thinkwork-cli 0.13.1 → 1.0.0

package/dist/plugins/catalog/src/contracts.ts

@@ -8,7 +8,6 @@
  *   - `skills`         — bundled skill folders seeded into the tenant catalog
  *   - `infrastructure` — a managed-app Terraform deployment
  *   - `ui-surface`     — declared or launchable UI identity
- *   - `auth-provider`  — declared/admin-configured login federation capability
  *
  * Capability declarations are catalog metadata, not install lifecycle
  * components. They let a plugin advertise channel contracts whose runtime is
@@ -34,7 +33,6 @@ export const PLUGIN_COMPONENT_TYPES = [
   "skills",
   "infrastructure",
   "ui-surface",
-  "auth-provider",
 ] as const;
 
 export type PluginComponentType = (typeof PLUGIN_COMPONENT_TYPES)[number];
@@ -212,6 +210,15 @@ export interface McpServerComponent {
   resultTransforms?: McpResultTransform[];
   /** Optional human notes about the tools the server exposes. */
   toolNotes?: string[];
+  /**
+   * THINK-623 — opt in to the long-call profile for this server's tools.
+   * Set it only when the server streams MCP progress notifications during
+   * long calls: the runtime then resets the per-attempt `callTool` wall on
+   * every notification (bounded by an absolute total ceiling) instead of
+   * killing the call at the fixed 60s wall. Servers that go quiet for
+   * longer than the per-attempt wall still time out.
+   */
+  longRunning?: boolean;
 }
 
 export interface SkillSupportingFile {
@@ -294,59 +301,11 @@ export interface UiSurfaceLaunchMetadata {
   entitlementProductKey?: string;
 }
 
-export const AUTH_PROVIDER_KEYS = ["workos"] as const;
-
-export type AuthProviderKey = (typeof AUTH_PROVIDER_KEYS)[number];
-
-export const AUTH_PROVIDER_CONFIG_FIELD_STORAGE = [
-  "metadata",
-  "secret-ref",
-] as const;
-
-export type AuthProviderConfigFieldStorage =
-  (typeof AUTH_PROVIDER_CONFIG_FIELD_STORAGE)[number];
-
-export interface AuthProviderConfigField {
-  /** Operator-facing input key; values are never present in the manifest. */
-  key: string;
-  displayName: string;
-  required: boolean;
-  /**
-   * metadata: non-secret config such as issuer/client id.
-   * secret-ref: stored only as an operator-managed secret reference.
-   */
-  storage: AuthProviderConfigFieldStorage;
-}
-
-export interface AuthProviderPublicOption {
-  /**
-   * Public-safe option key. For the U1-approved fallback this is `sso`; do not
-   * use provider-specific Google/Microsoft keys unless routing evidence exists.
-   */
-  key: string;
-  displayName: string;
-  providerSpecific: boolean;
-  recommended?: boolean;
-}
-
-export interface AuthProviderComponent {
-  type: "auth-provider";
-  key: string;
-  displayName: string;
-  provider: AuthProviderKey;
-  settingsSurface: string;
-  /** Cognito IdP name the validated bridge will use; not a secret. */
-  cognitoIdentityProviderName: string;
-  configFields: AuthProviderConfigField[];
-  publicOptions: AuthProviderPublicOption[];
-}
-
 export type PluginComponent =
   | McpServerComponent
   | SkillsComponent
   | InfrastructureComponent
-  | UiSurfaceComponent
-  | AuthProviderComponent;
+  | UiSurfaceComponent;
 
 export interface EmailChannelProviderOption {
   key: EmailChannelProviderKey;
@@ -566,12 +525,6 @@ function validatePluginVersion(value: unknown, pluginKey: string): void {
       case "ui-surface":
         validateUiSurfaceComponent(component as UiSurfaceComponent, label);
         break;
-      case "auth-provider":
-        validateAuthProviderComponent(
-          component as AuthProviderComponent,
-          label,
-        );
-        break;
     }
   }
 
@@ -727,6 +680,12 @@ function validateMcpServerComponent(
       );
     }
   }
+  if (
+    component.longRunning !== undefined &&
+    typeof component.longRunning !== "boolean"
+  ) {
+    throw new PluginManifestError(`${prefix}.longRunning must be a boolean`);
+  }
   const auth = component.auth as Partial<McpServerAuth> | undefined;
   if (!auth || typeof auth !== "object" || Array.isArray(auth)) {
     throw new PluginManifestError(`${prefix}.auth is required`);
@@ -1443,131 +1402,10 @@ function validateUiSurfaceLaunchMetadata(
   }
 }
 
-function validateAuthProviderComponent(
-  component: Partial<AuthProviderComponent>,
-  label: string,
-): void {
-  const prefix = `${label}: auth-provider "${component.key}"`;
-  requireString(component.displayName, `${prefix}.displayName`);
-  if (
-    typeof component.provider !== "string" ||
-    !(AUTH_PROVIDER_KEYS as readonly string[]).includes(component.provider)
-  ) {
-    throw new PluginManifestError(
-      `${prefix}.provider "${String(component.provider)}" is not supported`,
-    );
-  }
-  requireString(component.settingsSurface, `${prefix}.settingsSurface`);
-  requireString(
-    component.cognitoIdentityProviderName,
-    `${prefix}.cognitoIdentityProviderName`,
-  );
-
-  if (
-    !Array.isArray(component.configFields) ||
-    component.configFields.length === 0
-  ) {
-    throw new PluginManifestError(
-      `${prefix}.configFields must be a non-empty array`,
-    );
-  }
-  const seenConfigKeys = new Set<string>();
-  for (const [index, field] of component.configFields.entries()) {
-    const fieldPrefix = `${prefix}.configFields[${index}]`;
-    if (!field || typeof field !== "object" || Array.isArray(field)) {
-      throw new PluginManifestError(`${fieldPrefix} must be an object`);
-    }
-    rejectManifestValueCarrier(
-      field as unknown as Record<string, unknown>,
-      fieldPrefix,
-    );
-    requireString(field.key, `${fieldPrefix}.key`);
-    if (!CREDENTIAL_KEY_RE.test(field.key)) {
-      throw new PluginManifestError(
-        `${fieldPrefix}.key "${field.key}" must match ${CREDENTIAL_KEY_RE.source}`,
-      );
-    }
-    if (seenConfigKeys.has(field.key)) {
-      throw new PluginManifestError(
-        `${prefix}.configFields declares duplicate key "${field.key}"`,
-      );
-    }
-    seenConfigKeys.add(field.key);
-    requireString(field.displayName, `${fieldPrefix}.displayName`);
-    if (typeof field.required !== "boolean") {
-      throw new PluginManifestError(
-        `${fieldPrefix}.required must be a boolean`,
-      );
-    }
-    if (
-      !(AUTH_PROVIDER_CONFIG_FIELD_STORAGE as readonly string[]).includes(
-        field.storage,
-      )
-    ) {
-      throw new PluginManifestError(
-        `${fieldPrefix}.storage must be one of ${AUTH_PROVIDER_CONFIG_FIELD_STORAGE.join(", ")}`,
-      );
-    }
-  }
-
-  if (
-    !Array.isArray(component.publicOptions) ||
-    component.publicOptions.length === 0
-  ) {
-    throw new PluginManifestError(
-      `${prefix}.publicOptions must be a non-empty array`,
-    );
-  }
-  const seenOptionKeys = new Set<string>();
-  let recommendedCount = 0;
-  for (const [index, option] of component.publicOptions.entries()) {
-    const optionPrefix = `${prefix}.publicOptions[${index}]`;
-    if (!option || typeof option !== "object" || Array.isArray(option)) {
-      throw new PluginManifestError(`${optionPrefix} must be an object`);
-    }
-    rejectManifestValueCarrier(
-      option as unknown as Record<string, unknown>,
-      optionPrefix,
-    );
-    requireString(option.key, `${optionPrefix}.key`);
-    if (!SLUG_RE.test(option.key)) {
-      throw new PluginManifestError(
-        `${optionPrefix}.key "${option.key}" must match ${SLUG_RE.source}`,
-      );
-    }
-    if (seenOptionKeys.has(option.key)) {
-      throw new PluginManifestError(
-        `${prefix}.publicOptions declares duplicate key "${option.key}"`,
-      );
-    }
-    seenOptionKeys.add(option.key);
-    requireString(option.displayName, `${optionPrefix}.displayName`);
-    if (typeof option.providerSpecific !== "boolean") {
-      throw new PluginManifestError(
-        `${optionPrefix}.providerSpecific must be a boolean`,
-      );
-    }
-    if (
-      option.recommended !== undefined &&
-      typeof option.recommended !== "boolean"
-    ) {
-      throw new PluginManifestError(
-        `${optionPrefix}.recommended must be a boolean`,
-      );
-    }
-    if (option.recommended === true) recommendedCount += 1;
-  }
-  if (recommendedCount !== 1) {
-    throw new PluginManifestError(
-      `${prefix}.publicOptions must declare exactly one recommended option`,
-    );
-  }
-}
-
 function rejectManifestValueCarrier(
   value: Record<string, unknown>,
   prefix: string,
-  context = "auth-provider manifests",
+  context = "plugin manifests",
 ): void {
   for (const key of ["value", "secret", "defaultValue", "currentValue"]) {
     if (Object.prototype.hasOwnProperty.call(value, key)) {

package/dist/plugins/catalog/src/registry/generated-first-party.ts

@@ -3,27 +3,14 @@
 //   pnpm --filter @thinkwork/plugin-catalog generate:plugins
 
 import { defineFirstPartyPluginPackage } from "../plugin-package";
-import { companyDataPluginPackage as rawCompanyDataPluginPackage } from "@thinkwork/plugin-company-data";
-import { companyEtlPluginPackage as rawCompanyEtlPluginPackage } from "@thinkwork/plugin-company-etl";
 import { emailChannelPluginPackage as rawEmailChannelPluginPackage } from "@thinkwork/plugin-email-channel";
-import { lastmilePluginPackage as rawLastmilePluginPackage } from "@thinkwork/plugin-lastmile";
 import { n8nPluginPackage as rawN8nPluginPackage } from "@thinkwork/plugin-n8n";
 import { sendgridPluginPackage as rawSendgridPluginPackage } from "@thinkwork/plugin-sendgrid";
 import { twentyPluginPackage as rawTwentyPluginPackage } from "@thinkwork/plugin-twenty";
-import { workosAuthPluginPackage as rawWorkosAuthPluginPackage } from "@thinkwork/plugin-workos-auth";
 
-export const companyDataPluginPackage = defineFirstPartyPluginPackage(
-  rawCompanyDataPluginPackage,
-);
-export const companyEtlPluginPackage = defineFirstPartyPluginPackage(
-  rawCompanyEtlPluginPackage,
-);
 export const emailChannelPluginPackage = defineFirstPartyPluginPackage(
   rawEmailChannelPluginPackage,
 );
-export const lastmilePluginPackage = defineFirstPartyPluginPackage(
-  rawLastmilePluginPackage,
-);
 export const n8nPluginPackage = defineFirstPartyPluginPackage(
   rawN8nPluginPackage,
 );
@@ -33,28 +20,17 @@ export const sendgridPluginPackage = defineFirstPartyPluginPackage(
 export const twentyPluginPackage = defineFirstPartyPluginPackage(
   rawTwentyPluginPackage,
 );
-export const workosAuthPluginPackage = defineFirstPartyPluginPackage(
-  rawWorkosAuthPluginPackage,
-);
 
-export const companyDataManifest = companyDataPluginPackage.manifest;
-export const companyEtlManifest = companyEtlPluginPackage.manifest;
 export const emailChannelManifest = emailChannelPluginPackage.manifest;
-export const lastmileManifest = lastmilePluginPackage.manifest;
 export const n8nManifest = n8nPluginPackage.manifest;
 export const sendgridManifest = sendgridPluginPackage.manifest;
 export const twentyManifest = twentyPluginPackage.manifest;
-export const workosAuthManifest = workosAuthPluginPackage.manifest;
 
 export const firstPartyPluginPackages = [
-  companyDataPluginPackage,
-  companyEtlPluginPackage,
   emailChannelPluginPackage,
-  lastmilePluginPackage,
   n8nPluginPackage,
   sendgridPluginPackage,
   twentyPluginPackage,
-  workosAuthPluginPackage,
 ] as const;
 
 /**

package/dist/plugins/n8n/test/integrated-app-contract.test.ts

@@ -211,7 +211,7 @@ describe("n8n integrated app contract", () => {
     const docsPage = await readFile(
       fileURLToPath(
         new URL(
-          "../../../docs/src/content/docs/applications/n8n.mdx",
+          "../../../docs/reference/applications/n8n.mdx",
           import.meta.url,
         ),
       ),

package/dist/plugins/twenty/package.json

@@ -13,7 +13,8 @@
   "scripts": {
     "build": "tsc --build",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "migrate:lastmile": "tsx scripts/migrate-lastmile.ts"
   },
   "dependencies": {
     "graphql": "^16.10.0"

package/dist/plugins/twenty/scripts/LAMBDA_DEPLOY.md

@@ -0,0 +1,114 @@
+# TEI LastMile → Twenty sync — Lambda deploy runbook
+
+Deploy the nightly LastMile → Twenty delta sync as an AWS Lambda in **TEI's
+account** (the same account as `n8n.lastmile-tei.com` and the LastMile RDS), and
+invoke it nightly from n8n. The function reuses the exact code proven against
+TEI's live Twenty; a full delta run is ~90s, so it fits Lambda's 15-minute
+ceiling with wide headroom.
+
+**Properties:** idempotent (upsert by `sourceId` + deletion mirror), reads
+LastMile **read-only**, never provisions members, needs **no AWS credentials**
+of its own (the ~4 CRM attachments Twenty can't ingest are reported, not fatal).
+
+---
+
+## 1. Build the deployment zip
+
+From the repo root:
+
+```bash
+pnpm install
+bash plugins/twenty/scripts/build-lambda.sh
+# → plugins/twenty/dist/tei-lastmile-sync-lambda.zip   (handler: index.handler)
+```
+
+The zip is self-contained (pg, bcryptjs, aws-sdk all inlined) — no `npm install`
+in the account.
+
+## 2. Create the function
+
+- **Runtime:** Node.js 22.x
+- **Handler:** `index.handler`
+- **Architecture:** arm64 or x86_64 (either)
+- **Timeout:** 300s (run is ~90s; leaves headroom for a busier delta)
+- **Memory:** 512 MB
+- **Code:** upload `tei-lastmile-sync-lambda.zip`
+
+```bash
+aws lambda create-function \
+  --function-name tei-lastmile-sync \
+  --runtime nodejs22.x --handler index.handler \
+  --timeout 300 --memory-size 512 \
+  --role arn:aws:iam::<ACCOUNT_ID>:role/<lambda-exec-role> \
+  --zip-file fileb://plugins/twenty/dist/tei-lastmile-sync-lambda.zip
+# later updates: aws lambda update-function-code --function-name tei-lastmile-sync \
+#   --zip-file fileb://plugins/twenty/dist/tei-lastmile-sync-lambda.zip
+```
+
+## 3. Configuration (the three env vars)
+
+| Variable                | Value                                                |
+| ----------------------- | ---------------------------------------------------- |
+| `TWENTY_PUBLIC_URL`     | `https://crm.tei.thinkwork.ai`                       |
+| `TWENTY_API_KEY`        | Twenty workspace API key (Settings → API & Webhooks) |
+| `LASTMILE_DATABASE_URL` | read-only DSN for the `dispatch` database            |
+
+Set them directly as Lambda environment variables, or (preferred) store the two
+secrets in Secrets Manager and resolve them at start. If you use Secrets
+Manager, add `secretsmanager:GetSecretValue` to the execution role.
+
+```bash
+aws lambda update-function-configuration --function-name tei-lastmile-sync \
+  --environment "Variables={TWENTY_PUBLIC_URL=https://crm.tei.thinkwork.ai,TWENTY_API_KEY=***,LASTMILE_DATABASE_URL=***}"
+```
+
+## 4. Networking — the one thing that must be right
+
+The function must reach **both** the LastMile RDS **and** `crm.tei.thinkwork.ai`.
+Mirror wherever n8n already connects to the RDS:
+
+- **In-VPC (cleanest):** attach the Lambda to the RDS's VPC/subnets, give it a
+  security group allowed to reach the RDS on 5432, and ensure the subnets have a
+  **NAT gateway** so it can still reach `crm.tei.thinkwork.ai` over HTTPS.
+- **No-VPC (public):** the RDS is a public endpoint — the function reaches it and
+  Twenty over the internet, but the **RDS security group must admit the
+  function's egress IP** (the account's NAT/EIP). This is the same allowlisting
+  n8n already has.
+
+Execution role needs at least `AWSLambdaBasicExecutionRole` (CloudWatch Logs),
+plus `AWSLambdaVPCAccessExecutionRole` if you attach it to a VPC.
+
+## 5. Smoke test before scheduling
+
+Always dry-run first (reads + reports, writes nothing):
+
+```bash
+aws lambda invoke --function-name tei-lastmile-sync \
+  --payload '{"mode":"dry-run"}' --cli-binary-format raw-in-base64-out out.json
+cat out.json   # → {"ok":true,"failed":0,"report":{...parity...}}
+```
+
+If `report.mode` is `dry-run` and the entity counts look right, you're wired
+correctly. Then run once for real: `--payload '{"mode":"apply"}'` (or `'{}'` —
+apply is the default).
+
+## 6. Wire n8n
+
+1. **Schedule Trigger** node — cron `0 3 * * *` (03:00 America/Chicago), or your
+   preferred window.
+2. **AWS Lambda** node → _Invoke_, region `us-east-1`, function
+   `tei-lastmile-sync`, invocation type `RequestResponse`. Leave the payload
+   empty (defaults to apply) or send `{"mode":"apply"}`.
+3. (Optional) an **IF** node on `{{$json.ok}}` / `{{$json.failed}}` to post a
+   Slack/email alert when a run reports soft failures.
+
+n8n's AWS credential needs `lambda:InvokeFunction` on the function ARN.
+
+## 7. Operational invariants (human-owned)
+
+- Keep Twenty's **"Create company when adding a new person"** workflow
+  **deactivated** — the API key can't toggle it, and it mislinks new people.
+- **Rotate** the shared `TWENTY_REP_PASSWORD` once the validation window closes.
+- A **cold re-seed** (empty Twenty) creates thousands of records at Twenty's rate
+  limit and can exceed 15 min — run that from the CLI/bundle, not this Lambda.
+  Steady-state nightly deltas are the Lambda's job.

package/dist/plugins/twenty/scripts/build-lambda.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Build a self-contained AWS Lambda deployment zip for the LastMile → Twenty
+# nightly sync. The bundle inlines every dependency (pg, bcryptjs, aws-sdk),
+# so the target account needs no `npm install` — just upload the zip.
+#
+# Usage:  bash scripts/build-lambda.sh
+# Output: plugins/twenty/dist/tei-lastmile-sync-lambda.zip  (handler: index.handler)
+set -euo pipefail
+
+cd "$(dirname "$0")/.." # -> plugins/twenty
+OUT_DIR="dist/tei-lastmile-sync-lambda"
+ZIP="dist/tei-lastmile-sync-lambda.zip"
+
+rm -rf "$OUT_DIR" "$ZIP"
+mkdir -p "$OUT_DIR"
+
+# CJS + .js so Lambda's Node runtime resolves `index.handler` with no wrapper.
+npx esbuild scripts/lambda-handler.ts \
+  --bundle --platform=node --format=cjs --target=node20 \
+  --outfile="$OUT_DIR/index.js"
+
+# The repo's plugins/twenty/package.json is "type":"module", which would make
+# Node treat the CJS index.js as ESM. Ship a CommonJS marker inside the zip so
+# the handler loads correctly regardless of the deploy environment.
+printf '{\n  "type": "commonjs"\n}\n' >"$OUT_DIR/package.json"
+
+(cd "$OUT_DIR" && zip -q -r "../../$ZIP" index.js package.json)
+echo "built $(cd "$(dirname "$ZIP")" && pwd)/$(basename "$ZIP")"
+echo "  handler: index.handler   size: $(du -h "$ZIP" | cut -f1)"

package/dist/plugins/twenty/scripts/configure-product-views.ts

@@ -0,0 +1,195 @@
+#!/usr/bin/env npx tsx
+/**
+ * One-off: make the Opportunity's Products table show Product, Quantity, and
+ * Amount.
+ *
+ * Twenty gives a new custom object a default TABLE view whose columns are
+ * `name` plus the audit fields (createdAt, createdBy, updatedAt, updatedBy).
+ * So the Products section rendered a row per line with no product, no quantity,
+ * and no amount — the data was all there, just never surfaced.
+ *
+ * This sets the opportunityProduct table view to:
+ *   Product | Quantity | Amount | Line
+ * and hides the audit columns. It also orders the record-page field widget the
+ * same way.
+ *
+ * Idempotent: re-running reconciles the view to the same state.
+ *
+ * Usage:
+ *   npx tsx scripts/configure-product-views.ts          # dry-run
+ *   npx tsx scripts/configure-product-views.ts --apply
+ */
+
+import process from "node:process";
+
+import { fetchObjectMetadata } from "./lib/schema-ensure";
+import { TwentyClient, normalizeBaseUrl } from "./lib/twenty-client";
+
+/**
+ * Exactly what Eric asked for: "Each line needs to be Product Name, Quantity and
+ * Amount." `name` is the record's label identifier (it holds the product name,
+ * or "Line 2" for the 173 lines whose brand did not map), so it leads. Twenty
+ * will not let the label identifier be hidden, which is also why it stays.
+ */
+const VISIBLE_COLUMNS = ["name", "quantity", "amount"] as const;
+
+/** Noise on a line item: audit trail, internals, and the product relation whose
+ * value already reads out through `name`. */
+const HIDDEN_COLUMNS = [
+  "createdAt",
+  "createdBy",
+  "updatedAt",
+  "updatedBy",
+  "sourceId",
+  "sourceHash",
+  "isMobil",
+  "opportunity",
+  "lineNumber",
+  "product",
+] as const;
+
+interface ViewField {
+  id: string;
+  fieldMetadataId: string;
+  isVisible: boolean;
+  position: number;
+}
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing required environment variable: ${name}`);
+  return value;
+}
+
+function log(message: string): void {
+  process.stderr.write(`${message}\n`);
+}
+
+async function main(): Promise<void> {
+  const apply = process.argv.slice(2).includes("--apply");
+  const client = new TwentyClient({
+    baseUrl: normalizeBaseUrl(requireEnv("TWENTY_PUBLIC_URL")),
+    authToken: requireEnv("TWENTY_API_KEY"),
+  });
+
+  const objects = await fetchObjectMetadata(client);
+  const line = objects.get("opportunityProduct");
+  if (!line) throw new Error('Twenty object "opportunityProduct" not found.');
+  const fieldIdByName = new Map(
+    [...line.fields.values()].map((field) => [field.name, field.id]),
+  );
+
+  const views = await client.requestWithRetry<{
+    getViews: Array<{ id: string; name: string; type: string }>;
+  }>(
+    "/metadata",
+    `query ConfigViews($objectMetadataId: String!) {
+      getViews(objectMetadataId: $objectMetadataId) { id name type }
+    }`,
+    { objectMetadataId: line.id },
+  );
+
+  const report: Record<string, unknown> = {
+    mode: apply ? "apply" : "dry-run",
+    views: views.getViews.map((view) => `${view.type}:${view.name}`),
+  };
+  const changes: string[] = [];
+
+  for (const view of views.getViews) {
+    const fields = await client.requestWithRetry<{
+      getViewFields: ViewField[];
+    }>(
+      "/metadata",
+      `query ConfigViewFields($viewId: String!) {
+        getViewFields(viewId: $viewId) { id fieldMetadataId isVisible position }
+      }`,
+      { viewId: view.id },
+    );
+    const existingByFieldId = new Map(
+      fields.getViewFields.map((field) => [field.fieldMetadataId, field]),
+    );
+
+    // Wanted columns, in order.
+    for (const [index, name] of VISIBLE_COLUMNS.entries()) {
+      const fieldMetadataId = fieldIdByName.get(name);
+      if (!fieldMetadataId) {
+        throw new Error(
+          `opportunityProduct.${name} not found; run restructure-products first.`,
+        );
+      }
+      const existing = existingByFieldId.get(fieldMetadataId);
+      if (existing?.isVisible && existing.position === index) continue;
+
+      changes.push(`${view.type}: show ${name} at ${index}`);
+      if (!apply) continue;
+
+      if (existing) {
+        await client.requestOnce(
+          "/metadata",
+          `mutation ConfigUpdateViewField($input: UpdateViewFieldInput!) {
+            updateViewField(input: $input) { id }
+          }`,
+          {
+            input: {
+              id: existing.id,
+              update: { isVisible: true, position: index },
+            },
+          },
+        );
+      } else {
+        await client.requestOnce(
+          "/metadata",
+          `mutation ConfigCreateViewField($input: CreateViewFieldInput!) {
+            createViewField(input: $input) { id }
+          }`,
+          {
+            input: {
+              viewId: view.id,
+              fieldMetadataId,
+              isVisible: true,
+              position: index,
+              size: 150,
+            },
+          },
+        );
+      }
+    }
+
+    // Everything else on the line is noise in a table of deal lines.
+    for (const name of HIDDEN_COLUMNS) {
+      const fieldMetadataId = fieldIdByName.get(name);
+      if (!fieldMetadataId) continue;
+      const existing = existingByFieldId.get(fieldMetadataId);
+      if (!existing || !existing.isVisible) continue;
+      changes.push(`${view.type}: hide ${name}`);
+      if (!apply) continue;
+      await client.requestOnce(
+        "/metadata",
+        `mutation ConfigHideViewField($input: UpdateViewFieldInput!) {
+          updateViewField(input: $input) { id }
+        }`,
+        { input: { id: existing.id, update: { isVisible: false } } },
+      );
+    }
+  }
+
+  // The opportunity's `products` relation is left as-is (visible chips). An
+  // earlier version hid it and/or replaced it with a denormalized text field;
+  // both were wrong. The line records (Product / Quantity / Amount) are the
+  // correct structured model. A real inline COLUMNAR table on the record page
+  // is not something stock Twenty renders for a one-to-many relation — that
+  // needs a custom Twenty-app widget, scoped separately.
+
+  report.changes =
+    changes.length > 0 ? changes : "none — views already correct";
+  if (apply && changes.length > 0)
+    log(`applied ${changes.length} view changes`);
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+}
+
+main().catch((error) => {
+  process.stderr.write(
+    `${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exit(1);
+});