n8n 2.45.3 → 2.46.0

package/dist/modules/promotions.ee/promotions.service.js

@@ -13,27 +13,38 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PromotionsService = void 0;
+const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
+const is_record_1 = require("@n8n/utils/is-record");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const n8n_workflow_1 = require("n8n-workflow");
+const zod_1 = require("zod");
 const errors_1 = require("@n8n/errors");
 const directory_package_reader_1 = require("../../modules/n8n-packages/io/directory/directory-package-reader");
 const package_directory_inventory_reader_1 = require("../../modules/n8n-packages/io/directory/package-directory-inventory-reader");
 const n8n_packages_config_1 = require("../../modules/n8n-packages/n8n-packages.config");
 const n8n_packages_service_1 = require("../../modules/n8n-packages/n8n-packages.service");
 const constants_1 = require("../../modules/n8n-packages/spec/constants");
+const manifest_schema_1 = require("../../modules/n8n-packages/spec/manifest.schema");
 const n8n_packages_types_1 = require("../../modules/n8n-packages/n8n-packages.types");
+const folder_service_1 = require("../../services/folder.service");
 const project_service_ee_1 = require("../../services/project.service.ee");
 const base_branch_files_1 = require("./base-branch-files");
+const branch_placement_1 = require("./branch-placement");
+const cross_project_moves_1 = require("./cross-project-moves");
 const constants_2 = require("./constants");
+const promotion_commit_message_1 = require("./promotion-commit-message");
 const promotion_binding_preflight_service_1 = require("./promotion-binding-preflight.service");
-const promotion_config_resolver_1 = require("./promotion-config.resolver");
+const promotion_environment_resolver_1 = require("./promotion-environment.resolver");
 const promotion_providers_service_1 = require("./promotion-providers.service");
+const promotion_run_repository_1 = require("./database/repositories/promotion-run.repository");
+const promotion_reviews_service_1 = require("./promotion-reviews.service");
 const promotion_working_directory_service_1 = require("./promotion-working-directory.service");
 const promotions_git_service_1 = require("./promotions-git.service");
+const promotions_selective_push_error_1 = require("./promotions-selective-push.error");
 const promotions_git_utils_1 = require("./promotions-git.utils");
 const working_copy_updater_1 = require("./working-copy-updater");
 function isConfirmableConflict(code) {
@@ -47,7 +58,7 @@ const IMPORT_POLICY = {
     missingNodeTypeMode: n8n_packages_types_1.MissingNodeTypeMode.Fail,
     credentialMatchingMode: 'id-only',
     credentialMissingMode: 'must-preexist',
-    credentialConflictPolicy: n8n_packages_types_1.CredentialConflictPolicy.KeepExisting,
+    credentialConflictPolicy: n8n_packages_types_1.CredentialConflictPolicy.Overwrite,
     folderConflictPolicy: n8n_packages_types_1.FolderConflictPolicy.Overwrite,
     overwriteDeletionPolicy: n8n_packages_types_1.OverwriteDeletionPolicy.HardDelete,
     dataTableMatchingMode: 'by-id',
@@ -59,7 +70,7 @@ const IMPORT_POLICY = {
     tagConflictPolicy: n8n_packages_types_1.TagConflictPolicy.Rename,
 };
 let PromotionsService = class PromotionsService {
-    constructor(resolver, providersService, workingDirectory, workingCopy, gitService, projectRepository, sharedWorkflowRepository, projectService, n8nPackagesService, bindingPreflight, inventoryReader, packageImportConfig, logger) {
+    constructor(resolver, providersService, workingDirectory, workingCopy, gitService, projectRepository, sharedWorkflowRepository, projectService, folderService, n8nPackagesService, bindingPreflight, inventoryReader, packageImportConfig, runRepository, reviewsService, logger) {
         this.resolver = resolver;
         this.providersService = providersService;
         this.workingDirectory = workingDirectory;
@@ -68,55 +79,57 @@ let PromotionsService = class PromotionsService {
         this.projectRepository = projectRepository;
         this.sharedWorkflowRepository = sharedWorkflowRepository;
         this.projectService = projectService;
+        this.folderService = folderService;
         this.n8nPackagesService = n8nPackagesService;
         this.bindingPreflight = bindingPreflight;
         this.inventoryReader = inventoryReader;
         this.packageImportConfig = packageImportConfig;
+        this.runRepository = runRepository;
+        this.reviewsService = reviewsService;
         this.logger = logger;
         this.logger = this.logger.scoped('promotions');
     }
-    async clone(connectionId, direction) {
-        const input = await this.resolver.resolveForConnection(connectionId, direction);
+    async clone(environmentId) {
+        const input = await this.resolver.resolveForEnvironment(environmentId);
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
         await this.gitService.clone({
             remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
             credentials: await this.credentialsFor(input),
-            paths: this.workingDirectory.paths(input.configId),
+            paths: this.workingDirectory.paths(input.environmentId),
             branchName,
-            configId: input.configId,
+            environmentId: input.environmentId,
         });
         await this.workingDirectory.writeDescriptor(this.descriptorFor(input));
         return { ...this.checkoutIdentity(input), branchName, hasCheckout: true };
     }
-    async disconnect(connectionId, direction) {
-        const input = await this.resolver.resolveForConnection(connectionId, direction);
-        await this.workingDirectory.resetCheckout(input.configId);
+    async disconnect(environmentId) {
+        const input = await this.resolver.resolveForEnvironment(environmentId);
+        await this.workingDirectory.resetCheckout(input.environmentId);
         return {
             ...this.checkoutIdentity(input),
             branchName: (0, promotions_git_utils_1.checkoutBranchName)(input.config),
             hasCheckout: false,
         };
     }
-    async promote(connectionId, actor, request) {
-        const input = await this.resolver.resolveForConnection(connectionId, 'promote');
-        if (input.config.direction !== 'promote') {
-            throw new n8n_workflow_1.UnexpectedError('Resolved an invalid promotion direction');
-        }
+    async promote(environmentId, actor, request) {
+        const input = await this.resolver.resolveForEnvironment(environmentId, 'promote');
         this.assertInstanceScope(input, 'Promote');
         await this.assertCheckoutReady(input, 'promoting');
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
         const credentials = await this.credentialsFor(input);
-        const targetBranchName = await this.prepareTargetBranch(input, branchName, credentials);
-        const { repositoryFolder } = this.workingDirectory.paths(input.configId);
+        const target = await this.prepareTargetBranch(input, branchName, credentials);
+        const targetBranchName = target?.targetBranchName;
+        const { repositoryFolder } = this.workingDirectory.paths(input.environmentId);
         const packageFolder = node_path_1.default.join(repositoryFolder, constants_2.PACKAGE_SUBFOLDER);
+        await this.assertNoProjectMovesSinceBranch(input, branchName, credentials, target?.baseCommitSha);
         const projectIds = await this.projectRepository.findTeamProjectIds();
         this.logger.info('Exporting projects for a promotion', {
-            connectionId,
-            configId: input.configId,
+            environmentId,
             projectCount: projectIds.length,
         });
         await (0, promises_1.mkdir)(repositoryFolder, { recursive: true });
         const stagingFolder = await (0, promises_1.mkdtemp)(node_path_1.default.join(repositoryFolder, `.${constants_2.PACKAGE_SUBFOLDER}-`));
+        let pushed;
         try {
             const exportResult = await this.n8nPackagesService.exportPackageToDirectory({
                 user: actor,
@@ -132,57 +145,139 @@ let PromotionsService = class PromotionsService {
             await (0, promises_1.rm)(packageFolder, { recursive: true, force: true });
             await (0, promises_1.rename)(stagingFolder, packageFolder);
             if (targetBranchName) {
-                await this.workingDirectory.invalidateDescriptor(input.configId);
+                await this.workingDirectory.invalidateDescriptor(input.environmentId);
             }
+            const commitMessage = request.commitMessage ??
+                (0, promotion_commit_message_1.buildInstancePromotionCommitMessage)({
+                    projectCount: projectIds.length,
+                    workflowCount: exportResult.counts.workflows,
+                });
             const { commitSha } = await this.gitService.commitAndPush({
                 remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
                 credentials,
-                paths: this.workingDirectory.paths(input.configId),
+                paths: this.workingDirectory.paths(input.environmentId),
                 branchName,
                 targetBranchName,
-                configId: input.configId,
+                environmentId: input.environmentId,
                 author: this.commitAuthor(actor),
-                commitMessage: request.commitMessage,
+                commitMessage,
                 force: targetBranchName ? false : (request.force ?? false),
                 stagePathspec: constants_2.PACKAGE_SUBFOLDER,
                 onCheckoutRestored: async () => await this.workingDirectory.writeDescriptor(this.descriptorFor(input)),
             });
-            return {
-                connectionId: input.connectionId,
-                configId: input.configId,
-                counts: exportResult.counts,
-                git: { commitSha, branchName: targetBranchName ?? branchName },
-            };
+            pushed = { commitSha, counts: exportResult.counts, commitMessage };
         }
         finally {
             await (0, promises_1.rm)(stagingFolder, { recursive: true, force: true });
         }
+        return {
+            environmentId: input.environmentId,
+            counts: pushed.counts,
+            git: { commitSha: pushed.commitSha, branchName: targetBranchName ?? branchName },
+            ...(await this.openReview(input, actor, {
+                promotionBranchName: targetBranchName,
+                commitSha: pushed.commitSha,
+                commitMessage: pushed.commitMessage,
+                promotionRunContents: { projectIds },
+            })),
+        };
+    }
+    async openReview(input, actor, push) {
+        const recorded = await this.recordPromoteRun(input, actor, {
+            branchName: push.promotionBranchName ?? (0, promotions_git_utils_1.checkoutBranchName)(input.config),
+            commitSha: push.commitSha,
+            ...(push.promotionBranchName && { promotionRunContents: push.promotionRunContents }),
+        });
+        if (!recorded.runId) {
+            const opensMergeRequest = input.providerType === 'gitlab' && !!push.promotionBranchName;
+            return {
+                warnings: [
+                    {
+                        message: opensMergeRequest
+                            ? 'The push succeeded, but n8n could not record the promotion run, so no merge request was opened.'
+                            : 'The push succeeded, but n8n could not record the promotion run.',
+                    },
+                ],
+            };
+        }
+        if (!push.promotionBranchName)
+            return {};
+        const lines = push.commitMessage.split('\n');
+        const titleIndex = lines.findIndex((line) => line.trim() !== '');
+        if (titleIndex === -1) {
+            return {
+                warnings: [
+                    {
+                        message: 'No merge request was opened.',
+                    },
+                ],
+            };
+        }
+        const { review, warnings } = await this.reviewsService.openMergeRequest(input, actor, {
+            branchName: push.promotionBranchName,
+            baseBranchName: (0, promotions_git_utils_1.checkoutBranchName)(input.config),
+            commitSha: push.commitSha,
+            title: lines[titleIndex].trim(),
+            body: lines.slice(titleIndex + 1).join('\n'),
+        }, recorded.runId);
+        return {
+            ...(review && { review }),
+            ...(warnings.length > 0 && { warnings }),
+        };
     }
-    async promoteSelectionResolved(input, actor, request, selection) {
+    async recordPromoteRun(input, actor, git) {
+        try {
+            const type = api_types_1.promotionRunTypeSchema.parse('git');
+            const run = await this.runRepository.insertRun({
+                environmentId: input.environmentId,
+                createdById: actor.id,
+                direction: input.config.direction,
+                type,
+                details: (0, api_types_1.parsePromotionRunDetails)(type, {
+                    schemaVersion: 1,
+                    branchName: git.branchName,
+                    commitSha: git.commitSha,
+                    ...(git.promotionRunContents && { contents: git.promotionRunContents }),
+                }),
+                reviewId: null,
+            });
+            return { runId: run.id };
+        }
+        catch (error) {
+            this.logger.error('Could not record the promotion run', { error });
+            return {};
+        }
+    }
+    async promoteSelectionResolved(input, actor, request, selection, movedTo) {
         this.assertInstanceScope(input, 'Promote');
         this.workingCopy.validateSelection(selection);
-        await this.assertTeamProject(selection.projectId);
+        const project = await this.assertTeamProject(selection.projectId);
         await this.assertCheckoutReady(input, 'promoting');
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
         const credentials = await this.credentialsFor(input);
-        const targetBranchName = await this.prepareTargetBranch(input, branchName, credentials);
-        const { repositoryFolder } = this.workingDirectory.paths(input.configId);
+        const targetBranchName = (await this.prepareTargetBranch(input, branchName, credentials))
+            ?.targetBranchName;
+        const { repositoryFolder } = this.workingDirectory.paths(input.environmentId);
         const packageFolder = node_path_1.default.join(repositoryFolder, constants_2.PACKAGE_SUBFOLDER);
         const packageExisted = await pathExists(packageFolder);
         if (!(await pathExists(node_path_1.default.join(packageFolder, constants_1.MANIFEST_FILE))) &&
             (await this.gitService.hasCommittedPath({
-                paths: this.workingDirectory.paths(input.configId),
+                paths: this.workingDirectory.paths(input.environmentId),
                 branchName,
-                configId: input.configId,
+                environmentId: input.environmentId,
                 pathspec: `${constants_2.PACKAGE_SUBFOLDER}/${constants_1.MANIFEST_FILE}`,
             }))) {
-            throw new errors_1.BadRequestError('The local copy of the promote branch is incomplete. Disconnect and connect it again in the instance connection settings.');
+            throw new errors_1.BadRequestError('The local copy of the promote branch is incomplete. Disconnect and connect it again in the instance environment settings.');
         }
         const branch = await this.workingCopy.assertSelectionFitsBranch(packageFolder, selection);
+        if (movedTo.size > 0) {
+            throw new promotions_selective_push_error_1.PromotionsWorkflowsMovedCrossProjectError([...movedTo].map(([id, place]) => ({ id, detail: `now in ${place} here` })));
+        }
         const stagingFolder = await (0, promises_1.mkdtemp)(node_path_1.default.join(repositoryFolder, `.${constants_2.PACKAGE_SUBFOLDER}-`));
         const prePushBackup = `${packageFolder}.pre-selection`;
         let backedUp = false;
         let keepPrePushBackup = false;
+        let pushed;
         try {
             if (packageExisted) {
                 await (0, promises_1.rm)(prePushBackup, { recursive: true, force: true });
@@ -202,28 +297,25 @@ let PromotionsService = class PromotionsService {
             }, { targetDir: stagingFolder });
             await this.workingCopy.applySelection(packageFolder, stagingFolder, staging, selection, branch);
             if (targetBranchName) {
-                await this.workingDirectory.invalidateDescriptor(input.configId);
+                await this.workingDirectory.invalidateDescriptor(input.environmentId);
             }
+            const commitMessage = request.commitMessage ??
+                this.defaultSelectionCommitMessage(project.name, selection, staging, branch);
             const { commitSha } = await this.gitService.commitAndPush({
                 remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
                 credentials,
-                paths: this.workingDirectory.paths(input.configId),
+                paths: this.workingDirectory.paths(input.environmentId),
                 branchName,
                 targetBranchName,
-                configId: input.configId,
+                environmentId: input.environmentId,
                 author: this.commitAuthor(actor),
-                commitMessage: request.commitMessage,
+                commitMessage,
                 force: false,
                 stagePathspec: constants_2.PACKAGE_SUBFOLDER,
                 rollbackOnFailure: true,
                 onCheckoutRestored: async () => await this.workingDirectory.writeDescriptor(this.descriptorFor(input)),
             });
-            return {
-                connectionId: input.connectionId,
-                configId: input.configId,
-                counts,
-                git: { commitSha, branchName: targetBranchName ?? branchName },
-            };
+            pushed = { commitSha, counts, commitMessage };
         }
         catch (error) {
             if (backedUp) {
@@ -261,36 +353,55 @@ let PromotionsService = class PromotionsService {
                 this.logger.warn('Failed to remove the selection staging folder', { stagingFolder, error });
             });
         }
+        return {
+            environmentId: input.environmentId,
+            counts: pushed.counts,
+            git: { commitSha: pushed.commitSha, branchName: targetBranchName ?? branchName },
+            ...(await this.openReview(input, actor, {
+                promotionBranchName: targetBranchName,
+                commitSha: pushed.commitSha,
+                commitMessage: pushed.commitMessage,
+                promotionRunContents: { projectIds: [selection.projectId] },
+            })),
+        };
     }
     async promoteProjectSelection(projectId, actor, request) {
         if (new Set(request.workflowIds).size !== request.workflowIds.length) {
             throw new errors_1.BadRequestError('workflowIds contains duplicates');
         }
         const input = await this.resolver.resolveForProject(projectId, 'promote');
-        const selection = await this.classifySelection(projectId, request.workflowIds);
+        const { selection, movedTo } = await this.classifySelection(projectId, request.workflowIds);
         return await this.promoteSelectionResolved(input, actor, {
-            commitMessage: request.commitMessage ?? constants_2.PROMOTE_SELECTION_COMMIT_MESSAGE,
+            commitMessage: request.commitMessage,
             canExportVariableValues: request.canExportVariableValues,
-        }, selection);
+        }, selection, movedTo);
     }
     async classifySelection(projectId, workflowIds) {
         const ownerProjects = await this.sharedWorkflowRepository.findOwnerProjectsByWorkflowIds(workflowIds);
         const live = [];
         const deleted = [];
+        const movedTo = new Map();
         for (const id of workflowIds) {
-            if (ownerProjects.get(id)?.id !== projectId) {
-                deleted.push(id);
+            const owner = ownerProjects.get(id);
+            if (owner?.id === projectId) {
+                live.push(id);
                 continue;
             }
-            live.push(id);
+            if (owner) {
+                movedTo.set(id, owner.type === 'team' ? `project "${owner.name}"` : 'a personal project');
+            }
+            deleted.push(id);
         }
-        return { projectId, workflowIds: live, deletedWorkflowIds: deleted };
+        return {
+            selection: { projectId, workflowIds: live, deletedWorkflowIds: deleted },
+            movedTo,
+        };
     }
-    async apply(connectionId, actor, expectedSource) {
-        return await this.applyFromSource(connectionId, actor, expectedSource);
+    async apply(environmentId, actor, expectedSource) {
+        return await this.applyFromSource(environmentId, actor, expectedSource);
     }
-    async continueApply(connectionId, actor, request) {
-        return await this.applyFromSource(connectionId, actor, request.expectedSource, request.confirmDestructiveChanges === true);
+    async continueApply(environmentId, actor, request) {
+        return await this.applyFromSource(environmentId, actor, request.expectedSource, request.confirmDestructiveChanges === true);
     }
     async applyProjectSelection(projectId, actor, request) {
         return await this.applySelectionFromSource(projectId, actor, request.workflowIds, request.expectedSource);
@@ -298,27 +409,21 @@ let PromotionsService = class PromotionsService {
     async continueApplyProjectSelection(projectId, actor, request) {
         return await this.applySelectionFromSource(projectId, actor, request.workflowIds, request.expectedSource, request.confirmDestructiveChanges === true);
     }
-    async classifyApplySelection(inventory, projectId, workflowIds) {
+    async classifyApplySelection(inventory, projectId, workflowIds, movedWorkflowIds) {
         const branchWorkflowIds = new Set(inventory.workflows
             .filter((workflow) => workflow.projectId === projectId)
             .map(({ id }) => id));
-        const packageWorkflowIds = new Set(inventory.workflows.map(({ id }) => id));
         const ownerProjects = await this.sharedWorkflowRepository.findOwnerProjectsByWorkflowIds(workflowIds);
         const selectedWorkflowIds = [];
         const deletedWorkflowIds = [];
-        const movedWorkflowIds = [];
         const invalidWorkflowIds = [];
         for (const id of workflowIds) {
             if (branchWorkflowIds.has(id)) {
                 selectedWorkflowIds.push(id);
             }
             else if (ownerProjects.get(id)?.id === projectId) {
-                if (packageWorkflowIds.has(id)) {
-                    movedWorkflowIds.push(id);
-                }
-                else {
+                if (!movedWorkflowIds.has(id))
                     deletedWorkflowIds.push(id);
-                }
             }
             else {
                 invalidWorkflowIds.push(id);
@@ -327,30 +432,84 @@ let PromotionsService = class PromotionsService {
         if (invalidWorkflowIds.length > 0) {
             throw new errors_1.BadRequestError(`The following workflows are not in this project's branch or instance: ${invalidWorkflowIds.join(', ')}`);
         }
-        if (movedWorkflowIds.length > 0) {
-            throw new errors_1.ConflictError(`These workflows moved to another project: ${movedWorkflowIds.join(', ')}. A selective apply cannot move them. Apply all projects instead.`);
-        }
         return { selectedProjectId: projectId, selectedWorkflowIds, deletedWorkflowIds };
     }
+    async findCrossProjectMoves(inventory, projectId) {
+        const [owners, folders, existingProjects] = await Promise.all([
+            this.sharedWorkflowRepository.findOwnerProjectsByWorkflowIds(inventory.workflows.map(({ id }) => id)),
+            this.folderService.getFoldersByIds((0, cross_project_moves_1.foldersInScope)(inventory.folders, projectId).map(({ folder }) => folder.id)),
+            this.projectRepository.findTypesByIds(inventory.projects.map(({ id }) => id)),
+        ]);
+        return (0, cross_project_moves_1.crossProjectMoves)({
+            inventory,
+            owners,
+            folderHomes: new Map(folders.map(({ id, homeProject }) => [id, homeProject])),
+            existingProjectIds: new Set(existingProjects.map(({ id }) => id)),
+            projectId,
+        });
+    }
+    async checkApplyBlockers(projectId, commitSha) {
+        const input = await this.resolver.resolveForProject(projectId, 'apply');
+        await this.assertCheckoutReady(input, 'checking Apply blockers');
+        const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
+        const files = await this.gitService.readTreeAtCommit({
+            remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
+            credentials: await this.credentialsFor(input),
+            paths: this.workingDirectory.paths(input.environmentId),
+            branchName,
+            environmentId: input.environmentId,
+            commitSha,
+            directory: constants_2.PACKAGE_SUBFOLDER,
+            limits: this.packageImportConfig,
+        });
+        if (files.size === 0) {
+            throw new errors_1.BadRequestError('The remote branch has no exported package to import. Promote to it first.');
+        }
+        const inventory = await this.inventoryReader.read({
+            listEntries: async () => [...files.keys()],
+            readFile: async (entryPath) => {
+                const content = files.get(entryPath);
+                if (!content)
+                    throw new errors_1.BadRequestError(`Package does not contain entry: ${entryPath}`);
+                return content;
+            },
+        });
+        const moves = await this.findCrossProjectMoves(inventory, projectId);
+        const preflight = await this.bindingPreflight.checkInventory({
+            inventory,
+            selection: {
+                selectedProjectId: projectId,
+                selectedWorkflowIds: inventory.workflows
+                    .filter((workflow) => workflow.projectId === projectId)
+                    .map(({ id }) => id),
+            },
+        });
+        return {
+            environmentId: input.environmentId,
+            git: { commitSha, branchName },
+            preflight,
+            movedWorkflows: moves.workflows,
+            movedFolders: moves.folders,
+        };
+    }
     async applySelectionFromSource(projectId, actor, workflowIds, expectedSource, confirmDestructiveChanges = false) {
         const input = await this.resolver.resolveForProject(projectId, 'apply');
         await this.assertCheckoutReady(input, 'applying');
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
-        const paths = this.workingDirectory.paths(input.configId);
+        const paths = this.workingDirectory.paths(input.environmentId);
         const { commitSha } = await this.gitService.refreshCheckout({
             remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
             credentials: await this.credentialsFor(input),
             paths,
             branchName,
-            configId: input.configId,
+            environmentId: input.environmentId,
         });
         const identity = {
-            connectionId: input.connectionId,
-            configId: input.configId,
+            environmentId: input.environmentId,
             git: { commitSha, branchName },
         };
         if (expectedSource &&
-            (expectedSource.configId !== input.configId ||
+            (expectedSource.environmentId !== input.environmentId ||
                 expectedSource.branchName !== branchName ||
                 expectedSource.commitSha !== commitSha)) {
             this.logger.info('Apply stopped because the source changed', {
@@ -365,7 +524,16 @@ let PromotionsService = class PromotionsService {
         }
         const reader = new directory_package_reader_1.DirectoryPackageReader(packageFolder, this.packageImportConfig);
         const inventory = await this.inventoryReader.read(reader);
-        const selection = await this.classifyApplySelection(inventory, projectId, workflowIds);
+        const moves = await this.findCrossProjectMoves(inventory, projectId);
+        const selection = await this.classifyApplySelection(inventory, projectId, workflowIds, new Set(moves.workflows.map(({ id }) => id)));
+        const requested = new Set(workflowIds);
+        const blocking = {
+            ...moves,
+            workflows: moves.workflows.filter(({ id }) => requested.has(id)),
+        };
+        if (blocking.workflows.length > 0 || blocking.folders.length > 0) {
+            throw new errors_1.ConflictError((0, cross_project_moves_1.describeCrossProjectMoves)(blocking));
+        }
         const preflight = await this.bindingPreflight.checkInventory({
             inventory,
             selection: {
@@ -404,6 +572,9 @@ let PromotionsService = class PromotionsService {
             dataTableSchemaConflictPolicy: confirmDestructiveChanges
                 ? n8n_packages_types_1.DataTableSchemaConflictPolicy.Overwrite
                 : IMPORT_POLICY.dataTableSchemaConflictPolicy,
+            tagConflictPolicy: IMPORT_POLICY.tagConflictPolicy,
+            credentialConflictPolicy: IMPORT_POLICY.credentialConflictPolicy,
+            layoutConflictPolicy: n8n_packages_types_1.LayoutConflictPolicy.FollowPackage,
         }, { sourceDir: packageFolder }, selection);
         return {
             status: 'applied',
@@ -415,26 +586,25 @@ let PromotionsService = class PromotionsService {
             warnings: preflight.warnings,
         };
     }
-    async applyFromSource(connectionId, actor, expectedSource, confirmDestructiveChanges = false) {
-        const input = await this.resolver.resolveForConnection(connectionId, 'apply');
+    async applyFromSource(environmentId, actor, expectedSource, confirmDestructiveChanges = false) {
+        const input = await this.resolver.resolveForEnvironment(environmentId, 'apply');
         this.assertInstanceScope(input, 'Apply');
         await this.assertCheckoutReady(input, 'applying');
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
-        const paths = this.workingDirectory.paths(input.configId);
+        const paths = this.workingDirectory.paths(input.environmentId);
         const { commitSha } = await this.gitService.refreshCheckout({
             remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
             credentials: await this.credentialsFor(input),
             paths,
             branchName,
-            configId: input.configId,
+            environmentId: input.environmentId,
         });
         const identity = {
-            connectionId: input.connectionId,
-            configId: input.configId,
+            environmentId: input.environmentId,
             git: { commitSha, branchName },
         };
         if (expectedSource &&
-            (expectedSource.configId !== input.configId ||
+            (expectedSource.environmentId !== input.environmentId ||
                 expectedSource.branchName !== branchName ||
                 expectedSource.commitSha !== commitSha)) {
             this.logger.info('Apply stopped because the source changed', {
@@ -447,9 +617,12 @@ let PromotionsService = class PromotionsService {
         if (!(await isDirectory(packageFolder))) {
             throw new errors_1.BadRequestError('The remote branch has no exported package to import. Promote to it first.');
         }
-        const preflight = await this.bindingPreflight.checkDirectory({
-            sourceDir: packageFolder,
-        });
+        const inventory = await this.inventoryReader.read(new directory_package_reader_1.DirectoryPackageReader(packageFolder, this.packageImportConfig));
+        const moves = await this.findCrossProjectMoves(inventory);
+        if (moves.workflows.length > 0 || moves.folders.length > 0) {
+            throw new errors_1.ConflictError((0, cross_project_moves_1.describeCrossProjectMoves)(moves));
+        }
+        const preflight = await this.bindingPreflight.checkInventory({ inventory });
         const blockingConflicts = confirmDestructiveChanges
             ? preflight.conflicts.filter(({ code }) => !isConfirmableConflict(code))
             : preflight.conflicts;
@@ -469,13 +642,13 @@ let PromotionsService = class PromotionsService {
             return { status: 'blocked', ...identity, preflight };
         }
         this.logger.info('Importing a package', {
-            connectionId,
-            configId: input.configId,
+            environmentId,
             confirmDestructiveChanges,
         });
         const result = await this.n8nPackagesService.importPackageFromDirectory({
             user: actor,
             ...IMPORT_POLICY,
+            layoutConflictPolicy: n8n_packages_types_1.LayoutConflictPolicy.FollowPackage,
             dataTableSchemaConflictPolicy: confirmDestructiveChanges
                 ? n8n_packages_types_1.DataTableSchemaConflictPolicy.Overwrite
                 : IMPORT_POLICY.dataTableSchemaConflictPolicy,
@@ -493,21 +666,26 @@ let PromotionsService = class PromotionsService {
     async readBranchPackage(projectId, direction) {
         const input = await this.resolver.resolveForProject(projectId, direction);
         await this.assertCheckoutReady(input, 'listing branch files');
-        const paths = this.workingDirectory.paths(input.configId);
+        const paths = this.workingDirectory.paths(input.environmentId);
         const branchName = (0, promotions_git_utils_1.checkoutBranchName)(input.config);
+        const manifestPath = `${constants_2.PACKAGE_SUBFOLDER}/${constants_1.MANIFEST_FILE}`;
         const { commitSha, lsTreeOutput } = await this.gitService.listBranchTree({
             remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
             credentials: await this.credentialsFor(input),
             paths,
             branchName,
-            configId: input.configId,
-            pathspecs: base_branch_files_1.BASE_BRANCH_DIRECTORIES.map((directory) => `${constants_2.PACKAGE_SUBFOLDER}/${directory}/`),
+            environmentId: input.environmentId,
+            pathspecs: [
+                ...base_branch_files_1.BASE_BRANCH_DIRECTORIES.map((directory) => `${constants_2.PACKAGE_SUBFOLDER}/${directory}/`),
+                manifestPath,
+            ],
         });
         return {
-            configId: input.configId,
+            environmentId: input.environmentId,
             branchName,
             commitSha,
             files: (0, base_branch_files_1.parseBaseBranchFiles)(lsTreeOutput, { exportRoot: constants_2.PACKAGE_SUBFOLDER, projectId }),
+            hasManifest: lsTreeOutput.split('\0').some((record) => record.endsWith(`\t${manifestPath}`)),
             readFiles: async (filePaths) => {
                 if (commitSha === null) {
                     throw new errors_1.BadRequestError('The remote branch has no exported package to import. Promote to it first.');
@@ -515,31 +693,142 @@ let PromotionsService = class PromotionsService {
                 return await this.gitService.readFilesAtCommit({
                     paths,
                     branchName,
-                    configId: input.configId,
+                    environmentId: input.environmentId,
                     commitSha,
                     filePaths,
                 });
             },
         };
     }
+    async readBranchFilesAtCommit(projectId, direction, commitSha, filePaths) {
+        const input = await this.resolver.resolveForProject(projectId, direction);
+        await this.assertCheckoutReady(input, 'reading branch files');
+        return await this.readExistingFiles({
+            paths: this.workingDirectory.paths(input.environmentId),
+            branchName: (0, promotions_git_utils_1.checkoutBranchName)(input.config),
+            environmentId: input.environmentId,
+            commitSha,
+        }, filePaths);
+    }
+    async readReviewCommits(environmentId, request) {
+        const input = await this.resolver.resolveForEnvironment(environmentId, 'promote');
+        await this.assertCheckoutReady(input, 'reading a review');
+        const operation = {
+            paths: this.workingDirectory.paths(input.environmentId),
+            branchName: (0, promotions_git_utils_1.checkoutBranchName)(input.config),
+            environmentId: input.environmentId,
+        };
+        const { baselineCommitSha } = await this.gitService.fetchReviewCommits({
+            ...operation,
+            ...request,
+            remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
+            credentials: await this.credentialsFor(input),
+        });
+        const atCommit = (commitSha) => ({
+            commitSha,
+            listFiles: async () => await this.gitService.listFilesAtCommit({
+                ...operation,
+                commitSha,
+                directory: constants_2.PACKAGE_SUBFOLDER,
+            }),
+            readFiles: async (filePaths) => await this.readExistingFiles({ ...operation, commitSha }, filePaths),
+        });
+        return { baseline: atCommit(baselineCommitSha), head: atCommit(request.headCommitSha) };
+    }
+    async readExistingFiles(operation, filePaths) {
+        const existing = await this.gitService.findPathsAtCommit({ ...operation, filePaths });
+        return await this.gitService.readFilesAtCommit({
+            ...operation,
+            filePaths: filePaths.filter((path) => existing.has(path)),
+        });
+    }
     async prepareTargetBranch(input, branchName, credentials) {
         if (input.config.direction !== 'promote' || !input.config.settings.createBranchOnPromotion) {
             return undefined;
         }
         const targetBranchName = (0, promotions_git_utils_1.buildPromotionBranchName)(new Date());
         await this.gitService.validateBranchName(targetBranchName);
-        await this.gitService.prepareCheckoutForPromotion({
+        const { commitSha } = await this.gitService.prepareCheckoutForPromotion({
             remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input),
             credentials,
-            paths: this.workingDirectory.paths(input.configId),
+            paths: this.workingDirectory.paths(input.environmentId),
             branchName,
-            configId: input.configId,
+            environmentId: input.environmentId,
         });
-        return targetBranchName;
+        return { targetBranchName, baseCommitSha: commitSha };
+    }
+    async assertNoProjectMovesSinceBranch(input, branchName, credentials, baseCommitSha) {
+        const manifest = await this.readRemoteManifest(input, branchName, credentials, baseCommitSha);
+        if (manifest === null)
+            return;
+        const branch = readBranchPlacements(manifest, BRANCH_MANIFEST_PATH);
+        if (branch.workflows.length === 0 && branch.folders.length === 0)
+            return;
+        const [owners, folders, existingProjects] = await Promise.all([
+            this.sharedWorkflowRepository.findOwnerProjectsByWorkflowIds(branch.workflows.map(({ id }) => id)),
+            this.folderService.getFoldersByIds(branch.folders.map(({ folder }) => folder.id)),
+            this.projectRepository.findTypesByIds(branch.projects.map(({ id }) => id)),
+        ]);
+        const droppedWorkflows = branch.workflows.filter(({ id }) => {
+            const owner = owners.get(id);
+            return owner !== undefined && owner.type !== 'team';
+        });
+        if (droppedWorkflows.length > 0) {
+            throw new errors_1.BadRequestError(describeWorkflowsMovedToPersonalProjects(droppedWorkflows));
+        }
+        const moves = (0, cross_project_moves_1.crossProjectMoves)({
+            inventory: branch,
+            owners,
+            folderHomes: new Map(folders.map(({ id, homeProject }) => [id, homeProject])),
+            existingProjectIds: new Set(existingProjects.map(({ id }) => id)),
+        });
+        const refused = {
+            ...moves,
+            workflows: moves.workflows.filter(({ projectExists }) => projectExists),
+            folders: moves.folders.filter(({ projectExists }) => projectExists),
+        };
+        if (refused.workflows.length > 0 || refused.folders.length > 0) {
+            throw new errors_1.BadRequestError((0, cross_project_moves_1.describePromotedMoves)(refused));
+        }
+    }
+    async readRemoteManifest(input, branchName, credentials, knownHead) {
+        const paths = this.workingDirectory.paths(input.environmentId);
+        const local = { paths, branchName, environmentId: input.environmentId };
+        const commitSha = knownHead ??
+            (await this.fetchManifestHead({ ...local, remoteUrl: (0, promotions_git_utils_1.repositoryUrl)(input), credentials }));
+        if (commitSha === null)
+            return null;
+        const present = await this.gitService.findPathsAtCommit({
+            ...local,
+            commitSha,
+            filePaths: [BRANCH_MANIFEST_PATH],
+        });
+        if (!present.has(BRANCH_MANIFEST_PATH))
+            return null;
+        const files = await this.gitService.readFilesAtCommit({
+            ...local,
+            commitSha,
+            filePaths: [BRANCH_MANIFEST_PATH],
+        });
+        return files.get(BRANCH_MANIFEST_PATH) ?? '';
+    }
+    async fetchManifestHead(operation) {
+        try {
+            const head = await this.gitService.listBranchTree({
+                ...operation,
+                pathspecs: [BRANCH_MANIFEST_PATH],
+            });
+            return head.commitSha;
+        }
+        catch (error) {
+            if (await this.gitService.hasRemoteBranch(operation))
+                throw error;
+            return null;
+        }
     }
     assertInstanceScope(input, operation) {
-        if (input.connectionScope !== 'instance') {
-            throw new errors_1.BadRequestError(`${operation} is only available on the instance connection. Project connections are not supported yet.`);
+        if (input.scope !== 'instance') {
+            throw new errors_1.BadRequestError(`${operation} is only available on an instance environment. Project environments are not supported yet.`);
         }
     }
     async assertTeamProject(projectId) {
@@ -547,29 +836,39 @@ let PromotionsService = class PromotionsService {
         if (!project)
             throw new errors_1.NotFoundError('Project not found');
         if (project.type !== 'team') {
-            throw new errors_1.BadRequestError('Only team projects can use a promotion connection');
+            throw new errors_1.BadRequestError('Only team projects can use a promotion environment');
         }
+        return project;
+    }
+    defaultSelectionCommitMessage(projectName, selection, staging, branch) {
+        const onBranch = new Map((branch.state.workflows ?? []).map((w) => [w.id, w.name]));
+        const exported = new Map((staging.workflows ?? []).map((w) => [w.id, w.name]));
+        const pushed = selection.workflowIds.map((id) => ({ id, name: exported.get(id) ?? id }));
+        return (0, promotion_commit_message_1.buildSelectionPromotionCommitMessage)({
+            projectName,
+            added: pushed.filter(({ id }) => !onBranch.has(id)),
+            updated: pushed.filter(({ id }) => onBranch.has(id)),
+            removed: selection.deletedWorkflowIds.map((id) => ({ id, name: onBranch.get(id) ?? id })),
+        });
     }
     async assertCheckoutReady(input, gerund) {
-        const { repositoryFolder } = this.workingDirectory.paths(input.configId);
+        const { repositoryFolder } = this.workingDirectory.paths(input.environmentId);
         const cloned = await this.gitService.hasCheckout(repositoryFolder);
         const current = cloned && (await this.workingDirectory.matchesDescriptor(this.descriptorFor(input)));
         if (!current) {
-            throw new errors_1.BadRequestError(`This ${input.config.direction} configuration is not cloned. Clone it before ${gerund}.`);
+            throw new errors_1.BadRequestError(`This ${input.config.direction} environment is not connected. Connect it before ${gerund}.`);
         }
     }
     descriptorFor(input) {
         return (0, promotions_git_utils_1.buildCacheDescriptor)({
-            connectionId: input.connectionId,
-            configId: input.configId,
-            target: input.target,
+            environmentId: input.environmentId,
+            remote: input.remote,
             config: input.config,
         });
     }
     checkoutIdentity(input) {
         return {
-            connectionId: input.connectionId,
-            configId: input.configId,
+            environmentId: input.environmentId,
             direction: input.config.direction,
         };
     }
@@ -606,11 +905,14 @@ let PromotionsService = class PromotionsService {
                 deleted: projectReconciliation.deletedProjectIds.length,
             },
             folders: {
-                ...tally(importResult.folders, ['created', 'skipped']),
+                ...tally(importResult.folders, ['created', 'updated', 'skipped']),
+                moved: importResult.folders.filter(({ moved }) => moved).length,
+                renamed: importResult.folders.filter(({ renamed }) => renamed).length,
                 removed: importResult.removedFolders.length,
             },
             workflows: {
                 ...tally(importResult.workflows, ['created', 'updated', 'skipped']),
+                moved: importResult.workflows.filter(({ moved }) => moved).length,
                 archived: importResult.removedWorkflows.filter(({ deletion }) => deletion === 'archived')
                     .length,
                 deleted: importResult.removedWorkflows.filter(({ deletion }) => deletion === 'deleted')
@@ -620,6 +922,7 @@ let PromotionsService = class PromotionsService {
             credentials: {
                 matched: importResult.credentials.matched.length,
                 stubbed: importResult.credentials.stubbed.length,
+                updated: importResult.credentials.updated.length,
             },
             dataTables: {
                 matched: importResult.dataTables.matched,
@@ -646,7 +949,7 @@ let PromotionsService = class PromotionsService {
 exports.PromotionsService = PromotionsService;
 exports.PromotionsService = PromotionsService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [promotion_config_resolver_1.PromotionConfigResolver, promotion_providers_service_1.PromotionProvidersService, promotion_working_directory_service_1.PromotionWorkingDirectoryService, working_copy_updater_1.WorkingCopyUpdater, promotions_git_service_1.PromotionsGitService, db_1.ProjectRepository, db_1.SharedWorkflowRepository, project_service_ee_1.ProjectService, n8n_packages_service_1.N8nPackagesService, promotion_binding_preflight_service_1.PromotionBindingPreflightService, package_directory_inventory_reader_1.PackageDirectoryInventoryReader, n8n_packages_config_1.PackageImportConfig, backend_common_1.Logger])
+    __metadata("design:paramtypes", [promotion_environment_resolver_1.PromotionEnvironmentResolver, promotion_providers_service_1.PromotionProvidersService, promotion_working_directory_service_1.PromotionWorkingDirectoryService, working_copy_updater_1.WorkingCopyUpdater, promotions_git_service_1.PromotionsGitService, db_1.ProjectRepository, db_1.SharedWorkflowRepository, project_service_ee_1.ProjectService, folder_service_1.FolderService, n8n_packages_service_1.N8nPackagesService, promotion_binding_preflight_service_1.PromotionBindingPreflightService, package_directory_inventory_reader_1.PackageDirectoryInventoryReader, n8n_packages_config_1.PackageImportConfig, promotion_run_repository_1.PromotionRunRepository, promotion_reviews_service_1.PromotionReviewsService, backend_common_1.Logger])
 ], PromotionsService);
 async function pathExists(target) {
     try {
@@ -667,4 +970,46 @@ async function isDirectory(folder) {
         return false;
     }
 }
+const BRANCH_MANIFEST_PATH = `${constants_2.PACKAGE_SUBFOLDER}/${constants_1.MANIFEST_FILE}`;
+function describeWorkflowsMovedToPersonalProjects(moved) {
+    const items = moved.map(({ id, name, projectName }) => `"${name}" (${id}) is in a personal project here and in team project "${projectName}" on the branch`);
+    return `A promotion does not include personal projects, so these workflows would be deleted on the destination: ${items.join('; ')}. Move them back to the team project the branch holds them in, then promote again.`;
+}
+const branchPlacementsSchema = zod_1.z.object({
+    projects: zod_1.z.array(manifest_schema_1.manifestEntrySchema).optional(),
+    workflows: zod_1.z.array(manifest_schema_1.manifestEntrySchema).optional(),
+    folders: zod_1.z.array(manifest_schema_1.manifestEntrySchema).optional(),
+});
+function readBranchPlacements(raw, manifestPath) {
+    let json;
+    try {
+        json = raw === undefined ? undefined : (0, n8n_workflow_1.jsonParse)(raw);
+    }
+    catch {
+        json = undefined;
+    }
+    const parsed = branchPlacementsSchema.safeParse(json);
+    if (!parsed.success) {
+        const [key, index] = parsed.error.issues[0]?.path ?? [];
+        const list = typeof key === 'string' && (0, is_record_1.isRecord)(json) ? json[key] : undefined;
+        const entry = Array.isArray(list) && typeof index === 'number' ? list[index] : undefined;
+        const id = (0, is_record_1.isRecord)(entry) && typeof entry.id === 'string' ? ` (id "${entry.id}")` : '';
+        const part = typeof key === 'string' && typeof index === 'number'
+            ? `Entry ${index + 1} of "${key}" in "${manifestPath}"`
+            : `"${manifestPath}"`;
+        throw new errors_1.BadRequestError(`${part} on the branch is not readable${id}, so promote can't check it for workflows and folders that moved between projects. Fix the file on the branch, then promote again.`);
+    }
+    const { projects = [], workflows = [], folders = [] } = parsed.data;
+    return {
+        projects: projects.map(({ id, name }) => ({ id, name })),
+        workflows: workflows.flatMap(({ id, name, target }) => {
+            const project = (0, branch_placement_1.projectHolding)(projects, target);
+            return project ? [{ id, name, projectId: project.id, projectName: project.name }] : [];
+        }),
+        folders: folders.flatMap(({ id, name, target }) => {
+            const project = (0, branch_placement_1.projectHolding)(projects, target);
+            return project ? [{ projectId: project.id, folder: { id, name } }] : [];
+        }),
+    };
+}
 //# sourceMappingURL=promotions.service.js.map