primitive-admin 1.2.0-alpha.1 → 1.2.0-alpha.10

package/dist/src/lib/refresh-admin-credentials.js

@@ -53,6 +53,19 @@ export class RefreshError extends Error {
 export const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
 /** Any other refused refresh. */
 export const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
+/**
+ * The login was made before scoped sessions: the server no longer refreshes
+ * an unscoped CLI session, and a new login holds the default scope.
+ */
+export const SESSION_UNSCOPED_MESSAGE = "Your login predates scoped sessions and can no longer be refreshed. Run 'primitive login' to sign in again.";
+/** What to tell the developer about a refresh the server refused with `code`. */
+export function refreshRefusalMessage(code) {
+    if (code === "SESSION_UNSCOPED")
+        return SESSION_UNSCOPED_MESSAGE;
+    if (code === "SESSION_REVOKED")
+        return SESSION_REVOKED_MESSAGE;
+    return REFRESH_EXPIRED_MESSAGE;
+}
 /**
  * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
  * `Credentials` object — the caller is responsible for persistence via
@@ -95,7 +108,8 @@ export async function refreshAdminCredentials(credentials) {
     }
     if (!response.ok) {
         // #3885: a refresh of a revoked session answers 401 with code
-        // SESSION_REVOKED; say so, rather than calling the token expired.
+        // SESSION_REVOKED; say so, rather than calling the token expired. #3891:
+        // an unscoped login answers SESSION_UNSCOPED.
         let code;
         try {
             const body = (await response.json());
@@ -104,9 +118,7 @@ export async function refreshAdminCredentials(credentials) {
         catch {
             // Not JSON: no code to report.
         }
-        throw new RefreshError(code === "SESSION_REVOKED"
-            ? SESSION_REVOKED_MESSAGE
-            : REFRESH_EXPIRED_MESSAGE, "unauthorized", response.status, undefined, code);
+        throw new RefreshError(refreshRefusalMessage(code), "unauthorized", response.status, undefined, code);
     }
     const data = (await response.json());
     const accessToken = data?.accessToken || data?.jwt;

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAEA;IANT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;IACtB,8DAA8D;IACvD,IAAa;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kDAAkD,CAAC;AAErD,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+CAA+C,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;YAC5C,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,uBAAuB,EAC3B,cAAc,EACd,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAEA;IANT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;IACtB,8DAA8D;IACvD,IAAa;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kDAAkD,CAAC;AAErD,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+CAA+C,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,6GAA6G,CAAC;AAEhH,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,wBAAwB,CAAC;IACjE,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,uBAAuB,CAAC;IAC/D,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,8DAA8D;QAC9D,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;YAC5C,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,qBAAqB,CAAC,IAAI,CAAC,EAC3B,cAAc,EACd,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/root-import-decision.d.ts

@@ -0,0 +1,65 @@
+/**
+ * What `documents import` does with a root document export, by format
+ * (#4195).
+ *
+ * A legacy root export is one Yjs state, MERGED into the target user's root.
+ * A large-document root export (format 2) cannot go anywhere: the platform no
+ * longer serves the format, so it is refused, naming the way across — its
+ * snapshot row chunks, loaded into a record-log document. A target root that
+ * is itself a large document is refused the same way, and so is one that is
+ * a record-log document (format 3, #4546): a Yjs state has nowhere to merge
+ * in a document made of rows. When the target user
+ * has no root yet, the app's `rootDocumentFormat` setting predicts the format
+ * the mint will produce; the root the mint actually returns is decided again
+ * against that prediction.
+ *
+ * Pure, so every branch is pinned without a server.
+ */
+/**
+ * A root document's storage format: 1 (legacy), 2 (large document, no longer
+ * served) or 3 (record-log document). Only a legacy root takes a merge.
+ */
+export type RootDocumentFormat = 1 | 2 | 3;
+/** The facts a root import is decided from. */
+export interface RootImportDecisionInput {
+    /** The format `metadata.json` records for the export. */
+    exportFormat: RootDocumentFormat;
+    /** The target user's root's format, or null when they have none yet. */
+    existingRootFormat: RootDocumentFormat | null;
+    /** The target app's `rootDocumentFormat` setting, as the server reports it. */
+    appSetting: unknown;
+    /** Whether `--overwrite` was given (or the root was minted by this run). */
+    overwrite: boolean;
+    /**
+     * The format the plan predicted for a root this run minted. Given only when
+     * re-deciding against the root the mint returned.
+     */
+    predictedFormat?: RootDocumentFormat;
+    /** The target user, as the operator named them, for the reasons. */
+    owner?: string;
+    /** The target user's root document id, when they have one, for the reasons. */
+    targetRootDocId?: string;
+}
+/** What to do with a root export. */
+export type RootImportDecision = {
+    outcome: "merge";
+    targetFormat: RootDocumentFormat;
+} | {
+    outcome: "skip" | "refuse";
+    targetFormat: RootDocumentFormat;
+    reason: string;
+};
+/** Read a format off the wire: 2 or 3 as itself, anything else legacy. */
+export declare function rootDocumentFormatOf(value: unknown): RootDocumentFormat;
+/**
+ * Decide what a root export does in the target app.
+ *
+ * - The export is a large document: `refuse`, naming the migration.
+ * - The target root (existing, predicted from the app's setting, or minted)
+ *   is a large document: `refuse`.
+ * - A `predictedFormat` that the minted root contradicts: `refuse` — the
+ *   setting changed while the import ran.
+ * - Otherwise `merge` — into an existing root only with `overwrite`,
+ *   otherwise `skip`.
+ */
+export declare function decideRootImport(input: RootImportDecisionInput): RootImportDecision;

package/dist/src/lib/root-import-decision.js

@@ -0,0 +1,109 @@
+/**
+ * What `documents import` does with a root document export, by format
+ * (#4195).
+ *
+ * A legacy root export is one Yjs state, MERGED into the target user's root.
+ * A large-document root export (format 2) cannot go anywhere: the platform no
+ * longer serves the format, so it is refused, naming the way across — its
+ * snapshot row chunks, loaded into a record-log document. A target root that
+ * is itself a large document is refused the same way, and so is one that is
+ * a record-log document (format 3, #4546): a Yjs state has nowhere to merge
+ * in a document made of rows. When the target user
+ * has no root yet, the app's `rootDocumentFormat` setting predicts the format
+ * the mint will produce; the root the mint actually returns is decided again
+ * against that prediction.
+ *
+ * Pure, so every branch is pinned without a server.
+ */
+/** Read a format off the wire: 2 or 3 as itself, anything else legacy. */
+export function rootDocumentFormatOf(value) {
+    const format = Number(value);
+    return format === 2 || format === 3 ? format : 1;
+}
+/** Why a large document goes nowhere, and the way across for an export. */
+const NO_LONGER_SERVED = "a large document (documentFormat 2), which the platform no longer serves";
+/** Why a record-log root cannot take a legacy export (#4546). */
+const RECORD_LOG_ROOT = "a record-log document (documentFormat 3), which a legacy root export " +
+    "cannot be merged into";
+const MIGRATION = "Create a record-log document and run `primitive documents ingest " +
+    "<document-id> --input <export-dir>` to load its row chunks. Nothing was imported " +
+    "for it.";
+/**
+ * Decide what a root export does in the target app.
+ *
+ * - The export is a large document: `refuse`, naming the migration.
+ * - The target root (existing, predicted from the app's setting, or minted)
+ *   is a large document: `refuse`.
+ * - A `predictedFormat` that the minted root contradicts: `refuse` — the
+ *   setting changed while the import ran.
+ * - Otherwise `merge` — into an existing root only with `overwrite`,
+ *   otherwise `skip`.
+ */
+export function decideRootImport(input) {
+    const whose = (input.owner
+        ? `the root document of ${input.owner}`
+        : "the target user's root document") +
+        (input.targetRootDocId ? ` (${input.targetRootDocId})` : "");
+    const target = input.existingRootFormat ?? rootDocumentFormatOf(input.appSetting);
+    if (input.exportFormat === 2) {
+        return {
+            outcome: "refuse",
+            targetFormat: target,
+            reason: `it is a root document exported as ${NO_LONGER_SERVED}. ${MIGRATION}`,
+        };
+    }
+    if (input.existingRootFormat === null) {
+        if (target === 2) {
+            return {
+                outcome: "refuse",
+                targetFormat: target,
+                reason: `this app's rootDocumentFormat would mint ${whose} as ` +
+                    `${NO_LONGER_SERVED}. Nothing was imported for it.`,
+            };
+        }
+        if (target === 3) {
+            return {
+                outcome: "refuse",
+                targetFormat: target,
+                reason: `this app's rootDocumentFormat would mint ${whose} as ` +
+                    `${RECORD_LOG_ROOT}. Nothing was imported for it.`,
+            };
+        }
+        return { outcome: "merge", targetFormat: target };
+    }
+    if (input.predictedFormat !== undefined &&
+        input.predictedFormat !== input.existingRootFormat) {
+        return {
+            outcome: "refuse",
+            targetFormat: input.existingRootFormat,
+            reason: `${whose} came back from the server as a different format than the ` +
+                `app's rootDocumentFormat predicted — the setting changed while this ` +
+                `import ran, or a sign-in minted the root first. Nothing was imported ` +
+                `for it.`,
+        };
+    }
+    if (input.existingRootFormat === 2) {
+        return {
+            outcome: "refuse",
+            targetFormat: 2,
+            reason: `${whose} is ${NO_LONGER_SERVED}. Nothing was imported for it.`,
+        };
+    }
+    if (input.existingRootFormat === 3) {
+        return {
+            outcome: "refuse",
+            targetFormat: 3,
+            reason: `${whose} is ${RECORD_LOG_ROOT}. Nothing was imported for it.`,
+        };
+    }
+    if (!input.overwrite) {
+        return {
+            outcome: "skip",
+            targetFormat: 1,
+            reason: `${whose} already exists; use --overwrite to merge the exported ` +
+                `content into it`,
+        };
+    }
+    return { outcome: "merge", targetFormat: 1 };
+}
+//# sourceMappingURL=root-import-decision.js.map

package/dist/src/lib/root-import-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-import-decision.js","sourceRoot":"","sources":["../../../src/lib/root-import-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAsCH,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,2EAA2E;AAC3E,MAAM,gBAAgB,GACpB,0EAA0E,CAAC;AAC7E,iEAAiE;AACjE,MAAM,eAAe,GACnB,uEAAuE;IACvE,uBAAuB,CAAC;AAC1B,MAAM,SAAS,GACb,mEAAmE;IACnE,mFAAmF;IACnF,SAAS,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8B;IAE9B,MAAM,KAAK,GACT,CAAC,KAAK,CAAC,KAAK;QACV,CAAC,CAAC,wBAAwB,KAAK,CAAC,KAAK,EAAE;QACvC,CAAC,CAAC,iCAAiC,CAAC;QACtC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GACV,KAAK,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,MAAM;YACpB,MAAM,EAAE,qCAAqC,gBAAgB,KAAK,SAAS,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,YAAY,EAAE,MAAM;gBACpB,MAAM,EACJ,4CAA4C,KAAK,MAAM;oBACvD,GAAG,gBAAgB,gCAAgC;aACtD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,YAAY,EAAE,MAAM;gBACpB,MAAM,EACJ,4CAA4C,KAAK,MAAM;oBACvD,GAAG,eAAe,gCAAgC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,IACE,KAAK,CAAC,eAAe,KAAK,SAAS;QACnC,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,kBAAkB,EAClD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,KAAK,CAAC,kBAAkB;YACtC,MAAM,EACJ,GAAG,KAAK,4DAA4D;gBACpE,sEAAsE;gBACtE,uEAAuE;gBACvE,SAAS;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,KAAK,OAAO,gBAAgB,gCAAgC;SACxE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,KAAK,OAAO,eAAe,gCAAgC;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,CAAC;YACf,MAAM,EACJ,GAAG,KAAK,yDAAyD;gBACjE,iBAAiB;SACpB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/src/lib/run-status.d.ts

@@ -8,7 +8,7 @@
  * Those spellings no longer reach a client.
  *
  * #2636 — the vocabulary itself is no longer copied by hand: it is GENERATED
- * from the server's `src/workflows/run-status.ts` into
+ * from the server's `src/function-runs/run-status.ts` into
  * `run-status.generated.ts` (`pnpm gen:run-status`) and re-exported here, so a
  * future status is a one-site edit plus regeneration rather than four
  * hand-edits that a lagging copy turns into a hung poll loop. This module stays

package/dist/src/lib/run-status.generated.d.ts

@@ -2,7 +2,7 @@
  * GENERATED FILE — do not edit by hand.
  *
  * The canonical workflow-run status vocabulary, as the CLI sees it.
- * Generated from the server's `src/workflows/run-status.ts` by
+ * Generated from the server's `src/function-runs/run-status.ts` by
  * `scripts/gen-run-status-mirrors.mjs` (`pnpm gen:run-status`), because
  * the CLI is a separately built package and cannot import worker
  * source. A stale copy is worse than a missing feature: a poll loop whose
@@ -14,7 +14,7 @@
  * colours, help text) live in `cli/src/lib/run-status.ts`, which re-exports
  * everything below.
  */
-export declare const RUN_STATUSES: readonly ["queued", "running", "apply_pending", "apply_claimed", "completed", "failed", "terminated", "missing", "skipped"];
+export declare const RUN_STATUSES: readonly ["queued", "running", "apply_pending", "apply_claimed", "completed", "failed", "terminated", "missing", "skipped", "denied"];
 export type RunStatus = (typeof RUN_STATUSES)[number];
 /** Comma-separated list for help text and error messages. */
 export declare const RUN_STATUS_LIST: string;

package/dist/src/lib/run-status.generated.js

@@ -2,7 +2,7 @@
  * GENERATED FILE — do not edit by hand.
  *
  * The canonical workflow-run status vocabulary, as the CLI sees it.
- * Generated from the server's `src/workflows/run-status.ts` by
+ * Generated from the server's `src/function-runs/run-status.ts` by
  * `scripts/gen-run-status-mirrors.mjs` (`pnpm gen:run-status`), because
  * the CLI is a separately built package and cannot import worker
  * source. A stale copy is worse than a missing feature: a poll loop whose
@@ -24,6 +24,7 @@ export const RUN_STATUSES = [
     "terminated",
     "missing",
     "skipped",
+    "denied",
 ];
 /** Comma-separated list for help text and error messages. */
 export const RUN_STATUS_LIST = RUN_STATUSES.join(", ");
@@ -33,6 +34,7 @@ export const TERMINAL_RUN_STATUSES = new Set([
     "failed",
     "terminated",
     "skipped",
+    "denied",
 ]);
 /**
  * Apply-flow states: the run finished executing but is parked waiting for a

package/dist/src/lib/run-status.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-status.generated.js","sourceRoot":"","sources":["../../../src/lib/run-status.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ;IACR,SAAS;IACT,eAAe;IACf,eAAe;IACf,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,SAAS;CACD,CAAC;AAIX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEvD,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACxE,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAS;IACrE,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAS;IACzE,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS;IACvE,GAAG,qBAAqB;IACxB,GAAG,kBAAkB;IACrB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"run-status.generated.js","sourceRoot":"","sources":["../../../src/lib/run-status.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ;IACR,SAAS;IACT,eAAe;IACf,eAAe;IACf,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;CACA,CAAC;AAIX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEvD,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAS;IACxE,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAS;IACrE,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAS;IACzE,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS;IACvE,GAAG,qBAAqB;IACxB,GAAG,kBAAkB;IACrB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjF,CAAC;AACJ,CAAC"}

package/dist/src/lib/run-status.js

@@ -8,7 +8,7 @@
  * Those spellings no longer reach a client.
  *
  * #2636 — the vocabulary itself is no longer copied by hand: it is GENERATED
- * from the server's `src/workflows/run-status.ts` into
+ * from the server's `src/function-runs/run-status.ts` into
  * `run-status.generated.ts` (`pnpm gen:run-status`) and re-exported here, so a
  * future status is a one-site edit plus regeneration rather than four
  * hand-edits that a lagging copy turns into a hung poll loop. This module stays

package/dist/src/lib/schema-codegen/generated-schema-descriptor.d.ts

@@ -0,0 +1,129 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Vendored byte-for-byte from the canonical server module
+ * `src/function-runs/schema-descriptor.ts` — the SAME interpretation the server
+ * validator (`validateValue`) enforces. The CLI cannot import server `src/`
+ * at runtime, so the CLI's schema type converters import this committed
+ * copy instead.
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-schema-descriptor.mjs   (runs at CLI prebuild)
+ *
+ * A CI freshness guard
+ * (`cli/scripts/gen-schema-descriptor.mjs --check`, also asserted by
+ * `cli/tests/unit/schema-codegen-descriptor-drift-guard.test.ts`) fails if
+ * this committed copy does not match the source — see issue #1442 / #998.
+ */
+/**
+ * Canonical interpretation of the JSON-Schema subset the workflow platform
+ * supports (issue #1442).
+ *
+ * The server validator (`validateValue` in `schema-validation.ts`) and the CLI
+ * schema type converter (`schema-codegen/schemaToTs.ts`) must agree EXACTLY
+ * on how an `inputSchema`/`outputSchema` is interpreted —
+ * otherwise a generated `<Key>Input` type promises a shape the runtime does not
+ * enforce (or rejects a value the runtime accepts). Previously the converter
+ * re-derived those interpretation decisions by hand, which drifts from the
+ * validator over time.
+ *
+ * This module is the single source of that interpretation. Both consumers read
+ * from `describeSchema` + `isType`:
+ *
+ *   - the type gate is checked before `enum` (a value failing `type` is
+ *     rejected before `enum` is consulted);
+ *   - a type UNION (`type: ["string","null"]`) never descends into
+ *     `properties`/`items` — only the exact string types `"object"`/`"array"`
+ *     do;
+ *   - `integer` means `Number.isInteger`;
+ *   - `additionalProperties` only closes an object; it is not a nested schema.
+ *
+ * It is deliberately dependency-free (no imports) so the CLI can vendor a
+ * byte-for-byte copy as a committed artifact via
+ * `cli/scripts/gen-workflow-schema-descriptor.mjs` (the #998 gen-allowlist
+ * pattern). A drift-guard test runs that generator in `--check` mode, so a
+ * change here that isn't regenerated into the CLI artifact fails CI. The CLI
+ * never imports server `src/` at runtime — only the build-time generator reads
+ * this file.
+ */
+/** Does a value satisfy a JSON-schema `type` name? `integer` = `Number.isInteger`. */
+export declare function isType(value: any, type: string): boolean;
+/**
+ * The interpretation of a single schema node, normalized so both the validator
+ * and the type converter can consume it without re-reading raw schema fields.
+ */
+export interface SchemaDescriptor {
+    /** True when `schema.type` is an array (a type union). */
+    isUnion: boolean;
+    /** `schema.type` when it is a single string; null for a union or absent type. */
+    singularType: string | null;
+    /**
+     * The declared type(s) normalized to an array. An array `type` is kept as-is;
+     * a single string becomes a one-element array; an absent/falsy type is `[]`
+     * (no type gate). Matches the validator's `allowedTypes` normalization.
+     */
+    types: string[];
+    /** The `enum` array when present, else null. */
+    enumValues: any[] | null;
+    /**
+     * Object descent info — non-null ONLY when `schema.type` is exactly the
+     * string `"object"` AND `properties` is a declared object (matching the
+     * validator's `schema.type === "object" && schema.properties` descent gate).
+     * A type UNION containing `"object"` never descends.
+     */
+    object: {
+        /** The raw `properties` map (child schemas). May be empty `{}`. */
+        properties: Record<string, any>;
+        /** The raw `required` list (unfiltered, as the validator reads it). */
+        required: any[];
+        /** True when `additionalProperties === false` (a closed object). */
+        additionalPropertiesClosed: boolean;
+    } | null;
+    /**
+     * Array descent info — non-null ONLY when `schema.type` is exactly the string
+     * `"array"` AND `items` is present (matching the validator's
+     * `schema.type === "array" && schema.items` descent gate).
+     */
+    array: {
+        /** The raw `items` schema (may be a tuple array the validator no-ops on). */
+        items: any;
+    } | null;
+    /**
+     * Discriminated-union (tagged-union) interpretation of a `oneOf` node (#1511).
+     *
+     * Populated ONLY when the node carries a `oneOf` (or `anyOf`) array whose
+     * members are ALL `type: "object"` — a clearly-intended tagged union. A
+     * `oneOf`/`anyOf` with any non-object member is NOT a tagged union: `oneOf`
+     * stays `null` here and is ignored (renders `unknown` / validates
+     * permissively) exactly as before, preserving backward compatibility.
+     *
+     *   - `kind: "valid"` — a clean discriminated union: ≥2 object members sharing
+     *     exactly one discriminator property declared as a single-literal `enum`
+     *     in every member with distinct literals across members. The validator
+     *     branch-selects by `discriminant` and validates only the matched member;
+     *     the type converter renders the `|`-union of member object types.
+     *   - `kind: "invalid"` — an all-object-member union that LOOKS like a tagged
+     *     union but is defective (fewer than 2 members, no/ambiguous discriminator,
+     *     or `anyOf` — unsupported in v1). `reason` is the codegen error message.
+     *     The runtime validator ignores this (stays permissive); the codegen
+     *     converter throws `reason` (Fork 3 = strict, resolved by the maintainer).
+     */
+    oneOf: {
+        kind: "valid";
+        /** The auto-detected discriminator property name. */
+        discriminant: string;
+        /** One entry per member: its discriminant literal + raw member schema. */
+        members: Array<{
+            discriminantValue: any;
+            schema: any;
+        }>;
+    } | {
+        kind: "invalid";
+        reason: string;
+    } | null;
+}
+/**
+ * Interpret a parsed schema node. A non-object schema (null, array, scalar)
+ * enforces nothing → the empty descriptor.
+ */
+export declare function describeSchema(schema: any): SchemaDescriptor;