@productbrain/cli 0.1.0-beta.47 → 0.1.0-beta.4721

package/dist/commands/admin/probe.js

@@ -0,0 +1,191 @@
+import { resolveNamedProfileConfig } from '../../lib/profiles.js';
+import { CLIError, ErrorCode } from '../../lib/errors.js';
+import { adminBanner, bold, cyan, dim, green, heading, red } from '../../lib/style.js';
+import { isJsonMode } from '../../lib/runner.js';
+function isLedgerPayload(data) {
+    return (!!data &&
+        typeof data === 'object' &&
+        Array.isArray(data.rows));
+}
+/** Reconstructs the {rows:[{migrationId,scopes}]} shape diffMigrationLedgerResults expects,
+ * from the flat rows accumulated across every followed page. */
+function groupLedgerRows(rows) {
+    const byMigration = new Map();
+    for (const { migrationId, ...scope } of rows) {
+        const existing = byMigration.get(migrationId);
+        if (existing)
+            existing.push(scope);
+        else
+            byMigration.set(migrationId, [scope]);
+    }
+    return {
+        rows: Array.from(byMigration.entries()).map(([migrationId, scopes]) => ({ migrationId, scopes })),
+        truncated: false,
+    };
+}
+/**
+ * Per-migrationId, per-scopeHandle status comparison across environments — exported for unit
+ * testing (Task 11 Step 1). Degrades gracefully (empty rows) for a non-migrationLedger-shaped
+ * probe payload rather than throwing — `pb admin probe` supports every registered probe, not
+ * just migrationLedger, so a generic diff must not assume the shape.
+ */
+export function diffMigrationLedgerResults(results) {
+    const byKey = new Map();
+    for (const r of results) {
+        if (!r.ok || !isLedgerPayload(r.data))
+            continue;
+        for (const entry of r.data.rows) {
+            for (const scope of entry.scopes) {
+                const key = `${entry.migrationId} ${scope.scopeHandle}`;
+                if (!byKey.has(key))
+                    byKey.set(key, new Map());
+                byKey.get(key).set(r.env, scope.status);
+            }
+        }
+    }
+    const envNames = results.map((r) => r.env);
+    const rows = Array.from(byKey.entries()).map(([key, statusesByEnv]) => {
+        const [migrationId, scopeHandle] = key.split(' ');
+        const statuses = {};
+        for (const env of envNames)
+            statuses[env] = statusesByEnv.get(env);
+        const distinct = new Set(Object.values(statuses));
+        return { migrationId, scopeHandle, statuses, diff: distinct.size > 1 };
+    });
+    return { rows };
+}
+/** Resolves one --env value to its {apiKey, siteUrl} via the profile system. Exported for
+ * unit testing the "unknown profile" refusal without a network call. */
+export function resolveProbeEnv(envName) {
+    const config = resolveNamedProfileConfig(envName);
+    if (!config?.apiKey) {
+        throw new CLIError(`No profile named "${envName}" (pb admin probe --env resolves a PROFILE NAME, not a fixed environment enum). Run \`pb profile create ${envName}\` first, or check \`pb profile list\`.`, { code: ErrorCode.CONFIG_INVALID, category: 'config' });
+    }
+    const siteUrl = (config.siteUrl ?? '').replace(/\/$/, '');
+    if (!siteUrl) {
+        throw new CLIError(`Profile "${envName}" has no siteUrl configured.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+        });
+    }
+    return { apiKey: config.apiKey, siteUrl };
+}
+async function fetchProbePage(siteUrl, apiKey, name, cursor) {
+    const url = new URL('/api/admin/probe', siteUrl);
+    url.searchParams.set('name', name);
+    if (cursor)
+        url.searchParams.set('cursor', cursor);
+    const res = await fetch(url.toString(), { headers: { Authorization: `Bearer ${apiKey}` } });
+    const body = (await res.json().catch(() => ({})));
+    return { res, body };
+}
+/** Fail-safe against a pathological non-terminating pagination loop (a server bug that never
+ * sets isDone) — this is not a realistic ledger size, just a circuit breaker. */
+const MAX_PAGES = 200;
+/** Exported for unit testing the page-following loop (Copilot review, PR #574) — mocks global
+ * fetch and asserts the CLI accumulates every page before returning. */
+export async function fetchProbe(env, name) {
+    const { apiKey, siteUrl } = resolveProbeEnv(env);
+    try {
+        if (name !== 'migrationLedger') {
+            const { res, body } = await fetchProbePage(siteUrl, apiKey, name, null);
+            if (body.ok === false || !res.ok) {
+                return { env, ok: false, status: res.status, error: body.error ?? res.statusText };
+            }
+            return { env, ok: true, status: res.status, data: body.data };
+        }
+        // migrationLedger is REAL cursor-paginated (Copilot review, PR #574) — pb admin probe
+        // auto-follows every page so the operator always sees the COMPLETE ledger, never a
+        // silently-partial one. The S5a reconciler reads production through this SAME probe to
+        // decide whether an in-scope migration is unapplied; an incomplete CLI view here would
+        // hide exactly the gap this bet exists to catch.
+        const accumulated = [];
+        let cursor = null;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const { res, body } = await fetchProbePage(siteUrl, apiKey, name, cursor);
+            if (body.ok === false || !res.ok) {
+                return { env, ok: false, status: res.status, error: body.error ?? res.statusText };
+            }
+            const payload = body.data;
+            accumulated.push(...(payload.page ?? []));
+            if (payload.isDone) {
+                return { env, ok: true, status: res.status, data: groupLedgerRows(accumulated) };
+            }
+            cursor = payload.continueCursor ?? null;
+        }
+        return {
+            env,
+            ok: false,
+            error: `migrationLedger probe did not report isDone after ${MAX_PAGES} pages`,
+        };
+    }
+    catch (err) {
+        return { env, ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+function printSingleResult(result) {
+    if (isJsonMode()) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return;
+    }
+    if (!result.ok) {
+        console.log(red(`✗ ${result.env}: ${result.error ?? 'failed'}`));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(heading(`Probe result (${result.env})`));
+    console.log(JSON.stringify(result.data, null, 2));
+}
+function printComparison(results) {
+    if (isJsonMode()) {
+        process.stdout.write(JSON.stringify({ results, diff: diffMigrationLedgerResults(results) }, null, 2) + '\n');
+        return;
+    }
+    for (const r of results) {
+        if (!r.ok)
+            console.log(red(`✗ ${r.env}: ${r.error ?? 'failed'}`));
+    }
+    const { rows } = diffMigrationLedgerResults(results);
+    if (rows.length === 0) {
+        console.log(dim('No comparable migration-ledger rows across the given environments.'));
+        for (const r of results) {
+            if (r.ok) {
+                console.log(heading(`Probe result (${r.env})`));
+                console.log(JSON.stringify(r.data, null, 2));
+            }
+        }
+        return;
+    }
+    const envNames = results.map((r) => r.env);
+    console.log(heading(`Cross-environment comparison (${envNames.join(' vs ')})`));
+    for (const row of rows) {
+        const statusCols = envNames.map((e) => `${e}=${row.statuses[e] ?? dim('(absent)')}`).join('  ');
+        const marker = row.diff ? red('DIFF') : green('same');
+        console.log(`${bold(row.migrationId)} ${cyan(row.scopeHandle.slice(0, 10))}…  ${statusCols}  ${marker}`);
+    }
+}
+export function attachProbeCommand(admin) {
+    admin
+        .command('probe')
+        .description('Read the cross-environment probe window (GET /api/admin/probe). --env resolves a ' +
+        'named profile; repeat --env to compare environments side by side.')
+        .argument('<name>', 'probe name, e.g. migrationLedger, credentialAge, platformEntries, collectionShapeDrift')
+        .option('--env <name>', 'profile name to query (repeatable)', (v, prev) => [...prev, v], [])
+        .action(async (name, options) => {
+        const envs = options.env.length > 0 ? options.env : ['default'];
+        for (const env of envs) {
+            const { siteUrl } = resolveProbeEnv(env);
+            adminBanner(siteUrl);
+        }
+        const results = await Promise.all(envs.map((env) => fetchProbe(env, name)));
+        if (results.length > 1) {
+            printComparison(results);
+        }
+        else {
+            printSingleResult(results[0]);
+        }
+        if (results.some((r) => !r.ok))
+            process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=probe.js.map

package/dist/commands/admin/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../src/commands/admin/probe.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAcjD,SAAS,eAAe,CAAC,IAAa;IACrC,OAAO,CACN,CAAC,CAAC,IAAI;QACN,OAAO,IAAI,KAAK,QAAQ;QACxB,KAAK,CAAC,OAAO,CAAE,IAA2B,CAAC,IAAI,CAAC,CAChD,CAAC;AACH,CAAC;AAOD;gEACgE;AAChE,SAAS,eAAe,CAAC,IAAqB;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC9B,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjG,SAAS,EAAE,KAAK;KAChB,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAyB;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAoB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE;QACtF,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAuC,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,CAAC;AACjB,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC9C,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CACjB,qBAAqB,OAAO,2GAA2G,OAAO,yCAAyC,EACvL,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACtD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,YAAY,OAAO,8BAA8B,EAAE;YACrE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAID,KAAK,UAAU,cAAc,CAC5B,OAAe,EACf,MAAc,EACd,IAAY,EACZ,MAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAkB,CAAC;IACnE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;iFACiF;AACjF,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC;QACJ,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/D,CAAC;QAED,sFAAsF;QACtF,mFAAmF;QACnF,uFAAuF;QACvF,uFAAuF;QACvF,iDAAiD;QACjD,MAAM,WAAW,GAAoB,EAAE,CAAC;QACxC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAA6E,CAAC;YACnG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,CAAC;YACD,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACzC,CAAC;QACD,OAAO;YACN,GAAG;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,qDAAqD,SAAS,QAAQ;SAC7E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsB;IAChD,IAAI,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,OAAyB;IACjD,IAAI,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACtF,CAAC;QACF,OAAO;IACR,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;QACD,OAAO;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1G,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,KAAK;SACH,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACX,mFAAmF;QAClF,mEAAmE,CACpE;SACA,QAAQ,CAAC,QAAQ,EAAE,wFAAwF,CAAC;SAC5G,MAAM,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC,CAAS,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,EAAc,CAAC;SACzH,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA0B,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/admin/probe.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=probe.test.d.ts.map

package/dist/commands/admin/probe.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.test.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/probe.test.ts"],"names":[],"mappings":""}

package/dist/commands/admin/probe.test.js

@@ -0,0 +1,146 @@
+/**
+ * Task 11 Step 1 — pb admin probe tests (WP-608, parent WP-604).
+ *
+ * `--env prod --env dev` must print both side by side and diff per scope handle — the exact
+ * question being asked on 2026-08-02 ("did it run everywhere"). diffMigrationLedgerResults and
+ * resolveProbeEnv are pure, network-free, and exported specifically for this.
+ */
+import { describe, expect, it, vi, afterEach } from 'vitest';
+import { diffMigrationLedgerResults, resolveProbeEnv, fetchProbe } from './probe.js';
+vi.mock('../../lib/profiles.js', () => ({
+    resolveNamedProfileConfig: vi.fn((name) => {
+        if (name === 'prod')
+            return { apiKey: 'pb_sk_prod', siteUrl: 'https://prod.example.com' };
+        if (name === 'dev')
+            return { apiKey: 'pb_sk_dev', siteUrl: 'https://dev.example.com' };
+        if (name === 'no-site')
+            return { apiKey: 'pb_sk_x' };
+        return null;
+    }),
+}));
+describe('resolveProbeEnv', () => {
+    it('resolves a known profile to its apiKey + siteUrl', () => {
+        expect(resolveProbeEnv('prod')).toEqual({ apiKey: 'pb_sk_prod', siteUrl: 'https://prod.example.com' });
+    });
+    it('throws a clear, non-network error for an unknown profile name', () => {
+        expect(() => resolveProbeEnv('nope')).toThrow(/No profile named "nope"/);
+    });
+    it('throws when the profile has no siteUrl configured', () => {
+        expect(() => resolveProbeEnv('no-site')).toThrow(/no siteUrl configured/);
+    });
+});
+describe('diffMigrationLedgerResults', () => {
+    it('prints both environments side by side and marks a differing status as DIFF', () => {
+        const results = [
+            {
+                env: 'prod',
+                ok: true,
+                data: { rows: [{ migrationId: 'wp586', scopes: [{ scopeHandle: 'abc123', status: 'no-evidence' }] }], truncated: false },
+            },
+            {
+                env: 'dev',
+                ok: true,
+                data: { rows: [{ migrationId: 'wp586', scopes: [{ scopeHandle: 'abc123', status: 'applied' }] }], truncated: false },
+            },
+        ];
+        const { rows } = diffMigrationLedgerResults(results);
+        expect(rows).toHaveLength(1);
+        expect(rows[0].migrationId).toBe('wp586');
+        expect(rows[0].scopeHandle).toBe('abc123');
+        expect(rows[0].statuses).toEqual({ prod: 'no-evidence', dev: 'applied' });
+        expect(rows[0].diff).toBe(true);
+    });
+    it('marks matching statuses as NOT diff', () => {
+        const results = [
+            { env: 'prod', ok: true, data: { rows: [{ migrationId: 'm', scopes: [{ scopeHandle: 'h', status: 'applied' }] }], truncated: false } },
+            { env: 'dev', ok: true, data: { rows: [{ migrationId: 'm', scopes: [{ scopeHandle: 'h', status: 'applied' }] }], truncated: false } },
+        ];
+        const { rows } = diffMigrationLedgerResults(results);
+        expect(rows[0].diff).toBe(false);
+    });
+    it('a scope present in one environment but absent in another is a diff (undefined vs a status)', () => {
+        const results = [
+            { env: 'prod', ok: true, data: { rows: [{ migrationId: 'm', scopes: [{ scopeHandle: 'h', status: 'applied' }] }], truncated: false } },
+            { env: 'dev', ok: true, data: { rows: [], truncated: false } },
+        ];
+        const { rows } = diffMigrationLedgerResults(results);
+        expect(rows).toHaveLength(1);
+        expect(rows[0].statuses).toEqual({ prod: 'applied', dev: undefined });
+        expect(rows[0].diff).toBe(true);
+    });
+    it('degrades to empty rows for a non-migrationLedger-shaped payload rather than throwing', () => {
+        const results = [
+            { env: 'prod', ok: true, data: { some: 'other', shape: true } },
+            { env: 'dev', ok: true, data: { some: 'other', shape: true } },
+        ];
+        expect(() => diffMigrationLedgerResults(results)).not.toThrow();
+        expect(diffMigrationLedgerResults(results).rows).toEqual([]);
+    });
+    it('skips a failed environment result rather than crashing the diff', () => {
+        const results = [
+            { env: 'prod', ok: false, error: 'boom' },
+            { env: 'dev', ok: true, data: { rows: [{ migrationId: 'm', scopes: [{ scopeHandle: 'h', status: 'applied' }] }], truncated: false } },
+        ];
+        const { rows } = diffMigrationLedgerResults(results);
+        expect(rows[0].statuses).toEqual({ prod: undefined, dev: 'applied' });
+    });
+});
+describe('fetchProbe — migrationLedger page-following (Copilot review, PR #574)', () => {
+    const originalFetch = globalThis.fetch;
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it('auto-follows every page until isDone and returns the COMPLETE, regrouped ledger', async () => {
+        const calls = [];
+        globalThis.fetch = vi.fn(async (input) => {
+            const url = new URL(String(input));
+            calls.push(url.searchParams.get('cursor') ?? '(none)');
+            const cursor = url.searchParams.get('cursor');
+            if (!cursor) {
+                return new Response(JSON.stringify({
+                    ok: true,
+                    data: {
+                        page: [{ migrationId: 'm1', scopeHandle: 'h1', status: 'applied' }],
+                        isDone: false,
+                        continueCursor: 'cursor-page-2',
+                    },
+                }), { status: 200 });
+            }
+            if (cursor === 'cursor-page-2') {
+                return new Response(JSON.stringify({
+                    ok: true,
+                    data: {
+                        page: [{ migrationId: 'm2', scopeHandle: 'h2', status: 'no-evidence' }],
+                        isDone: true,
+                        continueCursor: '',
+                    },
+                }), { status: 200 });
+            }
+            throw new Error(`unexpected cursor in test: ${cursor}`);
+        });
+        const result = await fetchProbe('prod', 'migrationLedger');
+        expect(calls).toEqual(['(none)', 'cursor-page-2']); // exactly two pages followed
+        expect(result.ok).toBe(true);
+        const data = result.data;
+        expect(data.rows.map((r) => r.migrationId).sort()).toEqual(['m1', 'm2']);
+    });
+    it('does NOT page-follow a non-migrationLedger probe (single request only)', async () => {
+        const fetchMock = vi.fn(async () => new Response(JSON.stringify({ ok: true, data: { rows: [] } }), { status: 200 }));
+        globalThis.fetch = fetchMock;
+        await fetchProbe('prod', 'credentialAge');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it('surfaces a mid-page HTTP failure instead of silently returning a partial ledger', async () => {
+        globalThis.fetch = vi.fn(async (input) => {
+            const cursor = new URL(String(input)).searchParams.get('cursor');
+            if (!cursor) {
+                return new Response(JSON.stringify({ ok: true, data: { page: [{ migrationId: 'm1', scopeHandle: 'h1', status: 'applied' }], isDone: false, continueCursor: 'c2' } }), { status: 200 });
+            }
+            return new Response(JSON.stringify({ ok: false, error: 'boom' }), { status: 500 });
+        });
+        const result = await fetchProbe('prod', 'migrationLedger');
+        expect(result.ok).toBe(false);
+        expect(result.error).toBe('boom');
+    });
+});
+//# sourceMappingURL=probe.test.js.map

package/dist/commands/admin/probe.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.test.js","sourceRoot":"","sources":["../../../src/commands/admin/probe.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAuB,MAAM,YAAY,CAAC;AAE1G,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;QAChD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAC1F,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,OAAO,GAAqB;YAChC;gBACE,GAAG,EAAE,MAAM;gBACX,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;aACzH;YACD;gBACE,GAAG,EAAE,KAAK;gBACV,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;aACrH;SACF,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,OAAO,GAAqB;YAChC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YACtI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;SACtI,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,OAAO,GAAqB;YAChC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YACtI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,OAAO,GAAqB;YAChC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/D,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;SAC/D,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,OAAO,GAAqB;YAChC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;YACzC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;SACtI,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;wBACnE,MAAM,EAAE,KAAK;wBACb,cAAc,EAAE,eAAe;qBAChC;iBACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;wBACvE,MAAM,EAAE,IAAI;wBACZ,cAAc,EAAE,EAAE;qBACnB;iBACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC,CAA4B,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAE3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACjF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAmE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAChF,CAAC;QACF,UAAU,CAAC,KAAK,GAAG,SAAoC,CAAC;QAExD,MAAM,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAE1C,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;YAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,EAChJ,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC,CAA4B,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/admin/run.d.ts

@@ -0,0 +1,43 @@
+/**
+ * pb admin run — generic dispatcher for any admin manifest command (WP-592 S3 review fix).
+ *
+ * `convex/admin/commandManifest.ts` is the SSOT for every admin operation, but before this
+ * command the only generic CLI runner was `pb admin seed run` (seed.ts), which resolves
+ * exclusively against `SEED_BY_NAME` and throws on any `manage:`/`inspect:` name — so a command
+ * like `manage:archive-preset-residue` (WP-592) had NO agent-usable CLI surface on dev at all.
+ * `npx convex run` cannot substitute: it is PREVIEW-only by design (`scripts/convex-run.sh`
+ * refuses any non-`preview:` deployment).
+ *
+ * This command passes the raw parsed args object straight through `adminCall` to `/api/admin` —
+ * the SAME dispatch every other admin command uses, which is what gives a destructive op its
+ * STD-190/DEC-553 audit row (system-admin-gated, argsHash-logged).
+ *
+ * Unknown-command validation is deliberately NOT duplicated client-side. The server's
+ * `dispatchAdminCommand` (convex/admin/adminDispatch.ts) already refuses an unrecognized name
+ * with `Unknown admin command: "<name>". Available: <sorted COMMAND_MAP keys>`, and `adminCall`
+ * (lib/client.ts) throws that message verbatim on any `ok:false` response. A second, client-side
+ * copy of the manifest's command names would only be a second place for that list to drift from
+ * the real one — the server's error response IS the manifest, read live.
+ *
+ * Deployment awareness (WP-592 S3 second-pass review fix). This is the ONE generic command that
+ * can dispatch `manage:delete-workspace`, `manage:delete-user`, and
+ * `manage:archive-preset-residue` — so it must not be the one admin surface that never tells the
+ * operator which deployment it is about to hit. `adminBanner` prints unconditionally (it
+ * self-gates on quiet/JSON mode, same as every sibling command). The confirm gate is deliberately
+ * keyed on `requiresAdminDestructiveConfirmation(siteUrl)` — the DEPLOYMENT TIER — never on a
+ * client-side guess at whether `name` is "dangerous": duplicating the manifest's danger
+ * classification here is exactly the second copy the docstring above already refuses to keep for
+ * command names, and it would drift from the manifest the same way. So every dispatch through
+ * `run` on a non-local/non-dev-cloud deployment requires `--confirm` (or an interactive prompt),
+ * regardless of which command it is.
+ */
+import { Command } from 'commander';
+/**
+ * Parses a JSON args string into a plain object args map. Exported for unit testing.
+ * Refuses (never silently coerces) anything that isn't a JSON OBJECT — an array or bare scalar
+ * would otherwise reach `adminCall` as `args`, which every manifest command's Convex validator
+ * expects to be an object.
+ */
+export declare function parseRunArgs(raw: string | undefined): Record<string, unknown>;
+export declare function attachRunCommand(admin: Command): void;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/admin/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB7E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CA2DrD"}

package/dist/commands/admin/run.js

@@ -0,0 +1,78 @@
+import { adminCall } from '../../lib/client.js';
+import { resolveAdminConfig } from '../../lib/adminConfig.js';
+import { CLIError, ErrorCode } from '../../lib/errors.js';
+import { adminBanner, confirmProdAction } from '../../lib/style.js';
+import { confirmRiskNoteTitle, requiresAdminDestructiveConfirmation } from '../../lib/deployment.js';
+/**
+ * Parses a JSON args string into a plain object args map. Exported for unit testing.
+ * Refuses (never silently coerces) anything that isn't a JSON OBJECT — an array or bare scalar
+ * would otherwise reach `adminCall` as `args`, which every manifest command's Convex validator
+ * expects to be an object.
+ */
+export function parseRunArgs(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new CLIError(`Invalid JSON args: ${err instanceof Error ? err.message : String(err)}\n  Got: ${raw}`, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new CLIError(`Args must be a JSON OBJECT, e.g. '{"workspaceId":"<id>"}'. Got: ${raw}`, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+    }
+    return parsed;
+}
+export function attachRunCommand(admin) {
+    admin
+        .command('run')
+        .description('Run any admin manifest command directly by its full name (e.g. manage:archive-preset-residue). ' +
+        'The only generic runner that reaches manage:/inspect: commands — pb admin seed run is seed-only.')
+        .argument('<name>', 'full manifest command name, e.g. manage:archive-preset-residue')
+        .argument('[jsonArgs]', 'JSON object of args, e.g. \'{"workspaceId":"<id>"}\' (default: {})')
+        .option('--confirm', 'Non-interactive prod/cloud acknowledgment — required on a deployment tier that needs it', false)
+        .action(async (name, jsonArgs, options) => {
+        const args = parseRunArgs(jsonArgs);
+        // Let a config error surface naturally (no swallowed catch) — every path below, including
+        // the confirm gate, needs a real siteUrl to reason about.
+        const { siteUrl, source, profileName } = resolveAdminConfig();
+        // WP-681: name WHICH credential resolved the target, not just the deployment tier — this is
+        // the ONE generic command that can silently dispatch a destructive op to the wrong
+        // deployment (live-reproduced: a repo-pinned dev profile got overridden by the operator's
+        // global active profile, defaulting to prod, with nothing in the banner or the confirm
+        // prompt saying so).
+        const profileLabel = source === 'local-profile' && profileName ? `${profileName} (repo-pinned)`
+            : source === 'global-profile' && profileName ? `${profileName} (global)`
+                : source === 'env' ? 'shell env vars'
+                    : source === 'legacy' ? 'legacy ~/.config/productbrain/.env'
+                        : undefined;
+        // Deployment-tier gate, not a command-name allowlist (see module docstring) — `run` reaches
+        // every manifest command including the destructive ones, so any non-local/non-dev-cloud
+        // deployment requires explicit acknowledgment regardless of which command is being sent.
+        const needsConfirm = requiresAdminDestructiveConfirmation(siteUrl);
+        if (needsConfirm) {
+            const ok = await confirmProdAction({
+                confirm: options.confirm,
+                isProduction: true,
+                message: `Run admin command "${name}" via pb admin run on ${siteUrl}${profileLabel ? ` (profile: ${profileLabel})` : ''}?`,
+                noteTitle: confirmRiskNoteTitle(siteUrl),
+            });
+            if (!ok) {
+                process.stderr.write('Cancelled.\n');
+                process.exitCode = 1;
+                return;
+            }
+        }
+        // Self-gates on quiet/JSON mode (style.ts) — matches every sibling admin command's banner.
+        adminBanner(siteUrl, profileLabel);
+        // No client-side command-name allowlist — see module docstring: the server's own refusal
+        // already lists every valid name, read live from COMMAND_MAP, with no second copy to drift.
+        const data = await adminCall(name, args);
+        // Always the FULL result, untruncated, as JSON — a dry-run's candidate list (e.g.
+        // manage:archive-preset-residue) is the founder's review artifact, and there is no sensible
+        // generic human-format for a result shape that varies per arbitrary manifest command.
+        process.stdout.write(JSON.stringify({ command: name, data }, null, 2) + '\n');
+    });
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/admin/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/admin/run.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAErG;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAEtD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,EACvF,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAChB,mEAAmE,GAAG,EAAE,EACxE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,KAAK;SACF,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,iGAAiG;QAC/F,kGAAkG,CACrG;SACA,QAAQ,CAAC,QAAQ,EAAE,gEAAgE,CAAC;SACpF,QAAQ,CAAC,YAAY,EAAE,oEAAoE,CAAC;SAC5F,MAAM,CAAC,WAAW,EAAE,yFAAyF,EAAE,KAAK,CAAC;SACrH,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,QAA4B,EAAE,OAA6B,EAAE,EAAE;QAC1F,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEpC,0FAA0F;QAC1F,0DAA0D;QAC1D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAE9D,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,uFAAuF;QACvF,qBAAqB;QACrB,MAAM,YAAY,GAChB,MAAM,KAAK,eAAe,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,gBAAgB;YAC1E,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,WAAW;gBACxE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB;oBACrC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC;wBAC5D,CAAC,CAAC,SAAS,CAAC;QAEd,4FAA4F;QAC5F,wFAAwF;QACxF,yFAAyF;QACzF,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBACjC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,IAAI;gBAClB,OAAO,EAAE,sBAAsB,IAAI,yBAAyB,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,cAAc,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;gBAC1H,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC;aACzC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACrC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEnC,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEzC,kFAAkF;QAClF,4FAA4F;QAC5F,sFAAsF;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/admin/run.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tests for `pb admin run <name> [jsonArgs]` — the generic admin-manifest dispatcher
+ * (WP-592 S3 review fix).
+ *
+ * Covers:
+ *   - dispatches the given command name with parsed JSON args via adminCall
+ *   - defaults to {} when jsonArgs is omitted
+ *   - rejects invalid JSON before ever calling adminCall
+ *   - rejects a JSON array / scalar (must be an object) before ever calling adminCall
+ *   - prints the FULL result as JSON, untruncated
+ *   - an unknown-command error from adminCall (mirroring the server's
+ *     "Unknown admin command" refusal) propagates rather than being swallowed
+ *   - prints the deployment banner before dispatching (WP-592 S3 second-pass review fix)
+ *   - a deployment tier that requires confirmation gates the dispatch on confirmProdAction
+ *   - a tier that does not require confirmation (e.g. local) never consults confirmProdAction
+ */
+export {};
+//# sourceMappingURL=run.test.d.ts.map

package/dist/commands/admin/run.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.test.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/run.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}