primitive-admin 1.0.60 → 1.0.62

package/dist/src/lib/workflow-include-preserve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-include-preserve.js","sourceRoot":"","sources":["../../../src/lib/workflow-include-preserve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAqC7D,MAAM,UAAU,yBAAyB,CACvC,OAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,GACxE,OAAO,CAAC;IACV,MAAM,KAAK,GAAG,aAAa,WAAW,OAAO,CAAC;IAE9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAgC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW,GAAG,eAAe,CAAC,YAAY,CAAwB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yCAAyC;QACzC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtC,CAAC;IACD,IACE,WAAW,KAAK,IAAI;QACpB,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,IAAI,WAAW,CAAC,EAC3B,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,aAAkC,CAAC;IACvC,IAAI,CAAC;QACH,aAAa,GAAG,sBAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EACL,GAAG,KAAK,+CAA+C;gBACvD,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,mDAAmD;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAwB,CAAC;IAExE,2EAA2E;IAC3E,6EAA6E;IAC7E,2BAA2B;IAC3B,IAAI,cAAc,CAAC,aAAa,CAAC,KAAK,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,2BAA2B,CAAC;oBACnC,YAAY;oBACZ,WAAW;oBACX,SAAS;oBACT,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;oBACxC,cAAc;iBACf,CAAC;gBACF,OAAO,EACL,GAAG,KAAK,0DAA0D;oBAClE,kEAAkE;oBAClE,sCAAsC,WAAW,uBAAuB;aAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,2DAA2D;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACtD,CAAC,CAAC,aAAa,CAAC,KAAK;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,YAAY,CAAC,KAAK;QACpB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE7D,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,sEAAsE;QACtE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CACzC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACrC,WAAW,CACZ,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EACL,GAAG,KAAK,6DAA6D;gBACrE,oCAAoC,QAAQ,qBAAqB;gBACjE,gEAAgE;gBAChE,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAExD,2EAA2E;IAC3E,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;IACnC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC;QAClC,OAAO,EACL,GAAG,KAAK,UAAU,aAAa,uCAAuC;YACtE,SAAS,cAAc,CAAC,MAAM,4CAA4C;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,WAAgC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,qGAAqG;AACrG,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,yEAAyE;IACzE,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,yEAAyE;QACzE,IAAI,YAAY,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,EAAE,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,mEAAmE;YACnE,gEAAgE;YAChE,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,GAAG,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBAC5D,MAAM,GAAG,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,UAAU,EAAE,CAAC;YACb,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ;QAAE,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvD,CAAC,CAAC,GAAG,QAAQ,IAAI;QACjB,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAAC,OAMpC;IACC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,GACxE,OAAO,CAAC;IACV,MAAM,QAAQ,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAwB,CAAC;YAClE,IACE,CAAC,uBAAuB,CAAC,QAAQ,CAAC;gBAClC,cAAc,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;oBACzD,UAAU,EACZ,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC;IACnD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CACjC,aAAyC,EACzC,WAAuC;IAEvC,IAAI,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,kBAAkB,WAAW,CAAC,MAAM,4BAA4B,aAAa,CAAC,MAAM,wBAAwB,CAAC;IACtH,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,IACE,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YACxC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EACtC,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,OAAO,UAAU,KAAK,QAAQ;gBAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,UAAU,WAAW;gBACzC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,kCAAkC,UAAU,GAAG,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAqC;IAC3D,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IACpB,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/dist/src/lib/workflow-payload.d.ts

@@ -3,8 +3,8 @@
  *
  * Background: the CLI built the create/update workflow payload in THREE
  * separate hand-enumerated literals — `workflows create --from-file`
- * (`cli/src/commands/workflows.ts`), the `sync push` create branch
- * (`cli/src/commands/sync.ts`), and the `sync push` update branch (the metadata
+ * (`cli/src/commands/workflows.ts`), the `config push` create branch
+ * (`cli/src/commands/sync.ts`), and the `config push` update branch (the metadata
  * PATCH in `cli/src/lib/workflow-apply.ts`). Because each site listed the
  * `[workflow]` fields by hand, they drifted apart: a field added to one path was
  * silently dropped by the others. `status` was the 4th field lost this way
@@ -27,18 +27,30 @@
  * Presence semantics, by mode:
  *   - create: optional strings coalesce absent/empty → `undefined` (omit; the
  *     server default applies). `capabilities` forwards the raw array (absent →
- *     omit). Schemas omit when absent.
- *   - update: optional strings distinguish explicit-clear from leave-unset via
- *     `x !== undefined ? (x || null) : undefined`. `status` forwards the bare
- *     value (matching the server's hasOwnProperty path). Schemas send `null`
- *     when absent so a cleared schema round-trips.
- *   - booleans (`requiresClientApply`, and `syncCallable` on create) are raw
- *     pass-through so an explicit `false` is preserved and only a truly-absent
- *     key drops.
- *   - `syncCallable` is OMITTED in `mode: "update"`: the server re-validates
- *     `syncCallable: true` against the CURRENTLY-active steps, so the update
- *     path must send it as a deferred second PATCH after the new steps are live
- *     (#807). `applyWorkflowBody` owns that second PATCH.
+ *     omit). Schemas omit when absent. Booleans are raw pass-through so an
+ *     explicit `false` is preserved and only a truly-absent key drops.
+ *   - update: ALWAYS-SEND (#2743). The workflow TOML fully describes the
+ *     workflow, so every update-mode field carries a definite value and
+ *     `undefined` never appears: a defaulted scalar (`status`, the queue
+ *     limits, `dequeueOrder`, `requiresClientApply`) sends its concrete model
+ *     default when the file omits it, and a nullable field (`description`,
+ *     `accessRule`, `runAs`, `capabilities`, the schemas, `lock`) sends `null`.
+ *     Deleting a line from the file therefore CONVERGES the server rather than
+ *     silently leaving the old value live (#1567's bug class). Optional strings
+ *     keep their `"" → null` coalescing, so an explicit clear and an omission
+ *     land on the same wire value.
+ *
+ *     Defaulted scalars deliberately travel as their default, not as `null`: a
+ *     server predating #2743 coerces a queue-limit `null` to `0`, while an
+ *     explicit default converges identically on both. The shared map lives in
+ *     `workflow-defaults.ts` (the diff normalizer reads the same copy).
+ *
+ *     Omit-preserve survives only as the SERVER's contract for other clients
+ *     (web-admin): the PATCH still leaves an absent key alone.
+ *   - `syncCallable` is OMITTED from the builder in `mode: "update"`: its
+ *     ordering relative to the steps write is `applyWorkflowBody`'s to decide
+ *     (#807 — enabling must validate against the NEW steps, so it is deferred
+ *     to a second PATCH; disabling rides the first PATCH). See that module.
  */
 export type WorkflowPayloadMode = "create" | "update";
 /**
@@ -68,13 +80,12 @@ export type WorkflowExpressionsPayload = {
  */
 export declare function parseWorkflowExpressionsToml(tomlData: any): WorkflowExpressionsPayload | undefined;
 /**
- * The `[workflow]`-derived keys the builder emits, per mode. Exported so the
- * drift-guard unit test can assert the key set hasn't silently lost a field —
- * the recurring bug class this builder closes. `update` omits `syncCallable`
- * (deferred second PATCH, #807); everything else is shared.
+ * The `[workflow]`-derived keys the builder emits, per mode — read from the
+ * vendored definition (#2644), not restated here. A field added to
+ * `src/config-surface/workflow.ts` is pushed with no edit to this file, which
+ * is what closes the recurring "CLI silently drops a new server field" bug.
  */
-export declare const WORKFLOW_PAYLOAD_FIELDS_CREATE: readonly ["name", "description", "status", "accessRule", "runAs", "capabilities", "perUserMaxRunning", "perUserMaxQueued", "perAppMaxRunning", "perAppMaxQueued", "queueTtlSeconds", "dequeueOrder", "requiresClientApply", "inputSchema", "outputSchema", "syncCallable"];
-export declare const WORKFLOW_PAYLOAD_FIELDS_UPDATE: ReadonlyArray<string>;
+export declare function workflowPayloadFields(mode: WorkflowPayloadMode): string[];
 /**
  * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML
  * `[workflow]` table. `workflow` is `tomlData.workflow` (already merged with any

package/dist/src/lib/workflow-payload.js

@@ -3,8 +3,8 @@
  *
  * Background: the CLI built the create/update workflow payload in THREE
  * separate hand-enumerated literals — `workflows create --from-file`
- * (`cli/src/commands/workflows.ts`), the `sync push` create branch
- * (`cli/src/commands/sync.ts`), and the `sync push` update branch (the metadata
+ * (`cli/src/commands/workflows.ts`), the `config push` create branch
+ * (`cli/src/commands/sync.ts`), and the `config push` update branch (the metadata
  * PATCH in `cli/src/lib/workflow-apply.ts`). Because each site listed the
  * `[workflow]` fields by hand, they drifted apart: a field added to one path was
  * silently dropped by the others. `status` was the 4th field lost this way
@@ -27,19 +27,34 @@
  * Presence semantics, by mode:
  *   - create: optional strings coalesce absent/empty → `undefined` (omit; the
  *     server default applies). `capabilities` forwards the raw array (absent →
- *     omit). Schemas omit when absent.
- *   - update: optional strings distinguish explicit-clear from leave-unset via
- *     `x !== undefined ? (x || null) : undefined`. `status` forwards the bare
- *     value (matching the server's hasOwnProperty path). Schemas send `null`
- *     when absent so a cleared schema round-trips.
- *   - booleans (`requiresClientApply`, and `syncCallable` on create) are raw
- *     pass-through so an explicit `false` is preserved and only a truly-absent
- *     key drops.
- *   - `syncCallable` is OMITTED in `mode: "update"`: the server re-validates
- *     `syncCallable: true` against the CURRENTLY-active steps, so the update
- *     path must send it as a deferred second PATCH after the new steps are live
- *     (#807). `applyWorkflowBody` owns that second PATCH.
+ *     omit). Schemas omit when absent. Booleans are raw pass-through so an
+ *     explicit `false` is preserved and only a truly-absent key drops.
+ *   - update: ALWAYS-SEND (#2743). The workflow TOML fully describes the
+ *     workflow, so every update-mode field carries a definite value and
+ *     `undefined` never appears: a defaulted scalar (`status`, the queue
+ *     limits, `dequeueOrder`, `requiresClientApply`) sends its concrete model
+ *     default when the file omits it, and a nullable field (`description`,
+ *     `accessRule`, `runAs`, `capabilities`, the schemas, `lock`) sends `null`.
+ *     Deleting a line from the file therefore CONVERGES the server rather than
+ *     silently leaving the old value live (#1567's bug class). Optional strings
+ *     keep their `"" → null` coalescing, so an explicit clear and an omission
+ *     land on the same wire value.
+ *
+ *     Defaulted scalars deliberately travel as their default, not as `null`: a
+ *     server predating #2743 coerces a queue-limit `null` to `0`, while an
+ *     explicit default converges identically on both. The shared map lives in
+ *     `workflow-defaults.ts` (the diff normalizer reads the same copy).
+ *
+ *     Omit-preserve survives only as the SERVER's contract for other clients
+ *     (web-admin): the PATCH still leaves an absent key alone.
+ *   - `syncCallable` is OMITTED from the builder in `mode: "update"`: its
+ *     ordering relative to the steps write is `applyWorkflowBody`'s to decide
+ *     (#807 — enabling must validate against the NEW steps, so it is deferred
+ *     to a second PATCH; disabling rides the first PATCH). See that module.
  */
+import { writableFieldNames } from "./generated-config-surfaces.js";
+import { WORKFLOW_TABLE } from "./config-surface.js";
+import { WORKFLOW_MODEL_DEFAULTS } from "./workflow-defaults.js";
 /**
  * Parse a JSON schema field that TOML may present as a string OR (for an inline
  * table) as an already-parsed object. Kept here in `cli/src/lib` so the builder
@@ -75,30 +90,62 @@ export function parseWorkflowExpressionsToml(tomlData) {
     return Object.keys(out).length > 0 ? { cel: out } : undefined;
 }
 /**
- * The `[workflow]`-derived keys the builder emits, per mode. Exported so the
- * drift-guard unit test can assert the key set hasn't silently lost a field —
- * the recurring bug class this builder closes. `update` omits `syncCallable`
- * (deferred second PATCH, #807); everything else is shared.
+ * Fields the SERVER accepts on update but this BUILDER deliberately leaves to
+ * the caller. This is a sequencing invariant, not a statement about the server:
+ * `syncCallable: true` is re-validated against the CURRENTLY-active steps, so
+ * enabling it has to wait for a second PATCH once the new steps are live (#807
+ * — `applyWorkflowBody` owns the whole sequence, including the `false` case it
+ * puts in the FIRST PATCH). The definition correctly declares
+ * `writableOn: ["create", "update"]`; the exception lives here, where the
+ * ordering decision is.
+ */
+const CREATE_ONLY_ON_THE_WIRE = new Set(["syncCallable"]);
+/**
+ * The `[workflow]`-derived keys the builder emits, per mode — read from the
+ * vendored definition (#2644), not restated here. A field added to
+ * `src/config-surface/workflow.ts` is pushed with no edit to this file, which
+ * is what closes the recurring "CLI silently drops a new server field" bug.
+ */
+export function workflowPayloadFields(mode) {
+    const fields = writableFieldNames(WORKFLOW_TABLE, mode);
+    return mode === "create"
+        ? fields
+        : fields.filter((f) => !CREATE_ONLY_ON_THE_WIRE.has(f));
+}
+/**
+ * Per-field value producers, keyed by the definition's field name. A field with
+ * no entry is a scalar passthrough: on create the TOML value is forwarded as-is
+ * (absent → `undefined`, which `JSON.stringify` drops so the server default
+ * applies); on update it converges (absent → the field's model default, or
+ * `null` when it has none). That is what makes a passthrough field authorable
+ * by editing the definition alone (#2644 criterion 1); the entries below are
+ * the fields whose value semantics are genuinely their own.
  */
-export const WORKFLOW_PAYLOAD_FIELDS_CREATE = [
-    "name",
-    "description",
-    "status",
-    "accessRule",
-    "runAs",
-    "capabilities",
-    "perUserMaxRunning",
-    "perUserMaxQueued",
-    "perAppMaxRunning",
-    "perAppMaxQueued",
-    "queueTtlSeconds",
-    "dequeueOrder",
-    "requiresClientApply",
-    "inputSchema",
-    "outputSchema",
-    "syncCallable",
-];
-export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.filter((f) => f !== "syncCallable");
+const PAYLOAD_VALUE = {
+    // accessRule / runAs / description — create coalesces absent/empty → omit;
+    // update coalesces both an explicit clear ("") and an omission to `null`,
+    // because the file is the whole truth (#2743). `value || null` also keeps a
+    // whitespace-only value out of the "set" state the server would trim to "".
+    accessRule: (value, create) => (create ? value || undefined : value || null),
+    runAs: (value, create) => (create ? value || undefined : value || null),
+    description: (value, create) => (create ? value : value || null),
+    // Schemas — parse a JSON string (or accept an inline table). Create omits
+    // when absent; update sends null so a cleared schema round-trips.
+    inputSchema: (value, create) => value ? safeJsonParse(value) : create ? undefined : null,
+    outputSchema: (value, create) => value ? safeJsonParse(value) : create ? undefined : null,
+    // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
+    // A TOML-owned nested-object field, mirroring the schemas above. Presence-
+    // keyed, not truthiness-keyed: forward the value whenever the KEY is present
+    // (`!== undefined`) — the server's create/PATCH accept an object OR a JSON
+    // string, so a present-but-malformed falsy value (`lock = false`/`0`) must
+    // be forwarded so the server surfaces its validation error, rather than
+    // being silently treated as absent (dropped on create, cleared on update).
+    // Absent on create → omit (server default: no lock); absent on update →
+    // null so removing `[workflow.lock]` clears the server-side lock
+    // (config-as-code). Before this the field was dropped from both sync paths,
+    // so a pull → push cycle silently lost the lock (#1972).
+    lock: (value, create) => value !== undefined ? value : create ? undefined : null,
+};
 /**
  * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML
  * `[workflow]` table. `workflow` is `tomlData.workflow` (already merged with any
@@ -108,63 +155,23 @@ export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.fil
  */
 export function buildWorkflowPayloadFromToml(workflow, { mode }) {
     const create = mode === "create";
-    const payload = {
-        name: workflow.name,
-        description: workflow.description,
-        // status — create coalesces absent/empty → omit (server default `draft`
-        // applies); update forwards the bare value so it round-trips and an
-        // explicit "" surfaces the server's validation error rather than a silent
-        // no-op (matches the pre-existing update path).
-        status: create ? workflow.status || undefined : workflow.status,
-        // accessRule / runAs — create coalesces absent/empty → omit; update
-        // distinguishes explicit clear ("" → null) from leave-unset (absent →
-        // undefined).
-        accessRule: create
-            ? workflow.accessRule || undefined
-            : workflow.accessRule !== undefined
-                ? workflow.accessRule || null
-                : undefined,
-        runAs: create
-            ? workflow.runAs || undefined
-            : workflow.runAs !== undefined
-                ? workflow.runAs || null
-                : undefined,
-        // capabilities — create forwards the raw array (absent → omit); update
-        // forwards presence-aware so an explicit array round-trips. (The server
-        // update PATCH persist for capabilities is tracked separately in #1232; the
-        // round-trip guard asserts capabilities on the create leg only.)
-        capabilities: create
-            ? workflow.capabilities
-            : workflow.capabilities !== undefined
-                ? workflow.capabilities
-                : undefined,
-        // Queue limits — raw numeric pass-through both modes (absent → omit).
-        perUserMaxRunning: workflow.perUserMaxRunning,
-        perUserMaxQueued: workflow.perUserMaxQueued,
-        perAppMaxRunning: workflow.perAppMaxRunning,
-        perAppMaxQueued: workflow.perAppMaxQueued,
-        queueTtlSeconds: workflow.queueTtlSeconds,
-        dequeueOrder: workflow.dequeueOrder,
-        // requiresClientApply — raw boolean pass-through so an explicit `false` is
-        // preserved and only a truly-absent key drops (server default applies).
-        requiresClientApply: workflow.requiresClientApply,
-        // Schemas — parse a JSON string (or accept an inline table). Create omits
-        // when absent; update sends null so a cleared schema round-trips.
-        inputSchema: workflow.inputSchema
-            ? safeJsonParse(workflow.inputSchema)
-            : create
-                ? undefined
-                : null,
-        outputSchema: workflow.outputSchema
-            ? safeJsonParse(workflow.outputSchema)
+    const payload = {};
+    for (const field of workflowPayloadFields(mode)) {
+        const descriptor = WORKFLOW_TABLE.fields.find((f) => f.field === field);
+        const tomlKey = descriptor?.tomlKey ?? field;
+        const produce = PAYLOAD_VALUE[field];
+        const raw = workflow[tomlKey];
+        payload[field] = produce
+            ? produce(raw, create, workflow)
             : create
-                ? undefined
-                : null,
-    };
-    // syncCallable — create includes it (raw boolean pass-through); update omits
-    // it (deferred second PATCH, #807 — see module doc).
-    if (create) {
-        payload.syncCallable = workflow.syncCallable;
+                ? // Scalar passthrough on create: queue limits, dequeueOrder, name,
+                    // capabilities, and the boolean flags — raw so an explicit `false`
+                    // or `0` survives and only a truly-absent key drops.
+                    raw
+                : // Update converges (#2743): a field the file omits sends its concrete
+                    // model default, or `null` when it has none (`name`, `capabilities`).
+                    // `??` (not `||`) so an explicit `false` / `0` still wins.
+                    (raw ?? WORKFLOW_MODEL_DEFAULTS[field] ?? null);
     }
     return payload;
 }

package/dist/src/lib/workflow-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,MAAM,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CACH,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEjC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,cAAc;QACd,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YAClC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC7B,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,MAAM;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,SAAS;QACf,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACvB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,0EAA0E;QAC1E,kEAAkE;QAClE,WAAW,EAAE,QAAQ,CAAC,WAAW;YAC/B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;KACX,CAAC;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,aAAa,GAGf;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IAC5E,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IACvE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAC7B,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;IAC1D,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAC9B,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;IAC1D,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACtB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;CAC1D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO;YACtB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;YAChC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kEAAkE;oBAClE,mEAAmE;oBACnE,qDAAqD;oBACrD,GAAG;gBACL,CAAC,CAAC,sEAAsE;oBACtE,sEAAsE;oBACtE,2DAA2D;oBAC3D,CAAC,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/lib/workflow-toml-validator.d.ts

@@ -54,6 +54,12 @@ export declare const KNOWN_KINDS_FOR_DRIFT_GUARD: ReadonlySet<string>;
  * errors:
  *  - `__steps_shape__`: `steps` is not an array (table or scalar).
  *  - `__step_shape__`: a step is not an object.
+ *  - `__workflow_system_access_rule__`: `[workflow] runAs = "system"` with a
+ *    non-empty `accessRule` — dead config the server rejects (#1447/#1258).
+ *    A workflow-level error (not tied to a step): `stepIndex: -1, stepId: null`.
+ *  - `__template_expression__`: a `{{ }}` expression that can never resolve
+ *    (#2689). The field itself is valid — the `hint` carries the expression's
+ *    location and the lint's message.
  * `hint` is a short, user-facing explanation (used by
  * `formatWorkflowTomlErrors` to render the multi-line diagnostic).
  * `parentStepId` is set when this error came from a `collect` step's
@@ -70,14 +76,85 @@ export type WorkflowTomlError = {
     hint: string;
     parentStepId?: string | null;
 };
+/**
+ * #1447 workflow-identity predicate, extracted (codex review, 2026-07-15) so
+ * command sites that apply command-line metadata overrides can re-run it
+ * against the merged/effective workflow rather than only the parsed file.
+ *
+ * `runAs = "system"` + a non-empty `accessRule` is dead config: a system run
+ * can only be started by the system and never evaluates its accessRule, so any
+ * non-empty rule is inert. The server rejects this at save time (#1258,
+ * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
+ * `config push` all-or-nothing instead of failing mid-push and leaving partial
+ * server state (#1418 drift).
+ *
+ * Mirrors the server predicate byte-for-byte: returns the sentinel error only
+ * when `runAs === "system"` AND `typeof accessRule === "string"` AND
+ * `accessRule.trim() !== ""`. Default/unset/empty/whitespace-only runAs or
+ * accessRule (and a bare non-string boolean accessRule) return `null`.
+ *
+ * @param workflow The workflow-metadata object — the `[workflow]` table, or
+ *   for commands that accept unwrapped root-level metadata, the root TOML
+ *   object (`tomlData.workflow || tomlData`). Non-object inputs return `null`.
+ */
+export declare function validateWorkflowIdentity(workflow: any): WorkflowTomlError | null;
+/**
+ * #2643 — `templateMissingMarker` was removed from the platform. A workflow
+ * TOML that still sets it is rejected here, before the push, with the same
+ * sentence the server returns, rather than being silently dropped.
+ */
+export declare const REMOVED_TEMPLATE_MISSING_MARKER_MESSAGE: string;
+/**
+ * Non-blocking notes for a workflow TOML — things worth saying on a push that
+ * are not errors.
+ *
+ * #2643: `strict` / `strictParams` are accepted and ignored, because the
+ * failure they used to opt into now applies to every workflow. A definition
+ * that sets them keeps working unchanged, so this is a note, not an error.
+ */
+export declare function collectWorkflowTomlNotes(tomlData: any): string[];
+/** The runAs / accessRule pair the identity lint reads. */
+export interface WorkflowIdentityFields {
+    runAs?: unknown;
+    accessRule?: unknown;
+}
+/**
+ * #1447 (maintainer decision, 2026-07-21): compute the EFFECTIVE workflow
+ * identity that an `update --from-file` push will leave on the server — the
+ * merge of the persisted record with the incoming file/flags.
+ *
+ * The merge exists for a caller whose push OMITS one side of the
+ * runAs/accessRule pair and lets the server retain it. Linting the incoming
+ * payload alone misses the case where the OTHER side is already `system` / a
+ * stored rule: an existing `runAs="system"` workflow plus a file adding only an
+ * `accessRule`, or a file flipping a workflow with a stored rule to
+ * `runAs="system"`. Both pass a payload-only lint and are then rejected by the
+ * server's PATCH. Merging the two before `validateWorkflowIdentity` catches
+ * them locally at zero extra cost — the persisted record is already fetched at
+ * the call site.
+ *
+ * NOT `config push`, since #2743: its update is always-send, so the file alone IS
+ * the effective config (an omitted `accessRule` clears the stored rule rather
+ * than inheriting it) and its push-time lint of the file is exact. The merge
+ * semantics below are unchanged for any caller that does omit fields: a field
+ * PRESENT in `incoming` (including an empty-string clear) overrides the stored
+ * value; an ABSENT field (undefined) falls back to what the server keeps.
+ */
+export declare function effectiveWorkflowIdentity(existing: WorkflowIdentityFields | null | undefined, incoming: WorkflowIdentityFields | null | undefined): WorkflowIdentityFields;
 /**
  * Walk a parsed workflow TOML document and return all unknown-field errors.
  *
  * @param tomlData The output of `parseConfigToml()` for a workflow TOML file.
+ * @param opts.skipWorkflowIdentity When true, suppress the #1447 workflow
+ *   identity check (`runAs="system"` + non-empty `accessRule`). Callers that
+ *   merge command-line overrides after parsing re-run `validateWorkflowIdentity`
+ *   against the effective metadata themselves.
  * @returns An array of error objects, one per offending field. Empty if no
  *   errors were found.
  */
-export declare function validateWorkflowToml(tomlData: any): WorkflowTomlError[];
+export declare function validateWorkflowToml(tomlData: any, opts?: {
+    skipWorkflowIdentity?: boolean;
+}): WorkflowTomlError[];
 /**
  * Render a multi-line diagnostic for a list of errors. Designed for the
  * shape called out in the issue:
@@ -96,7 +173,7 @@ export declare function formatWorkflowTomlErrors(filePath: string, errors: Workf
 /**
  * #1614 — client-side mirror of the server's `validateWorkflowExpressions`
  * (`src/workflows/definition-store.ts`) for named `expr.*` CEL guards. Returns
- * structural errors so `sync push` fails fast with the same class of diagnostic
+ * structural errors so `config push` fails fast with the same class of diagnostic
  * the server would 400 on:
  *   1. every `expr.<name>` reference — in a definition body OR a step guard
  *      (`runIf` / `successWhen` / switch `when`) — names a DECLARED definition;
@@ -112,7 +189,7 @@ export declare function formatWorkflowTomlErrors(filePath: string, errors: Workf
  * #1614 — validate the RAW `[expr.cel]` table shape BEFORE
  * `parseWorkflowExpressionsToml` filters it. That parser drops any entry whose
  * body is not a string, so a mistyped `ready = true` would vanish and, with no
- * references left to fail on, `sync push` would succeed while omitting the whole
+ * references left to fail on, `config push` would succeed while omitting the whole
  * expression table. Surface non-string / empty / wrong-typed bodies (and a
  * non-table `cel`) as a hard CLI validation error instead. Mirrors the server's
  * `validateRawExpressionsShape` (`src/workflows/definition-store.ts`).