primitive-admin 1.2.0-alpha.0 → 1.2.0-alpha.10

package/dist/src/commands/workflows.js

@@ -1,252 +1,36 @@
-import { readFileSync, writeFileSync, readdirSync, } from "fs";
-import * as path from "path";
-import { stringifyConfigToml } from "../lib/config-toml.js";
-import { generateWorkflowTypes, } from "../lib/workflow-codegen/generator.js";
-import { generateWorkflowSwiftTypes } from "../lib/swift-codegen/generator.js";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { resolveWorkflowSelector } from "../lib/block-selector.js";
-import { formatAccessRuleForDisplay } from "../lib/access-rule-display.js";
-import { resolveCodegenSourceDir } from "../lib/codegen-shared/resolveCodegenSourceDir.js";
-import { expandWorkflow } from "../lib/workflow-fragments.js";
-import { confirmPrompt } from "../lib/confirm-prompt.js";
 import { parseStatusFilter } from "../lib/object-status-filter.js";
-import { buildWorkflowRunEnvelope, buildWorkflowRunListEnvelope, buildWorkflowStepEnvelope, collectWorkflowFailures, describeEmptyRunPage, describeFailureSweep, formatFailureCodeCell, formatFailureErrorCell, formatFailureStepCell, selectFailedStepRow, toWorkflowRunInspectionRow, DEFAULT_FAILURE_SWEEP_MAX_SCAN, FAILURE_SWEEP_MAX_REQUESTS, SERVER_SCAN_ROWS_PER_REQUEST, } from "../lib/log-inspection.js";
-import chalk from "chalk";
-import { success, error, info, warn, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, formatDuration, json, jsonLine, divider, dim, progress, progressEnd, } from "../lib/output.js";
-import { pollUntil, followLoop, watchLoop, parseIntervalSeconds, } from "../lib/watch.js";
-import { APPLY_RUN_STATUSES, RUN_STATUS_LIST, SETTLED_RUN_STATUSES, } from "../lib/run-status.js";
-import { requireTestCaseInputVariables } from "../lib/test-case-variables.js";
-/**
- * Render the `Step Results` section of `workflows runs status`. Pure
- * formatting helper — returns lines as strings so it's unit-testable
- * (the caller console.logs them). For each step, emits:
- *
- *   `  <id>: <status-label> <duration>`
- *
- * and, when applicable, indented follow-up lines:
- *
- * - `error_captured` step with `error` → `    error: <truncated message>`
- * - forEach output with `errors[]` non-empty →
- *   `    forEach errors: <N/M> - first: <truncated message>`
- *
- * The truncation length matches `runs steps` ERROR column (80 chars,
- * trailing "..." when truncated). See #688.
- */
-/**
- * Stop-polling predicate for the `workflows preview --wait` loop (issues #941,
- * #2348). True when the run has settled and the wait should stop — as opposed
- * to a still-in-flight status ("queued"/"running") that keeps the loop going
- * until the cap.
- *
- * Since #2348 the server reconciles every status surface onto the canonical
- * vocabulary before it goes on the wire, so this reads the one shared set in
- * `lib/run-status.ts` instead of re-deriving terminality here:
- *   - "completed" / "failed" / "terminated" — true terminals. "terminated" is
- *     an aborted preview, a real end state (Codex P2 on #941: it used to be
- *     omitted, so an abort was misreported as a wait timeout).
- *   - "apply_pending" / "apply_claimed" — the run finished and is parked
- *     waiting for a client to apply its result. It never advances on its own,
- *     so the previous ladder spun here until the 60s cap.
- *   - "missing" — no live instance to observe; more polling cannot help.
- *
- * The raw Cloudflare spellings ("complete"/"errored"/"waiting") are gone: the
- * server no longer puts them on the wire, and matching them here would have
- * kept two vocabularies alive.
- */
-export function isPreviewWaitTerminalStatus(s) {
-    return typeof s === "string" && SETTLED_RUN_STATUSES.has(s);
-}
-/**
- * Which arm the `workflows preview --wait` render ladder takes (#2636).
- *
- * Extracted from the ladder so the branch decision is testable: the point of
- * the `skipped` arm is that an elided preview — one whose declarative lock was
- * held under `onContention: "ignore"` — reports that it did not run, instead
- * of falling through to the timeout branch and exiting 124 as though it were
- * still going.
- */
-export function previewWaitOutcome(status) {
-    if (status === "completed")
-        return "completed";
-    if (status === "failed")
-        return "failed";
-    if (status === "terminated")
-        return "terminated";
-    if (status === "skipped")
-        return "skipped";
-    if (typeof status === "string" && APPLY_RUN_STATUSES.has(status))
-        return "apply";
-    if (status === "missing")
-        return "missing";
-    return "timeout";
-}
-export function renderRunStatusStepResults(stepResults) {
-    const lines = [];
-    for (const step of stepResults || []) {
-        const statusLabel = step.skipped
-            ? chalk.gray("skipped")
-            : step.status === "error_captured"
-                ? chalk.yellow("error_captured")
-                : step.status === "failed"
-                    ? chalk.red("failed")
-                    : step.status === "completed"
-                        ? chalk.green("completed")
-                        : step.status || "?";
-        const durationLabel = formatDuration(step.durationMs);
-        lines.push(`  ${step.id}: ${statusLabel} ${durationLabel}`);
-        // Single-step error_captured: show the captured error message.
-        if (step.status === "error_captured" && step.error) {
-            const errMsg = typeof step.error === "string" ? step.error : String(step.error);
-            const truncated = errMsg.length > 80 ? errMsg.slice(0, 77) + "..." : errMsg;
-            lines.push(`    ${chalk.dim("error:")} ${chalk.yellow(truncated)}`);
-        }
-        else if (step.status === "error_captured" && step.errorDetails) {
-            // No top-level error but errorDetails present — hint to drill in.
-            lines.push(`    ${chalk.dim("error: <see runs step-detail for full errorDetails>")}`);
-        }
-        // forEach aggregated errors: a one-line summary surfaces the count
-        // of `error_captured` iterations and a sample message (#688).
-        const fo = step.output;
-        if (fo && typeof fo === "object" && Array.isArray(fo.errors) && fo.errors.length > 0) {
-            const total = (Array.isArray(fo.items) ? fo.items.length : 0)
-                || (fo.totalSucceeded ?? 0) + (fo.totalFailed ?? 0);
-            const firstErr = (Array.isArray(fo.errorMessages) && fo.errorMessages.length > 0
-                ? fo.errorMessages[0]
-                : (fo.errors[0]?.error ?? "?"));
-            const firstStr = typeof firstErr === "string" ? firstErr : String(firstErr);
-            const truncated = firstStr.length > 80 ? firstStr.slice(0, 77) + "..." : firstStr;
-            lines.push(`    ${chalk.dim("forEach errors:")} ${chalk.yellow(`${fo.totalFailed ?? fo.errors.length}/${total}`)} ${chalk.dim("- first:")} ${chalk.yellow(truncated)}`);
-        }
-    }
-    return lines;
-}
-// #3348 — the step table, the gap annotation and the running-step duration now
-// live in `lib/step-run-table.ts`, shared with `functions runs steps`: a
-// function run's steps are the same rows, and the two views must not be two
-// tables that merely resemble each other. Re-exported from here because this is
-// where the two helpers were first exported for testability.
-export { annotateStepGaps, stepRunDisplayDurationMs, } from "../lib/step-run-table.js";
-import { renderStepRunTable, stepRunDisplayDurationMs, } from "../lib/step-run-table.js";
+import { error, info, result as printResult, formatTable, formatId, formatDate, formatStatus, json, divider, } from "../lib/output.js";
 import { normalizeCliListEnvelope, wholeListEnvelope, } from "../lib/paginate.js";
 import { pageCursorOption, pageLimitOption, parsePageLimit, printEmptyPage, printPageHint, } from "../lib/list-options.js";
 /**
- * #2771 — the step lines `workflows runs status` should render.
- *
- * Cloudflare's instance status carries `stepResults` only once the run reaches
- * a terminal state, so a live run used to print `Status: running` and nothing
- * else. The persisted step rows now exist DURING the run, so they are the
- * fallback: mapped onto the shape `renderRunStatusStepResults` reads, with a
- * running step's elapsed time in place of its 0 placeholder. The instance's own
- * results always win when it has them. Exported for testability.
- */
-export function stepResultsForRunStatus(instanceStepResults, persistedStepRuns, now = Date.now()) {
-    if (instanceStepResults && instanceStepResults.length > 0)
-        return instanceStepResults;
-    return (persistedStepRuns || []).map((row) => ({
-        id: row?.stepId,
-        kind: row?.stepKind,
-        status: row?.status,
-        durationMs: stepRunDisplayDurationMs(row, now),
-        error: row?.error,
-        errorDetails: row?.errorDetails,
-        output: row?.output,
-    }));
-}
-/**
- * #1367 — compute min / p50 / p95 / max over a set of latency samples (ms).
- * Ignores non-finite values. Returns `null` when there are no valid samples.
- * Percentiles use nearest-rank on the sorted samples. Exported for testability.
- */
-export function summarizeLatencyDistribution(values) {
-    const nums = (values || []).filter((v) => typeof v === "number" && Number.isFinite(v));
-    if (nums.length === 0)
-        return null;
-    nums.sort((a, b) => a - b);
-    const pct = (p) => {
-        const rank = Math.ceil((p / 100) * nums.length);
-        return nums[Math.min(nums.length - 1, Math.max(0, rank - 1))];
-    };
-    return {
-        count: nums.length,
-        min: nums[0],
-        p50: pct(50),
-        p95: pct(95),
-        max: nums[nums.length - 1],
-    };
-}
-/**
- * Issue #687 (review feedback): render an unambiguous label for a workflow
- * config slot ("active config", "draft config", etc.) when the slot may be
- * unnamed. Falls back to a short ID prefix so users staging multiple unnamed
- * configs can still tell them apart.
- *
- *   formatConfigSlotLabel("active config", "v2", "01KRT...")        → 'active config "v2"'
- *   formatConfigSlotLabel("active config", null, "01KRTABCDXYZ...") → 'active config (01KRTABCDXYZ…)'
- *   formatConfigSlotLabel("active config", null, null)              → 'active config'
- *
- * Exported for testability.
- */
-export function formatConfigSlotLabel(slot, configName, configId, prefixLength = 12) {
-    if (configName) {
-        return `${slot} "${configName}"`;
-    }
-    if (configId) {
-        return `${slot} (${String(configId).slice(0, prefixLength)}…)`;
-    }
-    return slot;
-}
-/**
- * Resolve a workflow reference — its server id, or the author-chosen key its
- * TOML file is named for — for the `tests` verbs (#3249).
+ * `primitive workflows` — retained DSL workflow history (#3190).
  *
- * The key is what an operator has: `workflows/<key>.toml` is the object and
- * `workflows/<key>.tests/` its cases. The resolution lives in
- * `block-selector.ts`, shared with `prompts`.
+ * DSL workflows retired with their engine. Their stored definitions,
+ * configurations and revisions are kept until their retention expires, and
+ * these four verbs read them. Nothing here writes: there is no verb to create,
+ * change, run or delete a workflow.
  */
-async function resolveWorkflowId(client, appId, ref) {
-    return (await resolveWorkflowSelector(client, appId, ref)).blockId;
-}
 export function registerWorkflowsCommands(program) {
     const workflows = program
         .command("workflows")
-        .description("Inspect workflows, run and monitor them, and take one out of service")
+        .description("Read retained DSL workflow history (DSL workflows are retired)")
         .addHelpText("after", `
+DSL workflows are retired. These verbs read the definitions, configurations and
+revisions an app still holds; nothing can create, change or run a workflow.
+Write the logic as a server function instead:
+  $ primitive config create function <key>
+
 Examples:
   $ primitive workflows list
-  $ primitive config create workflow process-doc       # scaffold workflows/process-doc.toml
-  $ primitive config push --only workflow/process-doc  # apply it
-  $ primitive workflows runs list 01HXY...
-  $ primitive workflows disable 01HXY...               # take it out of service now
-`);
-    // Server-side configuration is authored in TOML and applied with `config push`
-    // (issue #2645) — this group no longer carries config-setting flags.
-    workflows.addHelpText("after", `
-Configuration lives in workflows/<key>.toml:
-  $ primitive config fields workflow        # the file's keys, types and defaults
-  $ primitive config create workflow <key>  # scaffold one locally
-  $ primitive config set workflow/<key> <path>=<value>
-  $ primitive config push --only workflow/<key>
-
-Which body runs is configuration too: name it with activeConfigName in
-workflows/<key>.toml (bodies live in workflows/<key>.configs/<name>.toml) and
-apply it with 'config push'. There is no other write path: revisions are
-read-only history from the retired legacy path (issue #2768).
-`);
-    // Per-subject analytics have one home, the `analytics` noun (issue #2766) —
-    // this group's own analytics commands were removed, so say where they went.
-    workflows.addHelpText("after", `
-Analytics live under the analytics noun:
-  $ primitive analytics workflows --window-days 7 --limit 10
-
-That is the single home for per-subject analytics (workflows, prompts,
-integrations). It ranks workflows by runs; there is no app-wide workflow
-overview — the endpoint behind the retired overview command never existed.
+  $ primitive workflows get <workflow-id-or-key>
+  $ primitive workflows configs list <workflow-id-or-key>
+  $ primitive workflows configs get <workflow-id-or-key> <config-id>
 `);
-    // List workflows
     workflows
         .command("list")
-        .description("List workflows")
+        .description("List retained workflow definitions")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
         .option("--status <status>", "Filter by status: active, inactive, archived")
@@ -258,10 +42,6 @@ overview — the endpoint behind the retired overview command never existed.
         const resolvedAppId = resolveAppId(appId, options);
         const client = new ApiClient();
         try {
-            // #2803 — `draft` is gone; refuse it by name rather than returning the
-            // empty list a canonical filter would produce. #2887 added `archived`:
-            // the delete flow writes one now, so asking for the retired rows is a
-            // question with an answer rather than a 400.
             const page = normalizeCliListEnvelope(await client.listWorkflows(resolvedAppId, {
                 status: parseStatusFilter("workflows", options.status, [
                     "active",
@@ -296,7 +76,7 @@ overview — the endpoint behind the retired overview command never existed.
     });
     workflows
         .command("get")
-        .description("Get workflow details")
+        .description("Read a retained workflow definition, its configurations and revisions")
         .argument("<workflow-id>", "Workflow ID or key")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
@@ -314,37 +94,11 @@ overview — the endpoint behind the retired overview command never existed.
             printResult("Key", wf.workflowKey);
             printResult("Name", wf.name);
             printResult("Description", wf.description);
-            // #2803 — ONE availability row. The server returns the canonical
-            // value, so a workflow an operator disabled reads `inactive` here and
-            // there is no second row left to disagree with it.
             printResult("Status", formatStatus(wf.status));
             printResult("Active Config", wf.activeConfigId || "-");
             printResult("Latest Revision", wf.latestRevision || "-");
-            printResult("Client Apply", wf.requiresClientApply !== false ? "yes" : "no");
-            printResult("Sync Callable", wf.syncCallable === true ? "yes" : "no");
-            // #1233 — runAs unset means the engine defaults to "caller"; show that
-            // default rather than a blank so the deployed principal mode is visible.
-            printResult("Run As", wf.runAs || "caller");
-            printResult("Capabilities", Array.isArray(wf.capabilities) && wf.capabilities.length > 0
-                ? wf.capabilities.join(", ")
-                : "-");
-            // #2652: a caller workflow with no rule denies every non-admin start,
-            // so the row is always printed — the sentinel names the consequence,
-            // and a `runAs: "system"` workflow gets its own exempt wording.
-            printResult("Access Rule", formatAccessRuleForDisplay(wf.accessRule, "workflow", {
-                runAs: wf.runAs,
-            }));
-            divider();
-            info("Queue Settings:");
-            printResult("  Per User Max Running", wf.perUserMaxRunning);
-            printResult("  Per User Max Queued", wf.perUserMaxQueued);
-            printResult("  Per App Max Running", wf.perAppMaxRunning);
-            printResult("  Dequeue Order", wf.dequeueOrder);
-            if (wf.inputSchema) {
-                divider();
-                info("Input Schema:");
-                console.log(JSON.stringify(wf.inputSchema, null, 2));
-            }
+            const stepCount = (steps) => Array.isArray(steps) ? `${steps.length} step(s)` : "-";
+            printResult("Draft", stepCount(result.draft?.steps));
             if (result.configs && result.configs.length > 0) {
                 divider();
                 info(`Configurations (${result.configs.length}):`);
@@ -355,23 +109,17 @@ overview — the endpoint behind the retired overview command never existed.
                     {
                         header: "ACTIVE",
                         key: "configId",
-                        format: (v) => v === wf.activeConfigId ? "★" : "",
+                        format: (v) => (v === wf.activeConfigId ? "★" : ""),
                     },
                 ]));
             }
-            if (result.draft?.steps) {
-                divider();
-                info(`Draft Steps (${result.draft.steps.length}):`);
-                result.draft.steps.forEach((step, idx) => {
-                    console.log(`  ${idx + 1}. ${step.id} (${step.kind})`);
-                });
-            }
             if (result.revisions && result.revisions.length > 0) {
                 divider();
-                info(`Revisions - Legacy (${result.revisions.length}):`);
-                console.log(formatTable(result.revisions.slice(0, 5), [
+                info(`Revisions (${result.revisions.length}):`);
+                console.log(formatTable(result.revisions, [
                     { header: "ID", key: "revisionId", format: formatId },
-                    { header: "PUBLISHED", key: "publishedAt", format: formatDate },
+                    { header: "STEPS", key: "steps", format: stepCount },
+                    { header: "CREATED", key: "createdAt", format: formatDate },
                 ]));
             }
         }
@@ -380,2047 +128,74 @@ overview — the endpoint behind the retired overview command never existed.
             process.exit(1);
         }
     });
-    workflows
-        .command("expand")
-        .description("Expand a workflow TOML's include fragments and print the result")
-        .argument("<file>", "Path to the workflow TOML file")
-        .option("--format <format>", "Output format: json (default) or toml", "json")
-        .action((file, options) => {
-        try {
-            const expanded = expandWorkflow(file);
-            if (options.format === "toml") {
-                // Strip the `include` key (already removed by expander) and emit
-                // valid TOML so the result is round-trippable.
-                console.log(stringifyConfigToml(expanded));
-            }
-            else {
-                console.log(JSON.stringify(expanded, null, 2));
-            }
-        }
-        catch (err) {
-            error(err?.message ?? String(err));
-            process.exit(1);
-        }
-    });
-    // #2645 criterion 9 / #2803 — the operational verbs.
-    //
-    // Configuration is authored in TOML and applied with `config push`, which would
-    // otherwise mean an operator needs a repo checkout to stop a misbehaving
-    // workflow. It does not: taking something out of service is an OPERATION, and
-    // these two verbs are the ONLY writers of `status`, which is server-owned and
-    // no longer a TOML key. The committed configuration says nothing about
-    // availability, so `config diff` reports the server's status as operator
-    // state rather than as drift.
-    workflows
-        .command("disable")
-        .description("Take a workflow out of service now. Operational, not configuration: `status` is server-owned and 'config push' can neither set nor clear it.")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const result = await client.disableWorkflow(resolvedAppId, workflowId);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success(`Workflow disabled: ${result.workflowKey || workflowId}`);
-            info("New runs are refused. Configuration is unchanged — `primitive workflows enable` puts it back.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    workflows
-        .command("enable")
-        .description("Put a workflow back in service.")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const result = await client.enableWorkflow(resolvedAppId, workflowId);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success(`Workflow enabled: ${result.workflowKey || workflowId}`);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // #2907 — the delete flow's CLI spelling. Not a second writer of `status`:
-    // this is the plain `DELETE` #2887 made retire-with-history, which until now
-    // only the admin API and the console could reach. Named `archive`, not
-    // `delete`, because a configuration noun gets no `delete` verb
-    // (docs/cli-design.md) and prune-by-push stays the only CLI hard-delete path.
-    workflows
-        .command("archive")
-        .description("Retire a workflow (soft delete). Delete-lifecycle, not `disable`: the definition is kept so its history still resolves, it goes on holding its key, and there is no un-archive.")
+    const configs = workflows
+        .command("configs")
+        .description("Read a retained workflow's configurations");
+    configs
+        .command("list")
+        .description("List a retained workflow's configurations")
         .argument("<workflow-id>", "Workflow ID or key")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("-y, --yes", "Skip confirmation prompt")
         .option("--json", "Output as JSON")
-        .addHelpText("after", `
-What archiving a workflow costs (retire-with-history):
-  New runs are refused, and so is every \`workflow.call\` into it.
-  Its runs, revisions, configurations and test cases keep resolving what they
-  point at — that is what the tombstone exists for.
-  The archived row still holds its workflowKey.
-  \`primitive workflows enable\` refuses an archived workflow; there is no
-  un-archive.
-
-Reclaiming the key means hard-deleting the row and its cascade:
-  $ rm workflows/<key>.toml
-  $ primitive config push --prune     # confirmed; hard-deletes the row
-  # or hard-delete it in the console, then re-add the file and push.
-`)
         .action(async (workflowId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.yes) {
-            let confirmed;
-            try {
-                confirmed = await confirmPrompt(`Archive workflow ${workflowId}? New runs are refused, its history is ` +
-                    `kept, it goes on holding its key, and there is no un-archive.`);
-            }
-            catch (err) {
-                error(err.message);
-                process.exit(1);
-            }
-            if (!confirmed) {
-                info("Cancelled.");
-                return;
-            }
-        }
         const client = new ApiClient();
         try {
-            // The soft delete: no `hard`, so the #1238 cascade does not run and the
-            // definition row stays queryable.
-            const result = await client.deleteWorkflow(resolvedAppId, workflowId);
+            const { items } = await client.listWorkflowConfigs(resolvedAppId, workflowId);
             if (options.json) {
-                json(result);
-                return;
-            }
-            success(`Workflow archived: ${workflowId}`);
-            info("Runs, revisions and test cases keep resolving. The row still holds its key — reclaim it by removing its file and running a confirmed `primitive config push --prune`.");
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Preview workflow
-    workflows
-        .command("preview")
-        .description("Run a preview execution of the workflow")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--config <config-id>", "Use specific configuration")
-        .option("--draft", "Force preview of the draft version, even if active is newer")
-        .option("--active", "Force preview of the active config, even if a newer draft exists (issue #687)")
-        .option("--input <json>", "Root input as JSON")
-        .option("--wait", "Wait for completion and show result")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        if (options.draft && options.active) {
-            error("--draft and --active are mutually exclusive");
-            process.exit(1);
-        }
-        let rootInput;
-        if (options.input) {
-            try {
-                rootInput = JSON.parse(options.input);
-            }
-            catch {
-                error("Invalid JSON in --input");
-                process.exit(1);
-            }
-        }
-        const client = new ApiClient();
-        try {
-            const result = await client.previewWorkflow(resolvedAppId, workflowId, {
-                rootInput,
-                configId: options.config,
-                useDraft: options.draft || false,
-                // Issue #687: --active forces the active config even when a newer
-                // draft exists (the inverse of --draft).
-                preferActive: options.active || false,
-            });
-            // Display warning from the server (e.g. "previewing draft because newer than active")
-            if (result.warning) {
-                warn(result.warning);
-            }
-            if (!options.wait) {
-                if (options.json) {
-                    json(result);
-                    return;
-                }
-                success("Preview started.");
-                keyValue("Instance ID", result.instanceId);
-                // Issue #687: name the side we ran so the user always knows which
-                // version produced the output (the "print the source" pattern).
-                const source = result.source;
-                if (source === "draft") {
-                    info("Previewing draft version.");
-                }
-                else if (source === "active") {
-                    // Issue #687 (review feedback): when configName is missing,
-                    // fall back to a short ID prefix so users staging multiple
-                    // unnamed configs can disambiguate.
-                    const label = formatConfigSlotLabel("active config", result.configName, result.configId);
-                    info(`Previewing ${label}.`);
-                }
-                else if (source === "config") {
-                    const label = formatConfigSlotLabel("the requested config", result.configName, result.configId);
-                    info(`Previewing ${label}.`);
-                }
-                info("Use 'workflows runs status' to check progress.");
+                json(wholeListEnvelope(items));
                 return;
             }
-            // Poll for completion. Issue #941: track whether the loop broke on a
-            // terminal state vs. ran to exhaustion, so a timed-out wait is
-            // distinguishable from a workflow that legitimately reported "running".
-            info("Waiting for completion...");
-            let status;
-            // Fixed ~60s cap (60 × 1s sleep + RTT). PRIMITIVE_PREVIEW_WAIT_ATTEMPTS
-            // overrides the iteration count for tests that exercise the
-            // poll-loop-exhaustion path without a full 60s wait; unset in normal use.
-            const maxAttempts = (() => {
-                const raw = process.env.PRIMITIVE_PREVIEW_WAIT_ATTEMPTS;
-                const parsed = raw ? parseInt(raw, 10) : NaN;
-                return Number.isInteger(parsed) && parsed > 0 ? parsed : 60;
-            })();
-            let reachedTerminal = false;
-            for (let i = 0; i < maxAttempts; i++) {
-                await new Promise((r) => setTimeout(r, 1000));
-                const statusResult = await client.getPreviewStatus(resolvedAppId, workflowId, result.instanceId);
-                status = statusResult.status;
-                const s = status?.status;
-                // Issue #941 (Codex P2): an aborted preview reports
-                // status:"terminated" from the admin preview-status endpoint, which
-                // is a real terminal state — the wait did NOT time out. The shared
-                // predicate includes it so the loop breaks and `waitTimedOut` stays
-                // false (vs. the prior check that omitted "terminated" and let the
-                // loop run to the cap, misreporting an abort as a timeout).
-                if (isPreviewWaitTerminalStatus(s)) {
-                    reachedTerminal = true;
-                    break;
-                }
-            }
-            // Issue #941: on poll-loop exhaustion with a still-non-terminal run,
-            // emit an explicit timeout signal and exit non-zero (124, the GNU
-            // `timeout` convention) instead of silently returning the bare
-            // non-terminal status as if the wait succeeded.
-            const waitTimedOut = !reachedTerminal;
-            if (options.json) {
-                // Additive field only — `status` is preserved so existing parsers
-                // don't break; `waitTimedOut` lets automation tell "still running,
-                // wait gave up" from "finished".
-                json({ instanceId: result.instanceId, status, waitTimedOut });
-                if (waitTimedOut) {
-                    process.exit(124);
-                }
+            if (!items || items.length === 0) {
+                info("No configurations found.");
                 return;
             }
-            // #2348: this render ladder used to re-derive terminality (and matched
-            // the raw "complete"/"errored" spellings the server no longer emits).
-            // It now branches on the same canonical values the poll loop stops on,
-            // via the shared sets in lib/run-status.ts.
-            const waitOutcome = previewWaitOutcome(status?.status);
-            if (waitOutcome === "completed") {
-                success("Preview completed.");
-                if (status.output) {
-                    console.log("\nOutput:");
-                    console.log(JSON.stringify(status.output, null, 2));
-                }
-                if (status.stepResults) {
-                    divider();
-                    info("Step Results:");
-                    status.stepResults.forEach((step) => {
-                        console.log(`  ${step.id}: ${formatDuration(step.durationMs)} ${step.skipped ? "(skipped)" : ""}`);
-                    });
-                }
-            }
-            else if (waitOutcome === "failed") {
-                error("Preview failed.");
-                if (status.error) {
-                    console.log("\nError:");
-                    console.log(JSON.stringify(status.error, null, 2));
-                }
-            }
-            else if (waitOutcome === "terminated") {
-                // Issue #941 (Codex P2): the preview was aborted (e.g. via
-                // `workflows preview ... abort`, or an external terminate). This is a
-                // real terminal state — NOT a timeout — so render it distinctly and
-                // exit 0 (the wait succeeded in observing a terminal result).
-                warn("Preview was terminated (aborted before completion).");
-            }
-            else if (waitOutcome === "skipped") {
-                // #2636 — the preview's declarative lock was held and the definition
-                // declared `onContention: "ignore"`, so it never ran. That is an
-                // outcome, not a timeout: report it and exit 0.
-                warn(`Preview did not run — lock held${status?.skipReason ? ` (${status.skipReason})` : ""}.`);
-            }
-            else if (waitOutcome === "apply") {
-                // #2348: the run finished and is parked waiting for a client to claim
-                // and apply its result. It will not advance on its own, so the wait
-                // stopping here is a success, not a timeout.
-                warn(`Preview finished and is waiting to be applied (status: ${status.status}).`);
-                if (status.output) {
-                    console.log("\nOutput:");
-                    console.log(JSON.stringify(status.output, null, 2));
-                }
-            }
-            else if (waitOutcome === "missing") {
-                // #2348: no live instance to observe — reporting a timeout here would
-                // suggest the preview is still running, which it is not.
-                error("Preview instance not found (status: missing).");
-            }
-            else {
-                // Timed out without ever reaching a terminal state (issue #941).
-                error(`Wait timed out after ${maxAttempts}s; preview still running. Check status with 'workflows runs status'.`);
-                process.exit(124);
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // #1367 — hidden queue-latency measurement tool. Fires a batch of runs of a
-    // (trivial, no-op) workflow, polls until each has an executionStartedAt, and
-    // reports the observed queueDelayMs / createCallDurationMs distribution. This
-    // is the post-deploy verification vehicle: local miniflare does not exhibit
-    // real Cloudflare scheduling delay, so run it against an agents/alpha scratch
-    // app. Creates are paced (default 10/s) to stay clear of CF's ~100/s shared
-    // instance-creation limit; a create failure (e.g. 429) is recorded, not fatal.
-    workflows
-        .command("queue-latency-test", { hidden: true })
-        .description("(hidden) Fire N no-op runs and report the queue-delay distribution (post-deploy tool)")
-        .argument("<workflow-id>", "Workflow ID or key of a trivial no-op workflow")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--count <n>", "Number of runs to fire", "50")
-        .option("--rate <r>", "Max creates per second (<=10 recommended)", "10")
-        .option("--input <json>", "Root input as JSON")
-        .option("--timeout <sec>", "Seconds to wait for all runs to start", "120")
-        .option("--verbose", "Print a per-run row")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        const count = Math.max(1, parseInt(options.count, 10) || 50);
-        const rate = Math.max(1, parseInt(options.rate, 10) || 10);
-        const timeoutSec = Math.max(1, parseInt(options.timeout, 10) || 120);
-        const intervalMs = Math.ceil(1000 / rate);
-        const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-        let rootInput;
-        if (options.input) {
-            try {
-                rootInput = JSON.parse(options.input);
-            }
-            catch {
-                error("Invalid JSON in --input");
-                process.exit(1);
-            }
-        }
-        const fired = [];
-        if (!options.json) {
-            info(`Firing ${count} run(s) of ${workflowId} at up to ${rate}/s (interval ${intervalMs}ms)...`);
-        }
-        for (let i = 0; i < count; i++) {
-            try {
-                const res = await client.previewWorkflow(resolvedAppId, workflowId, {
-                    rootInput,
-                });
-                fired.push({
-                    index: i,
-                    instanceId: res?.instanceId,
-                    createFailed: false,
-                    started: false,
-                });
-            }
-            catch (err) {
-                // A create failure (e.g. HTTP 500 from CF's shared-class rate limit) is
-                // a recorded datapoint, not a reason to abort the whole batch.
-                fired.push({
-                    index: i,
-                    createFailed: true,
-                    createError: err?.message ? String(err.message) : String(err),
-                    started: false,
-                });
-            }
-            if (i < count - 1)
-                await sleep(intervalMs);
-        }
-        // Poll the run list until every non-failed run has executionStartedAt set
-        // (queueDelayMs present) or we hit the timeout.
-        const byInstance = new Map();
-        for (const f of fired) {
-            if (f.instanceId)
-                byInstance.set(f.instanceId, f);
-        }
-        const deadline = Date.now() + timeoutSec * 1000;
-        const pending = () => fired.filter((f) => !f.createFailed && !f.started).length;
-        // The admin run-list endpoint caps each page at 200, so a single large
-        // request cannot cover a batch of more than 200 runs — the earliest ones
-        // would never be matched and would be falsely reported as not started.
-        // Page through with the cursor (runs come back newest-first, so our batch
-        // is at the front) until every pending run is matched or we run out of
-        // pages. Bound the scan so we never walk the whole run history.
-        const PAGE_LIMIT = 200;
-        const scanBudget = count + PAGE_LIMIT;
-        while (pending() > 0 && Date.now() < deadline) {
-            await sleep(1000);
-            try {
-                let cursor;
-                let scanned = 0;
-                do {
-                    const { items, nextCursor } = await client.listWorkflowRuns(resolvedAppId, workflowId, { limit: PAGE_LIMIT, cursor: cursor ?? undefined });
-                    for (const run of items || []) {
-                        const f = run?.instanceId ? byInstance.get(run.instanceId) : undefined;
-                        if (f && !f.started && run.executionStartedAt) {
-                            f.started = true;
-                            f.queueDelayMs =
-                                typeof run.queueDelayMs === "number" ? run.queueDelayMs : null;
-                            f.createCallDurationMs =
-                                typeof run.createCallDurationMs === "number"
-                                    ? run.createCallDurationMs
-                                    : null;
-                        }
-                    }
-                    scanned += items?.length || 0;
-                    cursor = nextCursor;
-                } while (pending() > 0 && cursor && scanned < scanBudget);
-            }
-            catch {
-                // Transient list error — keep polling until the deadline.
-            }
-        }
-        const createFailures = fired.filter((f) => f.createFailed).length;
-        const startedRuns = fired.filter((f) => f.started);
-        const queueDelays = startedRuns.map((f) => f.queueDelayMs);
-        const createDurations = startedRuns.map((f) => f.createCallDurationMs);
-        const queueDist = summarizeLatencyDistribution(queueDelays);
-        const createDist = summarizeLatencyDistribution(createDurations);
-        const notStarted = fired.filter((f) => !f.createFailed && !f.started).length;
-        if (options.json) {
-            json({
-                workflowId,
-                requested: count,
-                created: count - createFailures,
-                createFailures,
-                started: startedRuns.length,
-                notStartedWithinTimeout: notStarted,
-                queueDelayMs: queueDist,
-                createCallDurationMs: createDist,
-                runs: options.verbose
-                    ? fired.map((f) => ({
-                        index: f.index,
-                        instanceId: f.instanceId ?? null,
-                        createFailed: f.createFailed,
-                        createError: f.createError ?? null,
-                        started: f.started,
-                        queueDelayMs: f.queueDelayMs ?? null,
-                        createCallDurationMs: f.createCallDurationMs ?? null,
-                    }))
-                    : undefined,
-            });
-            return;
-        }
-        divider();
-        keyValue("Requested", count);
-        keyValue("Created", count - createFailures);
-        keyValue("Create failures", createFailures);
-        keyValue("Started", startedRuns.length);
-        keyValue("Not started (timeout)", notStarted);
-        divider();
-        if (queueDist) {
-            info("Queue delay (executionStartedAt - requested):");
-            keyValue("  min", formatDuration(queueDist.min));
-            keyValue("  p50", formatDuration(queueDist.p50));
-            keyValue("  p95", formatDuration(queueDist.p95));
-            keyValue("  max", formatDuration(queueDist.max));
-        }
-        else {
-            warn("No runs started — no queue-delay samples collected.");
-        }
-        if (createDist) {
-            divider();
-            info("Create-call duration:");
-            keyValue("  min", formatDuration(createDist.min));
-            keyValue("  p50", formatDuration(createDist.p50));
-            keyValue("  p95", formatDuration(createDist.p95));
-            keyValue("  max", formatDuration(createDist.max));
-        }
-        if (options.verbose) {
-            divider();
-            console.log(formatTable(fired.map((f) => ({
-                run: f.index,
-                instanceId: f.instanceId ?? "-",
-                status: f.createFailed ? "create-failed" : f.started ? "started" : "pending",
-                queueDelayMs: f.queueDelayMs,
-                createCallDurationMs: f.createCallDurationMs,
-            })), [
-                { header: "RUN", key: "run" },
-                { header: "INSTANCE", key: "instanceId", format: formatId },
-                { header: "STATE", key: "status" },
-                { header: "DELAY", key: "queueDelayMs", format: formatDuration },
-                { header: "CREATE", key: "createCallDurationMs", format: formatDuration },
+            console.log(formatTable(items, [
+                { header: "ID", key: "configId", format: formatId },
+                { header: "NAME", key: "configName" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "MODIFIED", key: "modifiedAt", format: formatDate },
             ]));
         }
-    });
-    // Runs subcommand
-    const runs = workflows.command("runs").description("Manage workflow runs");
-    // List runs
-    const runsTableColumns = [
-        { header: "RUN ID", key: "runId", format: formatId },
-        { header: "STATUS", key: "status", format: formatStatus },
-        { header: "STARTED", key: "startedAt", format: formatDate },
-        // #1367 — queue delay (requested → execution start).
-        { header: "DELAY", key: "queueDelayMs", format: formatDuration },
-        { header: "ENDED", key: "endedAt", format: formatDate },
-        { header: "PREVIEW", key: "isPreview", format: (v) => (v ? "yes" : "") },
-    ];
-    runs
-        .command("list")
-        .description("List workflow runs")
-        // #1967 — the workflow id is optional when `--user-id` is given: that
-        // form lists one user's runs across every workflow.
-        .argument("[workflow-id]", "Workflow ID or key (optional with --user-id)")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        // #2348: the canonical run-status vocabulary. The old text advertised
-        // "pending", which no server path ever writes, and omitted "terminated".
-        // An unrecognised value is now a 400 from the server, not an empty page.
-        .option("--status <status>", `Filter by status: ${RUN_STATUS_LIST}`)
-        .option("--user-id <user-id>", "List runs started by this user, across every workflow")
-        .option("--limit <n>", "Number of runs to show", "20")
-        .option("--cursor <cursor>", "Pagination cursor from a previous page")
-        // #1969 — shared tailing flags. `--watch` re-renders the current list each
-        // interval (snapshot); `--follow` appends new/changed runs (tail). Mutually
-        // exclusive; `--interval` floor is 1s (default 2s).
-        .option("--watch", "Re-render the current run list every interval (snapshot)")
-        .option("--follow", "Append runs as they start or change (tail)")
-        .option("--interval <seconds>", "Poll interval in seconds (min 1, default 2)")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        const limit = parseInt(options.limit);
-        if (options.watch && options.follow) {
-            error("--watch and --follow are mutually exclusive; pass only one.");
-            process.exit(1);
-        }
-        // #1967 — one of the two selectors is required; `list` never enumerates
-        // every run in the app.
-        if (!workflowId && !options.userId) {
-            error("Provide a workflow ID, or --user-id to list one user's runs across every workflow.");
-            process.exit(1);
-        }
-        // The user view reads the runs-by-user index, which has no resume
-        // contract — `--follow`'s checkpoint is keyed on the by-workflow index.
-        if (options.userId && options.follow) {
-            error("--follow is not supported with --user-id (it reads a different index). Use --watch instead.");
-            process.exit(1);
-        }
-        // Both selectors resolve through the same page shape, so the rest of the
-        // command is identical either way.
-        const fetchPage = (params) => options.userId
-            ? client.listUserWorkflowRuns(resolvedAppId, options.userId, {
-                ...params,
-                // With both a workflow id and --user-id, narrow to that workflow.
-                workflowId: workflowId || undefined,
-            })
-            : client.listWorkflowRuns(resolvedAppId, workflowId, params);
-        // One-shot list (no tailing).
-        if (!options.watch && !options.follow) {
-            try {
-                const page = await fetchPage({
-                    status: options.status,
-                    limit,
-                    cursor: options.cursor,
-                });
-                const { items } = page;
-                if (options.json) {
-                    // The CLI's one list envelope with the shared inspection item
-                    // shape — never a bare array, and since #3646 no `nextCursor:
-                    // null`, because this is a `list` verb like any other (behaviors
-                    // 6, 7).
-                    json(buildWorkflowRunListEnvelope(items, page));
-                    return;
-                }
-                // The cursor hint prints whether or not this page had rows: a
-                // filtered read can come back empty with more of the index still to
-                // walk, and a bare "No runs found." would read as "this user has no
-                // matching runs" (#1967 review).
-                const printCursorHint = () => {
-                    if (!page.nextCursor)
-                        return;
-                    console.log();
-                    dim(`More runs. Use --cursor ${page.nextCursor} for the next page.`);
-                };
-                if (!items || items.length === 0) {
-                    // #2237 — the honest empty state: a bounded filtered read can stop
-                    // before it reaches a match, so the message says how far it got and
-                    // how to continue instead of asserting there are none. `runs list`
-                    // deliberately does NOT auto-resume like `runs failures` — it is a
-                    // pager, and its `--limit` is a page size.
-                    info(describeEmptyRunPage(page, !!options.cursor));
-                    return;
-                }
-                console.log(formatTable(items, runsTableColumns));
-                printCursorHint();
-            }
-            catch (err) {
-                error(err.message);
-                process.exit(1);
-            }
-            return;
-        }
-        // Tailing (`--watch` / `--follow`). SIGINT → AbortController installed
-        // here at the command level; the handler is removed in `finally` so it
-        // never leaks past this command (unlike the persistent process.on).
-        let intervalSeconds;
-        try {
-            intervalSeconds = parseIntervalSeconds(options.interval);
-        }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
-        const intervalMs = intervalSeconds * 1000;
-        const controller = new AbortController();
-        const onSigint = () => controller.abort();
-        process.on("SIGINT", onSigint);
-        try {
-            if (options.follow) {
-                const source = {
-                    fetchAfter: async (resumeAfter) => {
-                        if (resumeAfter === undefined) {
-                            // Bootstrap: newest position, descending, one row. followLoop
-                            // discards the items and keeps only the baseline checkpoint.
-                            const page = await client.listWorkflowRuns(resolvedAppId, workflowId, {
-                                follow: true,
-                                forward: false,
-                                limit: 1,
-                                status: options.status,
-                            });
-                            return { items: page.items, hasMore: false, resumeAfter: page.resumeAfter };
-                        }
-                        const page = await client.listWorkflowRuns(resolvedAppId, workflowId, {
-                            follow: true,
-                            forward: true,
-                            after: resumeAfter,
-                            limit,
-                            status: options.status,
-                        });
-                        return {
-                            items: page.items,
-                            hasMore: !!page.hasMore,
-                            resumeAfter: page.resumeAfter,
-                        };
-                    },
-                };
-                if (!options.json) {
-                    info("Following runs (Ctrl-C to stop)…");
-                }
-                await followLoop(source, {
-                    intervalMs,
-                    signal: controller.signal,
-                    render: (items) => {
-                        if (options.json) {
-                            // One JSON object per line (a tail has no closing bracket to
-                            // wait for), each in the shared inspection item shape — the
-                            // same items the one-shot envelope carries (behavior 7).
-                            for (const run of items)
-                                jsonLine(toWorkflowRunInspectionRow(run));
-                            return;
-                        }
-                        for (const run of items) {
-                            console.log(`${formatDate(run.startedAt)}  ${formatStatus(run.status)}  ${formatId(run.runId)}`);
-                        }
-                    },
-                });
-            }
-            else {
-                // --watch: periodic snapshot redraw. The most recent page's
-                // pagination fields are kept so the `--json` redraw emits the same
-                // envelope the one-shot path does, not a bare array (behavior 7).
-                let lastPage = {};
-                await watchLoop(async () => {
-                    const page = await fetchPage({
-                        status: options.status,
-                        limit,
-                        cursor: options.cursor,
-                    });
-                    lastPage = page;
-                    return page.items;
-                }, {
-                    intervalMs,
-                    signal: controller.signal,
-                    render: (items) => {
-                        if (options.json) {
-                            json(buildWorkflowRunListEnvelope(items, lastPage));
-                            return;
-                        }
-                        // Renderer owns the redraw: clear the screen, then print.
-                        process.stdout.write("\x1b[2J\x1b[H");
-                        if (!items || items.length === 0) {
-                            console.log("No runs found.");
-                            return;
-                        }
-                        console.log(formatTable(items, runsTableColumns));
-                    },
-                });
-            }
-        }
-        finally {
-            process.removeListener("SIGINT", onSigint);
-        }
     });
-    // Run status
-    runs
-        .command("status")
-        .description("Get status of a workflow run")
+    configs
+        .command("get")
+        .description("Read a retained configuration and its stored steps")
         .argument("<workflow-id>", "Workflow ID or key")
-        .argument("<run-id>", "Run ID")
+        .argument("<config-id>", "Configuration ID")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
         .option("--json", "Output as JSON")
-        .action(async (workflowId, runId, options) => {
+        .action(async (workflowId, configId, options) => {
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         try {
-            const result = await client.getWorkflowRunStatus(resolvedAppId, workflowId, runId);
-            // #2771 — a Cloudflare instance reports `stepResults` only once the run
-            // is terminal, so a live run used to answer with `status: running` and
-            // nothing else for its whole duration. Step rows are now written as the
-            // run goes, so fall back to them: the steps finished so far plus the one
-            // currently executing. Resolved BEFORE the output branches — a script
-            // polling `--json` needs the in-flight trace as much as a human does.
-            // Best-effort: a lookup failure still leaves the run details intact.
-            const instanceStepResults = result.instanceStatus?.stepResults;
-            let persistedStepRuns = [];
-            if (!instanceStepResults || instanceStepResults.length === 0) {
-                try {
-                    const stepRuns = await client.getWorkflowStepRuns(resolvedAppId, workflowId, runId);
-                    persistedStepRuns = stepRuns?.items || [];
-                }
-                catch {
-                    persistedStepRuns = [];
-                }
-            }
+            const config = await client.getWorkflowConfig(resolvedAppId, workflowId, configId);
             if (options.json) {
-                // Purely additive: `stepRuns` appears only when the persisted rows are
-                // what carries the trace, so a terminal run's JSON is unchanged.
-                json(persistedStepRuns.length > 0 ? { ...result, stepRuns: persistedStepRuns } : result);
+                json(config);
                 return;
             }
-            const run = result.run;
-            keyValue("Run ID", run.runId);
-            keyValue("Status", formatStatus(run.status));
-            // #2636 — the machine-readable outcome next to the status: why a
-            // failed run failed, or why an elided run never ran.
-            if (run.errorCode)
-                keyValue("Error code", run.errorCode);
-            if (run.skipReason)
-                keyValue("Skip reason", run.skipReason);
-            // #1367 — `startedAt` is the request time; `executionStartedAt` is when
-            // Cloudflare actually started running the instance. Queue delay is the
-            // gap. A still-queued run shows "-" for execution start / queue delay.
-            keyValue("Requested", formatDate(run.startedAt));
-            keyValue("Execution started", formatDate(run.executionStartedAt));
-            keyValue("Queue delay", formatDuration(run.queueDelayMs));
-            keyValue("Create call", formatDuration(run.createCallDurationMs));
-            keyValue("Ended", formatDate(run.endedAt));
-            keyValue("Preview", run.isPreview ? "yes" : "no");
-            const stepResultLines = renderRunStatusStepResults(stepResultsForRunStatus(instanceStepResults, persistedStepRuns));
-            if (result.instanceStatus?.output) {
-                divider();
-                info("Output:");
-                console.log(JSON.stringify(result.instanceStatus.output, null, 2));
-            }
-            if (stepResultLines.length > 0) {
-                divider();
-                info("Step Results:");
-                for (const line of stepResultLines) {
-                    console.log(line);
-                }
-            }
-            if (result.instanceStatus?.error) {
+            printResult("Config ID", config.configId);
+            printResult("Name", config.configName);
+            printResult("Description", config.description || "-");
+            printResult("Status", formatStatus(config.status));
+            printResult("Created", formatDate(config.createdAt));
+            printResult("Modified", formatDate(config.modifiedAt));
+            if (config.steps && config.steps.length > 0) {
                 divider();
-                error("Error:");
-                console.log(JSON.stringify(result.instanceStatus.error, null, 2));
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Steps for a run
-    runs
-        .command("steps")
-        .description("Show step-level details for a workflow run")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .argument("<run-id>", "Run ID")
-        .option("--app <app-id>", "App ID")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, runId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const { items } = await client.getWorkflowStepRuns(resolvedAppId, workflowId, runId);
-            if (options.json) {
-                // Steps are unpaginated (one run's full trace) — the shared
-                // inspection item shape wrapped in `{items}`, no cursor (behavior 6).
-                json(buildWorkflowStepEnvelope(items));
-                return;
-            }
-            if (!items || items.length === 0) {
-                info("No step runs found.");
-                return;
+                info(`Steps (${config.steps.length}):`);
+                config.steps.forEach((step, idx) => {
+                    console.log(`  ${idx + 1}. ${step.id} (${step.kind})`);
+                });
             }
-            console.log(renderStepRunTable(items));
         }
         catch (err) {
             error(err.message);
             process.exit(1);
         }
     });
-    // Step detail
-    runs
-        .command("step-detail")
-        .description("Show full details for a single step")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .argument("<run-id>", "Run ID")
-        .argument("<step-id>", "Step ID")
-        .option("--app <app-id>", "App ID")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, runId, stepId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const { items } = await client.getWorkflowStepRuns(resolvedAppId, workflowId, runId);
-            const step = items.find((s) => s.stepId === stepId);
-            if (!step) {
-                error(`Step "${stepId}" not found in run ${runId}`);
-                process.exit(1);
-            }
-            if (options.json) {
-                json(step);
-                return;
-            }
-            keyValue("Step", step.stepId);
-            keyValue("Kind", step.stepKind);
-            keyValue("Status", formatStatus(step.status));
-            keyValue("Duration", formatDuration(step.durationMs));
-            keyValue("Started", formatDate(step.startedAt));
-            keyValue("Ended", formatDate(step.endedAt));
-            if (step.totalTokens) {
-                keyValue("Tokens", `${step.inputTokens || 0} in / ${step.outputTokens || 0} out / ${step.totalTokens} total`);
-            }
-            if (step.retryCount) {
-                keyValue("Retries", String(step.retryCount));
-            }
-            if (step.config) {
-                divider();
-                info("Config (rendered):");
-                console.log(JSON.stringify(step.config, null, 2));
-            }
-            if (step.rawConfig) {
-                divider();
-                info("Config (raw):");
-                console.log(JSON.stringify(step.rawConfig, null, 2));
-            }
-            if (step.input) {
-                divider();
-                info("Input:");
-                console.log(JSON.stringify(step.input, null, 2));
-            }
-            if (step.output) {
-                divider();
-                info("Output:");
-                console.log(JSON.stringify(step.output, null, 2));
-            }
-            if (step.error) {
-                divider();
-                error("Error: " + step.error);
-                if (step.errorDetails) {
-                    console.log(step.errorDetails);
-                }
-            }
-            if (step.templateWarnings && step.templateWarnings.length > 0) {
-                divider();
-                warn("Template Warnings:");
-                step.templateWarnings.forEach((w) => {
-                    console.log(`  ${w.expression}: ${w.message}`);
-                });
-            }
-            if (step.context) {
-                divider();
-                info("Context Snapshot:");
-                console.log(JSON.stringify(step.context, null, 2));
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Integration call logs for a run (cross-pivot from workflow-run to
-    // integrations.logs — see issue #699).
-    runs
-        .command("logs")
-        .description("List integration calls made by a specific workflow run (cross-pivot of `integrations logs`)")
-        .argument("<run-id>", "Workflow run ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--limit <n>", "Number of logs to show", "100")
-        .option("--json", "Output as JSON")
-        .action(async (runId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const logs = await client.listWorkflowRunIntegrationLogs(resolvedAppId, runId, { limit: parseInt(options.limit) });
-            if (options.json) {
-                json(logs);
-                return;
-            }
-            if (!logs || logs.length === 0) {
-                info("No integration calls found for this run.");
-                return;
-            }
-            console.log(formatTable(logs, [
-                { header: "TIME", key: "timestamp", format: formatDate },
-                { header: "STEP", key: "stepId", format: (v) => v || "" },
-                {
-                    header: "INTEGRATION",
-                    key: "integrationKey",
-                    format: (v) => v || "",
-                },
-                { header: "METHOD", key: "method" },
-                { header: "PATH", key: "path" },
-                { header: "STATUS", key: "status" },
-                { header: "DURATION", key: "durationMs", format: formatDuration },
-                { header: "TRACE", key: "traceId", format: formatId },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Error summary
-    runs
-        .command("error")
-        .description("Show error details for a failed workflow run")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .argument("<run-id>", "Run ID")
-        .option("--app <app-id>", "App ID")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, runId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const [runResult, stepsResult] = await Promise.all([
-                client.getWorkflowRunStatus(resolvedAppId, workflowId, runId),
-                client.getWorkflowStepRuns(resolvedAppId, workflowId, runId),
-            ]);
-            // #2074 — one selection rule shared with the STEP column of
-            // `runs failures`: prefer the run's own denormalized attribution, and
-            // fall back to the lowest-`stepIndex` failed row (never "whatever the
-            // query returned first") so the two views can't disagree.
-            const failedStep = selectFailedStepRow(stepsResult.items, runResult.run?.failedStepId);
-            const errorInfo = {
-                runId,
-                status: runResult.run?.status,
-                // #2636 — the platform's classification of the failure, when it owns
-                // one (a lost declarative-lock race, an exhausted lock wait).
-                errorCode: runResult.run?.errorCode ?? null,
-                errorMessage: runResult.run?.errorMessage || runResult.instanceStatus?.error?.message,
-                failedStep: failedStep ? {
-                    stepId: failedStep.stepId,
-                    stepKind: failedStep.stepKind,
-                    error: failedStep.error,
-                    errorDetails: failedStep.errorDetails,
-                    input: failedStep.input,
-                    config: failedStep.config,
-                } : null,
-            };
-            if (options.json) {
-                json(errorInfo);
-                return;
-            }
-            keyValue("Run ID", runId);
-            keyValue("Status", formatStatus(errorInfo.status));
-            if (errorInfo.errorCode) {
-                keyValue("Code", errorInfo.errorCode);
-            }
-            if (errorInfo.errorMessage) {
-                divider();
-                error("Error: " + errorInfo.errorMessage);
-            }
-            if (failedStep) {
-                divider();
-                info(`Failed Step: ${failedStep.stepId} (${failedStep.stepKind})`);
-                if (failedStep.error) {
-                    error("  " + failedStep.error);
-                }
-                if (failedStep.errorDetails) {
-                    console.log(failedStep.errorDetails);
-                }
-                if (failedStep.input) {
-                    divider();
-                    info("Step Input:");
-                    console.log(JSON.stringify(failedStep.input, null, 2));
-                }
-                if (failedStep.config) {
-                    divider();
-                    info("Step Config:");
-                    console.log(JSON.stringify(failedStep.config, null, 2));
-                }
-            }
-            else {
-                info("No failed step found in step runs.");
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Failures list
-    runs
-        .command("failures")
-        .description("List recent workflow run failures")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .option("--app <app-id>", "App ID")
-        // #2237 — `--limit` is the number of FAILURES to collect, as the help text
-        // always claimed. It used to be passed straight through as the server's
-        // bounded page limit, so a workflow with a long success streak answered
-        // "No failures found." while failures sat just past the scan budget.
-        .option("--limit <n>", "Number of failures to collect", "10")
-        .option("--max-scan <n>", `Stop after examining this many runs, to the nearest request (each examines up to ${SERVER_SCAN_ROWS_PER_REQUEST}; 0 = no cap; a sweep issues at most ${FAILURE_SWEEP_MAX_REQUESTS} requests either way)`, String(DEFAULT_FAILURE_SWEEP_MAX_SCAN))
-        // `--cursor` seeds the sweep's starting position; the sweep then resumes
-        // itself, so it is only needed to continue an earlier capped search.
-        .option("--cursor <cursor>", "Resume the search from a previous cursor")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        const limit = parseInt(options.limit, 10);
-        const maxScan = parseInt(options.maxScan, 10);
-        if (!Number.isFinite(limit) || limit < 1) {
-            error("--limit must be a positive integer.");
-            process.exit(1);
-        }
-        if (!Number.isFinite(maxScan) || maxScan < 0) {
-            error("--max-scan must be a non-negative integer (0 = no cap).");
-            process.exit(1);
-        }
-        // Ctrl-C during a multi-second sweep prints what was collected plus the
-        // resume cursor rather than dropping the work on the floor. The handler
-        // is removed in `finally` so it never leaks past this command.
-        //
-        // Registering a listener replaces Node's terminate-on-SIGINT default, and
-        // `shouldStop` is only read between requests — so a first Ctrl-C during a
-        // slow in-flight request would otherwise appear to do nothing and leave
-        // the command unkillable. A second one exits immediately (#2237 review).
-        let interrupted = false;
-        let sigints = 0;
-        const onSigint = () => {
-            interrupted = true;
-            if (++sigints > 1)
-                process.exit(130);
-        };
-        process.on("SIGINT", onSigint);
-        // Progress on stderr, TTY only, never in `--json` mode: a silent
-        // multi-second command invites the Ctrl-C it is trying to survive.
-        const showProgress = !options.json && !!process.stderr.isTTY;
-        try {
-            const sweep = await collectWorkflowFailures(({ cursor, limit: pageLimit }) => client.listWorkflowRuns(resolvedAppId, workflowId, {
-                status: "failed",
-                limit: pageLimit,
-                cursor,
-            }), {
-                limit,
-                maxScan,
-                startCursor: options.cursor,
-                shouldStop: () => interrupted,
-                onProgress: showProgress
-                    ? (scanned, collected) => progress(`Searching… ${scanned} runs examined, ${collected} failure${collected === 1 ? "" : "s"} found`)
-                    : undefined,
-            });
-            if (showProgress && sweep.requests >= 1) {
-                // Clear the progress line so it does not sit above the table. One
-                // request is the common case — `onProgress` fires after EVERY request
-                // including the first, so guarding on `> 1` left the line on screen
-                // with the cursor parked at its end (#2237 review).
-                process.stderr.write("\r\x1b[K");
-            }
-            // A SIGINT that arrived after the sweep returned (while the table is
-            // rendering) did not truncate anything, so only a sweep that actually
-            // stopped on the interrupt reports 130. `exitCode` rather than
-            // `process.exit()` so a piped stdout is not truncated mid-write.
-            const exitInterrupted = sweep.stoppedBecause === "interrupted";
-            const items = sweep.items;
-            if (options.json) {
-                // #2074 — the shared inspection item shape inside the endpoint's own
-                // #1316 envelope, never a bare array. #2237 — `items` is the
-                // concatenation across every resumed page, `scanned` their sum, and
-                // `nextCursor` the last one observed.
-                json(buildWorkflowRunEnvelope(items, {
-                    nextCursor: sweep.nextCursor,
-                    hasMore: !!sweep.nextCursor,
-                    ...(sweep.scannedKnown ? { scanned: sweep.scanned } : {}),
-                }));
-                if (exitInterrupted)
-                    process.exitCode = 130;
-                return;
-            }
-            if (items.length > 0) {
-                console.log(formatTable(items, [
-                    { header: "RUN ID", key: "runId", format: formatId },
-                    // STEP sits before ERROR so the truncated message stays the last
-                    // wide column and the step id is never the thing that gets cut.
-                    // `-` is a routine outcome, not a bug: launch-time failures
-                    // (create/schema/R2 aborts, reclaimed runs) legitimately have no
-                    // failed step, and runs that predate #2074 carry no attribution.
-                    { header: "STEP", key: "failedStepId", format: formatFailureStepCell },
-                    // #2636 — the platform's classification, next to the message an
-                    // operator would otherwise have had to pattern-match.
-                    { header: "CODE", key: "errorCode", format: formatFailureCodeCell },
-                    { header: "ERROR", key: "errorMessage", format: formatFailureErrorCell },
-                    { header: "STARTED", key: "startedAt", format: formatDate },
-                    { header: "ENDED", key: "endedAt", format: formatDate },
-                ]));
-            }
-            // #2237 — replaces the unconditional "No failures found.": every form
-            // either states the search was complete or says how far it got and how
-            // to continue. A triage command must never assert an absence it did
-            // not establish.
-            const summary = describeFailureSweep(sweep, limit);
-            if (summary) {
-                if (items.length > 0)
-                    console.log();
-                info(summary);
-            }
-            if (exitInterrupted)
-                process.exitCode = 130;
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-        finally {
-            process.removeListener("SIGINT", onSigint);
-        }
-    });
-    // ── Iterations: inspect / reset iterate-users singleton iterations (#1209) ──
-    const iterations = workflows
-        .command("iterations")
-        .description("Inspect and reset iterate-users iterations");
-    iterations
-        .command("list")
-        .description("List iterate-users iterations for the app")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const { items } = await client.listIterations(resolvedAppId);
-            if (options.json) {
-                json(wholeListEnvelope(items));
-                return;
-            }
-            if (!items || items.length === 0) {
-                info("No iterations found.");
-                return;
-            }
-            console.log(formatTable(items, [
-                { header: "ITERATION", key: "iterationName" },
-                { header: "STATUS", key: "status", format: formatStatus },
-                { header: "ACQUIRED", key: "lastAcquireMode", format: (v) => v || "" },
-                { header: "PROCESSED", key: "totalProcessed" },
-                { header: "FAILED", key: "failedCount" },
-                { header: "LAST RUN", key: "lastRunAt", format: formatDate },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    iterations
-        .command("get")
-        .description("Show details for a single iterate-users iteration")
-        .argument("<name>", "Iteration name")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (name, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const it = await client.getIteration(resolvedAppId, name);
-            if (options.json) {
-                json(it);
-                return;
-            }
-            keyValue("Iteration", it.iterationName);
-            keyValue("Status", formatStatus(it.status));
-            keyValue("Acquired as", it.lastAcquireMode || "(unknown)");
-            keyValue("Run ID", it.runId);
-            keyValue("Instance ID", it.instanceId);
-            keyValue("Started", formatDate(it.startedAt));
-            keyValue("Last run", formatDate(it.lastRunAt));
-            keyValue("Lock expires", formatDate(it.lockExpiresAt));
-            keyValue("Processed", String(it.totalProcessed ?? 0));
-            keyValue("Succeeded", String(it.succeededCount ?? 0));
-            keyValue("Failed (total)", String(it.failedCount ?? 0));
-            keyValue("Skipped", String(it.skippedCount ?? 0));
-            if (it.lastError) {
-                keyValue("Last error", it.lastError);
-            }
-            const sample = Array.isArray(it.failedUserIdsSample)
-                ? it.failedUserIdsSample
-                : [];
-            if (sample.length > 0) {
-                const label = it.failedUserIdsTruncated
-                    ? `Failed user IDs (sample, truncated; ${it.failedCount} total)`
-                    : `Failed user IDs (sample)`;
-                keyValue(label, sample.join(", "));
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    iterations
-        .command("reset")
-        .description("Reset a terminal (completed/failed) iteration so the next trigger runs fresh")
-        .argument("<name>", "Iteration name")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (name, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const res = await client.resetIteration(resolvedAppId, name);
-            if (options.json) {
-                json(res);
-                return;
-            }
-            success(`Reset iteration "${name}" (was ${res.previousStatus}). The next trigger will run fresh.`);
-        }
-        catch (err) {
-            // A running iteration is refused with 409 + lock metadata — surface a
-            // clear message rather than a raw error.
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // ============================================
-    // CONFIGS SUBCOMMAND
-    // ============================================
-    const configs = workflows
-        .command("configs")
-        .description("Manage workflow configurations")
-        .addHelpText("after", `
-Examples:
-  $ primitive workflows configs list <workflow-id>
-  $ primitive workflows configs get <workflow-id> <config-id>
-
-Config bodies are authored as files, not verbs: write
-workflows/<key>.configs/<name>.toml and name the live one with
-activeConfigName in workflows/<key>.toml, then run 'primitive config push'.
-`);
-    // List configs
-    configs
-        .command("list")
-        .description("List configurations for a workflow")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const { items } = await client.listWorkflowConfigs(resolvedAppId, workflowId);
-            if (options.json) {
-                json(wholeListEnvelope(items));
-                return;
-            }
-            if (!items || items.length === 0) {
-                info("No configurations found.");
-                return;
-            }
-            // Get workflow to find active config
-            const { workflow } = await client.getWorkflow(resolvedAppId, workflowId);
-            const activeConfigId = workflow?.activeConfigId;
-            console.log(formatTable(items, [
-                { header: "ID", key: "configId", format: formatId },
-                { header: "NAME", key: "configName" },
-                { header: "STATUS", key: "status", format: formatStatus },
-                {
-                    header: "ACTIVE",
-                    key: "configId",
-                    format: (v) => v === activeConfigId ? "★" : "",
-                },
-                { header: "MODIFIED", key: "modifiedAt", format: formatDate },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Get config
-    configs
-        .command("get")
-        .description("Get configuration details")
-        .argument("<workflow-id>", "Workflow ID or key")
-        .argument("<config-id>", "Configuration ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflowId, configId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const config = await client.getWorkflowConfig(resolvedAppId, workflowId, configId);
-            if (options.json) {
-                json(config);
-                return;
-            }
-            printResult("Config ID", config.configId);
-            printResult("Name", config.configName);
-            printResult("Description", config.description || "-");
-            printResult("Status", formatStatus(config.status));
-            printResult("Created", formatDate(config.createdAt));
-            printResult("Modified", formatDate(config.modifiedAt));
-            if (config.steps && config.steps.length > 0) {
-                divider();
-                info(`Steps (${config.steps.length}):`);
-                config.steps.forEach((step, idx) => {
-                    console.log(`  ${idx + 1}. ${step.id} (${step.kind})`);
-                });
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // ============================================
-    // TESTS SUBCOMMAND
-    // ============================================
-    const tests = workflows
-        .command("tests")
-        .description("Run and inspect workflow test cases")
-        .addHelpText("after", `
-Test cases are authored in TOML at workflows/<key>.tests/<name>.toml and applied
-with \`primitive config push\` (issue #2769); \`config fields workflow\` lists the
-fields. Deleting a case is removing its file and running \`config push --prune\`.
-
-Every verb here takes the workflow's KEY or its ID (#3249). An identifier
-that names no workflow in the app fails; "No test cases found." only ever
-means the workflow exists and has no cases.
-
-Examples:
-  $ primitive workflows tests list <workflow>
-  $ primitive workflows tests run <workflow> <test-case-id>
-  $ primitive workflows tests run-all <workflow>
-  $ primitive workflows tests run-all <workflow> --test-cases 01ABC,01DEF,01GHI
-`);
-    tests
-        .command("list")
-        .description("List test cases for a workflow")
-        .argument("<workflow>", "Workflow key or ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .addOption(pageLimitOption())
-        .addOption(pageCursorOption())
-        .option("--json", "Output as JSON")
-        .action(async (workflow, options) => {
-        const limit = parsePageLimit(options.limit);
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            // #3249 — resolve BEFORE listing: the test-case endpoint answers an
-            // unknown block with an empty page, so an unresolved identifier would
-            // print "No test cases found." and exit 0.
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const page = normalizeCliListEnvelope(await client.listTestCases(resolvedAppId, "workflow", workflowId, {
-                limit,
-                cursor: options.cursor,
-            }));
-            const items = page.items;
-            if (options.json) {
-                json(page);
-                return;
-            }
-            if (items.length === 0) {
-                printEmptyPage(page, "test cases");
-                return;
-            }
-            console.log(formatTable(items, [
-                { header: "ID", key: "testCaseId", format: formatId },
-                { header: "NAME", key: "name" },
-                { header: "CREATED", key: "createdAt", format: formatDate },
-            ]));
-            printPageHint(page);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Get test case
-    tests
-        .command("get")
-        .description("Get test case details")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, testCaseId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const result = await client.getTestCase(resolvedAppId, "workflow", workflowId, testCaseId);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            printResult("Test Case ID", result.testCaseId);
-            printResult("Name", result.name);
-            printResult("Created", formatDate(result.createdAt));
-            divider();
-            info("Input Variables:");
-            try {
-                const vars = typeof result.inputVariables === 'string'
-                    ? JSON.parse(result.inputVariables || "{}")
-                    : (result.inputVariables || {});
-                console.log(JSON.stringify(vars, null, 2));
-            }
-            catch {
-                console.log(result.inputVariables || "{}");
-            }
-            if (result.expectedOutputPattern) {
-                divider();
-                printResult("Expected Pattern", result.expectedOutputPattern);
-            }
-            if (result.expectedOutputContains) {
-                divider();
-                info("Expected Contains:");
-                try {
-                    const contains = typeof result.expectedOutputContains === 'string'
-                        ? JSON.parse(result.expectedOutputContains)
-                        : result.expectedOutputContains;
-                    console.log(JSON.stringify(contains, null, 2));
-                }
-                catch {
-                    console.log(result.expectedOutputContains);
-                }
-            }
-            if (result.expectedJsonSubset) {
-                divider();
-                info("Expected JSON Subset:");
-                try {
-                    const subset = typeof result.expectedJsonSubset === 'string'
-                        ? JSON.parse(result.expectedJsonSubset)
-                        : result.expectedJsonSubset;
-                    console.log(JSON.stringify(subset, null, 2));
-                }
-                catch {
-                    console.log(result.expectedJsonSubset);
-                }
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Run a single test case
-    tests
-        .command("run")
-        .description("Run a single test case")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, testCaseId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            // Get test case to retrieve its variables
-            const testCase = await client.getTestCase(resolvedAppId, "workflow", workflowId, testCaseId);
-            // #3158 — the case's stored input IS the run's input, and the server
-            // hands it back parsed; `JSON.parse` on that object threw and the run
-            // went ahead with `{}`, disagreeing with `run-all` over the same case.
-            const variables = requireTestCaseInputVariables(testCase.inputVariables, testCaseId);
-            const result = await client.executeBlockTest(resolvedAppId, "workflow", workflowId, {
-                variables,
-                testCaseId,
-            });
-            if (options.json) {
-                json(result);
-                return;
-            }
-            const passed = result.verification?.passed;
-            if (passed) {
-                success("Test PASSED");
-            }
-            else {
-                error("Test FAILED");
-            }
-            keyValue("Duration", formatDuration(result.metrics?.durationMs));
-            if (result.verification) {
-                divider();
-                info("Verification:");
-                const v = result.verification;
-                keyValue("  Passed", v.passed ? "Yes" : "No");
-                keyValue("  Checks", `${v.summary?.passed || 0}/${v.summary?.total || 0} passed`);
-                if (v.checks && v.checks.length > 0) {
-                    console.log();
-                    for (const check of v.checks) {
-                        const icon = check.passed ? "✓" : "✗";
-                        console.log(`  ${icon} ${check.name}`);
-                        if (!check.passed && check.message) {
-                            console.log(`    ${check.message}`);
-                        }
-                    }
-                }
-            }
-            if (result.output) {
-                divider();
-                info("Output:");
-                console.log(typeof result.output === "string" ? result.output : JSON.stringify(result.output, null, 2));
-            }
-            if (result.error) {
-                divider();
-                error(`Error: ${result.error}`);
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Run all test cases (or a specific group)
-    tests
-        .command("run-all")
-        .description("Run all test cases for a workflow, or a specific subset")
-        .argument("<workflow>", "Workflow key or ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--test-cases <ids>", "Comma-separated list of test case IDs to run (runs only these)")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            // #3249 — resolve first, so `Total Tests: 0` can only ever mean the
-            // workflow exists and has no cases, never that the identifier was wrong.
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            // Parse test case IDs if provided
-            let testCaseIds;
-            if (options.testCases) {
-                testCaseIds = options.testCases.split(",").map((id) => id.trim()).filter(Boolean);
-                if (testCaseIds.length === 0) {
-                    error("No valid test case IDs provided in --test-cases");
-                    process.exit(1);
-                }
-            }
-            if (!options.json) {
-                if (testCaseIds) {
-                    info(`Running ${testCaseIds.length} selected test case(s)...`);
-                }
-                else {
-                    info("Running all test cases...");
-                }
-            }
-            const result = await client.runAllTestCases(resolvedAppId, "workflow", workflowId, {
-                testCaseIds,
-            });
-            if (options.json) {
-                json(result);
-                return;
-            }
-            const { summary, runs, comparisonGroup } = result;
-            divider();
-            keyValue("Comparison Group", comparisonGroup);
-            keyValue("Total Tests", summary.total);
-            keyValue("Passed", summary.passed);
-            keyValue("Failed", summary.failed);
-            divider();
-            if (runs && runs.length > 0) {
-                for (const r of runs) {
-                    const passed = r.verification?.passed;
-                    const icon = passed ? "✓" : "✗";
-                    const status = passed ? "PASSED" : "FAILED";
-                    console.log(`${icon} ${r.testCaseName} - ${status}`);
-                    if (!passed && r.verification?.details?.reason) {
-                        console.log(`  ${r.verification.details.reason}`);
-                    }
-                }
-            }
-            // Exit with error code if any tests failed
-            if (summary.failed > 0) {
-                process.exit(1);
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // List test runs
-    tests
-        .command("runs")
-        .description("List recent test runs for a workflow")
-        .argument("<workflow>", "Workflow key or ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--limit <n>", "Maximum number of runs to show", "20")
-        .option("--group <group>", "Filter by comparison group")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const { items } = await client.listTestRuns(resolvedAppId, "workflow", workflowId, {
-                limit: parseInt(options.limit),
-                comparisonGroup: options.group,
-            });
-            if (options.json) {
-                json(items);
-                return;
-            }
-            if (!items || items.length === 0) {
-                info("No test runs found.");
-                return;
-            }
-            console.log(formatTable(items, [
-                { header: "RUN ID", key: "runId", format: formatId },
-                { header: "TEST CASE ID", key: "testCaseId", format: (v) => v ? formatId(v) : "-" },
-                {
-                    header: "PASSED",
-                    key: "verificationPassed",
-                    format: (v) => v === true
-                        ? "Yes"
-                        : v === false
-                            ? "No"
-                            : "-",
-                },
-                { header: "DURATION", key: "durationMs", format: formatDuration },
-                { header: "STARTED", key: "startedAt", format: formatDate },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // ============================================
-    // BATCH TEST EXECUTION SUBCOMMAND
-    // ============================================
-    const batch = tests
-        .command("batch")
-        .description("Run tests in parallel using workflow-based execution")
-        .addHelpText("after", `
-Examples:
-  $ primitive workflows tests batch start <workflow>
-  $ primitive workflows tests batch start <workflow> --test-cases 01ABC,01DEF
-  $ primitive workflows tests batch status <workflow> <batch-id>
-  $ primitive workflows tests batch cancel <workflow> <batch-id>
-`);
-    // Start batch tests
-    batch
-        .command("start")
-        .description("Start parallel batch test execution")
-        .argument("<workflow>", "Workflow key or ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--test-cases <ids>", "Comma-separated list of test case IDs to run")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            let testCaseIds;
-            if (options.testCases) {
-                testCaseIds = options.testCases.split(",").map((id) => id.trim()).filter(Boolean);
-            }
-            if (!options.json) {
-                info("Starting batch test execution...");
-            }
-            const result = await client.startBatchTests(resolvedAppId, "workflow", workflowId, {
-                testCaseIds,
-            });
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success("Batch tests started!");
-            keyValue("Batch ID", result.batchId);
-            keyValue("Total Tests", result.totalTests);
-            keyValue("Workflow Instances", result.instanceIds?.length || 0);
-            if (result.errors && result.errors.length > 0) {
-                divider();
-                warn(`${result.errors.length} test(s) failed to start`);
-            }
-            divider();
-            info("Check status with:");
-            console.log(`  primitive workflows tests batch status ${workflowId} ${result.batchId}`);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Get batch status
-    batch
-        .command("status")
-        .description("Get status of a batch test execution")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<batch-id>", "Batch ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--wait", "Wait for completion (polls every 2 seconds)")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, batchId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const fetchStatus = async () => {
-                return client.getBatchTestStatus(resolvedAppId, "workflow", workflowId, batchId);
-            };
-            let result = await fetchStatus();
-            if (options.wait && result.status === "running") {
-                info("Waiting for batch completion...");
-                // #1969 — shared poll primitive (delay-then-probe every 2s, honoring
-                // an AbortSignal). `onError: "throw"` preserves the prior loop's
-                // fail-fast behavior: a throwing fetchStatus (expired token, deleted
-                // batch → 401/404) propagates to the command-level catch below and
-                // exits non-zero, rather than spinning forever with a frozen progress
-                // line. (The follow/watch tail loops legitimately keep "continue".)
-                const controller = new AbortController();
-                result = await pollUntil(fetchStatus, (r) => r.status !== "running", {
-                    intervalMs: 2000,
-                    signal: controller.signal,
-                    onError: "throw",
-                    // Progress goes to stderr so it can't corrupt JSON on stdout under --json.
-                    onValue: (r) => progress(`  Completed: ${r.completed}/${r.results?.length || 0}  `),
-                });
-                progressEnd();
-            }
-            if (options.json) {
-                json(result);
-                return;
-            }
-            keyValue("Batch ID", result.batchId);
-            keyValue("Status", formatStatus(result.status));
-            keyValue("Completed", result.completed);
-            keyValue("Passed", chalk.green(result.passed));
-            keyValue("Failed", result.failed > 0 ? chalk.red(result.failed) : "0");
-            if (result.results && result.results.length > 0) {
-                divider();
-                info("Results:");
-                for (const r of result.results) {
-                    const passed = r.verificationPassed;
-                    const icon = passed ? chalk.green("✓") : passed === false ? chalk.red("✗") : chalk.dim("○");
-                    const status = r.status === "completed" ? (passed ? "PASSED" : "FAILED") : r.status;
-                    const duration = r.durationMs ? formatDuration(r.durationMs) : "";
-                    console.log(`  ${icon} ${formatId(r.testCaseId)} - ${status} ${duration}`);
-                }
-            }
-            // Exit with error if tests failed
-            if (result.failed > 0) {
-                process.exit(1);
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Cancel batch tests
-    batch
-        .command("cancel")
-        .description("Cancel a running batch test execution")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<batch-id>", "Batch ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("-y, --yes", "Skip confirmation prompt")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, batchId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        if (!options.yes) {
-            let confirm;
-            try {
-                confirm = await confirmPrompt(`Are you sure you want to cancel batch ${batchId}?`);
-            }
-            catch (err) {
-                error(err.message);
-                process.exit(1);
-            }
-            if (!confirm) {
-                info("Cancelled.");
-                return;
-            }
-        }
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            // First get current status to get instance IDs
-            const status = await client.getBatchTestStatus(resolvedAppId, "workflow", workflowId, batchId);
-            // Get instance IDs that are still running
-            const runningInstanceIds = status.results
-                ?.filter((r) => r.status === "running" || r.status === "pending")
-                .map((r) => r.runId)
-                .filter(Boolean) || [];
-            if (runningInstanceIds.length === 0) {
-                info("No running tests to cancel.");
-                return;
-            }
-            const result = await client.cancelBatchTests(resolvedAppId, "workflow", workflowId, batchId, runningInstanceIds);
-            if (options.json) {
-                json(result);
-                return;
-            }
-            success("Batch tests cancelled.");
-            keyValue("Terminated", result.terminated?.length || 0);
-            if (result.errors && result.errors.length > 0) {
-                warn(`${result.errors.length} instance(s) could not be terminated`);
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // ============================================
-    // TEST CASE ATTACHMENTS SUBCOMMAND
-    // ============================================
-    const attachments = tests
-        .command("attachments")
-        .description("Inspect test case file attachments")
-        .addHelpText("after", `
-Attachments are authored as files in workflows/<key>.tests/<name>/ and applied
-with \`primitive config push\` (#2769); removing one and running
-\`config push --prune\` deletes it server-side. These verbs read server state.
-
-Examples:
-  $ primitive workflows tests attachments list <workflow> <test-case-id>
-  $ primitive workflows tests attachments download <workflow> <test-case-id> document.pdf
-`);
-    // List attachments
-    attachments
-        .command("list")
-        .description("List attachments for a test case")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .option("--json", "Output as JSON")
-        .action(async (workflow, testCaseId, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const result = await client.listTestCaseAttachments(resolvedAppId, "workflow", workflowId, testCaseId);
-            if (options.json) {
-                json(wholeListEnvelope(result.attachments));
-                return;
-            }
-            if (!result.attachments || result.attachments.length === 0) {
-                info("No attachments found.");
-                return;
-            }
-            console.log(formatTable(result.attachments, [
-                { header: "FILENAME", key: "filename" },
-                { header: "TYPE", key: "contentType" },
-                {
-                    header: "SIZE",
-                    key: "size",
-                    format: (v) => formatFileSize(v),
-                },
-            ]));
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // Download attachment
-    attachments
-        .command("download")
-        .description("Download a file attachment from a test case")
-        .argument("<workflow>", "Workflow key or ID")
-        .argument("<test-case-id>", "Test Case ID")
-        .argument("<filename>", "Name of the file to download")
-        .argument("[output-path]", "Output path (defaults to current directory)")
-        .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .action(async (workflow, testCaseId, filename, outputPath, options) => {
-        const resolvedAppId = resolveAppId(undefined, options);
-        const client = new ApiClient();
-        try {
-            const workflowId = await resolveWorkflowId(client, resolvedAppId, workflow);
-            const result = await client.downloadTestCaseAttachment(resolvedAppId, "workflow", workflowId, testCaseId, filename);
-            const finalPath = outputPath || filename;
-            writeFileSync(finalPath, result.data);
-            success(`Downloaded: ${finalPath}`);
-            keyValue("Size", formatFileSize(result.data.length));
-            keyValue("Type", result.contentType);
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-    // ============================================
-    // Codegen command (issue #1442)
-    // ============================================
-    workflows
-        .command("codegen")
-        .description("Generate typed client signatures from the local workflows/*.toml schemas. TypeScript (default): one <key>.generated.ts per workflow (<Key>Input/<Key>Output types + a <key>(client) invoker factory). Swift (--lang swift): one <key>.generated.swift per workflow (<Key>Input/<Key>Output Codable types).\n\nFormatting: the emitted TypeScript is already formatted the way Prettier's DEFAULT config formats it, so a `codegen` -> `prettier --write` -> `codegen --check` pipeline stays green. If your project uses a NON-default Prettier config (a different printWidth, trailingComma, or quote style), Prettier will reformat the generated files and `--check` will then fail: add the generated directory to `.prettierignore` and commit the raw emission instead.")
-        .argument("[workflow-key]", "Generate for a single workflow (defaults to every workflows/*.toml found)")
-        .option("-o, --output <dir>", "Output directory for the generated files (defaults to <config-dir>/workflows/generated/)")
-        .option("--lang <lang>", "Target language for the generated types: 'ts' (default) or 'swift'.", "ts")
-        .option("--check", "Exit non-zero if generated output is out of date (CI guard); does not write. Compares byte-for-byte, so the file on disk must match the emission exactly.")
-        .option("--json", "Output the result summary as JSON")
-        .action(async (workflowKey, options) => {
-        try {
-            // 0. Validate --lang up front so an unknown value fails clearly rather
-            //    than silently defaulting to the TS emitter.
-            const lang = String(options.lang ?? "ts").toLowerCase();
-            if (lang !== "ts" && lang !== "swift") {
-                error(`Unknown --lang "${options.lang}". Use "ts" or "swift".`);
-                process.exit(1);
-            }
-            // 1. The single source workflows/ directory: the environment's, and
-            //    only ever the environment's (#1510, #3154).
-            const workflowsSourceDir = resolveCodegenSourceDir({
-                subdir: "workflows",
-            });
-            // 2. Collect the source .toml files (one per workflow), filtered to a
-            //    single workflow when an argument is given. Match on the file stem;
-            //    the generator resolves the real key from `[workflow].key`.
-            const inputs = [];
-            for (const fileName of readdirSync(workflowsSourceDir)) {
-                if (!fileName.endsWith(".toml"))
-                    continue;
-                const stem = fileName.slice(0, -".toml".length);
-                if (workflowKey && stem !== workflowKey)
-                    continue;
-                const tomlPath = path.join(workflowsSourceDir, fileName);
-                inputs.push({
-                    fileStem: stem,
-                    tomlPath,
-                    tomlContent: readFileSync(tomlPath, "utf-8"),
-                });
-            }
-            if (inputs.length === 0) {
-                error(workflowKey
-                    ? `No workflows/${workflowKey}.toml found under primitive/<env>/.`
-                    : "No workflows/*.toml files found to generate from.");
-                process.exit(1);
-            }
-            // 3. Resolve the output directory. Default: a `generated/` subdir of
-            //    the first source dir (keeps generated output beside the schema).
-            const outputDir = options.output
-                ? path.resolve(options.output)
-                : path.join(path.dirname(inputs[0].tomlPath), "generated");
-            // 4. Run codegen (or --check) with the selected emitter. Both the TS
-            //    and Swift generators return the same WriteOrCheckResult shape, so
-            //    the reporting below is emitter-agnostic. Fork 1 = A: only the
-            //    emitter differs; both read the same synced TOMLs and the same
-            //    drift-guarded schema descriptor.
-            const codegenResult = lang === "swift"
-                ? await generateWorkflowSwiftTypes({
-                    inputs,
-                    outputDir,
-                    check: !!options.check,
-                    singleWorkflow: !!workflowKey,
-                })
-                : await generateWorkflowTypes({
-                    inputs,
-                    outputDir,
-                    check: !!options.check,
-                    singleWorkflow: !!workflowKey,
-                });
-            if (options.check) {
-                if (codegenResult.mismatches.length > 0) {
-                    if (options.json) {
-                        json({ ok: false, mismatches: codegenResult.mismatches });
-                    }
-                    else {
-                        error(`Check failed: ${codegenResult.mismatches.length} file(s) out of date.`);
-                        for (const m of codegenResult.mismatches) {
-                            error(`  ${m.reason}: ${path.relative(process.cwd(), m.filePath)}`);
-                        }
-                        // Echo back the options that decide WHERE and WHAT was
-                        // checked. Suggesting a bare `workflows codegen` after a
-                        // `--check -o <dir>` sent people to regenerate into the
-                        // default <config-dir>/workflows/generated/ instead of the
-                        // directory that is actually out of date, so the files stayed
-                        // stale and the next check failed the same way.
-                        const regenerate = ["primitive workflows codegen"];
-                        if (workflowKey)
-                            regenerate.push(workflowKey);
-                        if (lang === "swift")
-                            regenerate.push("--lang swift");
-                        if (options.output)
-                            regenerate.push(`-o ${options.output}`);
-                        info(`Run \`${regenerate.join(" ")}\` to regenerate.`);
-                    }
-                    process.exit(1);
-                }
-                if (options.json) {
-                    json({ ok: true, checked: codegenResult.writtenFiles.length });
-                }
-                else {
-                    success(`Check passed: ${codegenResult.writtenFiles.length} file(s) up to date.`);
-                }
-                return;
-            }
-            if (options.json) {
-                json({
-                    written: codegenResult.writtenFiles,
-                    deleted: codegenResult.deletedFiles,
-                });
-                return;
-            }
-            success(`Generated ${codegenResult.writtenFiles.length} file(s)` +
-                (codegenResult.deletedFiles.length > 0
-                    ? `, deleted ${codegenResult.deletedFiles.length} stale file(s).`
-                    : "."));
-            for (const f of codegenResult.writtenFiles) {
-                keyValue("  wrote", path.relative(process.cwd(), f));
-            }
-            for (const f of codegenResult.deletedFiles) {
-                keyValue("  deleted", path.relative(process.cwd(), f));
-            }
-        }
-        catch (err) {
-            error(err.message);
-            process.exit(1);
-        }
-    });
-}
-function formatFileSize(bytes) {
-    if (bytes < 1024)
-        return `${bytes} B`;
-    if (bytes < 1024 * 1024)
-        return `${(bytes / 1024).toFixed(1)} KB`;
-    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
 //# sourceMappingURL=workflows.js.map