primitive-admin 1.0.61 → 1.0.62

package/dist/src/lib/workflow-codegen/invokerIR.js

@@ -22,6 +22,7 @@
 import { parseConfigToml } from "../config-toml.js";
 import { safeJsonParse } from "../workflow-payload.js";
 import { schemaRejectsEmptyObject } from "./schemaToTs.js";
+import { describeSchema } from "./generated-schema-descriptor.js";
 import { INTERNAL_WORKFLOW_KEY_PREFIX, isPlatformOwnedWorkflowKey, } from "../platform-owned.js";
 // Re-export so existing importers of these codegen symbols keep working; the
 // single source of truth is now `../platform-owned.js` (#1660), shared with the
@@ -64,6 +65,10 @@ export function describeWorkflowInvoker(source) {
         // server applies when it decides whether a completed run needs a client
         // apply. An absent key means apply-mode.
         requiresClientApply: workflow.requiresClientApply !== false,
+        // Object-shaped only when the schema declares exactly `type: "object"` —
+        // the one case a cron `rootInput` may legitimately be partial.
+        inputIsObjectShaped: inputSchema !== undefined &&
+            describeSchema(inputSchema).singularType === "object",
         inputSchema,
         outputSchema,
     };

package/dist/src/lib/workflow-codegen/invokerIR.js.map

@@ -1 +1 @@
-{"version":3,"file":"invokerIR.js","sourceRoot":"","sources":["../../../../src/lib/workflow-codegen/invokerIR.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,6EAA6E;AAC7E,gFAAgF;AAChF,qEAAqE;AACrE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAiDxC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6B;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAQ,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GACP,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC,GAAG;QACd,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAEtB,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,2EAA2E;IAC3E,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO;QACL,GAAG;QACH,YAAY,EAAE,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC5C,yEAAyE;QACzE,oEAAoE;QACpE,aAAa,EACX,WAAW,KAAK,SAAS,IAAI,wBAAwB,CAAC,WAAW,CAAC;QACpE,2EAA2E;QAC3E,wEAAwE;QACxE,yCAAyC;QACzC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,KAAK,KAAK;QAC3D,WAAW;QACX,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"invokerIR.js","sourceRoot":"","sources":["../../../../src/lib/workflow-codegen/invokerIR.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,6EAA6E;AAC7E,gFAAgF;AAChF,qEAAqE;AACrE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AA4DxC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6B;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAQ,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GACP,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC,GAAG;QACd,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAEtB,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,2EAA2E;IAC3E,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO;QACL,GAAG;QACH,YAAY,EAAE,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC5C,yEAAyE;QACzE,oEAAoE;QACpE,aAAa,EACX,WAAW,KAAK,SAAS,IAAI,wBAAwB,CAAC,WAAW,CAAC;QACpE,2EAA2E;QAC3E,wEAAwE;QACxE,yCAAyC;QACzC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,KAAK,KAAK;QAC3D,yEAAyE;QACzE,+DAA+D;QAC/D,mBAAmB,EACjB,WAAW,KAAK,SAAS;YACzB,cAAc,CAAC,WAAW,CAAC,CAAC,YAAY,KAAK,QAAQ;QACvD,WAAW;QACX,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/src/lib/workflow-config-apply.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Apply a workflow's named config sidecars, and honor `activeConfigName`
+ * (issue #2645, spec §Contracts/Named configs).
+ *
+ * ── What this is for ─────────────────────────────────────────────────────
+ * Named configs used to be reachable only through `workflows configs
+ * create/update/duplicate/activate`. Those verbs are removed, so `config push`
+ * has to apply the bodies now — otherwise the capability would have been
+ * deleted rather than moved to TOML, which the spec's criterion 2 forbids.
+ *
+ * ── Division of labour with `applyWorkflowBody` ──────────────────────────
+ * The ACTIVE config's body stays where it already is: the `steps` at the top of
+ * `workflows/<key>.toml`, written through `applyWorkflowBody`'s
+ * ordering-sensitive sequence (metadata PATCH → steps → deferred `syncCallable`
+ * PATCH, #807). That path is deliberately untouched — a second single-object
+ * apply is what broke that ordering before. This module handles the OTHER named
+ * configs, each from its own sidecar, and then the activation.
+ *
+ * So each config body is declared exactly once: the live one at the top of the
+ * workflow file, every other one in `workflows/<key>.configs/<name>.toml`.
+ * After a pull that follows an `activeConfigName` change, the two swap roles.
+ *
+ * ── Ordering ─────────────────────────────────────────────────────────────
+ * Bodies first, activation last. Activating a config before writing its steps
+ * would put an empty or stale body into service for the width of one call.
+ */
+import type { ApiClient } from "./api-client.js";
+import type { WorkflowConfigSidecar } from "./workflow-config-sidecar.js";
+export interface ApplyWorkflowConfigsOptions {
+    /** The workflow's configs as the server currently has them. */
+    serverConfigs: any[];
+    /** `[workflow].activeConfigName` from the TOML, when the author set one. */
+    activeConfigName?: string;
+    /** The config that is live right now, so a no-op activation is skipped. */
+    currentActiveConfigId?: string;
+    /**
+     * Let `activeConfigName` NAME the config that just received the workflow
+     * file's body, instead of requiring it to already exist.
+     *
+     * Create only. A workflow the server has just made carries one config it
+     * named itself ("default"), holding the body from `workflows/<key>.toml` —
+     * and pull never writes a sidecar for the active config, so on a fresh app
+     * there is nothing else `activeConfigName` could be referring to.
+     *
+     * Deliberately NOT set on update: there, an `activeConfigName` matching no
+     * config and no sidecar is far more likely a typo than a rename, and
+     * renaming the live config out from under that typo would be a silent
+     * mutation. Update keeps failing with the message that names the file to
+     * author.
+     */
+    adoptActiveConfigName?: boolean;
+    log?: (message: string) => void;
+}
+export interface ApplyWorkflowConfigsResult {
+    /** Config name → id, which the rest of push needs to resolve test cases. */
+    configIds: Map<string, string>;
+    /** Whether this call moved the live config. */
+    activated: boolean;
+    /** The config that is live once this call returns, when known. */
+    activeConfigId?: string;
+}
+/**
+ * Create or update each sidecar's config, then activate the named one.
+ *
+ * Reports whether it activated anything: activation writes the workflow
+ * DEFINITION (`activeConfigId`, and with it a fresh `modifiedAt`), so the
+ * caller's sync state is stale afterwards unless it re-reads — which is how a
+ * push that only switched the active config left the next one to conflict.
+ */
+export declare function applyWorkflowConfigSidecars(client: ApiClient, appId: string, workflowId: string, sidecars: readonly WorkflowConfigSidecar[], options: ApplyWorkflowConfigsOptions): Promise<ApplyWorkflowConfigsResult>;

package/dist/src/lib/workflow-config-apply.js

@@ -0,0 +1,137 @@
+/**
+ * Apply a workflow's named config sidecars, and honor `activeConfigName`
+ * (issue #2645, spec §Contracts/Named configs).
+ *
+ * ── What this is for ─────────────────────────────────────────────────────
+ * Named configs used to be reachable only through `workflows configs
+ * create/update/duplicate/activate`. Those verbs are removed, so `config push`
+ * has to apply the bodies now — otherwise the capability would have been
+ * deleted rather than moved to TOML, which the spec's criterion 2 forbids.
+ *
+ * ── Division of labour with `applyWorkflowBody` ──────────────────────────
+ * The ACTIVE config's body stays where it already is: the `steps` at the top of
+ * `workflows/<key>.toml`, written through `applyWorkflowBody`'s
+ * ordering-sensitive sequence (metadata PATCH → steps → deferred `syncCallable`
+ * PATCH, #807). That path is deliberately untouched — a second single-object
+ * apply is what broke that ordering before. This module handles the OTHER named
+ * configs, each from its own sidecar, and then the activation.
+ *
+ * So each config body is declared exactly once: the live one at the top of the
+ * workflow file, every other one in `workflows/<key>.configs/<name>.toml`.
+ * After a pull that follows an `activeConfigName` change, the two swap roles.
+ *
+ * ── Ordering ─────────────────────────────────────────────────────────────
+ * Bodies first, activation last. Activating a config before writing its steps
+ * would put an empty or stale body into service for the width of one call.
+ */
+/**
+ * Create or update each sidecar's config, then activate the named one.
+ *
+ * Reports whether it activated anything: activation writes the workflow
+ * DEFINITION (`activeConfigId`, and with it a fresh `modifiedAt`), so the
+ * caller's sync state is stale afterwards unless it re-reads — which is how a
+ * push that only switched the active config left the next one to conflict.
+ */
+export async function applyWorkflowConfigSidecars(client, appId, workflowId, sidecars, options) {
+    const { serverConfigs, activeConfigName, currentActiveConfigId, adoptActiveConfigName, } = options;
+    const log = options.log ?? (() => { });
+    const nameToId = new Map();
+    for (const config of serverConfigs ?? []) {
+        if (config?.configName && config?.configId) {
+            nameToId.set(config.configName, config.configId);
+        }
+    }
+    // The workflow file's own `[[steps]]` IS the active config's body — pull
+    // deliberately does not repeat it as a sidecar
+    // (`workflowConfigSidecarsToWrite`). So when `activeConfigName` names no
+    // config the server knows, the config that just received that body is the
+    // one the file is naming, and it takes the authored name.
+    //
+    // Without this, a pulled tree could not be pushed back: the server names a
+    // new workflow's first config "default" (`admin-api.ts`), so any workflow
+    // whose active config is called something else pulled to a tree whose
+    // `activeConfigName` matched no sidecar and no server config — push then
+    // refused a file pull had just written. This runs BEFORE the sidecar loop so
+    // a `default.toml` sidecar creates its own config rather than overwriting
+    // the active body on its way past.
+    if (adoptActiveConfigName &&
+        activeConfigName &&
+        !nameToId.has(activeConfigName) &&
+        currentActiveConfigId) {
+        await client.updateWorkflowConfig(appId, workflowId, currentActiveConfigId, { configName: activeConfigName });
+        // The name it had is now free, and the map must say so. Leaving the old
+        // entry pointing at this id makes the sidecar of that name look like an
+        // existing config: the loop below UPDATES the just-renamed one instead of
+        // creating its own, both sidecars collapse onto a single config, and
+        // whichever is applied last silently wins. A fresh cross-app push of a
+        // two-config workflow landed exactly one config because of this.
+        for (const [name, id] of nameToId) {
+            if (id === currentActiveConfigId)
+                nameToId.delete(name);
+        }
+        nameToId.set(activeConfigName, currentActiveConfigId);
+        log(`    Named the active config "${activeConfigName}"`);
+    }
+    for (const sidecar of sidecars) {
+        const existingId = nameToId.get(sidecar.name);
+        if (existingId) {
+            // In place: the config keeps its id, so anything pointing at it (a test
+            // case, a running trigger) keeps working across the edit.
+            //
+            // `description` and `status` travel with the steps: they are in the file,
+            // so the file owns them (#1567's convention — an omitted `description`
+            // sends `null` and clears, since that is what the round-trip means). An
+            // update that sent steps alone silently ignored half of what the author
+            // wrote, which is the same invisibility the flag removal was about.
+            await client.updateWorkflowConfig(appId, workflowId, existingId, {
+                steps: sidecar.steps,
+                expressions: sidecar.expressions,
+                description: sidecar.description ?? null,
+                // A defaulted enum, so there is no "clear": an absent key leaves the
+                // server's value alone rather than inventing one.
+                status: sidecar.status,
+            });
+            log(`    Updated config "${sidecar.name}"`);
+        }
+        else {
+            const created = await client.createWorkflowConfig(appId, workflowId, {
+                configName: sidecar.name,
+                description: sidecar.description,
+                steps: sidecar.steps,
+                expressions: sidecar.expressions,
+            });
+            if (created?.configId)
+                nameToId.set(sidecar.name, created.configId);
+            log(`    Created config "${sidecar.name}"`);
+            // Create always mints an ACTIVE config (admin-api.ts, createWorkflowConfig
+            // hard-codes it), so a sidecar that says otherwise needs the follow-up
+            // write or its `status` would be silently dropped on a fresh app.
+            if (created?.configId && sidecar.status && sidecar.status !== "active") {
+                await client.updateWorkflowConfig(appId, workflowId, created.configId, {
+                    status: sidecar.status,
+                });
+            }
+        }
+    }
+    let activated = false;
+    let activeConfigId = currentActiveConfigId;
+    if (activeConfigName) {
+        const targetId = nameToId.get(activeConfigName);
+        if (!targetId) {
+            // Leaving the old config live would mean the committed file says one
+            // config is running and another is — the exact drift this issue removes.
+            // A typo has to stop the push, not be absorbed by it.
+            throw new Error(`activeConfigName "${activeConfigName}" names no configuration. ` +
+                `Author it at workflows/<key>.configs/${activeConfigName}.toml, or ` +
+                `correct the name in workflows/<key>.toml.`);
+        }
+        if (targetId !== currentActiveConfigId) {
+            await client.activateWorkflowConfig(appId, workflowId, targetId);
+            log(`    Activated config "${activeConfigName}"`);
+            activated = true;
+        }
+        activeConfigId = targetId;
+    }
+    return { configIds: nameToId, activated, activeConfigId };
+}
+//# sourceMappingURL=workflow-config-apply.js.map

package/dist/src/lib/workflow-config-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-config-apply.js","sourceRoot":"","sources":["../../../src/lib/workflow-config-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwCH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,QAA0C,EAC1C,OAAoC;IAEpC,MAAM,EACJ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,GAAG,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,MAAM,EAAE,UAAU,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC3C,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,+CAA+C;IAC/C,yEAAyE;IACzE,0EAA0E;IAC1E,0DAA0D;IAC1D,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,mCAAmC;IACnC,IACE,qBAAqB;QACrB,gBAAgB;QAChB,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/B,qBAAqB,EACrB,CAAC;QACD,MAAM,MAAM,CAAC,oBAAoB,CAC/B,KAAK,EACL,UAAU,EACV,qBAAqB,EACrB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACjC,CAAC;QACF,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;YAClC,IAAI,EAAE,KAAK,qBAAqB;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,gCAAgC,gBAAgB,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,wEAAwE;YACxE,0DAA0D;YAC1D,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;gBAC/D,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;gBACxC,qEAAqE;gBACrE,kDAAkD;gBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE;gBACnE,UAAU,EAAE,OAAO,CAAC,IAAI;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,QAAQ;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAC5C,2EAA2E;YAC3E,uEAAuE;YACvE,kEAAkE;YAClE,IAAI,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACvE,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACrE,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,cAAc,GAAG,qBAAqB,CAAC;IAC3C,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,qEAAqE;YACrE,yEAAyE;YACzE,sDAAsD;YACtD,MAAM,IAAI,KAAK,CACb,qBAAqB,gBAAgB,4BAA4B;gBAC/D,wCAAwC,gBAAgB,YAAY;gBACpE,2CAA2C,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,GAAG,CAAC,yBAAyB,gBAAgB,GAAG,CAAC,CAAC;YAClD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,cAAc,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC5D,CAAC"}

package/dist/src/lib/workflow-config-sidecar.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Named workflow configs as files (issue #2645, spec §Contracts/Named configs).
+ *
+ * A workflow's named configurations used to reach the server only through
+ * `workflows configs create/update/duplicate/activate` — verbs, not files. That
+ * made the live body of a running workflow invisible to the repo and to review,
+ * which is precisely the failure #1976 records and the reason this issue exists.
+ * The design-gate decision was "TOML wins": each config body is a file at
+ * `workflows/<key>.configs/<name>.toml`, and `activeConfigName` in
+ * `workflows/<key>.toml` names the live one.
+ *
+ * The layout mirrors the `<key>.tests/` sidecar convention the sync tree
+ * already uses, so there is one directory idiom rather than two.
+ *
+ *   workflows/order-intake.toml            # the workflow, incl. activeConfigName
+ *   workflows/order-intake.configs/v2.toml # a named config body
+ *   workflows/order-intake.tests/*.toml    # test cases (pre-existing)
+ *
+ * File shape:
+ *
+ *   [config]
+ *   description = "second cut"
+ *   status = "active"
+ *
+ *   [[steps]]
+ *   id = "greet"
+ *   kind = "noop"
+ *
+ *   [expr.cel]
+ *   ready = "input.ok == true"
+ *
+ * The config's NAME is the file name and is deliberately not restated inside
+ * the file: a second declaration would be a second thing to change and a
+ * mismatch to adjudicate, which is the shape of problem this issue removes.
+ */
+/** Directory holding a workflow's named config bodies. */
+export declare function workflowConfigsDir(configDir: string, key: string): string;
+/** The config name a sidecar file declares — its base name. */
+export declare function workflowConfigNameFromFile(file: string): string;
+/** A named config body, as authored on disk. */
+export interface WorkflowConfigSidecar {
+    name: string;
+    description?: string;
+    status?: string;
+    /** Always an array once parsed: an empty body is a real, pushable state. */
+    steps: any[];
+    /** `[expr.cel]` named guards travelling with these steps (#1614). */
+    expressions?: {
+        cel: Record<string, string>;
+    };
+}
+/** Emit a server config record as its sidecar file body. */
+export declare function serializeWorkflowConfigSidecar(config: any): string;
+/** Read a parsed sidecar back into the body `config push` applies. */
+export declare function parseWorkflowConfigSidecar(name: string, tomlData: any): WorkflowConfigSidecar;
+/**
+ * Every named config authored for a workflow, in file-name order.
+ *
+ * An absent directory returns an empty list rather than throwing: a workflow
+ * with no sidecars is the ordinary single-config case, where the body is the
+ * `steps` in `workflows/<key>.toml`.
+ */
+export declare function readWorkflowConfigSidecars(configDir: string, key: string, readToml?: (path: string) => any): WorkflowConfigSidecar[];

package/dist/src/lib/workflow-config-sidecar.js

@@ -0,0 +1,96 @@
+/**
+ * Named workflow configs as files (issue #2645, spec §Contracts/Named configs).
+ *
+ * A workflow's named configurations used to reach the server only through
+ * `workflows configs create/update/duplicate/activate` — verbs, not files. That
+ * made the live body of a running workflow invisible to the repo and to review,
+ * which is precisely the failure #1976 records and the reason this issue exists.
+ * The design-gate decision was "TOML wins": each config body is a file at
+ * `workflows/<key>.configs/<name>.toml`, and `activeConfigName` in
+ * `workflows/<key>.toml` names the live one.
+ *
+ * The layout mirrors the `<key>.tests/` sidecar convention the sync tree
+ * already uses, so there is one directory idiom rather than two.
+ *
+ *   workflows/order-intake.toml            # the workflow, incl. activeConfigName
+ *   workflows/order-intake.configs/v2.toml # a named config body
+ *   workflows/order-intake.tests/*.toml    # test cases (pre-existing)
+ *
+ * File shape:
+ *
+ *   [config]
+ *   description = "second cut"
+ *   status = "active"
+ *
+ *   [[steps]]
+ *   id = "greet"
+ *   kind = "noop"
+ *
+ *   [expr.cel]
+ *   ready = "input.ok == true"
+ *
+ * The config's NAME is the file name and is deliberately not restated inside
+ * the file: a second declaration would be a second thing to change and a
+ * mismatch to adjudicate, which is the shape of problem this issue removes.
+ */
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { basename, join } from "path";
+import { parseConfigToml, stringifyConfigToml } from "./config-toml.js";
+/** Directory holding a workflow's named config bodies. */
+export function workflowConfigsDir(configDir, key) {
+    return join(configDir, "workflows", `${key}.configs`);
+}
+/** The config name a sidecar file declares — its base name. */
+export function workflowConfigNameFromFile(file) {
+    return basename(file, ".toml");
+}
+/** Emit a server config record as its sidecar file body. */
+export function serializeWorkflowConfigSidecar(config) {
+    const cel = config?.expressions?.cel && typeof config.expressions.cel === "object"
+        ? config.expressions.cel
+        : undefined;
+    const data = {
+        config: {
+            description: config?.description || undefined,
+            status: config?.status || undefined,
+        },
+        steps: Array.isArray(config?.steps) ? config.steps : [],
+        ...(cel && Object.keys(cel).length > 0 ? { expr: { cel } } : {}),
+    };
+    for (const k of Object.keys(data.config)) {
+        if (data.config[k] === undefined)
+            delete data.config[k];
+    }
+    return stringifyConfigToml(data);
+}
+/** Read a parsed sidecar back into the body `config push` applies. */
+export function parseWorkflowConfigSidecar(name, tomlData) {
+    const config = tomlData?.config || {};
+    const cel = tomlData?.expr?.cel && typeof tomlData.expr.cel === "object"
+        ? tomlData.expr.cel
+        : undefined;
+    return {
+        name,
+        description: config.description ?? undefined,
+        status: config.status ?? undefined,
+        steps: Array.isArray(tomlData?.steps) ? tomlData.steps : [],
+        ...(cel ? { expressions: { cel } } : {}),
+    };
+}
+/**
+ * Every named config authored for a workflow, in file-name order.
+ *
+ * An absent directory returns an empty list rather than throwing: a workflow
+ * with no sidecars is the ordinary single-config case, where the body is the
+ * `steps` in `workflows/<key>.toml`.
+ */
+export function readWorkflowConfigSidecars(configDir, key, readToml = (p) => parseConfigToml(readFileSync(p, "utf-8"))) {
+    const dir = workflowConfigsDir(configDir, key);
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith(".toml"))
+        .sort()
+        .map((f) => parseWorkflowConfigSidecar(workflowConfigNameFromFile(f), readToml(join(dir, f))));
+}
+//# sourceMappingURL=workflow-config-sidecar.js.map

package/dist/src/lib/workflow-config-sidecar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-config-sidecar.js","sourceRoot":"","sources":["../../../src/lib/workflow-config-sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAExE,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,GAAW;IAC/D,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAaD,4DAA4D;AAC5D,MAAM,UAAU,8BAA8B,CAAC,MAAW;IACxD,MAAM,GAAG,GACP,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,QAAQ;QACpE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAQ;QAChB,MAAM,EAAE;YACN,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,SAAS;YAC7C,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS;SACpC;QACD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,QAAa;IAEb,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GACP,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC1D,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,SAAS;QAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;QAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC3D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,GAAW,EACX,WAAkC,CAAC,CAAC,EAAE,EAAE,CACtC,eAAe,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,0BAA0B,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClF,CAAC;AACN,CAAC"}

package/dist/src/lib/workflow-defaults.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The `[workflow]` fields whose model default the CLI has to know (#2743).
+ *
+ * Two call sites need the same map, and they must not drift:
+ *   - `buildWorkflowPayloadFromToml` (update mode) sends the CONCRETE default
+ *     for a field the TOML omits, so the push converges the server instead of
+ *     preserving the old value. It deliberately does NOT send `null` for these:
+ *     a server predating #2743 coerces a queue-limit `null` to `0`
+ *     (`Number(null)`), so an explicit default is the only value that converges
+ *     identically on both.
+ *   - `normalizeWorkflowTomlDefaults` (`config diff`) fills the same defaults into
+ *     the local side, so a hand-authored file that omits them compares equal to
+ *     a server holding the defaults — and unequal to one holding a real
+ *     override.
+ *
+ * These mirror `models.yaml` (`WorkflowDefinition`): `perUserMaxRunning=4`,
+ * `perUserMaxQueued=100`, `perAppMaxRunning=25`, `perAppMaxQueued=10000`,
+ * `queueTtlSeconds=43200`, `dequeueOrder="fifo"`, `requiresClientApply=true`,
+ * `syncCallable=false`.
+ *
+ * This is deliberately NOT a generic `models.yaml` default importer — the model
+ * carries defaults the serializer never writes. Only the serializer-emitted
+ * surface with a concrete default belongs here, because the remote side of a
+ * diff is hashed via `serializeWorkflow`. Emit-when-set fields whose GET value
+ * is null/empty when unset (`description`, `accessRule`, `runAs`,
+ * `capabilities`, the schemas, `lock`) have no default: push sends `null` for
+ * them and both sides of the diff simply omit the key.
+ */
+export declare const WORKFLOW_MODEL_DEFAULTS: Record<string, unknown>;

package/dist/src/lib/workflow-defaults.js

@@ -0,0 +1,41 @@
+/**
+ * The `[workflow]` fields whose model default the CLI has to know (#2743).
+ *
+ * Two call sites need the same map, and they must not drift:
+ *   - `buildWorkflowPayloadFromToml` (update mode) sends the CONCRETE default
+ *     for a field the TOML omits, so the push converges the server instead of
+ *     preserving the old value. It deliberately does NOT send `null` for these:
+ *     a server predating #2743 coerces a queue-limit `null` to `0`
+ *     (`Number(null)`), so an explicit default is the only value that converges
+ *     identically on both.
+ *   - `normalizeWorkflowTomlDefaults` (`config diff`) fills the same defaults into
+ *     the local side, so a hand-authored file that omits them compares equal to
+ *     a server holding the defaults — and unequal to one holding a real
+ *     override.
+ *
+ * These mirror `models.yaml` (`WorkflowDefinition`): `perUserMaxRunning=4`,
+ * `perUserMaxQueued=100`, `perAppMaxRunning=25`, `perAppMaxQueued=10000`,
+ * `queueTtlSeconds=43200`, `dequeueOrder="fifo"`, `requiresClientApply=true`,
+ * `syncCallable=false`.
+ *
+ * This is deliberately NOT a generic `models.yaml` default importer — the model
+ * carries defaults the serializer never writes. Only the serializer-emitted
+ * surface with a concrete default belongs here, because the remote side of a
+ * diff is hashed via `serializeWorkflow`. Emit-when-set fields whose GET value
+ * is null/empty when unset (`description`, `accessRule`, `runAs`,
+ * `capabilities`, the schemas, `lock`) have no default: push sends `null` for
+ * them and both sides of the diff simply omit the key.
+ */
+export const WORKFLOW_MODEL_DEFAULTS = {
+    // #2803 — no `status`. Availability is server-owned and off the config wire,
+    // so the file has no status line for a diff to normalize or a push to send.
+    perUserMaxRunning: 4,
+    perUserMaxQueued: 100,
+    perAppMaxRunning: 25,
+    perAppMaxQueued: 10000,
+    queueTtlSeconds: 43200,
+    dequeueOrder: "fifo",
+    requiresClientApply: true,
+    syncCallable: false,
+};
+//# sourceMappingURL=workflow-defaults.js.map

package/dist/src/lib/workflow-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-defaults.js","sourceRoot":"","sources":["../../../src/lib/workflow-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,6EAA6E;IAC7E,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,KAAK;IACtB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,MAAM;IACpB,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAE,KAAK;CACpB,CAAC"}

package/dist/src/lib/workflow-include-preserve.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Keep `[[include]]` fragment structure alive across `config pull` (issue #2416).
+ *
+ * Fragments are a CLI-only authoring form: `expandWorkflowTomlData()` splices
+ * the referenced fragments into a flat `[[steps]]` list and the server only
+ * ever stores that expansion (see `workflow-fragments.ts`). `config pull`
+ * serializes the server's flat steps straight back to disk, so before this
+ * module a pull unconditionally overwrote a fragment-authored file with its
+ * own expansion — the `[[include]]` blocks were gone and had to be rebuilt by
+ * hand, even when `config diff` reported the file as synced.
+ *
+ * `reconcileWorkflowIncludes()` decides what pull should write for one
+ * workflow file. It only ever engages for a local file that actually carries
+ * an `include` key; everything else takes the unchanged "write what the server
+ * gave us" path.
+ *
+ *   - **skip** — the local file expands to exactly what the server is running.
+ *     There is nothing to apply, so leave the fragment source (and its
+ *     comments and formatting) untouched. One thing still has to be applied to
+ *     an otherwise-unchanged file: a retired inline `[[configs]]` list (#2733).
+ *     Pull rewrites every other workflow file off it, and push rejects a file
+ *     that still carries one, so a plain skip left the fragment source in a
+ *     shape push refuses — pull → push of an untouched tree failed. Such a
+ *     file takes the write-merged path with only the list removed.
+ *   - **write-merged** — the server drifted, but its step list still *starts*
+ *     with exactly the steps the local includes expand to. The drift is
+ *     therefore expressible in fragment form: re-emit the file with the
+ *     original `[[include]]` blocks and put the remaining server steps in the
+ *     workflow's own `[[steps]]` list. Re-expanding that file reproduces the
+ *     server's step list in order, so the next `config diff` reads as synced.
+ *   - **write-expanded** — the fragment-derived prefix no longer matches what
+ *     the server is running (a fragment's steps were edited or removed
+ *     server-side), so no fragment-preserving file could reproduce it. Fall
+ *     back to the historical behavior — write the fully expanded form — and
+ *     say why, so the operator knows the fragment source was replaced rather
+ *     than silently losing it.
+ *
+ * The order rule comes from the expander: it emits every fragment's steps
+ * first (in `include` order) and then the workflow's own `[[steps]]`. So a
+ * fragment-preserving file can only represent a server step list whose leading
+ * steps are exactly the fragment expansion. Server steps inserted *between*
+ * fragment steps are not representable and take the write-expanded path.
+ */
+/**
+ * Hashes an already-parsed (and, for a local file, already-expanded) workflow
+ * TOML object to its canonical content hash. Injected by the caller so this
+ * module uses exactly the same normalization `config diff` does
+ * (`hashWorkflowTomlForDiff` in `commands/sync.ts`) without importing the
+ * command module back into `lib/`.
+ */
+export type WorkflowTomlHasher = (parsed: any) => string;
+export interface IncludeReconcileOutcome {
+    /**
+     * `write-expanded`: write the server's serialized TOML unchanged (the
+     * pre-#2416 behavior). `skip`: leave the local file alone. `write-merged`:
+     * write `content`, which preserves the local `[[include]]` blocks.
+     */
+    action: "write-expanded" | "skip" | "write-merged";
+    /** TOML to write. Only set when `action` is `write-merged`. */
+    content?: string;
+    /** Human-readable note for the pull log. Absent when there's nothing to say. */
+    message?: string;
+}
+export interface ReconcileWorkflowIncludesOptions {
+    /** Workflow key, used only for log messages. */
+    workflowKey: string;
+    /** Absolute path of the local workflow TOML (also resolves the fragments dir). */
+    localPath: string;
+    /** Current contents of that file, or `undefined` when it doesn't exist yet. */
+    localContent: string | undefined;
+    /** The TOML `config pull` would write, from `serializeWorkflow()`. */
+    remoteToml: string;
+    /** Canonical content hash for a parsed workflow TOML. */
+    hashParsedToml: WorkflowTomlHasher;
+}
+export declare function reconcileWorkflowIncludes(options: ReconcileWorkflowIncludesOptions): IncludeReconcileOutcome;