@sanity/workflow-cli 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # @sanity/workflow-cli
 
+## 0.13.0
+
+### Minor Changes
+
+- 58f8211: Every command's canonical oclif id now nests under the `editorial-workflows` topic, making the package mountable as a plugin of the `sanity` CLI (`sanity editorial-workflows deploy`) without colliding with host commands. The standalone surface is unchanged: the bare forms (`sanity-workflows deploy`, `sanity-workflows definition list`, …) remain as aliases of the nested ids.
+- 00c089d: **BREAKING:** Require every definition deployment and workflow deployment configuration to state an `expectedMinReaderModel` literal that exactly matches the installed engine's writer capability.
+
+  Deploy and definition-diff paths now reject missing or stale acknowledgements before client access or telemetry, with a structured error and readers-first rollout guidance.
+
+- 53661fa: Prompt interactive deploys to select a configured deployment tag when several are available and no selector flag was supplied. Render Ctrl+C prompt cancellations without a stack trace.
+
+### Patch Changes
+
+- 82e4a4e: Fix definition sharing to honor its opt-out contract: deploys now share newly created definition versions by default in every environment, including CI, `DO_NOT_TRACK`, and non-TTY runs. The first interactive run shows a mandatory disclosure rather than a consent choice, every other flagless run prints a clear status block with the explicit opt-in and opt-out flags, and only `--no-share-defs` suppresses sharing for that invocation.
+- 9126299: **BREAKING:** Delete persisted stage guard documents when their stage exits, and remove the lifted-record `GUARD_LIFTED_PREDICATE` and `isGuardLifted` exports.
+
+  Guard deletion now uses the observed document revision so stale exit reconciliation cannot delete a guard reactivated by a newer stage visit. Reactive guard streams contain only active persisted guards.
+
+- Updated dependencies [239d9f6]
+- Updated dependencies [3af2ca0]
+- Updated dependencies [7276702]
+- Updated dependencies [58f8211]
+- Updated dependencies [00c089d]
+- Updated dependencies [71cd58e]
+- Updated dependencies [cd03973]
+- Updated dependencies [d26cc1a]
+- Updated dependencies [9126299]
+- Updated dependencies [72018af]
+- Updated dependencies [5cd8ffd]
+- Updated dependencies [b82bda4]
+- Updated dependencies [55a54b3]
+- Updated dependencies [b82bda4]
+- Updated dependencies [4490442]
+- Updated dependencies [1540dce]
+  - @sanity/workflow-engine@0.18.0
+
+## 0.12.0
+
+### Minor Changes
+
+- e3a7ba2: `start` gains `--instance-id` — for retries: the id is the start's idempotency key, so passing the id of a start that failed partway resumes it instead of creating a duplicate (an already-settled start replays as a no-op). A start whose first auto-advance fails after the instance was created and primed (`StartNotSettledError`) now reports as STARTED with the cause and the retry id — a warn, not the "Start rejected" failure path — and the `--json` payload carries `{instanceId, notSettled: true, detail}`. A start that fails before priming (`StartNotPrimedError`) still fails, with the `--instance-id` retry hint appended so the operator can resume instead of duplicating.
+- a8ace4d: New `nuke --tag <tag>` command — the dev-period big red button that deletes every engine-owned document for a deployment tag: instances, definitions, and guard docs (matched by instance-id prefix, so guards orphaned by earlier partial deletions are swept too) across the deployment's workflow resource and every alias-bound resource. Content documents are never touched. The command always prints a per-dataset dry-run plan, then requires typing back every involved `project.dataset` target; `--force` skips the prompt for scripts/CI (the plan still prints). Unlike `definition delete` (the governed lifecycle path), `nuke` deletes raw docs without reading them, so it works on pre-amendment shapes a newer engine can no longer read — the sanctioned reset while the versioned upgrade framework doesn't exist.
+- 5a1a9fe: Direct reads of engine-owned documents adopt the data-model gate (`assertReadableModel`): the CLI's instance and definition reads (`show`, `tail`, `list`, `definition show`, `definition list`, deploy lookups, the share read-back) and the MCP tools that interpret rows from the ungated `engine.query` escape hatch (`list_workflow_definitions`, `list_workflow_instances`, the definition lookup behind `start_workflow` / `get_workflow_definition`). A document written by a newer engine data model now fails with the governed "upgrade `@sanity/workflow-engine`" error instead of rendering unchecked; list projections carry the stamp pair so projected rows gate too.
+
+### Patch Changes
+
+- 092a0d4: **BREAKING:** runtime-supplied refs written into field state are gated on the deployment's declared resource surface.
+  - A `doc.ref` / `doc.refs` / `release.ref` value a caller or effect handler supplies — start `initialFields` input, an action's param-sourced op values, `editField` values, effect-completion ops — must target a declared resource: the `workflowResource` itself or a resource the `resourceClients` resolver serves. An off-surface ref throws the new `RefResourceUndeclaredError` and the commit aborts, instead of writing cleanly and failing later when something dereferences it. The check is advisory like every engine check; stored documents are unchanged.
+  - Definition-authored refs are exempt: literal `initialValue` seeds, `type: 'query'` texts, spawn `with` projections, and op values that bind no action param were validated (and alias-expanded) at deploy, so they materialize into field state without re-checking.
+  - Resource aliases stay a deploy-time abstraction: `deployDefinitions({definitions, resourceAliases?})` expands every `@<alias>:` reference to its physical GDR before fingerprinting, and nothing alias-shaped survives past deploy — the runtime holds no alias map, and an alias-shaped ref supplied to a runtime verb is rejected as malformed like any other non-GDR string.
+  - `createBench` takes `serveResources` (dataset siblings served — and thereby declared — straight from the bench's own store) plus a raw `resourceClients` resolver for anything beyond same-store siblings. The engine also exports `sameResource` alongside the existing GDR helpers.
+  - The CLI wires no `resourceClients`, so refs supplied at runtime through it (`start --field`, `fire-action` ref params) admit the workflow resource only.
+
+- Updated dependencies [f9389e5]
+- Updated dependencies [d0c62ea]
+- Updated dependencies [c3eed2e]
+- Updated dependencies [df4bd80]
+- Updated dependencies [092a0d4]
+- Updated dependencies [5a1a9fe]
+- Updated dependencies [e3a7ba2]
+- Updated dependencies [30fed9e]
+- Updated dependencies [1321ba5]
+- Updated dependencies [e683875]
+- Updated dependencies [a8ace4d]
+  - @sanity/workflow-engine@0.17.0
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -20,6 +20,19 @@ pnpm --filter @sanity/workflow-cli dev list --include-completed
 pnpm --filter @sanity/workflow-cli dev show wf-instance.abc123
 ```
 
+The package is an [oclif](https://oclif.io) plugin: every command's canonical
+id nests under the `editorial-workflows` topic
+(`sanity-workflows editorial-workflows deploy`), so mounting the package into
+the `sanity` CLI's plugin list surfaces the same commands as
+`sanity editorial-workflows …` without its canonical ids colliding with the
+host's own commands (the sanity CLI already has a `deploy`). The bare forms
+used throughout this README (`deploy`, `definition list`, …) are aliases of
+the nested ids and are the standalone binary's stable surface. oclif registers
+plugin aliases in a host unconditionally (an id collision resolves by plugin
+priority, host first), so a host mount would also surface these bare aliases
+at its root — trimming or hiding them for the mounted context is part of the
+host-side mount work, not something a host can configure away.
+
 Authenticate once with `sanity login` (the CLI reads that session token); for
 CI, set `SANITY_AUTH_TOKEN` instead. Then create a `sanity.workflow.ts` in the
 directory you run from — see [Configuration](#configuration).
@@ -46,6 +59,7 @@ import {articleReview, urlDraft} from './src/workflows.ts'
 export default defineWorkflowConfig({
   deployments: [
     {
+      expectedMinReaderModel: 2,
       name: 'production',
       tag: 'prod', // the environment partition the engine's docs are scoped to
       workflowResource: {type: 'dataset', id: 'acme.workflows'}, // where those docs live
@@ -63,22 +77,33 @@ export default defineWorkflowConfig({
 ```
 
 Pick a deployment with `--tag <tag>`; with a single deployment configured you
-can omit it, and with several configured a bare `deploy` fails asking for
-`--tag` or `--all-tags`. `--all-tags` deploys every deployment in the config in
-one run: a failure in one doesn't stop the rest — the run continues, prints a
-summary of what failed, and exits non-zero. The client's project + dataset are derived
-from the deployment's `workflowResource`, and `deploy` expands each
-definition's `@<handle>:` reference to the bound physical resource. An invalid
-config fails with a clean, path-prefixed error before the command runs.
+can omit it. With several configured, a bare interactive `deploy` presents a
+keyboard-driven tag selector. In CI or another non-interactive shell, it fails
+asking for `--tag` or `--all-tags` instead of blocking for input. `--all-tags`
+deploys every deployment in the config in one run: a failure in one doesn't
+stop the rest — the run continues, prints a summary of what failed, and exits
+non-zero. The client's project + dataset are derived from the deployment's
+`workflowResource`, and `deploy` expands each definition's `@<handle>:`
+reference to the bound physical resource. An invalid config fails with a clean,
+path-prefixed error before the command runs.
 
 `resourceAliases` is only for content that lives in a _different_ resource from
 `workflowResource`. A definition can reference a document in the **same**
 resource by bare id, no alias needed — bare ids root at `workflowResource` at
-runtime. Rule of thumb: **different resource → bind an alias and reference it as
-`@<handle>:<id>`; same resource → use a bare id and omit `resourceAliases`
+runtime. Bindings exist at deploy time only: `deploy` expands each `@<handle>:`
+reference to its bound physical GDR, and nothing alias-shaped survives into the
+deployed definition or the runtime. Rule of thumb: **different resource →
+bind an alias; same resource → use a bare id and omit `resourceAliases`
 entirely.** So the simplest single-dataset setup is just a `workflowResource`
 and `definitions`, with no `resourceAliases` at all.
 
+Refs supplied at runtime (`start --field`, `fire-action` ref params) are gated
+separately: they may target the `workflowResource` itself, and anything else is
+rejected at the write with `RefResourceUndeclaredError`. The CLI wires no
+`resourceClients` resolver, so it has no way to widen that surface — a runtime
+foreign-resource ref goes through an engine consumer that serves the target
+resource, not through the CLI.
+
 | Var                 | Purpose                                                                                              |
 | ------------------- | ---------------------------------------------------------------------------------------------------- |
 | `SANITY_AUTH_TOKEN` | Explicit token for CI / scripted use — wins over the `sanity login` session (editor role for writes) |
@@ -118,25 +143,26 @@ stale compiled output.
 
 ## Command status
 
-| Command                                | Status                                                                                                                      |
-| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| `deploy`                               | wired — calls `workflow.deployDefinitions` over the selected deployment's definitions                                       |
-| `deploy --all-tags`                    | wired — deploys every deployment in the config, continuing past per-deployment failures                                     |
-| `deploy --check`                       | wired — runs `validateDefinition` over the local batch + a duplicate-name check                                             |
-| `deploy --dry-run`                     | wired — fetches existing docs and renders a coloured JSON diff per change                                                   |
-| `deploy --only <name>`                 | wired — filters deploy/check/dry-run to one definition by `name`                                                            |
-| `start <name>`                         | wired — calls `workflow.startInstance` (`--field` for input fields)                                                         |
-| `list`                                 | wired — `client.fetch` over `sanity.workflow.instance` documents (`--definition <name>` to filter)                          |
-| `show <instance-id>`                   | wired — `client.getDocument`                                                                                                |
-| `diagnose <instance-id>`               | wired — calls `workflow.diagnose`, classifies why the instance is/isn't progressing                                         |
-| `tail <instance-id>`                   | wired — `client.listen()` over the instance, prints new history entries                                                     |
-| `abort <instance-id>`                  | wired — calls `workflow.abortInstance` (hard stop: cancels pending effects, lifts guards)                                   |
-| `set-stage <instance-id> --to <stage>` | wired — calls `workflow.setStage` (admin override: skips declared transitions/filters; enter lifecycle + cascade still run) |
-| `fire-action <instance-id>`            | wired — `workflow.availableActions` lists actions; `workflow.fireAction` fires one                                          |
-| `definition list`                      | wired — `client.fetch` over `sanity.workflow.definition` documents                                                          |
-| `definition show <name>`               | wired — `client.fetch`, latest version unless `--version`                                                                   |
-| `definition diff <name>`               | wired — diffs the in-code definition against the deployed latest (`--version` to pin)                                       |
-| `definition delete <name>`             | wired — calls `workflow.deleteDefinition` (refuses on live instances unless `--cascade`)                                    |
+| Command                                | Status                                                                                                                                                                                           |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `deploy`                               | wired — calls `workflow.deployDefinitions` over the selected deployment's definitions                                                                                                            |
+| `deploy --all-tags`                    | wired — deploys every deployment in the config, continuing past per-deployment failures                                                                                                          |
+| `deploy --check`                       | wired — runs `validateDefinition` over the local batch + a duplicate-name check                                                                                                                  |
+| `deploy --dry-run`                     | wired — fetches existing docs and renders a coloured JSON diff per change                                                                                                                        |
+| `deploy --only <name>`                 | wired — filters deploy/check/dry-run to one definition by `name`                                                                                                                                 |
+| `start <name>`                         | wired — calls `workflow.startInstance` (`--field` for input fields)                                                                                                                              |
+| `list`                                 | wired — `client.fetch` over `sanity.workflow.instance` documents (`--definition <name>` to filter)                                                                                               |
+| `show <instance-id>`                   | wired — `client.getDocument`                                                                                                                                                                     |
+| `diagnose <instance-id>`               | wired — calls `workflow.diagnose`, classifies why the instance is/isn't progressing                                                                                                              |
+| `tail <instance-id>`                   | wired — `client.listen()` over the instance, prints new history entries                                                                                                                          |
+| `abort <instance-id>`                  | wired — calls `workflow.abortInstance` (hard stop: cancels pending effects, removes guards)                                                                                                      |
+| `set-stage <instance-id> --to <stage>` | wired — calls `workflow.setStage` (admin override: skips declared transitions/filters; enter lifecycle + cascade still run)                                                                      |
+| `fire-action <instance-id>`            | wired — `workflow.availableActions` lists actions; `workflow.fireAction` fires one                                                                                                               |
+| `definition list`                      | wired — `client.fetch` over `sanity.workflow.definition` documents                                                                                                                               |
+| `definition show <name>`               | wired — `client.fetch`, latest version unless `--version`                                                                                                                                        |
+| `definition diff <name>`               | wired — diffs the in-code definition against the deployed latest (`--version` to pin)                                                                                                            |
+| `definition delete <name>`             | wired — calls `workflow.deleteDefinition` (refuses on live instances unless `--cascade`)                                                                                                         |
+| `nuke --tag <tag>`                     | wired — dev-period reset (exists only until the versioned upgrade framework): deletes every engine-owned doc for the tag (instances, definitions, guards across resources); plan + typed confirm |
 
 ## Telemetry
 
@@ -145,8 +171,9 @@ per-command trace (`Editorial Workflows CLI Command Executed` — the command id
 names of declared flags used, never their values, and a success flag) plus
 the engine's adoption events from the operations it drives. Consent is the
 account-wide status managed by `npx sanity telemetry enable|disable|status`;
-CI and trueish `DO_NOT_TRACK` suppress everything (except a `deploy --share-defs`,
-which forces that deploy's telemetry — see [Definition sharing](#definition-sharing)),
+CI and trueish `DO_NOT_TRACK` suppress everything (except a deploy that may share
+new definitions, which forces that deploy's telemetry unless `--no-share-defs`
+is passed — see [Definition sharing](#definition-sharing)),
 and a session that isn't logged in sends nothing. A one-time notice on stderr
 discloses collection on first use.
 
@@ -166,25 +193,27 @@ definition-feedback endpoint, not the telemetry pipeline; telemetry carries
 only a content-free marker (content hash plus structural counts) per shared
 definition and a per-invocation decision event.
 
-Sharing is **opt-out**. Pass `--share-defs` to donate without being asked, or
-`--no-share-defs` to decline. With neither flag, an interactive terminal is
-asked **once** — the answer is remembered in your Sanity user config, so the
-prompt never repeats — before anything is sent; notice always precedes the
-send. Every later flagless deploy then prints a one-line reminder of the
-current state (sharing, or not) and the flag to change it, so an ongoing
-donation is never silent. Unattended runs (CI, `DO_NOT_TRACK`, a non-TTY pipe)
-can't prompt: by default they donate nothing (opt in per run with
-`--share-defs`). An explicit `--share-defs` also sends that deploy's telemetry
-regardless of CI / `DO_NOT_TRACK` — a command-line arg beats env vars;
-account-level `sanity telemetry disable` still applies. A failed share only
-warns, never failing a completed deploy.
+Sharing is **opt-out in every environment**. Pass `--no-share-defs` to decline
+for one invocation. With neither flag, the first interactive deploy prints a
+full notice before sending and remembers that the notice was shown; every later
+flagless deploy prints a status block showing that sharing is on by default and
+showing runnable shell examples for the default, explicit opt-in, and opt-out
+forms; the explicit flags suppress the status block. Unattended runs (CI,
+`DO_NOT_TRACK`, or a non-TTY pipe) also share by default and print that status
+block in their logs.
+A flagless deploy or explicit `--share-defs` forces that deploy's telemetry
+through the environment gate so donated definitions retain their content-free
+markers; account-level `sanity telemetry disable` still applies. A failed share
+only warns, never failing a completed deploy.
 
 ## Known gaps
 
-- **No `sanity workflow` plugin wiring yet.** The proposal targets the
-  Sanity CLI as a plugin host. The package publishes as a standalone
-  `sanity-workflows` binary today; plugging into `sanity` as an oclif
-  plugin is a separate piece of work.
+- **Not mounted in the `sanity` CLI yet.** The package side is mount-ready —
+  commands nest under the `editorial-workflows` oclif topic (see
+  [Run](#run)) — but the `sanity` CLI does not list this package in its
+  plugin array, so the commands ship only through the standalone
+  `sanity-workflows` binary today. The host-side mount (and what happens to
+  the bare aliases inside a host) is a separate piece of work.
 - **No true bypass.** `set-stage` is the engine's `setStage` admin
   override: it skips the definition's declared transitions and filters, but
   the target stage's enter lifecycle and the post-move cascade still run. A

package/dist/commands/{abort.d.ts → editorial-workflows/abort.d.ts}

@@ -1,7 +1,8 @@
 import { type WorkflowInstance } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../lib/base-command.ts';
-import { type WriteReport } from '../lib/ops-report.ts';
+import { WorkflowCommand } from '../../lib/base-command.ts';
+import { type WriteReport } from '../../lib/ops-report.ts';
 export default class Abort extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/{abort.js → editorial-workflows/abort.js}

@@ -1,13 +1,14 @@
 import { styleText } from 'node:util';
 import { Args, Flags } from '@oclif/core';
 import { workflow } from '@sanity/workflow-engine';
-import { WorkflowCommand } from "../lib/base-command.js";
-import { resolveInstanceContext } from "../lib/context.js";
-import { tagFlags } from "../lib/flags.js";
-import { buildOperationArgs } from "../lib/operation-args.js";
-import { runWriteVerb } from "../lib/ops-report.js";
+import { WorkflowCommand } from "../../lib/base-command.js";
+import { resolveInstanceContext } from "../../lib/context.js";
+import { tagFlags } from "../../lib/flags.js";
+import { buildOperationArgs } from "../../lib/operation-args.js";
+import { runWriteVerb } from "../../lib/ops-report.js";
 export default class Abort extends WorkflowCommand {
-    static description = 'Abort an in-flight workflow instance — a hard stop: pending effects are cancelled, stage guards lifted, and the instance is marked terminal where it stands.';
+    static aliases = ['abort'];
+    static description = 'Abort an in-flight workflow instance — a hard stop: pending effects are cancelled, stage guards removed, and the instance is marked terminal where it stands.';
     static examples = [
         '<%= config.bin %> abort wf-instance.abc123',
         "<%= config.bin %> abort wf-instance.abc123 --reason 'superseded by relaunch'",

package/dist/commands/{definition → editorial-workflows/definition}/delete.d.ts

@@ -1,7 +1,8 @@
 import { type DeleteDefinitionArgs, type DeleteDefinitionResult } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../../lib/base-command.ts';
-import { type EngineScope } from '../../lib/operation-args.ts';
+import { WorkflowCommand } from '../../../lib/base-command.ts';
+import { type EngineScope } from '../../../lib/operation-args.ts';
 export default class DefinitionDelete extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/{definition → editorial-workflows/definition}/delete.js

@@ -1,12 +1,13 @@
 import { styleText } from 'node:util';
 import { Args, Flags } from '@oclif/core';
 import { workflow, } from '@sanity/workflow-engine';
-import { WorkflowCommand } from "../../lib/base-command.js";
-import { resolveContext } from "../../lib/context.js";
-import { tagFlags } from "../../lib/flags.js";
-import { baseEngineArgs } from "../../lib/operation-args.js";
-import { runWriteVerb } from "../../lib/ops-report.js";
+import { WorkflowCommand } from "../../../lib/base-command.js";
+import { resolveContext } from "../../../lib/context.js";
+import { tagFlags } from "../../../lib/flags.js";
+import { baseEngineArgs } from "../../../lib/operation-args.js";
+import { runWriteVerb } from "../../../lib/ops-report.js";
 export default class DefinitionDelete extends WorkflowCommand {
+    static aliases = ['definition:delete'];
     static description = 'Delete a deployed workflow definition (every version, or one via --version). ' +
         'Refuses while non-terminal instances exist unless --cascade aborts them first — ' +
         'instances are aborted in place, never deleted.';

package/dist/commands/{definition → editorial-workflows/definition}/diff.d.ts

@@ -1,6 +1,7 @@
 import { type WorkflowDefinition } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../../lib/base-command.ts';
+import { WorkflowCommand } from '../../../lib/base-command.ts';
 export default class DefinitionDiff extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/{definition → editorial-workflows/definition}/diff.js

@@ -1,13 +1,14 @@
 import { Args, Flags } from '@oclif/core';
 import { diffEntry } from '@sanity/workflow-engine';
 import ora from 'ora';
-import { WorkflowCommand } from "../../lib/base-command.js";
-import { resolveContext } from "../../lib/context.js";
-import { fetchDeployedDefinition, selectDefinitions, validateOrFail } from "../../lib/definitions.js";
-import { diffReport } from "../../lib/diff.js";
-import { tagFlags } from "../../lib/flags.js";
-import { deploymentToTarget } from "../../lib/select-deployment.js";
+import { WorkflowCommand } from "../../../lib/base-command.js";
+import { resolveContext } from "../../../lib/context.js";
+import { fetchDeployedDefinition, selectDefinitions, validateOrFail, } from "../../../lib/definitions.js";
+import { diffReport } from "../../../lib/diff.js";
+import { tagFlags } from "../../../lib/flags.js";
+import { deploymentToTarget } from "../../../lib/select-deployment.js";
 export default class DefinitionDiff extends WorkflowCommand {
+    static aliases = ['definition:diff'];
     static description = 'Diff an in-code definition against the deployed version (latest by default).';
     static examples = [
         '<%= config.bin %> definition diff productLaunch',

package/dist/commands/{definition → editorial-workflows/definition}/list.d.ts

@@ -1,10 +1,11 @@
-import { WorkflowCommand } from '../../lib/base-command.ts';
+import { WorkflowCommand } from '../../../lib/base-command.ts';
 interface DefinitionListFlags {
     tag?: string | undefined;
     name?: string | undefined;
     limit: number;
 }
 export interface DefinitionListRow {
+    _id: string;
     name: string;
     version: number;
     title: string;
@@ -13,12 +14,15 @@ export interface DefinitionListRow {
     inFlightCount: number;
     totalInstances: number;
     _createdAt: string;
+    modelVersion?: number | null;
+    minReaderModel?: number | null;
 }
 export declare function buildDefinitionListQuery(flags: DefinitionListFlags): {
     groq: string;
     params: Record<string, unknown>;
 };
 export default class DefinitionList extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static flags: {

package/dist/commands/{definition → editorial-workflows/definition}/list.js

@@ -1,11 +1,11 @@
 import { Flags } from '@oclif/core';
-import { WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, inFlightFilter, tagScopeFilter, } from '@sanity/workflow-engine';
+import { WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, assertReadableModel, inFlightFilter, tagScopeFilter, } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
-import { WorkflowCommand } from "../../lib/base-command.js";
-import { resolveReadTargets } from "../../lib/context.js";
-import { tagFlags } from "../../lib/flags.js";
-import { runReadAcrossTargets } from "../../lib/read-fanout.js";
-import { clipToLimit, formatTable } from "../../lib/ui.js";
+import { WorkflowCommand } from "../../../lib/base-command.js";
+import { resolveReadTargets } from "../../../lib/context.js";
+import { tagFlags } from "../../../lib/flags.js";
+import { runReadAcrossTargets } from "../../../lib/read-fanout.js";
+import { logClippedTable } from "../../../lib/ui.js";
 export function buildDefinitionListQuery(flags) {
     const params = { limit: flags.limit + 1 };
     const filters = [`_type == "${WORKFLOW_DEFINITION_TYPE}"`];
@@ -25,11 +25,14 @@ export function buildDefinitionListQuery(flags) {
     }
     const instanceMatch = instanceFilters.join(' && ');
     const groq = `*[${filters.join(' && ')}] | order(name asc, version desc) [0...$limit]{
+      _id,
       name,
       version,
       title,
       tag,
       _createdAt,
+      modelVersion,
+      minReaderModel,
       "stageCount": count(stages),
       "inFlightCount": count(*[${instanceMatch} && ${inFlightFilter()}]),
       "totalInstances": count(*[${instanceMatch}])
@@ -37,6 +40,7 @@ export function buildDefinitionListQuery(flags) {
     return { groq, params };
 }
 export default class DefinitionList extends WorkflowCommand {
+    static aliases = ['definition:list'];
     static description = 'List deployed workflow definitions.';
     static examples = [
         '<%= config.bin %> definition list',
@@ -60,29 +64,28 @@ export default class DefinitionList extends WorkflowCommand {
             targets,
             log: (line) => this.log(line),
             run: async ({ client }) => {
-                const fetched = await client.fetch(groq, params, {
+                const fetched = (await client.fetch(groq, params, {
                     tag: 'definition.list',
-                });
+                })).map(assertReadableModel);
                 if (!fetched.length) {
                     this.log(`${logSymbols.info} no definitions found`);
                     return;
                 }
-                const { rows, note } = clipToLimit(fetched, flags.limit);
-                const lines = formatTable(['workflow', 'title', 'tag', 'stages', 'in flight', 'instances', 'created'], rows.map((r) => [
-                    `${r.name} v${r.version}`,
-                    r.title,
-                    r.tag,
-                    String(r.stageCount),
-                    String(r.inFlightCount),
-                    String(r.totalInstances),
-                    r._createdAt,
-                ]));
-                for (const line of lines) {
-                    this.log(line);
-                }
-                if (note) {
-                    this.log(note);
-                }
+                logClippedTable({
+                    rows: fetched,
+                    limit: flags.limit,
+                    headers: ['workflow', 'title', 'tag', 'stages', 'in flight', 'instances', 'created'],
+                    toCells: (r) => [
+                        `${r.name} v${r.version}`,
+                        r.title,
+                        r.tag,
+                        String(r.stageCount),
+                        String(r.inFlightCount),
+                        String(r.totalInstances),
+                        r._createdAt,
+                    ],
+                    log: (line) => this.log(line),
+                });
             },
         });
         if (failures.length > 0) {

package/dist/commands/{definition → editorial-workflows/definition}/show.d.ts

@@ -1,7 +1,8 @@
 import { type DeployedDefinition, type WorkflowDefinition, type WorkflowResource } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../../lib/base-command.ts';
-import { type ReadTarget } from '../../lib/context.ts';
+import { WorkflowCommand } from '../../../lib/base-command.ts';
+import { type ReadTarget } from '../../../lib/context.ts';
 export default class DefinitionShow extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static args: {
         name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;

package/dist/commands/{definition → editorial-workflows/definition}/show.js

@@ -1,14 +1,15 @@
 import { styleText } from 'node:util';
 import { Args, Flags } from '@oclif/core';
-import { isTerminalStage, } from '@sanity/workflow-engine';
+import { assertReadableModel, isTerminalStage, } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
-import { WorkflowCommand } from "../../lib/base-command.js";
-import { resolveReadTargets, soleHitOrFail } from "../../lib/context.js";
-import { buildDefinitionShowQuery, buildDefinitionTagsQuery } from "../../lib/definitions.js";
-import { fail } from "../../lib/fail.js";
-import { tagFlags } from "../../lib/flags.js";
-import { formatKeyValue, resourceLabel, sectionHeader } from "../../lib/ui.js";
+import { WorkflowCommand } from "../../../lib/base-command.js";
+import { resolveReadTargets, soleHitOrFail } from "../../../lib/context.js";
+import { buildDefinitionShowQuery, buildDefinitionTagsQuery } from "../../../lib/definitions.js";
+import { fail } from "../../../lib/fail.js";
+import { tagFlags } from "../../../lib/flags.js";
+import { formatKeyValue, resourceLabel, sectionHeader } from "../../../lib/ui.js";
 export default class DefinitionShow extends WorkflowCommand {
+    static aliases = ['definition:show'];
     static description = 'Show a deployed workflow definition.';
     static args = {
         name: Args.string({ required: true, description: 'Workflow definition name.' }),
@@ -64,7 +65,7 @@ export async function fetchDefinitionHits({ targets, groq, params, }) {
         const def = await target.client.fetch(groq, params, {
             tag: 'definition.show',
         });
-        return def === null ? undefined : { resource: target.resource, def };
+        return def === null ? undefined : { resource: target.resource, def: assertReadableModel(def) };
     }));
     return probes.filter((hit) => hit !== undefined);
 }

package/dist/commands/{deploy.d.ts → editorial-workflows/deploy.d.ts}

@@ -1,5 +1,5 @@
 import { type DeployDefinitionResult, type WorkflowDefinition, type WorkflowDeployment } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../lib/base-command.ts';
+import { WorkflowCommand } from '../../lib/base-command.ts';
 /** A deployment paired with the definitions selected + validated for it. */
 interface DeployBatch {
     deployment: WorkflowDeployment;
@@ -11,6 +11,7 @@ interface DeployFailure {
     message: string;
 }
 export default class Deploy extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static flags: {

package/dist/commands/{deploy.js → editorial-workflows/deploy.js}

@@ -3,18 +3,19 @@ import { Flags } from '@oclif/core';
 import { computeDiffEntries, errorMessage, workflow, } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
 import ora from 'ora';
-import { WorkflowCommand } from "../lib/base-command.js";
-import { clientFor, resolveTokenOrFail } from "../lib/client.js";
-import { selectDefinitions, validateOrFail } from "../lib/definitions.js";
-import { diffReport } from "../lib/diff.js";
-import { fail, isAuthRejection } from "../lib/fail.js";
-import { tagFlags } from "../lib/flags.js";
-import { loadWorkflowConfig } from "../lib/load-config.js";
-import { deploymentToTarget, selectDeployments } from "../lib/select-deployment.js";
-import { shareDefinitionsAfterDeploy } from "../lib/share-definitions.js";
-import { cliTelemetry } from "../lib/telemetry.js";
-import { groupBanner } from "../lib/ui.js";
+import { WorkflowCommand } from "../../lib/base-command.js";
+import { clientFor, resolveTokenOrFail } from "../../lib/client.js";
+import { selectDefinitions, validateOrFail } from "../../lib/definitions.js";
+import { diffReport } from "../../lib/diff.js";
+import { fail, isAuthRejection } from "../../lib/fail.js";
+import { tagFlags } from "../../lib/flags.js";
+import { loadWorkflowConfig } from "../../lib/load-config.js";
+import { deploymentToTarget, selectDeployments } from "../../lib/select-deployment.js";
+import { shareDefinitionsAfterDeploy } from "../../lib/share-definitions.js";
+import { cliTelemetry } from "../../lib/telemetry.js";
+import { groupBanner } from "../../lib/ui.js";
 export default class Deploy extends WorkflowCommand {
+    static aliases = ['deploy'];
     static description = 'Validate, diff, and deploy workflow definitions to the resource bound by the selected deployment.';
     static examples = [
         '<%= config.bin %> deploy --tag prod',
@@ -43,14 +44,14 @@ export default class Deploy extends WorkflowCommand {
         }),
         'share-defs': Flags.boolean({
             allowNo: true,
-            description: 'Share the definition documents newly created by this deploy with Sanity — the full document, verbatim (structure, names, filters, effect configuration, seeded values), plus its deployment coordinates (project and dataset, or resource id); never content documents, instances, or your Sanity auth token. Opt-out: an interactive terminal is asked once (the answer is remembered), while unattended runs (CI / non-TTY / DO_NOT_TRACK) share nothing unless --share-defs is passed. Use --no-share-defs to opt out. An explicit --share-defs also sends telemetry for this deploy regardless of CI / DO_NOT_TRACK.',
+            description: 'Share the definition documents newly created by this deploy with Sanity — the full document, verbatim (structure, names, filters, effect configuration, seeded values), plus its deployment coordinates (project and dataset, or resource id); never content documents, instances, or your Sanity auth token. Sharing is the default in every environment, including CI / non-TTY / DO_NOT_TRACK. Use --no-share-defs to opt out.',
         }),
     };
     async run() {
         const { flags } = await this.parse(Deploy);
         validateModeFlags(flags.check, flags['dry-run']);
         const config = await loadWorkflowConfig();
-        const batches = buildBatches(selectDeployments(config, { tag: flags.tag, allTags: flags['all-tags'] }), flags.only);
+        const batches = buildBatches(await selectDeployments(config, { tag: flags.tag, allTags: flags['all-tags'] }), flags.only);
         const log = (line) => this.log(line);
         if (flags.check) {
             await reconcileBatches({

package/dist/commands/{diagnose.d.ts → editorial-workflows/diagnose.d.ts}

@@ -1,5 +1,5 @@
 import { type Diagnosis, type DiagnoseInput, type SuggestedRemediation, type WorkflowEvaluation } from '@sanity/workflow-engine';
-import { WorkflowCommand } from '../lib/base-command.ts';
+import { WorkflowCommand } from '../../lib/base-command.ts';
 /** The `--json` transitions payload: raw derived state (atom GROQ, negation,
  *  pivotality, solvable requirement) — structure for scripts, never baked
  *  English. Pure so the shape is a testable contract. */
@@ -32,6 +32,7 @@ export declare function renderDiagnosis({ diagnosis, input, remediations, explan
     explanations?: ReadonlyMap<string, string> | undefined;
 }): string[];
 export default class Diagnose extends WorkflowCommand {
+    static aliases: string[];
     static description: string;
     static examples: string[];
     static args: {