@productbrain/cli 0.1.0-beta.42 → 0.1.0-beta.4208

package/dist/commands/admin/seed.js

@@ -3,14 +3,22 @@
  *
  * Seed metadata is duplicated from `convex/admin/commandManifest.ts` for CLI help
  * and ordering only — behavior is enforced server-side (STD-101).
+ *
+ * WP-433 S1b D13: the 4 substrate-repair migrations + backfill-default-team are
+ * generated from `convex/admin/seed/registry.ts` (single SSOT) into
+ * `seedRegistryEntries.generated.ts`. Run `npm run codegen` to refresh after registry edits.
  */
+import * as clack from '@clack/prompts';
 import { adminCall } from '../../lib/client.js';
-import { getConfig } from '../../lib/config.js';
+import { resolveAdminConfig } from '../../lib/config.js';
 import { CLIError, ErrorCode } from '../../lib/errors.js';
+import { ask, confirm, intro, isInteractive, log, multiselect, note, outro } from '../../lib/prompts.js';
 import { readSession } from '../../lib/session.js';
 import { isJsonMode } from '../../lib/runner.js';
+import { REGISTRY_SEED_COMMAND_ENTRIES } from './seedRegistryEntries.generated.js';
+import { confirmRiskNoteTitle, requiresAdminDestructiveConfirmation, seedAllConfirmMessage, seedMultiselectConfirmMessage, seedRunConfirmMessage, } from '../../lib/deployment.js';
 import { withSpinner } from '../../lib/spinner.js';
-import { adminBanner, bold, confirmProdAction, cyan, dim, green, heading, hint, icons, red, } from '../../lib/style.js';
+import { adminBanner, bold, confirmProdAction, cyan, dim, green, heading, hint, icons, red, yellow, } from '../../lib/style.js';
 /**
  * Order matches `ADMIN_COMMANDS` seed block in commandManifest.ts — dependency order for `seed all`.
  */
@@ -63,12 +71,6 @@ export const SEED_COMMAND_ENTRIES = [
         requiresWorkspaceId: true,
         dryRunSupported: false,
     },
-    {
-        name: 'seed:methodology-preset',
-        description: 'Install a methodology preset (e.g. cagan-tt) into a workspace — requires --preset-id',
-        requiresWorkspaceId: true,
-        dryRunSupported: false,
-    },
     {
         name: 'seed:process-templates',
         description: 'Seed process templates collection for a workspace',
@@ -93,29 +95,102 @@ export const SEED_COMMAND_ENTRIES = [
         requiresWorkspaceId: false,
         dryRunSupported: false,
     },
+    {
+        name: 'seed:migrate-scope-required-fields',
+        description: 'Fix scope semantic type: update requiredFields from description to purpose across all workspaces (TEN-346)',
+        requiresWorkspaceId: false,
+        dryRunSupported: true,
+    },
     {
         name: 'seed:writing-guidance',
         description: 'Seed writing guidance entries for a workspace',
         requiresWorkspaceId: true,
         dryRunSupported: true,
     },
+    // ─── WP-379 S5a: Starter Setup seed operations ─────────────────────────────
+    {
+        name: 'seed:show-starter',
+        description: 'List 18 Starter Setup assets for a workspace with body previews, lockLevel, and gate summary',
+        requiresWorkspaceId: true,
+        dryRunSupported: false,
+    },
+    {
+        name: 'seed:backfill-starter',
+        description: 'Idempotent bulk seed of Starter Setup bundle across workspaces. Defaults to dry-run.',
+        requiresWorkspaceId: false,
+        dryRunSupported: true,
+        dangerous: true,
+    },
+    {
+        name: 'seed:migrate-starter-fields',
+        description: 'STUB (WP-379 S5b): backfill explicit lockLevel + gate columns on existing setup-assets entries.',
+        requiresWorkspaceId: true,
+        dryRunSupported: true,
+    },
+    // WP-433 S1b D13: `seed:migrate-setup-skill-entryid` migrated to the SSOT registry.
+    // It now appears via REGISTRY_SEED_COMMAND_ENTRIES below (alongside the 3 new repair ops
+    // and `backfill-default-team`).
 ];
-const SEED_BY_NAME = new Map(SEED_COMMAND_ENTRIES.map((e) => [e.name, e]));
-/** Manifest order for `pb admin seed all`. */
-export const SEED_MANIFEST_ORDER = SEED_COMMAND_ENTRIES.map((e) => e.name);
-function isProductionSite(siteUrl) {
-    try {
-        const host = new URL(siteUrl).hostname;
-        return host !== 'localhost' && host !== '127.0.0.1' && host !== '[::1]';
-    }
-    catch {
-        return true;
-    }
-}
+// WP-433 S1b D13: registry-generated entries appended to the static list. These are the
+// 11 ops registered in `convex/admin/seed/registry.ts`. Filter out the prestep
+// (`align-workspace-collections`) — it cannot be invoked via `pb admin seed run`.
+const REGISTRY_RUNNABLE_ENTRIES = REGISTRY_SEED_COMMAND_ENTRIES
+    .filter((e) => e.runnable)
+    .map((e) => ({
+    name: e.name,
+    description: e.description,
+    requiresWorkspaceId: e.requiresWorkspaceId,
+    dryRunSupported: e.dryRunSupported,
+}));
+/** Combined list: static manifest entries (legacy seeds) + registry-generated entries. */
+const ALL_SEED_COMMAND_ENTRIES = [
+    ...SEED_COMMAND_ENTRIES,
+    ...REGISTRY_RUNNABLE_ENTRIES,
+];
+const SEED_BY_NAME = new Map(ALL_SEED_COMMAND_ENTRIES.map((e) => [e.name, e]));
+/**
+ * Manifest order for `pb admin seed all`.
+ *
+ * Includes the static legacy seeds plus the registry-generated runnable entries so
+ * `seed all` exercises the full surface (D13 SSOT).
+ */
+export const SEED_MANIFEST_ORDER = ALL_SEED_COMMAND_ENTRIES.map((e) => e.name);
 function shortLabel(manifestName) {
     return manifestName.startsWith('seed:') ? manifestName.slice('seed:'.length) : manifestName;
 }
-/** Accept `knowledge` or `seed:knowledge`. */
+/**
+ * Convert a manifest name (which may be a bare slug for registry-generated entries)
+ * to the backend command name expected by the admin dispatch layer.
+ *
+ * Legacy static entries are already stored as `seed:<slug>` — returned as-is.
+ * Registry-generated entries are stored as bare slugs (e.g. `seed-system-glossary`);
+ * the backend COMMAND_MAP expects `seed:<slug>`, so we add the prefix here.
+ */
+function toBackendCommand(manifestName) {
+    return manifestName.startsWith('seed:') ? manifestName : `seed:${manifestName}`;
+}
+/**
+ * Accept short-form or long-form seed op names; return the canonical backend command name.
+ *
+ * Static entries (legacy) are stored as `seed:<slug>` (e.g. `seed:knowledge`).
+ * Registry-generated entries (WP-433 S1b) are stored as bare slugs (e.g.
+ * `seed-system-glossary`) to avoid the double-prefix `seed:seed-*` trap that
+ * arose when slugs like `seed-system-glossary` were naively stored as
+ * `seed:seed-system-glossary`.
+ *
+ * Both forms always return the backend command name (`seed:<bare-slug>`):
+ *   - `'system-glossary'` or `'seed-system-glossary'` → `'seed:seed-system-glossary'`
+ *     would be wrong; instead the bare slug stored in the map IS `seed-system-glossary`
+ *     and the backend command is `seed:seed-system-glossary`.
+ *
+ * Resolution order:
+ *   1. Try `seed:<t>` — covers legacy static entries (`seed:knowledge`) and any input
+ *      that normalises to a key already stored with the `seed:` prefix.
+ *   2. Try bare `<t>` (stripping a leading `seed:` from the input if present) —
+ *      covers registry entries stored without the prefix.
+ *      When found via bare slug, return `seed:<bare>` so the caller always gets a
+ *      backend-compatible command name.
+ */
 export function normalizeSeedCommandName(input) {
     const t = input.trim();
     if (!t) {
@@ -124,15 +199,50 @@ export function normalizeSeedCommandName(input) {
             category: 'validation',
         });
     }
-    const full = t.startsWith('seed:') ? t : `seed:${t}`;
-    if (!SEED_BY_NAME.has(full)) {
-        const known = SEED_MANIFEST_ORDER.map((n) => shortLabel(n)).join(', ');
-        throw new CLIError(`Unknown seed operation "${input}". Known short names: ${known}`, {
-            code: ErrorCode.VALIDATION_FAILED,
-            category: 'validation',
-        });
+    // 1. Try the `seed:`-prefixed form (covers all legacy static entries).
+    const withPrefix = t.startsWith('seed:') ? t : `seed:${t}`;
+    if (SEED_BY_NAME.has(withPrefix))
+        return withPrefix;
+    // 2. Try the bare-slug form (covers registry-generated entries stored without `seed:`).
+    //    Strip one leading `seed:` if the input has it, so both
+    //    `seed-system-glossary` and `seed:seed-system-glossary` resolve to `seed-system-glossary`.
+    const bare = t.startsWith('seed:') ? t.slice('seed:'.length) : t;
+    if (SEED_BY_NAME.has(bare)) {
+        // Return the backend-compatible `seed:` form so callers can pass this directly
+        // to adminCall and the backend COMMAND_MAP will find it.
+        return `seed:${bare}`;
     }
-    return full;
+    const known = SEED_MANIFEST_ORDER.map((n) => shortLabel(n)).join(', ');
+    throw new CLIError(`Unknown seed operation "${input}". Known short names: ${known}`, {
+        code: ErrorCode.VALIDATION_FAILED,
+        category: 'validation',
+    });
+}
+// ─── WP-379 S5a: Starter-specific arg builders ───────────────────────────────
+/**
+ * Build args for seed:backfill-starter with CLI-side validation.
+ *
+ * Rules:
+ *   - confirm:true requires workspaceScope to be explicitly provided
+ *   - dryRun defaults to true when confirm is false
+ *
+ * Exported for testing.
+ */
+export function buildBackfillStarterArgs(opts) {
+    const confirm = opts.confirm ?? false;
+    const dryRun = opts.dryRun ?? !confirm;
+    if (confirm && !opts.workspaceScope) {
+        throw new CLIError('backfill-starter: --workspace-scope (dev|prod|all) is required when --confirm is passed. ' +
+            'Specify which deployment scope to seed to prevent accidental cross-scope writes.', { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+    }
+    const validScopes = ['dev', 'prod', 'all'];
+    if (opts.workspaceScope && !validScopes.includes(opts.workspaceScope)) {
+        throw new CLIError(`backfill-starter: --workspace-scope must be one of: ${validScopes.join(', ')}. Got: "${opts.workspaceScope}"`, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+    }
+    const args = { dryRun, confirm };
+    if (opts.workspaceScope)
+        args.workspaceScope = opts.workspaceScope;
+    return args;
 }
 function resolveWorkspaceId(explicit) {
     if (explicit)
@@ -147,7 +257,10 @@ function requireWorkspaceId(explicit) {
     return id;
 }
 export function buildSeedArgs(manifestName, opts) {
-    const def = SEED_BY_NAME.get(manifestName);
+    // Try exact match first (legacy static entries stored as `seed:<slug>`).
+    // Fall back to bare-slug lookup (registry-generated entries stored without `seed:` prefix).
+    const bare = manifestName.startsWith('seed:') ? manifestName.slice('seed:'.length) : manifestName;
+    const def = SEED_BY_NAME.get(manifestName) ?? SEED_BY_NAME.get(bare);
     if (!def) {
         throw new CLIError(`Unknown seed command: ${manifestName}`, {
             code: ErrorCode.VALIDATION_FAILED,
@@ -155,18 +268,6 @@ export function buildSeedArgs(manifestName, opts) {
         });
     }
     const args = {};
-    if (manifestName === 'seed:methodology-preset') {
-        const ws = requireWorkspaceId(opts.workspaceId);
-        if (!opts.presetId) {
-            throw new CLIError('seed:methodology-preset requires --preset-id <id>.', {
-                code: ErrorCode.VALIDATION_FAILED,
-                category: 'validation',
-            });
-        }
-        args.workspaceId = ws;
-        args.presetId = opts.presetId;
-        return args;
-    }
     if (def.requiresWorkspaceId) {
         args.workspaceId = requireWorkspaceId(opts.workspaceId);
     }
@@ -179,7 +280,7 @@ export function buildSeedArgs(manifestName, opts) {
     return args;
 }
 function printSeedList() {
-    const rows = SEED_COMMAND_ENTRIES.map((e) => ({
+    const rows = ALL_SEED_COMMAND_ENTRIES.map((e) => ({
         name: shortLabel(e.name),
         description: e.description,
         workspace: e.requiresWorkspaceId ? 'yes' : 'no',
@@ -190,7 +291,7 @@ function printSeedList() {
         return;
     }
     try {
-        adminBanner(getConfig().siteUrl);
+        adminBanner(resolveAdminConfig().siteUrl);
     }
     catch { /* not configured */ }
     const wName = Math.max(8, ...rows.map((r) => r.name.length));
@@ -203,7 +304,7 @@ function printSeedList() {
         process.stdout.write(`${cyan(r.name.padEnd(wName))}  ${r.workspace.padEnd(wWs)}  ${dryRunStr}  ${dim(r.description)}\n`);
     }
     process.stdout.write('\n');
-    hint(`${SEED_COMMAND_ENTRIES.length} operations — behavior enforced server-side (commandManifest.ts)`);
+    hint(`${ALL_SEED_COMMAND_ENTRIES.length} operations — behavior enforced server-side (commandManifest.ts + WP-433 S1b registry)`);
     hint('pb admin seed run <name>     Run one operation');
     hint('pb admin seed all            Run all in manifest order');
 }
@@ -214,10 +315,10 @@ async function printSeedStatus(workspaceIdOpt) {
     if (wsId) {
         collection = await adminCall('inspect:collection', { workspaceId: wsId });
     }
-    const note = 'Per-seed run history is not tracked server-side yet — use workspace totals and readiness diagnose as signals.';
+    const statusNote = 'Per-seed run history is not tracked server-side yet — use workspace totals and readiness diagnose as signals.';
     if (isJsonMode()) {
         process.stdout.write(JSON.stringify({
-            note,
+            note: statusNote,
             readinessConfig: readiness,
             workspaceCollections: collection,
             workspaceId: wsId ?? null,
@@ -225,7 +326,7 @@ async function printSeedStatus(workspaceIdOpt) {
         return;
     }
     process.stdout.write(`${bold('Seed status')}\n\n`);
-    process.stdout.write(`  ${dim(note)}\n\n`);
+    process.stdout.write(`  ${dim(statusNote)}\n\n`);
     process.stdout.write(`${bold('Readiness config migration (inspect:readiness-config)')}\n`);
     process.stdout.write(`  ${dim(JSON.stringify(readiness, null, 2).split('\n').join('\n  '))}\n\n`);
     if (collection && typeof collection === 'object' && collection !== null && 'workspace' in collection) {
@@ -242,34 +343,263 @@ async function runSeedOperation(manifestName, opts) {
     const args = buildSeedArgs(manifestName, opts);
     return adminCall(manifestName, args);
 }
+/**
+ * WP-433 S1b D16 — render the system/fleet seed status report.
+ *
+ * Frame: this is a system-admin (operator) command. Output never says "your workspace" —
+ * always "the system" / "X workspaces" / a specific named workspace.
+ */
+function renderSeedStatusReport(data) {
+    if (!data || typeof data !== 'object') {
+        process.stdout.write(`${dim('No data returned.')}\n`);
+        return;
+    }
+    const report = data;
+    const mode = report.mode;
+    if (mode === 'fleet') {
+        const summary = report.summary;
+        const failures = report.failures ?? [];
+        process.stdout.write(`${bold(`System: ${summary.total} workspace${summary.total === 1 ? '' : 's'} total`)}\n\n`);
+        process.stdout.write(`  ${green(icons.pass)} ${summary.healthy} healthy (all assertions passed)\n`);
+        if (summary.failed > 0) {
+            process.stdout.write(`  ${red(icons.fail)} ${summary.failed} with failed assertions\n`);
+        }
+        if (summary.neverRun > 0) {
+            process.stdout.write(`  ${dim('!')} ${summary.neverRun} with never-run ops (likely created pre-registry)\n`);
+        }
+        if (failures.length === 0) {
+            process.stdout.write(`\n${dim('No failures or never-run ops to report.')}\n`);
+            return;
+        }
+        // Group failures by status for readable output.
+        const failedRows = failures.filter((f) => f.status === 'failed');
+        const neverRunRows = failures.filter((f) => f.status === 'never-run');
+        if (failedRows.length > 0) {
+            process.stdout.write(`\n${red('Failures:')}\n`);
+            for (const f of failedRows) {
+                process.stdout.write(`  - ${cyan(`workspace-${f.workspaceId}`)} (${bold(f.workspaceName)}) — ${f.slug}: ${f.detail}\n`);
+                if (f.recommendedRepairOp) {
+                    process.stdout.write(`    repair: ${dim(`pb admin seed run ${f.recommendedRepairOp} --workspace-id ${f.workspaceId}`)}\n`);
+                }
+            }
+        }
+        if (neverRunRows.length > 0) {
+            process.stdout.write(`\n${dim('Never-run ops:')}\n`);
+            for (const f of neverRunRows) {
+                process.stdout.write(`  - ${cyan(`workspace-${f.workspaceId}`)} (${bold(f.workspaceName)}) — ${f.slug} never invoked\n`);
+                if (f.recommendedRepairOp) {
+                    process.stdout.write(`    repair: ${dim(`pb admin seed run ${f.recommendedRepairOp} --workspace-id ${f.workspaceId}`)}\n`);
+                }
+            }
+        }
+        return;
+    }
+    if (mode === 'drilldown') {
+        const workspaceName = report.workspaceName;
+        const workspaceId = report.workspaceId;
+        const rows = report.rows ?? [];
+        if (rows.length === 0) {
+            process.stdout.write(`${bold(`Workspace: ${workspaceName}`)} ${dim(`(${workspaceId})`)}\n\n`);
+            process.stdout.write(`${dim('No registered ops.')}\n`);
+            return;
+        }
+        // TEN-2021: group by level so non-tech operators don't conflate
+        // platform-substrate ops with on-demand repair tools.
+        const levelBySlug = new Map(REGISTRY_SEED_COMMAND_ENTRIES.map((e) => [e.name, e.level]));
+        const platformRows = rows.filter((r) => levelBySlug.get(r.slug) === 'platform');
+        const workspaceRows = rows.filter((r) => levelBySlug.get(r.slug) === 'workspace');
+        const repairRows = rows.filter((r) => levelBySlug.get(r.slug) === 'repair');
+        // TEN-2019 known soft-failure: platform-source workspace has no curated
+        // methods/skills entries to project. Not a workspace bug — render as ⚠.
+        const PLATFORM_SOURCE_EMPTY_MARKER = 'neither methods nor skills collection found';
+        const isPlatformSourceEmptyRow = (r) => r.status === 'failed' && r.detail.includes(PLATFORM_SOURCE_EMPTY_MARKER);
+        // ── Header: workspace identity + at-a-glance health summary ────────────────
+        const isSeedRow = (r) => {
+            const lvl = levelBySlug.get(r.slug);
+            return lvl === 'platform' || lvl === 'workspace';
+        };
+        const seedRows = rows.filter(isSeedRow);
+        const passCount = seedRows.filter((r) => r.status === 'passed').length;
+        const warnCount = seedRows.filter(isPlatformSourceEmptyRow).length;
+        const failCount = seedRows.filter((r) => r.status === 'failed' && !isPlatformSourceEmptyRow(r)).length;
+        process.stdout.write(`${bold('Workspace:')}  ${workspaceName}\n`);
+        process.stdout.write(`${bold('ID:')}         ${dim(workspaceId)}\n`);
+        process.stdout.write(`${bold('Health:')}     ${green(`${passCount} ${icons.pass}`)}   ${yellow(`${warnCount} ⚠`)}   ${red(`${failCount} ${icons.fail}`)}\n\n`);
+        // ── Row renderer: only show detail on ⚠ / ✗ via indented sub-line ──────────
+        const renderRow = (r) => {
+            const isWarn = isPlatformSourceEmptyRow(r);
+            const icon = isWarn ? yellow('⚠')
+                : r.status === 'passed' ? green(icons.pass)
+                    : r.status === 'failed' ? red(icons.fail)
+                        : dim('-');
+            process.stdout.write(`  ${icon}  ${cyan(r.slug)}\n`);
+            // Detail sub-line only for genuine signals (⚠ or ✗). ✓ and "-" are noise.
+            if (isWarn) {
+                process.stdout.write(`     ${dim('└─ Platform-curated content not yet published (TEN-2019).')}\n`);
+            }
+            else if (r.status === 'failed') {
+                const cleaned = r.detail.replace(new RegExp(`^${r.slug} assertion failed:\\s*`), '');
+                process.stdout.write(`     ${dim(`└─ ${cleaned}`)}\n`);
+            }
+        };
+        if (platformRows.length > 0) {
+            process.stdout.write(`${bold('Seeded on workspace creation')}\n`);
+            process.stdout.write(`${dim('Runs automatically when a new workspace is created.')}\n\n`);
+            for (const r of platformRows)
+                renderRow(r);
+            process.stdout.write('\n');
+        }
+        if (workspaceRows.length > 0) {
+            process.stdout.write(`${bold('Owner-level defaults')}\n`);
+            process.stdout.write(`${dim('Per-workspace state seeded for the owner.')}\n\n`);
+            for (const r of workspaceRows)
+                renderRow(r);
+            process.stdout.write('\n');
+        }
+        if (repairRows.length > 0) {
+            process.stdout.write(`${bold('Repair commands (manual)')}\n`);
+            process.stdout.write(`${dim('Used to fix older or drifted workspaces. Usually nothing to do.')}\n\n`);
+            for (const r of repairRows)
+                renderRow(r);
+        }
+        return;
+    }
+    if (mode === 'op-filter') {
+        const slug = report.slug;
+        const rows = report.rows ?? [];
+        process.stdout.write(`${bold(`Op: ${slug}`)} ${dim(`(${rows.length} workspace${rows.length === 1 ? '' : 's'})`)}\n\n`);
+        if (rows.length === 0) {
+            process.stdout.write(`${dim('Op not found in registry, or no workspaces exist.')}\n`);
+            return;
+        }
+        for (const r of rows) {
+            const icon = r.status === 'passed' ? green(icons.pass)
+                : r.status === 'failed' ? red(icons.fail)
+                    : dim('-');
+            const detail = r.detail ? `  ${dim(r.detail)}` : '';
+            process.stdout.write(`  ${icon}  ${cyan(`workspace-${r.workspaceId}`)} (${bold(r.workspaceName)})${detail}\n`);
+        }
+        return;
+    }
+    process.stdout.write(`${dim('Unknown report mode.')}\n`);
+}
 /** Attach seed subcommands to the `seed` Commander node. */
 export function attachSeedCommands(seed) {
     // Default action when `pb admin seed` is invoked with no subcommand.
-    seed.action(() => {
+    seed.action(async () => {
+        if (isJsonMode()) {
+            process.stdout.write(JSON.stringify({
+                operations: ALL_SEED_COMMAND_ENTRIES.map((e) => ({
+                    name: shortLabel(e.name),
+                    requiresWorkspaceId: e.requiresWorkspaceId,
+                    dryRunSupported: e.dryRunSupported,
+                    description: e.description,
+                })),
+            }, null, 2) + '\n');
+            return;
+        }
         let siteUrl = '';
         try {
-            siteUrl = getConfig().siteUrl;
+            siteUrl = resolveAdminConfig().siteUrl;
         }
         catch { /* not configured */ }
         if (siteUrl)
             adminBanner(siteUrl);
-        process.stdout.write(`${heading('Seed operations')}  ${dim(`(${SEED_COMMAND_ENTRIES.length})`)}\n\n`);
+        if (isInteractive()) {
+            intro('Seed Operations');
+            const menuEntries = ALL_SEED_COMMAND_ENTRIES;
+            const selected = await multiselect({
+                message: 'Select operations to run (space to toggle, enter to confirm):',
+                options: menuEntries.map((e) => ({
+                    value: e.name,
+                    label: shortLabel(e.name),
+                    hint: [
+                        e.requiresWorkspaceId ? 'needs workspace' : 'platform-wide',
+                        e.dryRunSupported ? 'dry-run ✓' : '',
+                    ].filter(Boolean).join(' · '),
+                })),
+                required: false,
+            });
+            if (!Array.isArray(selected) || selected.length === 0) {
+                outro('Nothing selected — use pb admin seed run <name> for individual operations');
+                return;
+            }
+            // Resolve workspace-id upfront for any selected ops that need it
+            const needsWs = selected.some((name) => SEED_BY_NAME.get(name)?.requiresWorkspaceId);
+            let workspaceId;
+            if (needsWs) {
+                const sessionWsId = readSession()?.workspaceId;
+                if (sessionWsId) {
+                    workspaceId = sessionWsId;
+                    log.info(`Using session workspace: ${dim(sessionWsId)}`);
+                }
+                else {
+                    workspaceId = await ask({
+                        message: 'Workspace ID (required for selected operations):',
+                        validate: (v) => v.trim() ? undefined : 'Workspace ID is required',
+                    });
+                }
+            }
+            const needsConfirm = requiresAdminDestructiveConfirmation(siteUrl);
+            if (needsConfirm) {
+                const ok = await confirm({
+                    message: seedMultiselectConfirmMessage(siteUrl, selected.length),
+                    initialValue: false,
+                });
+                if (!ok) {
+                    outro('Cancelled');
+                    return;
+                }
+            }
+            // Run selected operations in order, stop on first failure (same policy as seed all)
+            const results = [];
+            for (const name of selected) {
+                try {
+                    await withSpinner(`Running ${shortLabel(name)}`, async () => {
+                        const args = buildSeedArgs(name, { workspaceId });
+                        await adminCall(toBackendCommand(name), args);
+                    });
+                    results.push({ name, ok: true });
+                }
+                catch (e) {
+                    const msg = e instanceof Error ? e.message : String(e);
+                    results.push({ name, ok: false, error: msg });
+                    break;
+                }
+            }
+            const passed = results.filter((r) => r.ok).length;
+            const failed = results.filter((r) => !r.ok).length;
+            const summaryLines = results
+                .map((r) => r.ok ? `✓ ${shortLabel(r.name)}` : `✗ ${shortLabel(r.name)} — ${r.error}`)
+                .join('\n');
+            note(summaryLines, `${passed}/${selected.length} complete`);
+            if (failed > 0) {
+                process.exitCode = 1;
+                outro('Some operations failed — see above');
+            }
+            else {
+                outro(`${passed} operation(s) complete`);
+            }
+            return;
+        }
+        // Non-interactive (non-JSON) fallback — existing static preview
+        process.stdout.write(`${heading('Seed operations')}  ${dim(`(${ALL_SEED_COMMAND_ENTRIES.length})`)}\n\n`);
         // Show first 6 entries as a preview
-        const preview = SEED_COMMAND_ENTRIES.slice(0, 6);
+        const preview = ALL_SEED_COMMAND_ENTRIES.slice(0, 6);
         const wName = Math.max(...preview.map((e) => shortLabel(e.name).length));
         for (const e of preview) {
             const label = shortLabel(e.name);
             const flags = e.dryRunSupported ? dim('  dry-run ✓') : '';
             process.stdout.write(`  ${cyan(label.padEnd(wName))}  ${dim(e.description)}${flags}\n`);
         }
-        if (SEED_COMMAND_ENTRIES.length > 6) {
-            process.stdout.write(`  ${dim(`... ${SEED_COMMAND_ENTRIES.length - 6} more — run pb admin seed list`)}\n`);
+        if (ALL_SEED_COMMAND_ENTRIES.length > 6) {
+            process.stdout.write(`  ${dim(`... ${ALL_SEED_COMMAND_ENTRIES.length - 6} more — run pb admin seed list`)}\n`);
         }
         process.stdout.write('\n');
-        hint('pb admin seed list             Full list with workspace + dry-run flags');
-        hint('pb admin seed run <name>       Run one operation');
-        hint('pb admin seed all              Run all in manifest order');
-        hint('pb admin seed status           Workspace readiness signals');
+        process.stdout.write(`  ${cyan('pb admin seed list')}             ${dim('Full list with workspace + dry-run flags')}\n`);
+        process.stdout.write(`  ${cyan('pb admin seed run <name>')}       ${dim('Run one operation')}\n`);
+        process.stdout.write(`  ${cyan('pb admin seed all')}              ${dim('Run all in manifest order')}\n`);
+        process.stdout.write(`  ${cyan('pb admin seed status')}           ${dim('Fleet-wide seed health (system admin)')}\n`);
         process.stdout.write('\n');
     });
     seed
@@ -278,12 +608,56 @@ export function attachSeedCommands(seed) {
         .action(() => {
         printSeedList();
     });
+    // WP-433 S1b D16 — fleet-wide seed status (system-admin command).
+    // Default behaviour: scan ALL workspaces in the deployment and report summary + failures.
+    // `--workspace-id <id>` drilldown flag triages a single workspace.
+    // `--op <slug>` fleet view filtered to one op.
+    // `--failed-only` fleet view skipping healthy workspaces.
+    // `--legacy-readiness` falls back to the pre-S1b workspace-readiness signals view.
     seed
         .command('status')
-        .description('Readiness + workspace collection signals (no per-seed run log yet)')
-        .option('--workspace-id <id>', 'Workspace id (defaults to session workspace when set)')
+        .description('WP-433 S1b D16: Fleet-wide seed health (system admin). Default scans ALL workspaces. ' +
+        'Use --workspace-id to drill down, --op to filter one op, --failed-only for failures only.')
+        .option('--workspace-id <id>', 'Drill down to one workspace (operator triage)')
+        .option('--op <slug>', 'Filter fleet view to one op slug')
+        .option('--failed-only', 'Skip healthy workspaces; show failures only', false)
+        .option('--legacy-readiness', 'Use pre-S1b workspace readiness signals view', false)
         .action(async (options) => {
-        await printSeedStatus(options.workspaceId);
+        if (options.legacyReadiness) {
+            if (!isJsonMode()) {
+                try {
+                    adminBanner(resolveAdminConfig().siteUrl);
+                }
+                catch { /* not configured */ }
+                intro('Seed: status (legacy readiness)');
+            }
+            await printSeedStatus(options.workspaceId);
+            if (!isJsonMode()) {
+                outro('Read-only status check complete');
+            }
+            return;
+        }
+        if (!isJsonMode()) {
+            try {
+                adminBanner(resolveAdminConfig().siteUrl);
+            }
+            catch { /* not configured */ }
+            intro('Seed status — system / fleet view');
+        }
+        const callArgs = {};
+        if (options.workspaceId)
+            callArgs.workspaceId = options.workspaceId;
+        if (options.op)
+            callArgs.opSlug = options.op;
+        if (options.failedOnly)
+            callArgs.failedOnly = true;
+        const data = await withSpinner('Scanning the system', () => adminCall('admin:seed-status', callArgs));
+        if (isJsonMode()) {
+            process.stdout.write(JSON.stringify(data, null, 2) + '\n');
+            return;
+        }
+        renderSeedStatusReport(data);
+        outro('Done');
     });
     seed
         .command('run')
@@ -291,19 +665,18 @@ export function attachSeedCommands(seed) {
         .argument('<name>', 'e.g. knowledge or seed:knowledge')
         .option('--dry-run', 'Pass dryRun when supported', false)
         .option('--workspace-id <id>', 'Workspace id for workspace-scoped seeds')
-        .option('--preset-id <id>', 'Required for methodology-preset')
         .option('--confirm', 'Non-interactive prod acknowledgment for dangerous ops', false)
         .action(async (name, options) => {
-        const { siteUrl } = getConfig();
+        const { siteUrl } = resolveAdminConfig();
         const manifestName = normalizeSeedCommandName(name);
-        const meta = SEED_BY_NAME.get(manifestName);
-        const isProd = isProductionSite(siteUrl);
-        // All seed ops on prod require confirmation — same policy as `seed all`.
-        if (isProd) {
+        const needsConfirm = requiresAdminDestructiveConfirmation(siteUrl);
+        // Remote / prod deployments require confirmation — not local or known dev-cloud.
+        if (needsConfirm) {
             const ok = await confirmProdAction({
                 confirm: options.confirm,
                 isProduction: true,
-                message: `Run ${manifestName} on production?`,
+                message: seedRunConfirmMessage(siteUrl, manifestName),
+                noteTitle: confirmRiskNoteTitle(siteUrl),
             });
             if (!ok) {
                 process.stderr.write('Cancelled.\n');
@@ -311,36 +684,192 @@ export function attachSeedCommands(seed) {
                 return;
             }
         }
-        adminBanner(siteUrl);
-        const label = `Running ${manifestName}`;
-        const data = await withSpinner(label, () => runSeedOperation(manifestName, {
+        if (!isJsonMode()) {
+            adminBanner(siteUrl);
+            intro(`seed:${shortLabel(manifestName)}`);
+        }
+        const data = await withSpinner(`Running ${manifestName}`, () => runSeedOperation(manifestName, {
             workspaceId: options.workspaceId,
             dryRun: options.dryRun,
-            presetId: options.presetId,
         }));
         if (isJsonMode()) {
             process.stdout.write(JSON.stringify({ command: manifestName, data }, null, 2) + '\n');
+            return;
         }
-        else {
-            process.stdout.write(`\n${green(icons.pass)} ${bold(manifestName)} complete.\n`);
-            process.stdout.write(dim(JSON.stringify(data, null, 2)) + '\n');
+        const summaryLines = data && typeof data === 'object'
+            ? Object.entries(data)
+                .map(([k, v]) => `${k}: ${typeof v === 'object' ? JSON.stringify(v) : String(v)}`)
+                .slice(0, 8)
+                .join('\n')
+            : String(data ?? 'No response data');
+        note(summaryLines || 'No response data', manifestName);
+        outro('Complete');
+    });
+    // ─── WP-379 S5a: Starter Setup subcommands ─────────────────────────────────
+    seed
+        .command('show-starter')
+        .description('List 18 Starter Setup assets for a workspace with body previews, lockLevel, and gate summary')
+        .option('--workspace-id <id>', 'Workspace id (required; defaults to session workspace when set)')
+        .action(async (options) => {
+        const wsId = requireWorkspaceId(options.workspaceId);
+        const { siteUrl } = resolveAdminConfig();
+        if (!isJsonMode()) {
+            adminBanner(siteUrl);
+            intro('seed:show-starter');
+        }
+        const data = await withSpinner('Fetching starter assets', () => adminCall('seed:show-starter', { workspaceId: wsId }));
+        if (isJsonMode()) {
+            process.stdout.write(JSON.stringify(data, null, 2) + '\n');
+            return;
+        }
+        const assets = Array.isArray(data?.assets) ? data.assets : [];
+        if (assets.length === 0) {
+            note('No platform-seeded assets found. Run: pb admin seed run backfill-starter', 'show-starter');
+            outro('Done');
+            return;
         }
+        const wIdx = assets.length.toString().length + 2;
+        const wId = Math.max(10, ...assets.map((a) => a.entryId.length));
+        const wLock = 10;
+        const wGate = 24;
+        process.stdout.write(`${bold(`${'#'.padEnd(wIdx)}${' '}${'Entry ID'.padEnd(wId)}  ${'Lock'.padEnd(wLock)}  ${'Gate'.padEnd(wGate)}  Name / Preview`)}\n`);
+        process.stdout.write(dim('─'.repeat(wIdx + wId + wLock + wGate + 40)) + '\n');
+        assets.forEach((asset, i) => {
+            const idx = `${i + 1}.`.padEnd(wIdx);
+            const entryId = cyan(asset.entryId.padEnd(wId));
+            const lock = dim((asset.lockLevel ?? '—').padEnd(wLock));
+            const gateStr = asset.gate
+                ? asset.gate.kind === 'always'
+                    ? 'always'
+                    : `readiness[${asset.gate.min ?? '0'}–${asset.gate.max ?? '100'}]`
+                : '—';
+            const gate = dim(gateStr.padEnd(wGate));
+            const preview = dim(asset.bodyPreview.slice(0, 60));
+            process.stdout.write(`${idx} ${entryId}  ${lock}  ${gate}  ${bold(asset.name)}  ${preview}\n`);
+        });
+        process.stdout.write('\n');
+        note(`${assets.length} / 18 starter assets seeded`, 'show-starter');
+        outro('Done');
     });
+    seed
+        .command('backfill-starter')
+        .description('Idempotent bulk seed of Starter Setup bundle across workspaces (dry-run by default)')
+        .option('--all', 'Required: acknowledge you intend to act on all workspaces in scope', false)
+        .option('--dry-run', 'Preview what would be seeded without writing anything (default behavior)', false)
+        .option('--workspace-scope <scope>', 'Required when --confirm is passed: dev | prod | all')
+        .option('--confirm', 'Execute seeds (requires --all and --workspace-scope)', false)
+        .action(async (options) => {
+        const { siteUrl } = resolveAdminConfig();
+        // CLI-side guard: --confirm requires --all
+        if (options.confirm && !options.all) {
+            process.stderr.write(red('Error: --confirm requires --all. Pass --all to acknowledge you intend to act on all workspaces in scope.\n'));
+            process.exitCode = 1;
+            return;
+        }
+        // Validate args and enforce scope gate via shared helper (also used by tests)
+        let callArgs;
+        try {
+            callArgs = buildBackfillStarterArgs({
+                confirm: options.confirm,
+                dryRun: options.dryRun,
+                workspaceScope: options.workspaceScope,
+            });
+        }
+        catch (e) {
+            process.stderr.write(red(`Error: ${e instanceof Error ? e.message : String(e)}\n`));
+            process.exitCode = 1;
+            return;
+        }
+        const isConfirm = options.confirm;
+        const isDryRun = callArgs.dryRun;
+        // Production acknowledgment for destructive confirm path
+        const needsConfirm = requiresAdminDestructiveConfirmation(siteUrl);
+        if (isConfirm && needsConfirm) {
+            const ok = await confirmProdAction({
+                confirm: options.confirm,
+                isProduction: true,
+                message: `Seed Starter Setup across ALL workspaces (scope: ${options.workspaceScope ?? 'all'}) on ${siteUrl}`,
+                noteTitle: confirmRiskNoteTitle(siteUrl),
+            });
+            if (!ok) {
+                process.stderr.write('Cancelled.\n');
+                process.exitCode = 1;
+                return;
+            }
+        }
+        if (!isJsonMode()) {
+            adminBanner(siteUrl);
+            intro(`seed:backfill-starter (${isDryRun ? 'DRY RUN' : 'EXECUTE'})`);
+        }
+        const result = await withSpinner(isDryRun ? 'Running dry-run scan' : 'Seeding workspaces', () => adminCall('seed:backfill-starter', callArgs));
+        if (isJsonMode()) {
+            process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+            return;
+        }
+        // Per-workspace progress
+        const rows = Array.isArray(result?.rows) ? result.rows : [];
+        for (const row of rows) {
+            const statusIcon = row.status === 'seeded' ? green(icons.pass) :
+                row.status === 'already-seeded' ? dim(icons.dot) :
+                    row.status === 'errored' ? red(icons.fail) :
+                        dim(icons.dot);
+            const detail = row.detail ? dim(`  ${row.detail}`) : '';
+            process.stdout.write(`  ${statusIcon}  ${bold(row.workspaceName)}${detail}\n`);
+        }
+        // Summary
+        const summaryLines = [
+            `Total workspaces: ${result.totalWorkspaces}`,
+            result.seededCount > 0 ? `${green(icons.pass)} Seeded: ${result.seededCount}` : null,
+            result.alreadySeededCount > 0 ? `${dim(icons.dot)} Already seeded: ${result.alreadySeededCount}` : null,
+            result.skippedCount > 0 ? `${dim(icons.dot)} Skipped (dry-run): ${result.skippedCount}` : null,
+            `Scope: ${result.workspaceScope}`,
+            result.dryRun ? dim('(dry-run — no writes performed)') : green('(writes executed)'),
+        ].filter(Boolean).join('\n');
+        note(summaryLines, 'backfill-starter');
+        outro('Done');
+    });
+    seed
+        .command('migrate-starter-fields')
+        .description('STUB (WP-379 S5b): backfill explicit lockLevel + gate columns on existing setup-assets entries')
+        .option('--workspace-id <id>', 'Workspace id (required; defaults to session workspace when set)')
+        .option('--dry-run', 'Preview changes without writing (default in stub)', false)
+        .action(async (options) => {
+        const wsId = requireWorkspaceId(options.workspaceId);
+        const { siteUrl } = resolveAdminConfig();
+        if (!isJsonMode()) {
+            adminBanner(siteUrl);
+            intro('seed:migrate-starter-fields');
+        }
+        const result = await withSpinner('Calling migrate-starter-fields', () => adminCall('seed:migrate-starter-fields', { workspaceId: wsId, dryRun: options.dryRun }));
+        if (isJsonMode()) {
+            process.stdout.write(JSON.stringify({ command: 'seed:migrate-starter-fields', data: result }, null, 2) + '\n');
+            return;
+        }
+        const summaryLines = [
+            `Migrated: ${result.migrated}`,
+            `Skipped: ${result.skipped}`,
+            `Dry-run: ${result.dryRun}`,
+            result.note ? dim(result.note) : null,
+        ].filter(Boolean).join('\n');
+        note(summaryLines, 'migrate-starter-fields');
+        outro('Done');
+    });
+    // ─── End WP-379 S5a Starter Setup subcommands ───────────────────────────────
     seed
         .command('all')
-        .description('Run all seed operations in manifest order (skips methodology-preset unless --preset-id)')
+        .description('Run all seed operations in manifest order')
         .option('--workspace-id <id>', 'Workspace id for workspace-scoped seeds')
-        .option('--preset-id <id>', 'If set, runs seed:methodology-preset with this preset')
         .option('--dry-run', 'Pass dryRun to operations that support it', false)
         .option('--confirm', 'Required in production (non-interactive)', false)
         .action(async (options) => {
-        const { siteUrl } = getConfig();
-        const isProd = isProductionSite(siteUrl);
-        if (isProd) {
+        const { siteUrl } = resolveAdminConfig();
+        const needsConfirm = requiresAdminDestructiveConfirmation(siteUrl);
+        if (needsConfirm) {
             const ok = await confirmProdAction({
                 confirm: options.confirm,
                 isProduction: true,
-                message: 'Run ALL seed operations on production?',
+                message: seedAllConfirmMessage(siteUrl),
+                noteTitle: confirmRiskNoteTitle(siteUrl),
             });
             if (!ok) {
                 process.stderr.write('Cancelled.\n');
@@ -348,52 +877,67 @@ export function attachSeedCommands(seed) {
                 return;
             }
         }
-        adminBanner(siteUrl);
         const results = [];
-        for (const cmd of SEED_MANIFEST_ORDER) {
-            if (cmd === 'seed:methodology-preset' && !options.presetId) {
-                results.push({
-                    command: cmd,
-                    ok: true,
-                    skipped: true,
-                    note: 'pass --preset-id to include methodology preset',
-                });
-                if (!isJsonMode()) {
-                    process.stdout.write(`${dim(icons.dot)} ${cmd} skipped (no --preset-id)\n`);
+        // ── JSON mode: silent execution, structured output ────────────────────
+        if (isJsonMode()) {
+            for (const cmd of SEED_MANIFEST_ORDER) {
+                try {
+                    const args = buildSeedArgs(cmd, { workspaceId: options.workspaceId, dryRun: options.dryRun });
+                    await adminCall(toBackendCommand(cmd), args);
+                    results.push({ command: cmd, ok: true });
+                }
+                catch (e) {
+                    const msg = e instanceof Error ? e.message : String(e);
+                    results.push({ command: cmd, ok: false, error: msg });
+                    break;
                 }
-                continue;
             }
+            if (results.some((r) => !r.ok))
+                process.exitCode = 1;
+            process.stdout.write(JSON.stringify({ results }, null, 2) + '\n');
+            return;
+        }
+        // ── Human mode: spinner per operation + finale summary panel ─────────
+        adminBanner(siteUrl);
+        intro('Seed All Operations');
+        const total = SEED_MANIFEST_ORDER.length;
+        let current = 0;
+        const startMs = Date.now();
+        const s = clack.spinner();
+        for (const cmd of SEED_MANIFEST_ORDER) {
+            current++;
+            const label = shortLabel(cmd);
+            s.start(`${current}/${total}  ${label}`);
             try {
-                await withSpinner(`Running ${cmd}`, async () => {
-                    const args = buildSeedArgs(cmd, {
-                        workspaceId: options.workspaceId,
-                        dryRun: options.dryRun,
-                        presetId: options.presetId,
-                    });
-                    await adminCall(cmd, args);
-                });
+                const args = buildSeedArgs(cmd, { workspaceId: options.workspaceId, dryRun: options.dryRun });
+                await adminCall(toBackendCommand(cmd), args);
+                s.stop(`${green(icons.pass)} ${label}`);
                 results.push({ command: cmd, ok: true });
-                if (!isJsonMode()) {
-                    process.stdout.write(`${green(icons.pass)} ${cmd}\n`);
-                }
             }
             catch (e) {
                 const msg = e instanceof Error ? e.message : String(e);
+                s.stop(`${red(icons.fail)} ${label} — ${msg}`);
                 results.push({ command: cmd, ok: false, error: msg });
-                if (!isJsonMode()) {
-                    process.stdout.write(`${red(icons.fail)} ${cmd} — ${msg}\n`);
-                }
                 break;
             }
         }
-        if (results.some((r) => !r.ok)) {
+        const elapsed = ((Date.now() - startMs) / 1000).toFixed(1);
+        const passed = results.filter((r) => r.ok && !r.skipped).length;
+        const skippedCount = results.filter((r) => r.skipped).length;
+        const failed = results.filter((r) => !r.ok).length;
+        const summaryLines = [
+            `${green(icons.pass)} ${passed} succeeded`,
+            skippedCount > 0 ? `${dim(icons.dot)} ${skippedCount} skipped` : null,
+            failed > 0 ? `${red(icons.fail)} ${failed} failed` : null,
+            `${dim(`elapsed: ${elapsed}s`)}`,
+        ].filter(Boolean).join('\n');
+        note(summaryLines, `${passed + skippedCount}/${total} complete`);
+        if (failed > 0) {
             process.exitCode = 1;
-        }
-        if (isJsonMode()) {
-            process.stdout.write(JSON.stringify({ results }, null, 2) + '\n');
+            outro('Some operations failed — fix errors and re-run affected seeds individually');
         }
         else {
-            hint('seed all stops on first failure. Fix the error and re-run, or run individual `pb admin seed run` commands.');
+            outro(`All ${passed} operations complete in ${elapsed}s`);
         }
     });
 }