Add destructive confirmation and import guidance

apps/admin-api/src/service.rs

@@ -47,6 +47,7 @@ use crate::{
         hash_session_secret, verify_password,
     },
     error::ApiError,
+    import_guidance::import_guidance_warnings,
     storage::LocalArtifactStorage,
 };
 
@@ -2685,6 +2686,7 @@ impl AdminService {
             tool_description: document.operation.tool_description.clone(),
             wizard_state: document.operation.wizard_state.clone(),
         };
+        let warnings = import_guidance_warnings(&document.operation);
 
         match query.mode {
             ImportMode::Create => {
@@ -2694,7 +2696,7 @@ impl AdminService {
                     workspace_id: created.workspace_id,
                     version: created.version,
                     import_mode: ImportMode::Create,
-                    warnings: Vec::new(),
+                    warnings,
                 })
             }
             ImportMode::Upsert => {
@@ -2718,7 +2720,7 @@ impl AdminService {
                         workspace_id: created.workspace_id,
                         version: created.version,
                         import_mode: ImportMode::Upsert,
-                        warnings: Vec::new(),
+                        warnings,
                     };
                     info!(
                         operation_id = %response.operation_id,
@@ -2733,7 +2735,7 @@ impl AdminService {
                         workspace_id: created.workspace_id,
                         version: created.version,
                         import_mode: ImportMode::Upsert,
-                        warnings: Vec::new(),
+                        warnings,
                     };
                     info!(
                         operation_id = %response.operation_id,
@@ -3446,6 +3448,7 @@ fn demo_rest_operation_payload() -> OperationPayload {
             retry_policy: None,
             response_cache: None,
             idempotency: None,
+            safety: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
         },
@@ -3513,6 +3516,7 @@ fn demo_archived_operation_payload() -> OperationPayload {
             retry_policy: None,
             response_cache: None,
             idempotency: None,
+            safety: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
         },
@@ -3602,6 +3606,9 @@ fn runtime_error_code(error: &RuntimeError) -> &'static str {
         RuntimeError::Schema(_) => "schema_error",
         RuntimeError::Mapping(_) => "mapping_error",
         RuntimeError::InvalidPreparedRequest { .. } => "invalid_request",
+        RuntimeError::ConfirmationRequired { .. } => "confirmation_required",
+        RuntimeError::InvalidConfirmationToken { .. } => "invalid_confirmation_token",
+        RuntimeError::ConfirmationStoreUnavailable { .. } => "confirmation_unavailable",
         RuntimeError::RestAdapter(_) => "rest_error",
         RuntimeError::ProtocolAdapter(_) => "adapter_error",
         RuntimeError::UnsupportedProtocol { .. } => "unsupported_protocol",
@@ -3926,6 +3933,7 @@ mod tests {
             retry_policy: None,
             response_cache: Some(ResponseCachePolicy { ttl_ms: 5_000 }),
             idempotency: None,
+            safety: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
         }
@@ -3942,6 +3950,7 @@ mod tests {
                 input_field: Some("request_id".to_owned()),
                 header_name: Some("Idempotency-Key".to_owned()),
             }),
+            safety: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
         }