id } canCreateNewItems canConnectExistingItems canConnectMultipleItems childMustExistToMoveParent childMustExistToFinishParent allChildrenMustBeDoneToMoveParent allChildrenMustBeDoneToFinishParent }'],
-        ]);
-        if (prSel) {
-            const pr = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { ${prSel} } }`, { id: String(repoId) }, 'pipe_relations');
-            if (pr?.pipe?.pipe_relations) {
-                relations.pipe_relations = pr.pipe.pipe_relations.map((r) => ({
-                    id: numOrNull(r['id']),
-                    name: r['name'],
-                    parent_id: numOrNull(firstId(r['parent'])),
-                    child_id: numOrNull(firstId(r['child'])),
-                    can_create_new_items: r['canCreateNewItems'],
-                    can_connect_existing_items: r['canConnectExistingItems'],
-                    can_connect_multiple_items: r['canConnectMultipleItems'],
-                    child_must_exist_to_move_parent: r['childMustExistToMoveParent'],
-                    child_must_exist_to_finish_parent: r['childMustExistToFinishParent'],
-                    all_children_must_be_done_to_move_parent: r['allChildrenMustBeDoneToMoveParent'],
-                    all_children_must_be_done_to_finish_parent: r['allChildrenMustBeDoneToFinishParent'],
-                }));
-                mark('pipe_relations', 'partial');
-            }
+        /**
+         * `Pipe.pipe_relations` does not exist — this used to ask for it, the prune
+         * dropped it, and every reconstructed pull had pipe_relations `unknown`.
+         * The public names are `parentsRelations` and `childrenRelations`, and their
+         * `parent` / `child` are a union (Pipe | Table), so `{ id }` is refused
+         * until it is spread per type. Both directions are read and merged by id:
+         * which of them a snapshot carries has not been measured, and a superset
+         * can only add a row a snapshot lacks, never hide one this pipe has.
+         */
+        const REL = `{ id name
+      parent { ... on Pipe { id } ... on Table { id } }
+      child { ... on Pipe { id } ... on Table { id } }
+      canCreateNewItems canConnectExistingItems canConnectMultipleItems
+      childMustExistToMoveParent childMustExistToFinishParent
+      allChildrenMustBeDoneToMoveParent allChildrenMustBeDoneToFinishParent }`;
+        const pr = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { parentsRelations ${REL} childrenRelations ${REL} } }`, { id: String(repoId) }, 'pipe_relations');
+        if (pr?.pipe && Array.isArray(pr.pipe.parentsRelations) && Array.isArray(pr.pipe.childrenRelations)) {
+            const byId = new Map();
+            for (const r of [...pr.pipe.parentsRelations, ...pr.pipe.childrenRelations])
+                byId.set(String(r['id']), r);
+            relations.pipe_relations = [...byId.values()].map((r) => ({
+                id: numOrNull(r['id']),
+                name: r['name'],
+                parent_id: numOrNull(firstId(r['parent'])),
+                child_id: numOrNull(firstId(r['child'])),
+                can_create_new_items: r['canCreateNewItems'],
+                can_connect_existing_items: r['canConnectExistingItems'],
+                can_connect_multiple_items: r['canConnectMultipleItems'],
+                child_must_exist_to_move_parent: r['childMustExistToMoveParent'],
+                child_must_exist_to_finish_parent: r['childMustExistToFinishParent'],
+                all_children_must_be_done_to_move_parent: r['allChildrenMustBeDoneToMoveParent'],
+                all_children_must_be_done_to_finish_parent: r['allChildrenMustBeDoneToFinishParent'],
+            }));
+            mark('pipe_relations', 'complete');
+        }
+        else {
+            notes.push('pipe_relations: parentsRelations / childrenRelations did not answer');
+        }
+        // ── phase team members ──────────────────────────────────────────────────
+        // `Phase.teamMembers` is public; the payload holds one row per member.
+        const tm = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { phases { id teamMembers { id } } } }`, { id: String(repoId) }, 'phase team members');
+        if (tm?.pipe?.phases?.every((ph) => Array.isArray(ph.teamMembers))) {
+            relations.phase_team_memberships = tm.pipe.phases.flatMap((ph) => (ph.teamMembers ?? []).map((u) => ({ phase_id: numOrNull(ph.id), user_id: numOrNull(u['id']) })));
+            mark('phase_team_memberships', 'complete');
+        }
+        else {
+            notes.push('phase_team_memberships: Phase.teamMembers did not answer');
+        }
+        // ── repo preferences and the public form ────────────────────────────────
+        /**
+         * One row each, both public. Fewer columns than a snapshot's (no id, no
+         * custom sorting, no guests settings) — columns are partial, as for every
+         * reconstructed group — but every column the compiler can write is here.
+         * `submitterEmailCollectionMethod` is the payload's `submitter_email_required`:
+         * both read "required" on the same pipe.
+         */
+        const prefs = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { preferences {
+        aiAgentsEnabled aiCopilotEnabled findable hiddenStartFormAttributes
+        hiddenTopButtons inboxEmailEnabled mainTabViews startFormTitle } } }`, { id: String(repoId) }, 'repo_preferences');
+        if (prefs?.pipe) {
+            const r = prefs.pipe.preferences;
+            relations.repo_preferences = r
+                ? [
+                    {
+                        repo_id: root['id'],
+                        ai_agents_enabled: r['aiAgentsEnabled'],
+                        ai_copilot_enabled: r['aiCopilotEnabled'],
+                        findable: r['findable'],
+                        hidden_start_form_attributes: r['hiddenStartFormAttributes'] ?? [],
+                        hidden_top_buttons: r['hiddenTopButtons'] ?? [],
+                        inbox_email_enabled: r['inboxEmailEnabled'],
+                        main_tab_views: r['mainTabViews'] ?? [],
+                        start_form_title: r['startFormTitle'] ?? null,
+                    },
+                ]
+                : [];
+            mark('repo_preferences', 'complete');
+        }
+        const pf = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { publicForm {
+        id active title description submitButtonText afterSubmitMessage brandColor
+        backgroundColor backgroundImage logo displayPipefyLogo showSubmitAnotherResponseButton
+        reuseLastSubmissionResponse submitterEmailCollectionEnabled
+        submitterEmailCollectionMethod submitterEmailField { id } } } }`, { id: String(repoId) }, 'public_forms');
+        if (pf?.pipe) {
+            const f = pf.pipe.publicForm;
+            relations.public_forms = f
+                ? [
+                    {
+                        id: numOrNull(f['id']),
+                        repo_id: root['id'],
+                        active: f['active'],
+                        title: f['title'] ?? null,
+                        description: f['description'] ?? null,
+                        submit_button_text: f['submitButtonText'] ?? null,
+                        after_submit_message: f['afterSubmitMessage'] ?? null,
+                        brand_color: f['brandColor'] ?? null,
+                        background_color: f['backgroundColor'] ?? null,
+                        background_image: f['backgroundImage'] ?? null,
+                        logo: f['logo'] ?? null,
+                        display_pipefy_logo: f['displayPipefyLogo'],
+                        show_submit_another_response_button: f['showSubmitAnotherResponseButton'],
+                        reuse_last_submission_response: f['reuseLastSubmissionResponse'],
+                        submitter_email_collection_enabled: f['submitterEmailCollectionEnabled'],
+                        submitter_email_required: f['submitterEmailCollectionMethod'] ?? null,
+                        submitter_email_field_id: numOrNull(firstId(f['submitterEmailField'])),
+                    },
+                ]
+                : [];
+            mark('public_forms', 'complete');
         }
         // ── field conditions (+ actions, condition, expressions) ────────────────
         await this.readFieldConditions(repoId, root, relations, mark, notes);
@@ -367,19 +456,27 @@ export class Reconstructor {
             }
         }
         /**
-         * No reconstructed group is ever 'complete'.
+         * No reconstructed group has every *column*; most have every *row*.
          *
-         * Row coverage and *column* coverage are different things: the public API
+         * Row coverage and column coverage are different things: the public API
          * returns every phase, but not `color_uuid`, `only_admin_can_move_to_previous`
-         * or `repo_id`. Marking such a group complete made a snapshot-vs-reconstruction
-         * diff report ten phantom changes per phase, each one a proposal to null a
-         * column that had simply not been read. 'partial' is the honest ceiling, and it
-         * is what tells the diff to treat absence here as no information.
+         * or `repo_id`. Marking such a group's columns complete made a
+         * snapshot-vs-reconstruction diff report ten phantom changes per phase, each
+         * one a proposal to null a column that had simply not been read — so every
+         * group that was read has its columns marked partial.
+         *
+         * Rows are another matter, and they used to be marked partial too. That
+         * made the diff refuse every create and delete on a reconstructed pull,
+         * which was every pull while the snapshot download answered 500: a new
+         * phase could not be created because the read had not seen `color_uuid`.
+         * `coverage` now says what was measured about rows — complete where the
+         * API returns the whole list, partial where it is known not to
+         * (phase_jumps read forward-only, pipe_relations never compared against a
+         * snapshot, automations that would not load).
          */
-        for (const name of ENTITY_NAMES) {
-            if (coverage[name] === 'complete')
-                coverage[name] = 'partial';
-        }
+        const columns = {};
+        for (const name of ENTITY_NAMES)
+            columns[name] = coverage[name] === 'unknown' ? 'unknown' : 'partial';
         const payload = { ...root, id: Number(root['id']), relations };
         return {
             source: 'reconstructed',
@@ -387,6 +484,7 @@ export class Reconstructor {
             readAt: new Date().toISOString(),
             repoKind: 'pipe',
             coverage,
+            columns,
             repo_columns: pipe.missing ? 'partial' : 'complete',
             notes,
             payload,
@@ -472,7 +570,16 @@ export class Reconstructor {
      * shortcut — this is N+1 by necessity, bounded by readConcurrency.
      */
     async readAutomations(repoId, root, relations, mark, notes, organizationId) {
-        const orgId = organizationId ?? (root['organization_id'] ? String(root['organization_id']) : null);
+        /**
+         * The repo's own organization first. The one passed in is the caller's
+         * default — `--org`, or whatever `pipe login --token` saved — and a token
+         * that belongs to several organizations pulls pipes from all of them. Sent
+         * a pipe from another organization, the internal query answers "Couldn't
+         * find Repo with 'id'=…" about a pipe that plainly exists, and every
+         * automation is left unknown. Seen in a field run, reproduced here with
+         * one pipe under its own organization (32 automations) and under another.
+         */
+        const orgId = (root['organization_id'] ? String(root['organization_id']) : null) ?? organizationId;
         if (!orgId) {
             notes.push('automations: no organization id available for the internal automations query');
             return;
@@ -626,6 +733,8 @@ const CAMEL_TO_SNAKE = {
     hasAuthenticationValue: 'has_authentication_value',
     authenticationAddTo: 'authentication_add_to',
     aiParams: 'ai_params',
+    // Its own subfields arrive already aliased to snake_case (AI_BEHAVIOR_PARAMS_SELECTION).
+    aiBehaviorParams: 'ai_behavior_params',
     slaParams: 'sla_params',
     taskParams: 'task_params',
     fieldIds: 'field_ids',
@@ -662,8 +771,7 @@ const snakeParams = (v) => {
 };
 /** Reported by `pipe doctor` so an FDE knows what a reconstructed pull cannot see. */
 export const RECONSTRUCTION_GAPS = [
-    'public_forms — no public read path',
-    'repo_preferences — no public read path',
+    'public_forms / repo_preferences — read, with fewer columns than a snapshot (no ids for preferences, no custom sorting)',
     'visibilities — no public read path (read-only anyway)',
     'email_templates / email_inboxes — no public read path (read-only anyway)',
     'labels.uuid — not exposed publicly, so labels are matched by id and name',