primitive-admin 1.2.0-alpha.7 → 1.2.0-alpha.9

package/dist/src/lib/scope-request.js

@@ -2,11 +2,12 @@
  * The scoped-login request `primitive login --scope …` and
  * `primitive token --scope …` send to `GET /admin/api/oauth-cli` (#3889).
  *
- * One builder serves both commands, so they agree on every rule: a list
- * holding `admin` is a step-up and names the current session as its parent;
- * a step-up is pinned to the environment's app unless `--app` says otherwise
- * (`--app none` asks for an unpinned one); a printed token carries its
- * lifetime. `primitive auth sessions create` builds its CI-session request
+ * One builder serves both commands, so they agree on every rule: `--step-up`
+ * asks for a step-up holding exactly `--scope` (#4564), and a list holding
+ * `admin` is one with or without the flag; a step-up names the current
+ * session as its parent and is pinned to the environment's app unless
+ * `--app` says otherwise (`--app none` asks for an unpinned one); a printed
+ * token carries its lifetime. `primitive auth sessions create` builds its CI-session request
  * here too (#3890). Every mistake is a usage error before any browser opens.
  *
  * Pure: the flags, the environment's app id and the stored session's id are
@@ -54,6 +55,9 @@ export function buildScopeRequest(input) {
     const { command } = input;
     if (command === "sessions")
         return buildCiSessionRequest(input);
+    if (input.stepUp && input.scope === undefined) {
+        return usage(`--step-up needs the scopes the command needs: primitive ${command} --step-up --scope <list> [--app <ids>]`);
+    }
     if (input.scope === undefined) {
         if (input.app !== undefined)
             return usage(`--app needs --scope: primitive ${command} --scope <list> --app <ids>`);
@@ -75,9 +79,9 @@ export function buildScopeRequest(input) {
     if (unknown.length > 0) {
         return usage(`Unknown scope ${unknown.join(", ")}. Scopes are ${ADMIN_SCOPES.join(", ")}.`);
     }
-    const stepUp = scopes.includes("admin");
+    const stepUp = input.stepUp === true || scopes.includes("admin");
     if (stepUp && !input.parentSid) {
-        return usage("An admin step-up builds on your current login. Run `primitive login` first.");
+        return usage("A step-up builds on your current login. Run `primitive login` first.");
     }
     let apps;
     if (input.app === "none")
@@ -92,7 +96,12 @@ export function buildScopeRequest(input) {
     }
     else
         apps = stepUp && input.envAppId ? [input.envAppId] : [];
-    const query = { scope: scopes.join(",") };
+    // An explicit step-up says so; one holding `admin` is inferred by the
+    // server, as it is from older CLIs.
+    const query = {
+        ...(input.stepUp ? { kind: "step-up" } : {}),
+        scope: scopes.join(","),
+    };
     if (apps.length > 0)
         query.apps = apps.join(",");
     if (stepUp)

package/dist/src/lib/scope-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-request.js","sourceRoot":"","sources":["../../../src/lib/scope-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAE3F,mCAAmC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,KAAK,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,KAAK,CAAC;AAElD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,YAAY,GAA2B;IAC3C,CAAC,EAAE,EAAE;IACL,GAAG,EAAE,EAAE;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,CAAC,GAAG,KAAK;IACZ,EAAE,EAAE,EAAE,GAAG,KAAK;IACd,CAAC,EAAE,GAAG,GAAG,KAAK;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AA8BD,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,kCAAkC,OAAO,6BAA6B,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CACV,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,+DAA+D,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM;QAAE,IAAI,GAAG,EAAE,CAAC;SAC/B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACjC,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;;QAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,MAAM,KAAK,GAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAU,CAAC;IAC5C,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;IAEvB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACrE,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,oCAAoC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACjB,OAAO,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,6CAA6C,KAAK,CAAC,GAAG,YAAY;oBACpE,CAAC,CAAC,+CAA+C,KAAK,CAAC,GAAG,YAAY,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,YAAY,GAChB,qFAAqF,CAAC;AAExF;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAwB;IACrD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,qBAAqB,0BAA0B,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,GAAG,0BAA0B,CAAC;IACzC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,yCAAyC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,4CAA4C,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9B,OAAO,KAAK,CACV,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACpB,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;SACrB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scope-request.js","sourceRoot":"","sources":["../../../src/lib/scope-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAE3F,mCAAmC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,KAAK,CAAC;AAErD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,KAAK,CAAC;AAElD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,YAAY,GAA2B;IAC3C,CAAC,EAAE,EAAE;IACL,GAAG,EAAE,EAAE;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,CAAC,GAAG,KAAK;IACZ,EAAE,EAAE,EAAE,GAAG,KAAK;IACd,CAAC,EAAE,GAAG,GAAG,KAAK;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAgCD,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CACV,2DAA2D,OAAO,yCAAyC,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,kCAAkC,OAAO,6BAA6B,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CACV,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,+DAA+D,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM;QAAE,IAAI,GAAG,EAAE,CAAC;SAC/B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACjC,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;;QAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,sEAAsE;IACtE,oCAAoC;IACpC,MAAM,KAAK,GAA2B;QACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAU,CAAC;IAC5C,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;IAEvB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACrE,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,oCAAoC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACjB,OAAO,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,6CAA6C,KAAK,CAAC,GAAG,YAAY;oBACpE,CAAC,CAAC,+CAA+C,KAAK,CAAC,GAAG,YAAY,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,YAAY,GAChB,qFAAqF,CAAC;AAExF;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAwB;IACrD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,qBAAqB,0BAA0B,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,wCAAwC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,GAAG,0BAA0B,CAAC;IACzC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,yCAAyC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,4CAA4C,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9B,OAAO,KAAK,CACV,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACpB,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/lib/swift-codegen/agentGenerator.d.ts

@@ -8,9 +8,13 @@
  *   - `<Key>Tool<Name>Input` / `<Key>Tool<Name>Output` for every CLIENT tool
  *     (a server tool's schemas are its function's, typed in that function's
  *     own file);
- *   - `<Key>Event<Name>` for every event kind; and
+ *   - `<Key>Presentation<Name>` for every presentation (`runs =
+ *     "presentation"`, #4549), from its `inputSchema`;
+ *   - `<Key>Event<Name>` for every event kind;
+ *   - `<Key>AgentPresentation`, an enum with one case per presentation that
+ *     decodes the client's `AgentPresentation` by name; and
  *   - `<Key>Agent`, a namespace enum with the key a session is created with
- *     and the declared client-tool and event names.
+ *     and the declared client-tool, presentation and event names.
  *
  * ── Nothing about the agent is re-derived here ───────────────────────────
  *

package/dist/src/lib/swift-codegen/agentGenerator.js

@@ -8,9 +8,13 @@
  *   - `<Key>Tool<Name>Input` / `<Key>Tool<Name>Output` for every CLIENT tool
  *     (a server tool's schemas are its function's, typed in that function's
  *     own file);
- *   - `<Key>Event<Name>` for every event kind; and
+ *   - `<Key>Presentation<Name>` for every presentation (`runs =
+ *     "presentation"`, #4549), from its `inputSchema`;
+ *   - `<Key>Event<Name>` for every event kind;
+ *   - `<Key>AgentPresentation`, an enum with one case per presentation that
+ *     decodes the client's `AgentPresentation` by name; and
  *   - `<Key>Agent`, a namespace enum with the key a session is created with
- *     and the declared client-tool and event names.
+ *     and the declared client-tool, presentation and event names.
  *
  * ── Nothing about the agent is re-derived here ───────────────────────────
  *
@@ -29,6 +33,7 @@ import { fingerprintToml } from "../db-codegen/dbFingerprint.js";
 import { describePromptSchema, } from "../prompt-schema-codegen.js";
 import { renderSwiftRootType, SwiftCodegenError } from "./schemaToSwift.js";
 import { swiftKeyLiteral } from "./generator.js";
+import { enumCaseNames } from "./swiftNaming.js";
 import { AGENT_SWIFT_BANNER_PREFIX } from "./banners.js";
 import { parseTopLevelSwiftSymbols } from "./siblingSymbols.js";
 export { AGENT_SWIFT_BANNER_PREFIX };
@@ -39,6 +44,47 @@ const INDENT = "    ";
 function nameList(names) {
     return `[${names.map(swiftKeyLiteral).join(", ")}]`;
 }
+/**
+ * `<Key>AgentPresentation`: one case per presentation carrying its typed
+ * input, and `init?(_:)`, which decodes a presentation the session view
+ * answers by its name — `nil` for another name or an input that does not
+ * decode. An agent with no presentation gets the enum with no case.
+ *
+ * The decode is a `do`/`catch`, not `try?`: an input schema that admits
+ * `null` types the case as an optional, and a decoded `nil` is a presentation
+ * the model sent, not a failure (CSO-4549-001).
+ */
+function presentationEnum(typeBaseName, key, presentations) {
+    // `_` is a legal agent name and `enumCaseIdentifier` keeps it, but a bare
+    // `_` is not a legal case name or member reference (CSO-4549-002).
+    const cases = enumCaseNames(presentations.map((presentation) => presentation.name)).map((named, index) => ({
+        ...named,
+        name: named.name === "_" ? "`_`" : named.name,
+        typeName: presentations[index].typeName,
+    }));
+    const lines = [
+        `/// A presentation the \`${key}\` agent hands the client with its answer,`,
+        `/// typed by name: decode one of \`view.presentations(of:names:)\` with \`init?(_:)\`.`,
+        `public enum ${typeBaseName}AgentPresentation: Equatable, Sendable {`,
+    ];
+    for (const { name, typeName } of cases)
+        lines.push(`${INDENT}case ${name}(${typeName})`);
+    if (cases.length > 0)
+        lines.push("");
+    lines.push(`${INDENT}/// The presentation's typed input; \`nil\` for a name this agent does not`, `${INDENT}/// declare, or an input its type does not decode.`, `${INDENT}public init?(_ presentation: AgentPresentation) {`);
+    if (cases.length === 0) {
+        lines.push(`${INDENT}${INDENT}return nil`);
+    }
+    else {
+        lines.push(`${INDENT}${INDENT}switch presentation.name {`);
+        for (const { name, raw, typeName } of cases) {
+            lines.push(`${INDENT}${INDENT}case ${swiftKeyLiteral(raw)}:`, `${INDENT}${INDENT}${INDENT}do { self = .${name}(try presentation.decode(${typeName}.self)) } catch { return nil }`);
+        }
+        lines.push(`${INDENT}${INDENT}default:`, `${INDENT}${INDENT}${INDENT}return nil`, `${INDENT}${INDENT}}`);
+    }
+    lines.push(`${INDENT}}`, `}`);
+    return lines.join("\n");
+}
 /**
  * Render the full `<key>.agent.generated.swift` content for one agent prompt.
  * Pure — exported so tests can assert on the string directly. Throws a
@@ -66,6 +112,10 @@ export function renderAgentSwiftFile(source) {
                 decl: renderSwiftRootType(tool.output.typeName, tool.output.schema, { sourceFile }),
             },
         ]),
+        ...agent.presentations.map((presentation) => ({
+            path: `tools.${presentation.name}.inputSchema`,
+            decl: renderSwiftRootType(presentation.typeName, presentation.schema, { sourceFile }),
+        })),
         ...agent.events.map((event) => ({
             path: `events.${event.name}.schema`,
             decl: renderSwiftRootType(event.typeName, event.schema, { sourceFile }),
@@ -88,12 +138,14 @@ export function renderAgentSwiftFile(source) {
         }
     }
     const decls = rendered.map((entry) => entry.decl);
+    const presentations = presentationEnum(prompt.typeBaseName, prompt.key, agent.presentations);
     const namespace = [
         `/// The \`${prompt.key}\` agent: the key a session is created with, and the`,
-        `/// client tools and event kinds it declares.`,
+        `/// client tools, presentations and event kinds it declares.`,
         `public enum ${prompt.typeBaseName}Agent {`,
         `${INDENT}public static let key = ${swiftKeyLiteral(prompt.key)}`,
         `${INDENT}public static let clientToolNames: [String] = ${nameList(agent.clientTools.map((tool) => tool.name))}`,
+        `${INDENT}public static let presentationNames: [String] = ${nameList(agent.presentations.map((presentation) => presentation.name))}`,
         `${INDENT}public static let eventNames: [String] = ${nameList(agent.events.map((event) => event.name))}`,
         `}`,
     ].join("\n");
@@ -105,7 +157,7 @@ export function renderAgentSwiftFile(source) {
     // `JsBaoClient` for `JSONValue`, which an open schema renders to — the
     // import the function invokers carry too.
     const imports = ["import Foundation", "import JsBaoClient"].join("\n");
-    const content = [banner, imports, ...decls, namespace].join("\n\n") + "\n";
+    const content = [banner, imports, ...decls, presentations, namespace].join("\n\n") + "\n";
     return {
         key: prompt.key,
         content,

package/dist/src/lib/swift-codegen/agentGenerator.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentGenerator.js","sourceRoot":"","sources":["../../../../src/lib/swift-codegen/agentGenerator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,yEAAyE;AACzE,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAK7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,MAAM,CAAC,SAAS,iCAAiC,EACzE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG;QACf;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC;SACtF;QACD,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC;gBACE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,cAAc;gBACtC,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;aAClF;YACD;gBACE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,eAAe;gBACvC,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;aACpF;SACF,CAAC;QACF,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,UAAU,KAAK,CAAC,IAAI,SAAS;YACnC,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;SACxE,CAAC,CAAC;KACJ,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,UAAU,OAAO,KAAK,YAAY,IAAI,UAAU;oBACtE,yBAAyB,MAAM,sCAAsC;oBACrE,mEAAmE,EACrE,EAAE,UAAU,EAAE,CACf,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG;QAChB,aAAa,MAAM,CAAC,GAAG,sDAAsD;QAC7E,+CAA+C;QAC/C,eAAe,MAAM,CAAC,YAAY,SAAS;QAC3C,GAAG,MAAM,2BAA2B,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACjE,GAAG,MAAM,iDAAiD,QAAQ,CAChE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3C,EAAE;QACH,GAAG,MAAM,4CAA4C,QAAQ,CAC3D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACxC,EAAE;QACH,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG;QACb,GAAG,yBAAyB,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB;QACpF,kEAAkE;QAClE,mBAAmB,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,uEAAuE;IACvE,0CAA0C;IAC1C,MAAM,OAAO,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3E,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO;QACP,kEAAkE;QAClE,oEAAoE;QACpE,2BAA2B;QAC3B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agentGenerator.js","sourceRoot":"","sources":["../../../../src/lib/swift-codegen/agentGenerator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,yEAAyE;AACzE,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,YAAoB,EACpB,GAAW,EACX,aAAgE;IAEhE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CACrF,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,GAAG,KAAK;QACR,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;QAC7C,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAE,CAAC,QAAQ;KACzC,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,4BAA4B,GAAG,4CAA4C;QAC3E,wFAAwF;QACxF,eAAe,YAAY,0CAA0C;KACtE,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,4EAA4E,EACrF,GAAG,MAAM,oDAAoD,EAC7D,GAAG,MAAM,mDAAmD,CAC7D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,4BAA4B,CAAC,CAAC;QAC3D,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,GAAG,MAAM,QAAQ,eAAe,CAAC,GAAG,CAAC,GAAG,EACjD,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,gBAAgB,IAAI,4BAA4B,QAAQ,gCAAgC,CACpH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,YAAY,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAK7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,MAAM,CAAC,SAAS,iCAAiC,EACzE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG;QACf;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC;SACtF;QACD,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC;gBACE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,cAAc;gBACtC,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;aAClF;YACD;gBACE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,eAAe;gBACvC,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;aACpF;SACF,CAAC;QACF,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,SAAS,YAAY,CAAC,IAAI,cAAc;YAC9C,IAAI,EAAE,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,UAAU,KAAK,CAAC,IAAI,SAAS;YACnC,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;SACxE,CAAC,CAAC;KACJ,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,UAAU,OAAO,KAAK,YAAY,IAAI,UAAU;oBACtE,yBAAyB,MAAM,sCAAsC;oBACrE,mEAAmE,EACrE,EAAE,UAAU,EAAE,CACf,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElD,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAE7F,MAAM,SAAS,GAAG;QAChB,aAAa,MAAM,CAAC,GAAG,sDAAsD;QAC7E,8DAA8D;QAC9D,eAAe,MAAM,CAAC,YAAY,SAAS;QAC3C,GAAG,MAAM,2BAA2B,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACjE,GAAG,MAAM,iDAAiD,QAAQ,CAChE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3C,EAAE;QACH,GAAG,MAAM,mDAAmD,QAAQ,CAClE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAC7D,EAAE;QACH,GAAG,MAAM,4CAA4C,QAAQ,CAC3D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACxC,EAAE;QACH,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG;QACb,GAAG,yBAAyB,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB;QACpF,kEAAkE;QAClE,mBAAmB,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,uEAAuE;IACvE,0CAA0C;IAC1C,MAAM,OAAO,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO;QACP,kEAAkE;QAClE,oEAAoE;QACpE,2BAA2B;QAC3B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/src/lib/workflow-field-descriptor.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Classification of the `WorkflowDefinition` field surface (issue #2326,
+ * Phase 1 of #1976).
+ *
+ * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
+ * happening — the server grows a `[workflow]`-level config field (`syncCallable`
+ * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
+ * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
+ * `WorkflowDefinition` model must appear in exactly one of the three groups
+ * below. The generated artifact `generated-workflow-model-fields.ts` carries the
+ * model's real field list (parsed from `models.yaml` at build time), and
+ * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
+ *
+ *     synced ∪ structural ∪ internal  ===  the model's fields
+ *
+ * so a new field hard-fails the guard until someone classifies it.
+ *
+ * ── Scope: declarative classification and coverage ONLY ──────────────────
+ * Decision of record (#1976, 2026-07-23): this table records WHICH fields
+ * exist, whether each is synced / structural / internal, and its `[workflow]`
+ * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
+ * stays outside the table. In particular this file deliberately does NOT encode
+ * as boolean knobs:
+ *   - the schema fields' native-TOML-table-vs-JSON-string parsing
+ *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
+ *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
+ *     owns that),
+ *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
+ *     channels, which are attached alongside the steps write and are not
+ *     `[workflow]`-table keys at all.
+ * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
+ * deliberately narrow.
+ *
+ * ── What Phase 1 does and does not do ───────────────────────────────────
+ * Phase 1 (this file) is the guard only. Making the push builder
+ * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
+ * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
+ * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
+ * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
+ */
+/** Value shape of a synced `[workflow]` key. Descriptive; behavior lives in the handlers. */
+export type WorkflowFieldType = "string" | "number" | "boolean" | "string[]" | "json";
+export interface WorkflowFieldDescriptor {
+    /** `WorkflowDefinition` model field name === the server payload key. */
+    field: string;
+    /** Key under the `[workflow]` table in workflow TOML (usually === `field`). */
+    tomlKey: string;
+    /** Value shape, for the Phase 2 handlers and for documentation. */
+    type: WorkflowFieldType;
+}
+/**
+ * The author-facing `[workflow]`-table config fields — the ones a workflow
+ * author manages as code and the CLI must round-trip.
+ */
+export declare const WORKFLOW_FIELD_DESCRIPTOR: readonly WorkflowFieldDescriptor[];
+/**
+ * Fields that ARE author-controlled but do not live in the `[workflow]` table —
+ * they travel through their own structural channel. Kept distinct from
+ * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
+ */
+export declare const WORKFLOW_FIELDS_STRUCTURAL: ReadonlySet<string>;
+/**
+ * Fields the server owns: identity, ownership, timestamps, computed pointers,
+ * and the deprecated draft/revision slot. None of these are ever sent by the
+ * CLI, and none belong in workflow TOML.
+ */
+export declare const WORKFLOW_FIELDS_INTERNAL: ReadonlySet<string>;
+/**
+ * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
+ * Recorded explicitly so "classified" is never mistaken for "implemented".
+ * `lock` was wired by #1972; `templateMissingMarker` was removed from the
+ * platform by #2643, so the set is now empty.
+ */
+export declare const SYNCED_NOT_YET_WIRED: ReadonlySet<string>;
+/** Descriptor `field` names, for coverage/parity checks. */
+export declare const WORKFLOW_SYNCED_FIELDS: ReadonlySet<string>;
+/** Look up a synced field's descriptor by model field name. */
+export declare function getWorkflowFieldDescriptor(field: string): WorkflowFieldDescriptor | undefined;
+/**
+ * Model fields that are classified in NONE of synced / structural / internal —
+ * i.e. a field someone added to `models.yaml` without deciding how the CLI
+ * treats it. Non-empty is a hard failure in the drift guard.
+ */
+export declare function findUnclassifiedWorkflowFields(modelFields: readonly string[]): string[];
+/**
+ * Classifications that no longer correspond to a model field — i.e. a field
+ * removed from `models.yaml` while the CLI still classifies it. Also a hard
+ * failure: a stale classification must not silently pass, or the coverage
+ * claim quietly stops meaning anything.
+ */
+export declare function findStaleWorkflowClassifications(modelFields: readonly string[]): string[];

package/dist/src/lib/workflow-field-descriptor.js

@@ -0,0 +1,153 @@
+/**
+ * Classification of the `WorkflowDefinition` field surface (issue #2326,
+ * Phase 1 of #1976).
+ *
+ * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
+ * happening — the server grows a `[workflow]`-level config field (`syncCallable`
+ * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
+ * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
+ * `WorkflowDefinition` model must appear in exactly one of the three groups
+ * below. The generated artifact `generated-workflow-model-fields.ts` carries the
+ * model's real field list (parsed from `models.yaml` at build time), and
+ * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
+ *
+ *     synced ∪ structural ∪ internal  ===  the model's fields
+ *
+ * so a new field hard-fails the guard until someone classifies it.
+ *
+ * ── Scope: declarative classification and coverage ONLY ──────────────────
+ * Decision of record (#1976, 2026-07-23): this table records WHICH fields
+ * exist, whether each is synced / structural / internal, and its `[workflow]`
+ * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
+ * stays outside the table. In particular this file deliberately does NOT encode
+ * as boolean knobs:
+ *   - the schema fields' native-TOML-table-vs-JSON-string parsing
+ *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
+ *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
+ *     owns that),
+ *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
+ *     channels, which are attached alongside the steps write and are not
+ *     `[workflow]`-table keys at all.
+ * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
+ * deliberately narrow.
+ *
+ * ── What Phase 1 does and does not do ───────────────────────────────────
+ * Phase 1 (this file) is the guard only. Making the push builder
+ * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
+ * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
+ * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
+ * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
+ */
+/**
+ * The author-facing `[workflow]`-table config fields — the ones a workflow
+ * author manages as code and the CLI must round-trip.
+ */
+export const WORKFLOW_FIELD_DESCRIPTOR = [
+    { field: "name", tomlKey: "name", type: "string" },
+    { field: "status", tomlKey: "status", type: "string" },
+    { field: "description", tomlKey: "description", type: "string" },
+    // JSON Schema objects. TOML may present them as an inline table OR as a
+    // JSON string; the push builder owns that parse (not a knob here).
+    { field: "inputSchema", tomlKey: "inputSchema", type: "json" },
+    { field: "outputSchema", tomlKey: "outputSchema", type: "json" },
+    { field: "perUserMaxRunning", tomlKey: "perUserMaxRunning", type: "number" },
+    { field: "perUserMaxQueued", tomlKey: "perUserMaxQueued", type: "number" },
+    { field: "perAppMaxRunning", tomlKey: "perAppMaxRunning", type: "number" },
+    { field: "perAppMaxQueued", tomlKey: "perAppMaxQueued", type: "number" },
+    { field: "queueTtlSeconds", tomlKey: "queueTtlSeconds", type: "number" },
+    { field: "dequeueOrder", tomlKey: "dequeueOrder", type: "string" },
+    {
+        field: "requiresClientApply",
+        tomlKey: "requiresClientApply",
+        type: "boolean",
+    },
+    // Create-only on the wire (#807: update sends it as a deferred second PATCH
+    // once the new steps are live). That sequencing is the payload builder's job.
+    { field: "syncCallable", tomlKey: "syncCallable", type: "boolean" },
+    { field: "accessRule", tomlKey: "accessRule", type: "string" },
+    { field: "runAs", tomlKey: "runAs", type: "string" },
+    // #1518/#1972 — declarative run-scoped lock. `[workflow.lock]` inline table
+    // on the TOML side, JSON on the wire; validated server-side by
+    // `parseWorkflowLock` (decision of record #6: no client-side mirror validator).
+    { field: "lock", tomlKey: "lock", type: "json" },
+    // #1078 Tier 1b — StringSetField on the model, string array in TOML/JSON.
+    { field: "capabilities", tomlKey: "capabilities", type: "string[]" },
+];
+/**
+ * Fields that ARE author-controlled but do not live in the `[workflow]` table —
+ * they travel through their own structural channel. Kept distinct from
+ * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
+ */
+export const WORKFLOW_FIELDS_STRUCTURAL = new Set([
+    // The workflow's identity. Comes from the TOML file name / `--key`, and is
+    // attached by the caller rather than spread from the `[workflow]` table.
+    "workflowKey",
+    // #1304 — JSON declared-access manifest, derived from the workflow's CEL
+    // fields and attached alongside the steps write, not typed by the author.
+    "metadataManifest",
+]);
+/**
+ * Fields the server owns: identity, ownership, timestamps, computed pointers,
+ * and the deprecated draft/revision slot. None of these are ever sent by the
+ * CLI, and none belong in workflow TOML.
+ */
+export const WORKFLOW_FIELDS_INTERNAL = new Set([
+    // Identity / ownership / timestamps — assigned by the server.
+    "workflowId",
+    "appId",
+    "createdBy",
+    "createdAt",
+    "modifiedAt",
+    // Pointer to the active WorkflowConfiguration — server-computed on publish.
+    "activeConfigId",
+    // DEPRECATED in models.yaml: the legacy revision + draft slot, kept for
+    // migration/backward compatibility. Server-managed; never author-authored.
+    "latestRevision",
+    "stepsR2Key",
+    "draftStepsR2Key",
+    "draftInputSchema",
+    "draftOutputSchema",
+    "draftModifiedAt",
+]);
+/**
+ * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
+ * Recorded explicitly so "classified" is never mistaken for "implemented".
+ * `lock` was wired by #1972; `templateMissingMarker` was removed from the
+ * platform by #2643, so the set is now empty.
+ */
+export const SYNCED_NOT_YET_WIRED = new Set([]);
+/** Descriptor `field` names, for coverage/parity checks. */
+export const WORKFLOW_SYNCED_FIELDS = new Set(WORKFLOW_FIELD_DESCRIPTOR.map((d) => d.field));
+/** Look up a synced field's descriptor by model field name. */
+export function getWorkflowFieldDescriptor(field) {
+    return WORKFLOW_FIELD_DESCRIPTOR.find((d) => d.field === field);
+}
+/**
+ * Model fields that are classified in NONE of synced / structural / internal —
+ * i.e. a field someone added to `models.yaml` without deciding how the CLI
+ * treats it. Non-empty is a hard failure in the drift guard.
+ */
+export function findUnclassifiedWorkflowFields(modelFields) {
+    return modelFields
+        .filter((f) => !WORKFLOW_SYNCED_FIELDS.has(f) &&
+        !WORKFLOW_FIELDS_STRUCTURAL.has(f) &&
+        !WORKFLOW_FIELDS_INTERNAL.has(f))
+        .sort();
+}
+/**
+ * Classifications that no longer correspond to a model field — i.e. a field
+ * removed from `models.yaml` while the CLI still classifies it. Also a hard
+ * failure: a stale classification must not silently pass, or the coverage
+ * claim quietly stops meaning anything.
+ */
+export function findStaleWorkflowClassifications(modelFields) {
+    const known = new Set(modelFields);
+    return [
+        ...WORKFLOW_SYNCED_FIELDS,
+        ...WORKFLOW_FIELDS_STRUCTURAL,
+        ...WORKFLOW_FIELDS_INTERNAL,
+    ]
+        .filter((f) => !known.has(f))
+        .sort();
+}
+//# sourceMappingURL=workflow-field-descriptor.js.map

package/dist/src/lib/workflow-field-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-field-descriptor.js","sourceRoot":"","sources":["../../../src/lib/workflow-field-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAmBH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAuC;IAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClD,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtD,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChE,wEAAwE;IACxE,mEAAmE;IACnE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9D,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IAChE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClE;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;KAChB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;IACnE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9D,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,+DAA+D;IAC/D,gFAAgF;IAChF,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAChD,0EAA0E;IAC1E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5D,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,yEAAyE;IACzE,0EAA0E;IAC1E,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,8DAA8D;IAC9D,YAAY;IACZ,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS,EAAE,CAAC,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAChE,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC9C,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,0BAA0B,CACxC,KAAa;IAEb,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAA8B;IAE9B,OAAO,WAAW;SACf,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,wBAAwB;KAC5B;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.2.0-alpha.7",
+  "version": "1.2.0-alpha.9",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {
@@ -58,7 +58,7 @@
     "commander": "^12.1.0",
     "esbuild": "0.25.12",
     "inquirer": "^9.2.12",
-    "js-bao": "0.12.0-alpha.7",
+    "js-bao": "0.12.0-alpha.9",
     "mime-types": "^2.1.35",
     "open": "^10.0.3",
     "smol-toml": "1.7.0",