primitive-admin 1.0.60 → 1.0.61

package/dist/src/lib/workflow-fragments.d.ts

@@ -14,6 +14,29 @@
  *   - Unique step ids validated post-expansion; collisions name both
  *     locations in the error message.
  *
+ * Parameterized includes (#1448):
+ *   - Two include forms are supported. The bare form
+ *     `include = ["name", ...]` (an array of fragment-name strings) is
+ *     unchanged. The parameterized form uses `[[include]]` array-of-tables:
+ *
+ *       [[include]]
+ *       fragment = "lifecycle-email"          # required
+ *       runIf = "input.type == 'x'"           # optional; ANDed onto each step
+ *       with = { id = "...", subject = "..." } # params, exposed as {{ params.* }}
+ *
+ *   - A file uses one form or the other — mixing string and table entries in a
+ *     single `include` array is an error.
+ *   - `{{ params.* }}` references inside the fragment's steps are substituted
+ *     at EXPAND time from the include's `with` table. A whole-string
+ *     `{{ params.x }}` splices the raw typed value (number/bool/table);
+ *     an embedded `{{ params.x }}` inside a larger string stringifies it.
+ *     A missing param is a hard error. Only the `params.` namespace is
+ *     touched — every other `{{ ... }}` template passes through to the server
+ *     verbatim, and `params.` never survives into the expanded output.
+ *   - The include-level `runIf` (CEL) is ANDed onto every expanded step:
+ *     both present → `(<includeRunIf>) && (<stepRunIf>)`; one present → that
+ *     one; neither → no runIf.
+ *
  * Wiring: `parseTomlFile()` in `cli/src/commands/sync.ts` calls
  * `expandWorkflowTomlData()` after parsing. All 24 push parse sites in
  * sync.ts route through that single seam, so the expansion is uniform.

package/dist/src/lib/workflow-fragments.js

@@ -14,6 +14,29 @@
  *   - Unique step ids validated post-expansion; collisions name both
  *     locations in the error message.
  *
+ * Parameterized includes (#1448):
+ *   - Two include forms are supported. The bare form
+ *     `include = ["name", ...]` (an array of fragment-name strings) is
+ *     unchanged. The parameterized form uses `[[include]]` array-of-tables:
+ *
+ *       [[include]]
+ *       fragment = "lifecycle-email"          # required
+ *       runIf = "input.type == 'x'"           # optional; ANDed onto each step
+ *       with = { id = "...", subject = "..." } # params, exposed as {{ params.* }}
+ *
+ *   - A file uses one form or the other — mixing string and table entries in a
+ *     single `include` array is an error.
+ *   - `{{ params.* }}` references inside the fragment's steps are substituted
+ *     at EXPAND time from the include's `with` table. A whole-string
+ *     `{{ params.x }}` splices the raw typed value (number/bool/table);
+ *     an embedded `{{ params.x }}` inside a larger string stringifies it.
+ *     A missing param is a hard error. Only the `params.` namespace is
+ *     touched — every other `{{ ... }}` template passes through to the server
+ *     verbatim, and `params.` never survives into the expanded output.
+ *   - The include-level `runIf` (CEL) is ANDed onto every expanded step:
+ *     both present → `(<includeRunIf>) && (<stepRunIf>)`; one present → that
+ *     one; neither → no runIf.
+ *
  * Wiring: `parseTomlFile()` in `cli/src/commands/sync.ts` calls
  * `expandWorkflowTomlData()` after parsing. All 24 push parse sites in
  * sync.ts route through that single seam, so the expansion is uniform.
@@ -23,6 +46,22 @@
 import { existsSync, readFileSync } from "fs";
 import { dirname, join, basename } from "path";
 import { parseConfigToml } from "./config-toml.js";
+/**
+ * True only for a genuine plain TOML table: a non-null, non-array object whose
+ * prototype is `Object.prototype` or `null`. This deliberately rejects the
+ * non-plain objects that a bare `typeof x === "object"` check would accept —
+ * notably smol-toml's `TomlDate` (a `Date` subclass) and any other boxed value
+ * — so a TOML date/time literal (`with = 1979-05-27T07:32:00Z`) can never slip
+ * through a guard that expects a parameter table. Used everywhere a `with` /
+ * params sub-table is required so the plain-table rule is applied consistently.
+ */
+function isPlainTable(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
 /**
  * Read and expand a workflow TOML file from disk. Returns the parsed
  * TOML with all `include` fragments spliced in. If the file has no
@@ -58,16 +97,35 @@ export function expandWorkflowTomlData(parsed, workflowPath) {
         ? parsed.steps
         : [];
     const allOriginated = [];
-    for (const fragmentName of includeList) {
-        if (typeof fragmentName !== "string" || fragmentName.length === 0) {
-            throw new Error(`Workflow '${workflowPath}' has an invalid include entry: ${JSON.stringify(fragmentName)}. Each entry must be a fragment name string.`);
+    // Classify each entry as a bare fragment-name string or a parameterized
+    // `[[include]]` table. A single file must use one form throughout. A
+    // `[[include]]` entry must be a genuine plain table — a non-plain object
+    // (e.g. a TOML date literal parsed to a `TomlDate`) is neither a valid
+    // string entry nor a valid table and falls through to the per-entry error.
+    const isTable = (e) => isPlainTable(e);
+    const hasStringEntry = includeList.some((e) => typeof e === "string");
+    const hasTableEntry = includeList.some((e) => isTable(e));
+    if (hasStringEntry && hasTableEntry) {
+        throw new Error(`Workflow '${workflowPath}' mixes bare-string include entries and [[include]] tables in one 'include' array. Pick one form per file: either \`include = ["a", "b"]\` or repeated \`[[include]]\` tables.`);
+    }
+    includeList.forEach((entry, index) => {
+        if (typeof entry === "string") {
+            if (entry.length === 0) {
+                throw new Error(`Workflow '${workflowPath}' has an invalid include entry: ${JSON.stringify(entry)}. Each entry must be a fragment name string.`);
+            }
+            const fragmentPath = join(fragmentsDir, `${entry}.toml`);
+            const fragment = readFragmentSafely(fragmentPath, workflowPath, entry);
+            for (const step of fragment.steps) {
+                allOriginated.push({ step, origin: `fragment '${entry}'` });
+            }
+            return;
         }
-        const fragmentPath = join(fragmentsDir, `${fragmentName}.toml`);
-        const fragment = readFragmentSafely(fragmentPath, workflowPath, fragmentName);
-        for (const step of fragment.steps) {
-            allOriginated.push({ step, origin: `fragment '${fragmentName}'` });
+        if (isTable(entry)) {
+            expandParameterizedInclude(entry, index, fragmentsDir, workflowPath, allOriginated);
+            return;
         }
-    }
+        throw new Error(`Workflow '${workflowPath}' has an invalid include entry: ${JSON.stringify(entry)}. Each entry must be a fragment name string or a [[include]] table.`);
+    });
     for (const step of workflowOwnSteps) {
         allOriginated.push({ step, origin: `workflow '${basename(workflowPath)}'` });
     }
@@ -103,6 +161,169 @@ function readFragmentSafely(fragmentPath, workflowPath, fragmentName) {
         : [];
     return { steps };
 }
+// ── Parameterized include expansion (#1448) ─────────────────────────────────
+const ALLOWED_INCLUDE_KEYS = new Set(["fragment", "runIf", "with"]);
+// The dotted path after `params.`. Each segment is a TOML bare key, which may
+// contain letters, digits, `_` and `-`; segments are joined by dots. Keeping
+// the full bare-key charset means hyphenated keys like `subject-line` expand
+// instead of leaking `{{ params.subject-line }}` to the server.
+const PARAM_PATH = "[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)*";
+// A string that is EXACTLY one `{{ params.<path> }}` token (raw typed splice).
+const WHOLE_PARAM_RE = new RegExp(`^\\{\\{\\s*params\\.(${PARAM_PATH})\\s*\\}\\}$`);
+// Any embedded `{{ params.<path> }}` token (string interpolation).
+const EMBEDDED_PARAM_RE = new RegExp(`\\{\\{\\s*params\\.(${PARAM_PATH})\\s*\\}\\}`, "g");
+function expandParameterizedInclude(entry, index, fragmentsDir, workflowPath, allOriginated) {
+    const includeLabel = `[[include]] #${index + 1}`;
+    for (const key of Object.keys(entry)) {
+        if (!ALLOWED_INCLUDE_KEYS.has(key)) {
+            throw new Error(`Workflow '${workflowPath}' has an unknown key '${key}' in ${includeLabel}. Allowed keys are: fragment, runIf, with.`);
+        }
+    }
+    const fragmentName = entry.fragment;
+    if (typeof fragmentName !== "string" || fragmentName.length === 0) {
+        throw new Error(`Workflow '${workflowPath}' has a ${includeLabel} missing a valid 'fragment' name (got ${JSON.stringify(fragmentName)}).`);
+    }
+    const includeRunIf = entry.runIf;
+    if (includeRunIf !== undefined && typeof includeRunIf !== "string") {
+        throw new Error(`Workflow '${workflowPath}' has a non-string 'runIf' in ${includeLabel} (fragment '${fragmentName}'). runIf must be a CEL string.`);
+    }
+    const withParams = entry.with;
+    // `with` must be a genuine plain table. `isPlainTable` rejects arrays and any
+    // non-plain object — including a TOML date/time literal (`with = 1979-…Z`),
+    // which parses to a `TomlDate` and would otherwise be accepted as a param
+    // table by a bare `typeof === "object"` check.
+    if (withParams !== undefined && !isPlainTable(withParams)) {
+        throw new Error(`Workflow '${workflowPath}' has a non-table 'with' in ${includeLabel} (fragment '${fragmentName}'). 'with' must be a table of parameters.`);
+    }
+    const params = withParams ?? {};
+    const fragmentPath = join(fragmentsDir, `${fragmentName}.toml`);
+    const fragment = readFragmentSafely(fragmentPath, workflowPath, fragmentName);
+    const ctx = {
+        fragment: fragmentName,
+        includeLabel,
+        workflowPath,
+    };
+    for (const rawStep of fragment.steps) {
+        const step = substituteParamsDeep(rawStep, params, ctx);
+        applyIncludeRunIf(step, includeRunIf, ctx);
+        allOriginated.push({
+            step,
+            origin: `fragment '${fragmentName}' (${includeLabel})`,
+        });
+    }
+}
+/**
+ * Recursively substitute `{{ params.* }}` references throughout a fragment
+ * step. Returns a new value; the input is not mutated. Only the `params.`
+ * namespace is touched — every other `{{ ... }}` template is preserved
+ * verbatim for the server to render.
+ */
+function substituteParamsDeep(node, params, ctx) {
+    if (typeof node === "string") {
+        return substituteParamsInString(node, params, ctx);
+    }
+    if (Array.isArray(node)) {
+        return node.map((el) => substituteParamsDeep(el, params, ctx));
+    }
+    if (node !== null && typeof node === "object") {
+        // Only recurse into plain tables. Non-plain objects (e.g. smol-toml's
+        // `TomlDate`, which extends `Date`) carry internal state that is not
+        // enumerable, so rebuilding them via `Object.entries` would collapse them
+        // to `{}`. TOML date/time literals can only appear as leaf param values —
+        // there is nothing to substitute inside them — so pass them through
+        // unchanged.
+        const proto = Object.getPrototypeOf(node);
+        if (proto !== Object.prototype && proto !== null) {
+            return node;
+        }
+        // Clone into a null-prototype object so a legal TOML key that collides with
+        // a prototype member — `__proto__`, `constructor`, `prototype` — is written
+        // as an ordinary own data property instead of tripping the `__proto__`
+        // setter (which would drop the field or reparent the clone). `Object.entries`
+        // reads only own enumerable keys, so no inherited members leak in either.
+        const out = Object.create(null);
+        for (const [k, v] of Object.entries(node)) {
+            out[k] = substituteParamsDeep(v, params, ctx);
+        }
+        return out;
+    }
+    return node;
+}
+function substituteParamsInString(value, params, ctx) {
+    // Whole-string `{{ params.x }}` → splice the raw typed value.
+    const whole = value.match(WHOLE_PARAM_RE);
+    if (whole) {
+        return resolveParamPath(whole[1], params, ctx);
+    }
+    // Embedded `{{ params.x }}` → stringify the resolved value in place.
+    return value.replace(EMBEDDED_PARAM_RE, (_match, path) => stringifyParamValue(resolveParamPath(path, params, ctx)));
+}
+/**
+ * Resolve a dotted `params.<path>` reference against the include's `with`
+ * table. A missing key (or missing sub-path) is a hard error naming the
+ * fragment, the param, and the include.
+ */
+function resolveParamPath(path, params, ctx) {
+    const segments = path.split(".");
+    let cursor = params;
+    for (const segment of segments) {
+        // Resolve only OWN properties at each segment. Using `in` here would walk
+        // the prototype chain, so `{{ params.constructor }}`, `{{ params.toString }}`,
+        // `{{ params.__proto__ }}`, or `{{ params.hasOwnProperty }}` would resolve
+        // an inherited `Object.prototype` member instead of hard-erroring like any
+        // other missing param. `Object.hasOwn` restricts the lookup to real,
+        // author-declared keys.
+        if (cursor === null ||
+            typeof cursor !== "object" ||
+            Array.isArray(cursor) ||
+            !Object.hasOwn(cursor, segment)) {
+            throw new Error(`Fragment '${ctx.fragment}' references '{{ params.${path} }}' but no matching key exists in the ${ctx.includeLabel} 'with' table (workflow '${ctx.workflowPath}').`);
+        }
+        cursor = cursor[segment];
+    }
+    return cursor;
+}
+function stringifyParamValue(value) {
+    if (value === null || value === undefined)
+        return "";
+    if (typeof value === "object")
+        return JSON.stringify(value);
+    return String(value);
+}
+/**
+ * AND the include-level `runIf` onto a step's own `runIf`. Each operand is
+ * paren-wrapped because CEL's `&&` binds tighter than `||`. Mutates `step`.
+ */
+function applyIncludeRunIf(step, includeRunIf, ctx) {
+    // A non-string step `runIf` (e.g. `runIf = 123`, or a param that spliced a
+    // non-string value in) must hard-error, consistent with the include-level
+    // non-string `runIf` rejection. Otherwise it would fall through the
+    // string-only guard below and be silently dropped, turning a guarded step
+    // into an unconditional one.
+    if ("runIf" in step &&
+        step.runIf !== undefined &&
+        typeof step.runIf !== "string") {
+        throw new Error(`Fragment '${ctx.fragment}' produced a non-string 'runIf' (got ${JSON.stringify(step.runIf)}) in ${ctx.includeLabel} (workflow '${ctx.workflowPath}'). runIf must be a CEL string.`);
+    }
+    const include = typeof includeRunIf === "string" && includeRunIf.length > 0
+        ? includeRunIf
+        : undefined;
+    const own = typeof step.runIf === "string" && step.runIf.length > 0
+        ? step.runIf
+        : undefined;
+    let combined;
+    if (include && own)
+        combined = `(${include}) && (${own})`;
+    else
+        combined = include ?? own;
+    if (combined === undefined) {
+        if ("runIf" in step)
+            delete step.runIf;
+    }
+    else {
+        step.runIf = combined;
+    }
+}
 function assertUniqueStepIds(originated, workflowPath) {
     const seen = new Map();
     for (const { step, origin } of originated) {

package/dist/src/lib/workflow-fragments.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-fragments.js","sourceRoot":"","sources":["../../../src/lib/workflow-fragments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AASnD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAwB,CAAC;IAC/D,OAAO,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,YAAoB;IAEpB,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAA0B,CAAC;IACpC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,qFAAqF,CAC/G,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,8CAA8C;IAC9C,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,CAAC,CAAE,MAAM,CAAC,KAAoC;QAC9C,CAAC,CAAC,EAAE,CAAC;IAOP,MAAM,aAAa,GAAqB,EAAE,CAAC;IAE3C,KAAK,MAAM,YAAY,IAAI,WAAW,EAAE,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,mCAAmC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,8CAA8C,CACvI,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,YAAY,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEjD,sEAAsE;IACtE,kEAAkE;IAClE,8CAA8C;IAC9C,MAAM,MAAM,GAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC;IACtB,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,MAA0B,CAAC;AACpC,CAAC;AAMD,SAAS,kBAAkB,CACzB,YAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,wBAAwB,YAAY,qCAAqC,YAAY,IAAI,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,GAAG,eAAe,CAAC,OAAO,CAAwB,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,SAAS,YAAY,MAAM,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,SAAS,YAAY,8HAA8H,CAC7K,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,SAAS,YAAY,6EAA6E,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,CAAC,CAAE,MAAM,CAAC,KAAoC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgE,EAChE,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,iDAAiD;QAChG,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,4CAA4C,YAAY,eAAe,WAAW,aAAa,MAAM,GAAG,CACvH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"workflow-fragments.js","sourceRoot":"","sources":["../../../src/lib/workflow-fragments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AASnD;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAwB,CAAC;IAC/D,OAAO,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,YAAoB;IAEpB,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAA0B,CAAC;IACpC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,qFAAqF,CAC/G,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,8CAA8C;IAC9C,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,CAAC,CAAE,MAAM,CAAC,KAAoC;QAC9C,CAAC,CAAC,EAAE,CAAC;IAOP,MAAM,aAAa,GAAqB,EAAE,CAAC;IAE3C,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,gLAAgL,CAC1M,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8CAA8C,CAChI,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACvE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,0BAA0B,CACxB,KAA4B,EAC5B,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,CACd,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,qEAAqE,CACvJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEjD,sEAAsE;IACtE,kEAAkE;IAClE,8CAA8C;IAC9C,MAAM,MAAM,GAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC;IACtB,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,MAA0B,CAAC;AACpC,CAAC;AAMD,SAAS,kBAAkB,CACzB,YAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,wBAAwB,YAAY,qCAAqC,YAAY,IAAI,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,GAAG,eAAe,CAAC,OAAO,CAAwB,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,SAAS,YAAY,MAAM,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,SAAS,YAAY,8HAA8H,CAC7K,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,SAAS,YAAY,6EAA6E,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,CAAC,CAAE,MAAM,CAAC,KAAoC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,gEAAgE;AAChE,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,wBAAwB,UAAU,cAAc,CAAC,CAAC;AACpF,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,uBAAuB,UAAU,aAAa,EAC9C,GAAG,CACJ,CAAC;AAQF,SAAS,0BAA0B,CACjC,KAA0B,EAC1B,KAAa,EACb,YAAoB,EACpB,YAAoB,EACpB,aAAmE;IAEnE,MAAM,YAAY,GAAG,gBAAgB,KAAK,GAAG,CAAC,EAAE,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,yBAAyB,GAAG,QAAQ,YAAY,4CAA4C,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;IACpC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,WAAW,YAAY,yCAAyC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,iCAAiC,YAAY,eAAe,YAAY,iCAAiC,CACnI,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,+BAA+B,YAAY,eAAe,YAAY,2CAA2C,CAC3I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAyB,UAAkC,IAAI,EAAE,CAAC;IAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAE9E,MAAM,GAAG,GAAiB;QACxB,QAAQ,EAAE,YAAY;QACtB,YAAY;QACZ,YAAY;KACb,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAGrD,CAAC;QACF,iBAAiB,CAAC,IAAI,EAAE,YAAkC,EAAE,GAAG,CAAC,CAAC;QACjE,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,MAAM,EAAE,aAAa,YAAY,MAAM,YAAY,GAAG;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAS,EACT,MAA2B,EAC3B,GAAiB;IAEjB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,sEAAsE;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,aAAa;QACb,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,GAAG,GAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAa,EACb,MAA2B,EAC3B,GAAiB;IAEjB,8DAA8D;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,qEAAqE;IACrE,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAC/D,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,MAA2B,EAC3B,GAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,GAAQ,MAAM,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,+EAA+E;QAC/E,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,wBAAwB;QACxB,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,CAAC,QAAQ,2BAA2B,IAAI,0CAA0C,GAAG,CAAC,YAAY,4BAA4B,GAAG,CAAC,YAAY,KAAK,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAU;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,IAAyB,EACzB,YAAgC,EAChC,GAAiB;IAEjB,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,6BAA6B;IAC7B,IACE,OAAO,IAAI,IAAI;QACf,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,CAAC,QAAQ,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,YAAY,eAAe,GAAG,CAAC,YAAY,iCAAiC,CACpL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAO,IAAI,GAAG;QAAE,QAAQ,GAAG,IAAI,OAAO,SAAS,GAAG,GAAG,CAAC;;QACrD,QAAQ,GAAG,OAAO,IAAI,GAAG,CAAC;IAE/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgE,EAChE,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,iDAAiD;QAChG,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,4CAA4C,YAAY,eAAe,WAAW,aAAa,MAAM,GAAG,CACvH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/src/lib/workflow-payload.d.ts

@@ -73,7 +73,7 @@ export declare function parseWorkflowExpressionsToml(tomlData: any): WorkflowExp
  * the recurring bug class this builder closes. `update` omits `syncCallable`
  * (deferred second PATCH, #807); everything else is shared.
  */
-export declare const WORKFLOW_PAYLOAD_FIELDS_CREATE: readonly ["name", "description", "status", "accessRule", "runAs", "capabilities", "perUserMaxRunning", "perUserMaxQueued", "perAppMaxRunning", "perAppMaxQueued", "queueTtlSeconds", "dequeueOrder", "requiresClientApply", "inputSchema", "outputSchema", "syncCallable"];
+export declare const WORKFLOW_PAYLOAD_FIELDS_CREATE: readonly ["name", "description", "status", "accessRule", "runAs", "capabilities", "perUserMaxRunning", "perUserMaxQueued", "perAppMaxRunning", "perAppMaxQueued", "queueTtlSeconds", "dequeueOrder", "requiresClientApply", "inputSchema", "outputSchema", "lock", "syncCallable"];
 export declare const WORKFLOW_PAYLOAD_FIELDS_UPDATE: ReadonlyArray<string>;
 /**
  * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML

package/dist/src/lib/workflow-payload.js

@@ -96,6 +96,7 @@ export const WORKFLOW_PAYLOAD_FIELDS_CREATE = [
     "requiresClientApply",
     "inputSchema",
     "outputSchema",
+    "lock",
     "syncCallable",
 ];
 export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.filter((f) => f !== "syncCallable");
@@ -160,6 +161,22 @@ export function buildWorkflowPayloadFromToml(workflow, { mode }) {
             : create
                 ? undefined
                 : null,
+        // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
+        // A TOML-owned nested-object field, mirroring the schemas above. Presence-
+        // keyed, not truthiness-keyed: forward the value whenever the KEY is present
+        // (`!== undefined`) — the server's create/PATCH accept an object OR a JSON
+        // string, so a present-but-malformed falsy value (`lock = false`/`0`) must
+        // be forwarded so the server surfaces its validation error, rather than
+        // being silently treated as absent (dropped on create, cleared on update).
+        // Absent on create → omit (server default: no lock); absent on update →
+        // null so removing `[workflow.lock]` clears the server-side lock
+        // (config-as-code). Before this the field was dropped from both sync paths,
+        // so a pull → push cycle silently lost the lock (#1972).
+        lock: workflow.lock !== undefined
+            ? workflow.lock
+            : create
+                ? undefined
+                : null,
     };
     // syncCallable — create includes it (raw boolean pass-through); update omits
     // it (deferred second PATCH, #807 — see module doc).

package/dist/src/lib/workflow-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,MAAM,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CACH,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEjC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,cAAc;QACd,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YAClC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC7B,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,MAAM;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,SAAS;QACf,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACvB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,0EAA0E;QAC1E,kEAAkE;QAClE,WAAW,EAAE,QAAQ,CAAC,WAAW;YAC/B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;KACX,CAAC;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,MAAM;IACN,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,MAAM,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CACH,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEjC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,cAAc;QACd,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YAClC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC7B,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,MAAM;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,SAAS;QACf,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACvB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,0EAA0E;QAC1E,kEAAkE;QAClE,WAAW,EAAE,QAAQ,CAAC,WAAW;YAC/B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,4EAA4E;QAC5E,yDAAyD;QACzD,IAAI,EACF,QAAQ,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;KACb,CAAC;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/lib/workflow-toml-validator.d.ts

@@ -54,6 +54,9 @@ export declare const KNOWN_KINDS_FOR_DRIFT_GUARD: ReadonlySet<string>;
  * errors:
  *  - `__steps_shape__`: `steps` is not an array (table or scalar).
  *  - `__step_shape__`: a step is not an object.
+ *  - `__workflow_system_access_rule__`: `[workflow] runAs = "system"` with a
+ *    non-empty `accessRule` — dead config the server rejects (#1447/#1258).
+ *    A workflow-level error (not tied to a step): `stepIndex: -1, stepId: null`.
  * `hint` is a short, user-facing explanation (used by
  * `formatWorkflowTomlErrors` to render the multi-line diagnostic).
  * `parentStepId` is set when this error came from a `collect` step's
@@ -70,14 +73,67 @@ export type WorkflowTomlError = {
     hint: string;
     parentStepId?: string | null;
 };
+/**
+ * #1447 workflow-identity predicate, extracted (codex review, 2026-07-15) so
+ * command sites that apply command-line metadata overrides can re-run it
+ * against the merged/effective workflow rather than only the parsed file.
+ *
+ * `runAs = "system"` + a non-empty `accessRule` is dead config: a system run
+ * can only be started by the system and never evaluates its accessRule, so any
+ * non-empty rule is inert. The server rejects this at save time (#1258,
+ * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
+ * `sync push` all-or-nothing instead of failing mid-push and leaving partial
+ * server state (#1418 drift).
+ *
+ * Mirrors the server predicate byte-for-byte: returns the sentinel error only
+ * when `runAs === "system"` AND `typeof accessRule === "string"` AND
+ * `accessRule.trim() !== ""`. Default/unset/empty/whitespace-only runAs or
+ * accessRule (and a bare non-string boolean accessRule) return `null`.
+ *
+ * @param workflow The workflow-metadata object — the `[workflow]` table, or
+ *   for commands that accept unwrapped root-level metadata, the root TOML
+ *   object (`tomlData.workflow || tomlData`). Non-object inputs return `null`.
+ */
+export declare function validateWorkflowIdentity(workflow: any): WorkflowTomlError | null;
+/** The runAs / accessRule pair the identity lint reads. */
+export interface WorkflowIdentityFields {
+    runAs?: unknown;
+    accessRule?: unknown;
+}
+/**
+ * #1447 (maintainer decision, 2026-07-21): compute the EFFECTIVE workflow
+ * identity that an `update --from-file` push will leave on the server — the
+ * merge of the persisted record with the incoming file/flags.
+ *
+ * `applyWorkflowBody` omits undefined fields, so the server retains whichever
+ * side of the runAs/accessRule pair the incoming payload doesn't set. Linting
+ * the incoming payload alone therefore misses the case where the OTHER side is
+ * already `system` / a stored rule: an existing `runAs="system"` workflow plus
+ * a file adding only an `accessRule`, or a file flipping a workflow with a
+ * stored rule to `runAs="system"`. Both pass a payload-only lint and are then
+ * rejected by the server's PATCH. Merging the two before `validateWorkflowIdentity`
+ * catches them locally at zero extra cost — the persisted record is already
+ * fetched at the call site.
+ *
+ * Presence semantics mirror the update payload builder: a field PRESENT in
+ * `incoming` (including an empty-string clear) overrides the stored value; an
+ * ABSENT field (undefined) falls back to what the server keeps.
+ */
+export declare function effectiveWorkflowIdentity(existing: WorkflowIdentityFields | null | undefined, incoming: WorkflowIdentityFields | null | undefined): WorkflowIdentityFields;
 /**
  * Walk a parsed workflow TOML document and return all unknown-field errors.
  *
  * @param tomlData The output of `parseConfigToml()` for a workflow TOML file.
+ * @param opts.skipWorkflowIdentity When true, suppress the #1447 workflow
+ *   identity check (`runAs="system"` + non-empty `accessRule`). Callers that
+ *   merge command-line overrides after parsing re-run `validateWorkflowIdentity`
+ *   against the effective metadata themselves.
  * @returns An array of error objects, one per offending field. Empty if no
  *   errors were found.
  */
-export declare function validateWorkflowToml(tomlData: any): WorkflowTomlError[];
+export declare function validateWorkflowToml(tomlData: any, opts?: {
+    skipWorkflowIdentity?: boolean;
+}): WorkflowTomlError[];
 /**
  * Render a multi-line diagnostic for a list of errors. Designed for the
  * shape called out in the issue:

package/dist/src/lib/workflow-toml-validator.js

@@ -57,18 +57,115 @@ export const ALLOWLISTED_FIELDS_FOR_DRIFT_GUARD = ALLOWLISTED_FIELDS;
  * guard assert the generated known-kind set matches a fresh scan.
  */
 export const KNOWN_KINDS_FOR_DRIFT_GUARD = KNOWN_KINDS;
+/**
+ * #1447 workflow-identity predicate, extracted (codex review, 2026-07-15) so
+ * command sites that apply command-line metadata overrides can re-run it
+ * against the merged/effective workflow rather than only the parsed file.
+ *
+ * `runAs = "system"` + a non-empty `accessRule` is dead config: a system run
+ * can only be started by the system and never evaluates its accessRule, so any
+ * non-empty rule is inert. The server rejects this at save time (#1258,
+ * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
+ * `sync push` all-or-nothing instead of failing mid-push and leaving partial
+ * server state (#1418 drift).
+ *
+ * Mirrors the server predicate byte-for-byte: returns the sentinel error only
+ * when `runAs === "system"` AND `typeof accessRule === "string"` AND
+ * `accessRule.trim() !== ""`. Default/unset/empty/whitespace-only runAs or
+ * accessRule (and a bare non-string boolean accessRule) return `null`.
+ *
+ * @param workflow The workflow-metadata object — the `[workflow]` table, or
+ *   for commands that accept unwrapped root-level metadata, the root TOML
+ *   object (`tomlData.workflow || tomlData`). Non-object inputs return `null`.
+ */
+export function validateWorkflowIdentity(workflow) {
+    if (workflow === null ||
+        typeof workflow !== "object" ||
+        Array.isArray(workflow)) {
+        return null;
+    }
+    const runAs = workflow.runAs;
+    const accessRule = workflow.accessRule;
+    if (runAs === "system" &&
+        typeof accessRule === "string" &&
+        accessRule.trim() !== "") {
+        return {
+            stepIndex: -1,
+            stepId: null,
+            field: "__workflow_system_access_rule__",
+            hint: 'accessRule has no effect when runAs = "system" (system runs skip ' +
+                "accessRule; gate callers with syncCallable + caller-mode, or see #1433)",
+        };
+    }
+    return null;
+}
+/**
+ * #1447 (maintainer decision, 2026-07-21): compute the EFFECTIVE workflow
+ * identity that an `update --from-file` push will leave on the server — the
+ * merge of the persisted record with the incoming file/flags.
+ *
+ * `applyWorkflowBody` omits undefined fields, so the server retains whichever
+ * side of the runAs/accessRule pair the incoming payload doesn't set. Linting
+ * the incoming payload alone therefore misses the case where the OTHER side is
+ * already `system` / a stored rule: an existing `runAs="system"` workflow plus
+ * a file adding only an `accessRule`, or a file flipping a workflow with a
+ * stored rule to `runAs="system"`. Both pass a payload-only lint and are then
+ * rejected by the server's PATCH. Merging the two before `validateWorkflowIdentity`
+ * catches them locally at zero extra cost — the persisted record is already
+ * fetched at the call site.
+ *
+ * Presence semantics mirror the update payload builder: a field PRESENT in
+ * `incoming` (including an empty-string clear) overrides the stored value; an
+ * ABSENT field (undefined) falls back to what the server keeps.
+ */
+export function effectiveWorkflowIdentity(existing, incoming) {
+    const ex = existing ?? {};
+    const inc = incoming ?? {};
+    return {
+        runAs: inc.runAs !== undefined ? inc.runAs : ex.runAs,
+        accessRule: inc.accessRule !== undefined ? inc.accessRule : ex.accessRule,
+    };
+}
 /**
  * Walk a parsed workflow TOML document and return all unknown-field errors.
  *
  * @param tomlData The output of `parseConfigToml()` for a workflow TOML file.
+ * @param opts.skipWorkflowIdentity When true, suppress the #1447 workflow
+ *   identity check (`runAs="system"` + non-empty `accessRule`). Callers that
+ *   merge command-line overrides after parsing re-run `validateWorkflowIdentity`
+ *   against the effective metadata themselves.
  * @returns An array of error objects, one per offending field. Empty if no
  *   errors were found.
  */
-export function validateWorkflowToml(tomlData) {
+export function validateWorkflowToml(tomlData, opts) {
     const errors = [];
     if (tomlData === null || tomlData === undefined) {
         return errors;
     }
+    // #1447 — workflow-level identity lint: `runAs = "system"` + a non-empty
+    // `accessRule` is dead config. See `validateWorkflowIdentity` for the
+    // predicate. This runs BEFORE the `steps` early-returns below so a file
+    // carrying the bad combo but with missing/malformed `[[steps]]` is still
+    // flagged.
+    //
+    // Metadata shape (codex review, 2026-07-15): read the workflow table with
+    // the same `tomlData.workflow || tomlData` fallback the consuming commands
+    // use (`workflows create/update --from-file`), so an UNWRAPPED root-level
+    // TOML carrying `runAs`/`accessRule` is checked too — not only the wrapped
+    // `[workflow]` form.
+    //
+    // `skipWorkflowIdentity` (codex review, 2026-07-15): callers that apply
+    // command-line metadata overrides AFTER parsing (e.g. `workflows update
+    // --from-file` with `--access-rule`) pass this to suppress the identity
+    // check on the raw file, then re-run `validateWorkflowIdentity` against the
+    // merged/effective metadata themselves. Otherwise `--access-rule ""` could
+    // not repair an offending file, and an override-introduced accessRule would
+    // escape the lint. Structural checks (#685 misnest, etc.) still run.
+    if (!opts?.skipWorkflowIdentity) {
+        const identityError = validateWorkflowIdentity(tomlData.workflow || tomlData);
+        if (identityError)
+            errors.push(identityError);
+    }
     const steps = tomlData.steps;
     // No steps section at all → nothing to validate. This is fine for
     // partial TOML files (some commands accept a metadata-only file).
@@ -291,6 +388,12 @@ export function formatWorkflowTomlErrors(filePath, errors) {
             lines.push(`  steps[${err.stepIndex}] is malformed: ${err.hint}`);
             continue;
         }
+        // #1447 — workflow-level error, not tied to a step. Render the bare hint
+        // (no `steps[N]` prefix) under the file header.
+        if (err.field === "__workflow_system_access_rule__") {
+            lines.push(`  ${err.hint}`);
+            continue;
+        }
         // For errors inside a `collect` step's nested inner step (codex review,
         // 2026-05-15), use a `steps[N].step` slot prefix so operators see that
         // the offending field is on the inner step, not the outer collect.