primitive-admin 1.1.0 → 1.2.0-alpha.1

package/dist/src/lib/generated-config-surfaces.js

@@ -94,7 +94,8 @@ export function writableFieldNames(table, mode) {
  * The field names the server PERSISTS for this table in `mode`: the writable
  * fields, plus the `deprecated` classifications — "still writable, superseded
  * by another field" is what that kind means (`types.ts`), so a superseded key
- * a handler still honors (`accessPolicy`, `passkeyRpId`) belongs in every
+ * a handler still honors (`passkeyRpId`, or a flat chat key such as
+ * `systemPrompt` under `[[configs]]`, #3626) belongs in every
  * accepted set, and a field that is NOT writable belongs in none of them.
  *
  * Stated once here because three consumers need the same answer: the generated
@@ -2265,6 +2266,23 @@ export function unknownRequestKeysMessage(keys) {
         `${keys.join(", ")}. This endpoint rejects keys it does not accept rather ` +
         "than ignoring them.");
 }
+// #3997 — the three type configs author their rule-set reference by name
+// (#2644): an id names a row in one app and resolves to nothing in another, so
+// a copied file failed instead of resolving. One sentence serves all three
+// tables. The `request` half is never surfaced: `ruleSetId` is the live body key
+// on all three routes, and both `rememberRetiredKeys` (`request-schema.ts`) and
+// the admin API's unknown-key path skip a key the schema accepts. It exists
+// because the interface requires both halves.
+const RULE_SET_ID_RETIRED = {
+    toml: "`ruleSetId` is no longer authored in TOML (#3997). A rule-set id names " +
+        "a row in one app and resolves to nothing in another, so the reference " +
+        'is authored by name: replace this line with `ruleSetName = "<name>"`, ' +
+        "where the name is the `name` the rule set's own `rule-sets/<key>.toml` " +
+        "declares, and push again. A file pulled since #2644 already spells it " +
+        "that way.",
+    request: "`ruleSetId` is the live request key on this surface; only its TOML " +
+        "spelling is retired (#3997). Send the rule set's id.",
+};
 export const RETIRED_CONFIG_KEYS = {
     // #2891 — the app-settings auth surface was reshaped so that `app.toml` can
     // state what the server holds. All five keys below stay DECLARED in
@@ -2346,6 +2364,27 @@ export const RETIRED_CONFIG_KEYS = {
                 "send `emailSignInEnabled`.",
         },
     },
+    // #3996 — a bucket's access is `preset` (#1020). The old spelling stayed
+    // accepted as an alias, which left two vocabularies for one decision —
+    // `owner-only` still read as "the uploader", the bug #1020 fixed — and an
+    // echo whose value depended on the row's age. A file or body that still
+    // carries it is refused rather than mapped, so the author meets the new
+    // vocabulary once. The model attribute stays declared: a pre-#1020 row
+    // still resolves to its preset (`resolveBucketPreset`).
+    bucket: {
+        accessPolicy: {
+            toml: "`accessPolicy` is no longer authored in TOML (#3996): a bucket's " +
+                "access is `preset`. Map the value — `public-read` → `public`, " +
+                "`authenticated` → `authenticated`, `owner-only` → `admin-only` (it " +
+                "always meant app admins; `personal-uploads` is the per-uploader " +
+                "preset). Replace the line and push again, or `config pull` rewrites " +
+                "the file.",
+            request: "`accessPolicy` is retired (#3996): send `preset`. `public-read` → " +
+                "`public`, `authenticated` → `authenticated`, `owner-only` → " +
+                "`admin-only` (app admins; `personal-uploads` is the per-uploader " +
+                "preset).",
+        },
+    },
     // #2645 — pausing moved off `state` onto its own field, so `state` stopped
     // being author-writable rather than becoming a second way to say "paused".
     // Every pre-#2645 pull wrote the line, so existing repos hit this on their
@@ -2381,6 +2420,12 @@ export const RETIRED_CONFIG_KEYS = {
                 "`primitive cron-triggers archive` to retire the trigger (#2907).",
         },
     },
+    // #3997 — keyed by each table's TOML prefix. Only `database-type-config`
+    // uses `[type]`, so that entry cannot reach another surface; the blob
+    // bucket's `[bucket] ruleSetId` is its live key and is not listed.
+    type: { ruleSetId: RULE_SET_ID_RETIRED },
+    groupTypeConfig: { ruleSetId: RULE_SET_ID_RETIRED },
+    collectionTypeConfig: { ruleSetId: RULE_SET_ID_RETIRED },
     // #2803 — the OBJECT-level availability leaves TOML. The per-version
     // `[[configs]] status` (`active | archived`) is a different question — which
     // named config is retired — and stays authorable.
@@ -2396,6 +2441,26 @@ export const RETIRED_CONFIG_KEYS = {
                 "`primitive prompts archive` to retire the prompt (#2907).",
         },
     },
+    // #3999 — the prompt `[[configs]]` table (its TOML path is `configs`; no
+    // other field table has that path — the workflow file's `[[configs]]` is a
+    // document key with its own retired list). The live-config marker has one
+    // spelling since #2645, `active`. The legacy `isActive` is refused rather
+    // than ignored: a file whose only marker it is would otherwise push without
+    // activating anything and leave a different config live.
+    configs: {
+        isActive: {
+            toml: "`isActive` is no longer accepted on a `[[configs]]` entry (#3999). " +
+                "The live-config marker has one spelling since #2645: write " +
+                "`active = true` on exactly one entry (pull writes it there), delete " +
+                "the `isActive` line and push again. The line is refused rather than " +
+                "ignored because a file that still carries it would otherwise leave a " +
+                "different config live.",
+            request: "`isActive` is not a config-body key (#3999). Which config a prompt " +
+                "runs is set through " +
+                "`POST …/prompts/{promptId}/configs/{configId}/activate`; omit the " +
+                "field.",
+        },
+    },
     integration: {
         status: {
             toml: "`status` is no longer authored in TOML (#2803), and `draft` no longer " +
@@ -2477,6 +2542,47 @@ export const RETIRED_CONFIG_KEYS = {
                 "Omit the field.",
         },
     },
+    // #3998 — a test-case sidecar names what it pins: the configuration it runs
+    // under and its judge prompt, by name, so the file means the same thing in
+    // every app. The id spellings were deprecated TOML-only keys that won over
+    // the name, and — unlike every other retired key — `config pull` still WROTE
+    // them whenever its id→name lookup missed, so the spelling kept being
+    // generated. Pull now reports such a case instead of writing an id.
+    //
+    // The three stay the stored references the admin API accepts on create and
+    // update, so the `request` wording below is never shown: `rememberRetiredKeys`
+    // and the admin API's unknown-key check both skip a key the wire accepts. It
+    // is here because the entry's shape requires it.
+    test: {
+        configId: {
+            toml: "`configId` is no longer authored in TOML (#3998): a test case names " +
+                "the configuration it runs under, so the file means the same thing in " +
+                "every app. Replace the line with `configName = \"…\"` (a " +
+                "`[[configs]]` name of the block this sidecar belongs to), or delete it " +
+                "to run the active configuration, and push again.",
+            request: "`configId` is the stored configuration reference; only its TOML " +
+                "spelling is retired (#3998). Sidecars author it as `configName`.",
+        },
+        evaluatorPromptId: {
+            toml: "`evaluatorPromptId` is no longer authored in TOML (#3998): a test " +
+                "case names its judge prompt, so the file means the same thing in " +
+                "every app. Replace the line with `evaluatorPromptKey = \"…\"` (the " +
+                "judge prompt's key) and push again.",
+            request: "`evaluatorPromptId` is the stored judge-prompt reference; only its " +
+                "TOML spelling is retired (#3998). Sidecars author it as " +
+                "`evaluatorPromptKey`.",
+        },
+        evaluatorConfigId: {
+            toml: "`evaluatorConfigId` is no longer authored in TOML (#3998): a test " +
+                "case names its judge's configuration, so the file means the same " +
+                "thing in every app. Replace the line with " +
+                "`evaluatorConfigName = \"…\"` (a `[[configs]]` name of the prompt " +
+                "`evaluatorPromptKey` names) and push again.",
+            request: "`evaluatorConfigId` is the stored judge-configuration reference; only " +
+                "its TOML spelling is retired (#3998). Sidecars author it as " +
+                "`evaluatorConfigName`.",
+        },
+    },
     // #2803 — availability is one server-owned `status`. As a TOML key it made
     // `config push` a second writer: pushing a file pulled before an operator ran
     // `workflows disable` put the workflow back in service as a side effect.
@@ -5365,7 +5471,8 @@ export function resolveDecisionsRunQuestions(questions, runCriteria) {
 }
 /**
  * Move the deprecated flat chat keys of one `[[configs]]` entry under `chat`
- * — #3626 §4, the blob-bucket `accessPolicy` precedent made reusable.
+ * — #3626 §4, the deprecated-TOML-key pattern blob buckets used until #3996
+ * retired theirs, made reusable.
  *
  * Push keeps accepting the nine keys flat so no existing file breaks, and pull
  * rewrites them, so one pull-then-push migrates a file. A key present in BOTH
@@ -6829,7 +6936,8 @@ const SHARED_WITH_AGENT = ["chat", "agent"];
 /**
  * #3626 §4 — the nine chat keys, still accepted FLAT under `[[configs]]`.
  *
- * The blob-bucket `accessPolicy` precedent: declared `deprecated`, so
+ * The deprecated-TOML-key pattern blob buckets used until #3996 retired
+ * theirs: declared `deprecated`, so
  * `config push` keeps taking a file written before the `[configs.chat]` block
  * existed, while `config pull` never writes the spelling again. One
  * pull-then-push migrates a file. `hoistDeprecatedChatKeys` moves them into the
@@ -7335,20 +7443,13 @@ export const PROMPT_SURFACE = {
                 // carry `active = true`; pull writes it on the active entry and push
                 // honors it on create AND update by calling the activate endpoint
                 // (activatePromptConfig). It is a control, never a key in the config
-                // body.
+                // body. It has one spelling (#3999, `retired-keys.ts`).
                 active: {
                     kind: "structural",
                     note: "Which config the prompt runs (#2645). Pull writes it on the " +
                         "active entry; push enacts it through the activate endpoint " +
                         "(activatePromptConfig), never as a config-body key.",
                 },
-                isActive: {
-                    kind: "structural",
-                    note: "Legacy spelling of `active` — the create leg read it before pull " +
-                        "ever wrote a marker. Declared here so the unrecognized-key " +
-                        "rejection does not fail a file that has always used it; pull " +
-                        "never writes it.",
-                },
                 // #3626 §4 — the nine chat keys in their pre-kind FLAT spelling.
                 ...DEPRECATED_FLAT_CHAT_KEYS,
             },
@@ -8178,8 +8279,9 @@ export const CRON_TRIGGER_SURFACE = {
  *
  * `ttlTier` is `writableOn: ["create"]`: the update handler does not read it, so
  * the retention tier is fixed at creation. `preset` and `ruleSetId` are the two
- * halves of the access model (#1020) — at most one may change per request, which
- * is the controller's rule and stays there.
+ * halves of the access model (#1020), and the only access keys: at most one may
+ * change per request, which is the controller's rule and stays there. The
+ * pre-#1020 `accessPolicy` spelling is a retired key (#3996, `retired-keys.ts`).
  */
 const BLOB_BUCKET_HANDLER = "src/app-api/controllers/blob-buckets-controller.ts";
 export const BLOB_BUCKET_SURFACE = {
@@ -8258,11 +8360,11 @@ export const BLOB_BUCKET_SURFACE = {
                         "TOML spelling is declared in tomlOnlyKeys as `key`.",
                 },
                 accessPolicy: {
-                    kind: "deprecated",
-                    note: "#1020 — the legacy access field, superseded by `preset`. Still " +
-                        "accepted on the wire and returned as a read alias, but authors " +
-                        "write `preset`, so pull does not emit it (writing both would " +
-                        "author the same decision twice).",
+                    kind: "server-owned",
+                    note: "RETIRED from the write surface by #3996, superseded by `preset` " +
+                        "(#1020). The attribute stays declared so `resolveBucketPreset` " +
+                        "can read a pre-#1020 row; no write path accepts it and no " +
+                        "serializer emits it.",
                 },
                 createdBy: {
                     kind: "server-owned",
@@ -8283,12 +8385,6 @@ export const BLOB_BUCKET_SURFACE = {
                     note: "The bucket key. `config pull` writes it for readability; push takes " +
                         "the identity from the file name and attaches `bucketKey` itself.",
                 },
-                accessPolicy: {
-                    kind: "deprecated",
-                    note: "Accepted in existing files as the pre-#1020 spelling of `preset` " +
-                        "and forwarded on push, so an unmigrated file still pushes. Pull " +
-                        "writes `preset`.",
-                },
             },
             responseOnlyKeys: {},
         },
@@ -8517,7 +8613,8 @@ export const DATABASE_TYPE_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as a portable name and sent as an id; the server checks
-                    // the set exists and has `resourceType: "database"`.
+                    // the set exists and has `resourceType: "database"`. The id
+                    // spelling is retired in TOML (#3997): `retired-keys.ts`, `type`.
                     validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
                 {
@@ -8604,11 +8701,6 @@ export const DATABASE_TYPE_SURFACE = {
                 },
             },
             tomlOnlyKeys: {
-                ruleSetId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based rule-set reference. Still accepted on push " +
-                        "so an unmigrated file pushes unchanged; pull writes `ruleSetName`.",
-                },
                 metadataAccess: {
                     kind: "deprecated",
                     note: "The legacy spelling of `celContextAccess`. Read on push when the " +
@@ -8785,8 +8877,8 @@ export const RULE_SET_SURFACE = {
  * `ruleSetName`, because a name is portable across apps and an id is not. The
  * name → id resolution is the CLI's (`config push` resolves against the app's
  * rule sets); the server validates that the id exists and has
- * `resourceType: "group"`. The legacy id spelling stays accepted on push and is
- * declared in `tomlOnlyKeys`.
+ * `resourceType: "group"`. The id spelling is refused on push (#3997), with
+ * the guidance in `retired-keys.ts`.
  */
 const GROUP_TYPE_HANDLER = "src/app-api/controllers/group-type-config-controller.ts";
 export const GROUP_TYPE_CONFIG_SURFACE = {
@@ -8815,7 +8907,9 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
-                    // checked server-side, and an empty value clears the reference.
+                    // checked server-side, and an empty value clears the reference. The
+                    // id spelling is retired in TOML (#3997): `retired-keys.ts`,
+                    // `groupTypeConfig`.
                     validation: handledBy(GROUP_TYPE_HANDLER, "GroupTypeConfigController", "apply"),
                 },
                 {
@@ -8855,13 +8949,7 @@ export const GROUP_TYPE_CONFIG_SURFACE = {
                     note: "User who created the config; assigned server-side.",
                 },
             },
-            tomlOnlyKeys: {
-                ruleSetId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based rule-set reference. Still accepted on push " +
-                        "so an unmigrated file pushes unchanged; pull writes `ruleSetName`.",
-                },
-            },
+            tomlOnlyKeys: {},
             responseOnlyKeys: {},
         },
     ],
@@ -8908,7 +8996,9 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     emit: "always",
                     writableOn: BOTH,
                     // Authored as a name, sent as an id; existence and resourceType are
-                    // checked server-side, and an empty value clears the reference.
+                    // checked server-side, and an empty value clears the reference. The
+                    // id spelling is retired in TOML (#3997): `retired-keys.ts`,
+                    // `collectionTypeConfig`.
                     validation: handledBy(COLLECTION_TYPE_HANDLER, "CollectionTypeConfigController", "apply"),
                 },
             ],
@@ -8938,13 +9028,7 @@ export const COLLECTION_TYPE_CONFIG_SURFACE = {
                     note: "User who created the config; assigned server-side.",
                 },
             },
-            tomlOnlyKeys: {
-                ruleSetId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based rule-set reference. Still accepted on push " +
-                        "so an unmigrated file pushes unchanged; pull writes `ruleSetName`.",
-                },
-            },
+            tomlOnlyKeys: {},
             responseOnlyKeys: {},
         },
     ],
@@ -9528,11 +9612,13 @@ export const SERVER_FUNCTION_SURFACE = {
  * which is exactly why the spec names them explicitly: nothing that syncs sits
  * outside the registry.
  *
- * Three fields are stored as ids and AUTHORED as keys — `configId` /
+ * Three fields are stored as ids and AUTHORED as names — `configId` /
  * `evaluatorPromptId` / `evaluatorConfigId` become `configName` /
  * `evaluatorPromptKey` / `evaluatorConfigName` — so a test file is portable
- * across apps. The legacy id spellings stay accepted on push and are declared
- * in `tomlOnlyKeys`.
+ * across apps. The id spellings are retired from the TOML surface (#3998):
+ * `config push` refuses a sidecar that still carries one, with the guidance in
+ * `retired-keys.ts`, and `config pull` reports a reference it cannot resolve
+ * rather than writing an id. On the wire the three stay ids.
  *
  * Three more are stored as JSON strings and carried in TOML as JSON strings
  * (`inputVariables`, `expectedOutputContains`, `expectedJsonSubset`) while the
@@ -9709,23 +9795,7 @@ export const TEST_CASE_SURFACE = {
                     note: "Timestamp, assigned server-side.",
                 },
             },
-            tomlOnlyKeys: {
-                configId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based config reference. Still accepted on push so " +
-                        "an unmigrated file pushes unchanged; pull writes `configName`.",
-                },
-                evaluatorPromptId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based evaluator-prompt reference; pull writes " +
-                        "`evaluatorPromptKey`.",
-                },
-                evaluatorConfigId: {
-                    kind: "deprecated",
-                    note: "The legacy id-based evaluator-config reference; pull writes " +
-                        "`evaluatorConfigName`.",
-                },
-            },
+            tomlOnlyKeys: {},
             responseOnlyKeys: {},
         },
     ],