primitive-admin 1.1.0-alpha.71 → 1.1.0-alpha.72

package/dist/src/lib/env-resolver-core.d.ts

@@ -52,8 +52,46 @@ export interface CoreEnvironmentEntry {
     apiUrl: string;
     appId?: string;
     appName?: string;
+    /**
+     * The app's web counterpart for this environment, as a normalized origin
+     * (#2982). Read through `normalizeWebOrigin`, so a value this reader carries
+     * is always an origin — see that function for why the typed read other
+     * fields get is not enough here.
+     */
+    webUrl?: string;
     description?: string;
 }
+/**
+ * The app's web counterpart as a normalized ORIGIN, or undefined when the
+ * value cannot be one (#2982).
+ *
+ * Unlike `appId`/`appName`, a typed read is not enough. This value is not
+ * merely carried: the Swift app points its emailed sign-in link at
+ * `<webUrl>/oauth/callback` and trusts incoming universal links from the same
+ * origin, and BOTH jobs need an origin —
+ *
+ *   - https except loopback, the rule the server applies to every redirect URI
+ *     (`src/auth/redirect-uri.ts`): an origin that cannot be allow-listed turns
+ *     every sign-in request into a 400, and a plain-http link would carry the
+ *     magic token in clear;
+ *   - no path, query or fragment: the web client serves its callback on its own
+ *     origin plus `/oauth/callback`, which is also the exact path the
+ *     `apple-app-site-association` component claims;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * `primitive env add --web-url` and the project-config validation reject those
+ * shapes with a field-named error, but neither is on the path from a
+ * hand-edited `.primitive/config.json` to an Xcode build: the Swift template's
+ * pre-build script reads the file directly. So every reader that feeds
+ * `primitive.json` applies the contract, and a value that misses it is read as
+ * "this environment has no web counterpart" — code-only email, no trusted
+ * origin, nothing silently pointed at the wrong URL.
+ *
+ * The message-producing twin of this rule lives in `cli/src/lib/web-url.ts`;
+ * this file cannot import it (see COPYABILITY above), and a test pins that the
+ * two agree.
+ */
+export declare function normalizeWebOrigin(value: unknown): string | undefined;
 export interface CoreProjectConfig {
     version: number;
     defaultEnvironment?: string;
@@ -68,6 +106,8 @@ export interface ResolvedPrimitiveEnv {
     wsUrl: string;
     appId?: string;
     appName?: string;
+    /** The app's web counterpart for the SELECTED environment, if it has one. */
+    webUrl?: string;
     description?: string;
     source: PrimitiveEnvSource;
     configPath: string;

package/dist/src/lib/env-resolver-core.js

@@ -50,6 +50,64 @@ export class PrimitiveEnvError extends Error {
         this.path = path;
     }
 }
+/**
+ * The app's web counterpart as a normalized ORIGIN, or undefined when the
+ * value cannot be one (#2982).
+ *
+ * Unlike `appId`/`appName`, a typed read is not enough. This value is not
+ * merely carried: the Swift app points its emailed sign-in link at
+ * `<webUrl>/oauth/callback` and trusts incoming universal links from the same
+ * origin, and BOTH jobs need an origin —
+ *
+ *   - https except loopback, the rule the server applies to every redirect URI
+ *     (`src/auth/redirect-uri.ts`): an origin that cannot be allow-listed turns
+ *     every sign-in request into a 400, and a plain-http link would carry the
+ *     magic token in clear;
+ *   - no path, query or fragment: the web client serves its callback on its own
+ *     origin plus `/oauth/callback`, which is also the exact path the
+ *     `apple-app-site-association` component claims;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * `primitive env add --web-url` and the project-config validation reject those
+ * shapes with a field-named error, but neither is on the path from a
+ * hand-edited `.primitive/config.json` to an Xcode build: the Swift template's
+ * pre-build script reads the file directly. So every reader that feeds
+ * `primitive.json` applies the contract, and a value that misses it is read as
+ * "this environment has no web counterpart" — code-only email, no trusted
+ * origin, nothing silently pointed at the wrong URL.
+ *
+ * The message-producing twin of this rule lives in `cli/src/lib/web-url.ts`;
+ * this file cannot import it (see COPYABILITY above), and a test pins that the
+ * two agree.
+ */
+export function normalizeWebOrigin(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return undefined;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+        return undefined;
+    if (url.protocol === "http:" &&
+        url.hostname !== "localhost" &&
+        url.hostname !== "127.0.0.1") {
+        return undefined;
+    }
+    if (url.username || url.password)
+        return undefined;
+    if (url.pathname !== "/" && url.pathname !== "")
+        return undefined;
+    if (url.search || url.hash)
+        return undefined;
+    return url.origin;
+}
 /**
  * Derives the WebSocket URL from the API URL. Every apiUrl/wsUrl pair in
  * practice is the same host with the scheme swapped, so it is derived rather
@@ -149,6 +207,7 @@ export function readCoreProjectConfig(configPath) {
             apiUrl: e.apiUrl.replace(/\/$/, ""),
             appId: typeof e.appId === "string" ? e.appId : undefined,
             appName: typeof e.appName === "string" ? e.appName : undefined,
+            webUrl: normalizeWebOrigin(e.webUrl),
             description: typeof e.description === "string" ? e.description : undefined,
         };
     }
@@ -255,6 +314,7 @@ export function resolvePrimitiveEnv(options = {}) {
         wsUrl: deriveWsUrl(entry.apiUrl),
         appId: entry.appId,
         appName: entry.appName,
+        webUrl: entry.webUrl,
         description: entry.description,
         source,
         configPath,

package/dist/src/lib/env-resolver-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver-core.js","sourceRoot":"","sources":["../../../src/lib/env-resolver-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAehE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAC5B,IAAI,CAAU;IAEvB,YAAY,IAA2B,EAAE,OAAe,EAAE,IAAa;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgDD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsE,EAAE;IAExE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,MAAM,2BAA2B,aAAa,UAAU,uCAAuC,EAC/F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,kBAAkB,2BAA2B,KAAK,UAAU,MAAM,GAAG,CAAC,OAAO,EAAE,EAC/E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,mBAAmB,2BAA2B,KAAK,UAAU,MAAM,GAAG,CAAC,OAAO,EAAE,EAChF,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,gDAAgD,EAC7F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,gDAAgD,EAC7F,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,GAAG,2BAA2B,KAAK,UAAU,iBAAiB,GAAG,CAAC,OAAO,uCAAuC,wBAAwB,GAAG,EAC3I,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,8CAA8C,EAC3F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAuC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gBAAgB,IAAI,0BAA0B,2BAA2B,KAAK,UAAU,IAAI,EAC5F,UAAU,CACX,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gBAAgB,IAAI,8CAA8C,2BAA2B,KAAK,UAAU,IAAI,EAChH,UAAU,CACX,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACxD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC9D,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,kBAAkB,EAChB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB;YAClE,CAAC,CAAC,GAAG,CAAC,kBAAkB;YACxB,CAAC,CAAC,SAAS;QACf,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAS,EAAE;QACxC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,GAAG,wBAAwB,KAAK,IAAI,oBAAoB,MAAM,yDAAyD,EACvH,IAAI,CACL,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAyB,EACzB,OAKC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU;QAC9B,CAAC,CAAC,GAAG,2BAA2B,KAAK,OAAO,CAAC,UAAU,GAAG;QAC1D,CAAC,CAAC,2BAA2B,CAAC;IAEhC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,MAA0B,EAAE,MAAc,EAAE,EAAE;QAChF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,gBAAgB,IAAI,uBAAuB,KAAK,cAAc,MAAM,iBAAiB,IAAI,EAAE,EAC3F,OAAO,CAAC,UAAU,CACnB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,wBAAwB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,GAAG,KAAK,mFAAmF,EAC3F,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,wFAAwF,KAAK,yCAAyC,IAAI,EAAE,EAC5I,OAAO,CAAC,UAAU,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA0B,EAAE;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,MAAM,2BAA2B,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,oHAAoH,CAC/L,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACrD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACrC,cAAc,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC9C,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,gBAAgB,IAAI,QAAQ,2BAA2B,KAAK,UAAU,6EAA6E,IAAI,cAAc,KAAK,CAAC,MAAM,qCAAqC,EACtN,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,UAAU;QACV,cAAc,EAAE,2BAA2B,CAAC,UAAU,CAAC;QACvD,WAAW,EAAE,wBAAwB,CAAC,UAAU,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env-resolver-core.js","sourceRoot":"","sources":["../../../src/lib/env-resolver-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAehE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAC5B,IAAI,CAAU;IAEvB,YAAY,IAA2B,EAAE,OAAe,EAAE,IAAa;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC5E,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW,EAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AA2CD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsE,EAAE;IAExE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,MAAM,2BAA2B,aAAa,UAAU,uCAAuC,EAC/F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,kBAAkB,2BAA2B,KAAK,UAAU,MAAM,GAAG,CAAC,OAAO,EAAE,EAC/E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,mBAAmB,2BAA2B,KAAK,UAAU,MAAM,GAAG,CAAC,OAAO,EAAE,EAChF,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,gDAAgD,EAC7F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,gDAAgD,EAC7F,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,GAAG,2BAA2B,KAAK,UAAU,iBAAiB,GAAG,CAAC,OAAO,uCAAuC,wBAAwB,GAAG,EAC3I,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,GAAG,2BAA2B,KAAK,UAAU,8CAA8C,EAC3F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAuC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gBAAgB,IAAI,0BAA0B,2BAA2B,KAAK,UAAU,IAAI,EAC5F,UAAU,CACX,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gBAAgB,IAAI,8CAA8C,2BAA2B,KAAK,UAAU,IAAI,EAChH,UAAU,CACX,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACxD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC9D,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,kBAAkB,EAChB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB;YAClE,CAAC,CAAC,GAAG,CAAC,kBAAkB;YACxB,CAAC,CAAC,SAAS;QACf,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAS,EAAE;QACxC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,GAAG,wBAAwB,KAAK,IAAI,oBAAoB,MAAM,yDAAyD,EACvH,IAAI,CACL,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAyB,EACzB,OAKC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU;QAC9B,CAAC,CAAC,GAAG,2BAA2B,KAAK,OAAO,CAAC,UAAU,GAAG;QAC1D,CAAC,CAAC,2BAA2B,CAAC;IAEhC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,MAA0B,EAAE,MAAc,EAAE,EAAE;QAChF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,gBAAgB,IAAI,uBAAuB,KAAK,cAAc,MAAM,iBAAiB,IAAI,EAAE,EAC3F,OAAO,CAAC,UAAU,CACnB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,wBAAwB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,GAAG,KAAK,mFAAmF,EAC3F,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,wFAAwF,KAAK,yCAAyC,IAAI,EAAE,EAC5I,OAAO,CAAC,UAAU,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA0B,EAAE;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,MAAM,2BAA2B,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,oHAAoH,CAC/L,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACrD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACrC,cAAc,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC9C,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,gBAAgB,IAAI,QAAQ,2BAA2B,KAAK,UAAU,6EAA6E,IAAI,cAAc,KAAK,CAAC,MAAM,qCAAqC,EACtN,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,UAAU;QACV,cAAc,EAAE,2BAA2B,CAAC,UAAU,CAAC;QACvD,WAAW,EAAE,wBAAwB,CAAC,UAAU,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/src/lib/generated-workflow-model-fields.d.ts

@@ -0,0 +1,20 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the `WorkflowDefinition` model in the repo-root
+ * `models.yaml` — the one statically-parseable server anchor for the
+ * `[workflow]`-level config surface (issue #2326, Phase 1 of #1976).
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-fields.mjs   (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-workflow-fields.mjs --check`, also
+ * asserted by `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts`)
+ * fails if this committed artifact does not match a fresh parse of
+ * `models.yaml`. The same test asserts every field below is classified in
+ * `cli/src/lib/workflow-field-descriptor.ts` as synced, structural, or
+ * internal — so a new server-side workflow field cannot be silently ignored by
+ * the CLI.
+ */
+/** Every `WorkflowDefinition` field, in `models.yaml` declaration order (#2326). */
+export declare const GENERATED_WORKFLOW_MODEL_FIELDS: readonly string[];

package/dist/src/lib/generated-workflow-model-fields.js

@@ -0,0 +1,53 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the `WorkflowDefinition` model in the repo-root
+ * `models.yaml` — the one statically-parseable server anchor for the
+ * `[workflow]`-level config surface (issue #2326, Phase 1 of #1976).
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-fields.mjs   (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-workflow-fields.mjs --check`, also
+ * asserted by `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts`)
+ * fails if this committed artifact does not match a fresh parse of
+ * `models.yaml`. The same test asserts every field below is classified in
+ * `cli/src/lib/workflow-field-descriptor.ts` as synced, structural, or
+ * internal — so a new server-side workflow field cannot be silently ignored by
+ * the CLI.
+ */
+/** Every `WorkflowDefinition` field, in `models.yaml` declaration order (#2326). */
+export const GENERATED_WORKFLOW_MODEL_FIELDS = [
+    "workflowId",
+    "appId",
+    "workflowKey",
+    "name",
+    "status",
+    "latestRevision",
+    "description",
+    "stepsR2Key",
+    "draftStepsR2Key",
+    "draftInputSchema",
+    "draftOutputSchema",
+    "draftModifiedAt",
+    "activeConfigId",
+    "inputSchema",
+    "outputSchema",
+    "perUserMaxRunning",
+    "perUserMaxQueued",
+    "perAppMaxRunning",
+    "perAppMaxQueued",
+    "queueTtlSeconds",
+    "dequeueOrder",
+    "requiresClientApply",
+    "syncCallable",
+    "accessRule",
+    "metadataManifest",
+    "runAs",
+    "lock",
+    "capabilities",
+    "createdBy",
+    "createdAt",
+    "modifiedAt",
+];
+//# sourceMappingURL=generated-workflow-model-fields.js.map

package/dist/src/lib/generated-workflow-model-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-workflow-model-fields.js","sourceRoot":"","sources":["../../../src/lib/generated-workflow-model-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAsB;IAChE,YAAY;IACZ,OAAO;IACP,aAAa;IACb,MAAM;IACN,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,OAAO;IACP,MAAM;IACN,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC"}

package/dist/src/lib/google-client-secret-status.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The operator-facing warning for an app whose stored `googleClientSecret` is
+ * not a `{{secrets.KEY}}` reference (#2256, #2307).
+ *
+ * The server never sends such a value back: `GET /settings` omits the key and
+ * reports `googleClientSecretStatus` in its place, so the only way an operator
+ * learns the field is still unmigrated is a command that reads the status and
+ * says so. Two do — `apps get` and `config pull` — and
+ * each has two statuses to describe, so the wording lives here once and the
+ * call sites supply only what genuinely differs: how the field is named in that
+ * context, where the value is missing from, and what the un-migrated value
+ * blocks.
+ *
+ * Modelled on `signingSecretStatusWarning` (the same problem for
+ * `webhook.signingSecret`), deliberately kept as a separate function: the
+ * remediation names a different TOML key, and a `legacy-literal` blocks
+ * different things on the two fields.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export declare function googleClientSecretStatusWarning(status: string | null | undefined, context: {
+    /** How to name the field, e.g. `"googleClientSecret"`. Starts the sentence. */
+    subject: string;
+    /** Where the value is missing from, e.g. `"this output"`. */
+    withheldFrom: string;
+    /**
+     * What an un-migrated value blocks, e.g. `"the next settings write will be
+     * rejected"`. Every settings write on such an app fails unless it carries a
+     * `googleClientSecret` that migrates the field
+     * (`validateGoogleClientSecretMigration`), and a pulled `app.toml` never
+     * carries one — so for the pull paths this is the concrete consequence.
+     */
+    blocks: string;
+}): string | null;

package/dist/src/lib/google-client-secret-status.js

@@ -0,0 +1,56 @@
+/**
+ * The operator-facing warning for an app whose stored `googleClientSecret` is
+ * not a `{{secrets.KEY}}` reference (#2256, #2307).
+ *
+ * The server never sends such a value back: `GET /settings` omits the key and
+ * reports `googleClientSecretStatus` in its place, so the only way an operator
+ * learns the field is still unmigrated is a command that reads the status and
+ * says so. Two do — `apps get` and `config pull` — and
+ * each has two statuses to describe, so the wording lives here once and the
+ * call sites supply only what genuinely differs: how the field is named in that
+ * context, where the value is missing from, and what the un-migrated value
+ * blocks.
+ *
+ * Modelled on `signingSecretStatusWarning` (the same problem for
+ * `webhook.signingSecret`), deliberately kept as a separate function: the
+ * remediation names a different TOML key, and a `legacy-literal` blocks
+ * different things on the two fields.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export function googleClientSecretStatusWarning(status, context) {
+    const remediation = "Store the value with `primitive secrets set KEY --value <value>` and set " +
+        'googleClientSecret = "{{secrets.KEY}}".';
+    if (status === "legacy-literal") {
+        return (`${context.subject} still holds a raw value rather than a {{secrets.KEY}} reference, ` +
+            `so it is withheld from ${context.withheldFrom}. Google sign-in keeps working, but the ` +
+            `value is deprecated and ${context.blocks} until it is migrated. ${remediation}`);
+    }
+    // Not a working legacy literal: the stored value carries reference syntax
+    // that resolves to nothing, so Google sign-in is already failing (#2332).
+    //
+    // Two deliberate differences from the branch above, both to keep the
+    // rendered settings output byte-identical to what PR #2293 shipped:
+    //
+    //   - `context.blocks` is unused. A push of the pulled file is rejected for
+    //     this status too (`validateGoogleClientSecretMigration` gates on
+    //     `isWithheldSecretStatus`, which covers both), but the sign-in outage is
+    //     the louder problem and the remediation below already fixes both. The
+    //     sibling `signingSecretStatusWarning` drops `blocks` in its malformed
+    //     branch the same way.
+    //   - The remediation sentence is written out rather than interpolating the
+    //     `remediation` constant above: this one says "the real client secret",
+    //     which the shared sentence does not.
+    //
+    // Both are worth revisiting together if `apps get`'s wording is ever
+    // allowed to change.
+    if (status === "malformed-reference") {
+        return (`${context.subject} is neither a {{secrets.KEY}} reference nor a plain stored value — it ` +
+            `carries reference syntax that does not resolve, so it is withheld from ${context.withheldFrom} ` +
+            "and Google sign-in is already FAILING. Store the real client secret with " +
+            '`primitive secrets set KEY --value <value>` and set googleClientSecret = "{{secrets.KEY}}".');
+    }
+    return null;
+}
+//# sourceMappingURL=google-client-secret-status.js.map

package/dist/src/lib/google-client-secret-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client-secret-status.js","sourceRoot":"","sources":["../../../src/lib/google-client-secret-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAiC,EACjC,OAaC;IAED,MAAM,WAAW,GACf,2EAA2E;QAC3E,yCAAyC,CAAC;IAC5C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,oEAAoE;YACtF,0BAA0B,OAAO,CAAC,YAAY,0CAA0C;YACxF,2BAA2B,OAAO,CAAC,MAAM,0BAA0B,WAAW,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,2BAA2B;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,0CAA0C;IAC1C,EAAE;IACF,qEAAqE;IACrE,qBAAqB;IACrB,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,wEAAwE;YAC1F,0EAA0E,OAAO,CAAC,YAAY,GAAG;YACjG,2EAA2E;YAC3E,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/init-client-platforms.d.ts

@@ -0,0 +1,14 @@
+import type { Platform } from "./resolve-platform.js";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export declare function detectClientPlatform(dir: string): Platform | null;
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export declare function discoverClientPlatforms(projectRoot: string): Platform[];
+/** Whether the app ends up with an iOS client AND a web client. */
+export declare function appHasBothPlatforms(planned: Platform[], discovered: Platform[]): boolean;

package/dist/src/lib/init-client-platforms.js

@@ -0,0 +1,71 @@
+/**
+ * Which client platforms an app HAS — the ones this run scaffolds plus the
+ * ones already in the repository (#2982).
+ *
+ * An app with both an iOS and a web client gets the universal-link wiring: the
+ * emailed sign-in link becomes the web deployment's https callback, which
+ * opens the installed app and still signs in from any browser. So "does this
+ * app have both?" decides whether init seeds a `webUrl` and prints the
+ * activation checklist.
+ *
+ * The existing clients are found by the signals the templates ship — a Swift
+ * package or Xcode project, a Vite project — so a `functions/` directory with
+ * a `package.json` is not mistaken for a client. They are looked for in child
+ * directories AND at the project root: `primitive init` still produces the
+ * flat single-client layout where the client IS the repository root, and
+ * adding the second platform to such a repository is exactly the case this
+ * feature exists for (DSO-2982-013).
+ */
+import { existsSync, readdirSync } from "fs";
+import { join } from "path";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export function detectClientPlatform(dir) {
+    let hasXcodeProject = false;
+    try {
+        hasXcodeProject = readdirSync(dir).some((name) => name.endsWith(".xcodeproj"));
+    }
+    catch {
+        return null;
+    }
+    if (existsSync(join(dir, "Package.swift")) || hasXcodeProject)
+        return "ios";
+    if (existsSync(join(dir, "package.json")) && existsSync(join(dir, "vite.config.ts"))) {
+        return "web";
+    }
+    return null;
+}
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export function discoverClientPlatforms(projectRoot) {
+    const found = new Set();
+    const atRoot = detectClientPlatform(projectRoot);
+    if (atRoot)
+        found.add(atRoot);
+    let entries;
+    try {
+        entries = readdirSync(projectRoot, { withFileTypes: true });
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name.startsWith("."))
+            continue;
+        const platform = detectClientPlatform(join(projectRoot, entry.name));
+        if (platform)
+            found.add(platform);
+    }
+    return ["web", "ios"].filter((platform) => found.has(platform));
+}
+/** Whether the app ends up with an iOS client AND a web client. */
+export function appHasBothPlatforms(planned, discovered) {
+    const platforms = new Set([...planned, ...discovered]);
+    return platforms.has("ios") && platforms.has("web");
+}
+//# sourceMappingURL=init-client-platforms.js.map

package/dist/src/lib/init-client-platforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-client-platforms.js","sourceRoot":"","sources":["../../../src/lib/init-client-platforms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAY,CAAC;IAElC,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAQ,CAAC,KAAK,EAAE,KAAK,CAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,OAAmB,EACnB,UAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAW,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/src/lib/init-email-redirect-uris.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+export type EmailRedirectUriMerge = {
+    action: "already-listed";
+} | {
+    action: "merge";
+    uris: string[];
+} | {
+    action: "leave-alone";
+    reason: string;
+};
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export declare function planEmailRedirectUriMerge(existing: unknown, callbackUri: string): EmailRedirectUriMerge;

package/dist/src/lib/init-email-redirect-uris.js

@@ -0,0 +1,46 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export function planEmailRedirectUriMerge(existing, callbackUri) {
+    if (!Array.isArray(existing)) {
+        return {
+            action: "leave-alone",
+            reason: "this app has no emailRedirectUris list of its own, and writing one would replace the allow-list it behaves by today",
+        };
+    }
+    const uris = existing.filter((value) => typeof value === "string");
+    if (uris.length === 0) {
+        return {
+            action: "leave-alone",
+            reason: "this app's emailRedirectUris list is empty, which is a deliberate 'reject every link target'",
+        };
+    }
+    if (uris.includes(callbackUri))
+        return { action: "already-listed" };
+    return { action: "merge", uris: [...uris, callbackUri] };
+}
+//# sourceMappingURL=init-email-redirect-uris.js.map

package/dist/src/lib/init-email-redirect-uris.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-email-redirect-uris.js","sourceRoot":"","sources":["../../../src/lib/init-email-redirect-uris.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/src/lib/init-ios-links.d.ts

@@ -29,6 +29,20 @@ export interface StampResult {
  * serializer would drop them.
  */
 export declare function stampCallbackScheme(clientDir: string, scheme: string): StampResult;
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * refuses a name the config already has. Every environment anyone reads this
+ * about already exists (init wrote `dev`; `prod` was added when the app was
+ * deployed), so the instruction for those has to be the file, which is also
+ * what the docs describe as the way to edit one. The flag is worth naming only
+ * where a new environment is being created.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export declare function setWebUrlInstruction(origin: string, indent?: string): string[];
 /**
  * What init prints about email sign-in on the iOS path: it already works, and
  * this is the one opt-in that adds the link.
@@ -46,5 +60,31 @@ export declare function stampCallbackScheme(clientDir: string, scheme: string):
 export declare function linkOptInGuidance(scheme: string, options?: {
     registered?: boolean;
 }): string[];
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export declare function universalLinkGuidance(options?: {
+    webOrigin?: string;
+    unverifiedDevCallback?: string;
+}): string[];
 /** What init says when the template predates the `PrimitiveAuth` URL type. */
 export declare function missingUrlTypeGuidance(scheme: string): string[];