primitive-admin 1.0.61 → 1.0.63

package/dist/src/lib/watch.js

@@ -0,0 +1,169 @@
+/**
+ * Shared poll-based tailing helpers for `--watch` / `--follow` (#1969).
+ *
+ * Two render modes over one abortable poll loop:
+ *   - `--watch`  → periodic full-snapshot redraw (a repeated `list`/`get`).
+ *   - `--follow` → append-only tail: fetch rows after an opaque server-owned
+ *                  `resumeAfter` checkpoint each tick.
+ *
+ * The loop is endpoint-agnostic. `--follow` consumers supply a {@link FollowSource}
+ * that knows how to fetch the page after a checkpoint; `--watch` consumers supply
+ * a `snapshot()` and a renderer. The renderer is injected (there is no `json`
+ * flag in the options) so this file never decides output shape or clears the
+ * terminal — that is entirely the caller's renderer.
+ *
+ * `--follow` is near-lossless observed-version tailing: it re-emits a row when a
+ * newer version is observed, holds no per-item dedup state, and asserts only
+ * forward progress — never a total-order or exactly-once property (the
+ * underlying GSI sorts by `modifiedAt` alone and is eventually consistent). See
+ * the design in #1969.
+ *
+ * Unit-tested against fake sources (the `cli/src/lib/paginate.ts` pattern) with
+ * no server.
+ */
+/** Interval floor: reject anything below this (prevents a request storm). */
+export const MIN_INTERVAL_SECONDS = 1;
+/** Default poll interval when `--interval` is omitted. */
+export const DEFAULT_INTERVAL_SECONDS = 2;
+/**
+ * Default cap on how many pages `followLoop` drains within a single tick when a
+ * burst is larger than one page. Bounds the within-tick work and, with the
+ * non-advancing-checkpoint guard, prevents an infinite drain.
+ */
+export const DEFAULT_MAX_PAGES_PER_TICK = 20;
+/**
+ * Validate an `--interval` value (in seconds). Returns the interval in seconds,
+ * or throws with a clear message for a missing/NaN/sub-floor value. Command
+ * handlers call this and surface the error; the library loops take a validated
+ * `intervalMs`.
+ */
+export function parseIntervalSeconds(raw) {
+    if (raw === undefined)
+        return DEFAULT_INTERVAL_SECONDS;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < MIN_INTERVAL_SECONDS) {
+        throw new Error(`--interval must be a number of seconds >= ${MIN_INTERVAL_SECONDS}`);
+    }
+    return n;
+}
+/**
+ * Sleep for `ms`, resolving early (never rejecting) if `signal` aborts. The
+ * timer and abort listener are always cleaned up, so a resolved delay leaves no
+ * dangling timer. Used by every poll loop so Ctrl-C stops promptly between
+ * ticks.
+ */
+export function delay(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            cleanup();
+            resolve();
+        };
+        const cleanup = () => signal?.removeEventListener("abort", onAbort);
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/**
+ * Delay-then-probe until `done(value)` is true or the signal aborts. Returns
+ * the last probed value. Delay-first (not probe-first) so a caller that already
+ * holds a fresh value — the batch-status loops — keeps its "poll every N
+ * seconds" cadence with no extra immediate request.
+ */
+export async function pollUntil(probe, done, options) {
+    const onError = options.onError ?? "throw";
+    let last;
+    let haveValue = false;
+    while (!options.signal.aborted) {
+        await delay(options.intervalMs, options.signal);
+        if (options.signal.aborted)
+            break;
+        try {
+            last = await probe();
+            haveValue = true;
+        }
+        catch (err) {
+            if (onError === "continue")
+                continue;
+            throw err;
+        }
+        options.onValue?.(last);
+        if (done(last))
+            return last;
+    }
+    // Aborted before `done`: return the last probed value (probe once if we never
+    // got one, so the return type holds).
+    if (!haveValue)
+        last = await probe();
+    return last;
+}
+/**
+ * Append-only tail. Bootstraps the baseline checkpoint (emitting nothing), then
+ * each tick drains forward while `hasMore` (bounded by `maxPagesPerTick`,
+ * stopping if the checkpoint fails to advance), rendering rows server-ascending.
+ * Holds no per-item state — the only carried state is the single opaque
+ * `resumeAfter` string.
+ */
+export async function followLoop(source, options) {
+    const onError = options.onError ?? "continue";
+    const maxPages = source.maxPagesPerTick ?? DEFAULT_MAX_PAGES_PER_TICK;
+    // Bootstrap: establish the baseline; do not emit its rows.
+    let resumeAfter;
+    try {
+        resumeAfter = (await source.fetchAfter(undefined)).resumeAfter;
+    }
+    catch (err) {
+        if (onError !== "continue")
+            throw err;
+        resumeAfter = ""; // fall through to polling; the next tick retries
+    }
+    while (!options.signal.aborted) {
+        try {
+            let pages = 0;
+            while (pages < maxPages && !options.signal.aborted) {
+                const page = await source.fetchAfter(resumeAfter || undefined);
+                if (page.items.length > 0)
+                    options.render(page.items);
+                const advanced = page.resumeAfter !== resumeAfter;
+                resumeAfter = page.resumeAfter;
+                pages++;
+                // Stop the within-tick drain when the burst is drained, or if the
+                // checkpoint didn't advance (guards against an endless drain).
+                if (!page.hasMore || !advanced)
+                    break;
+            }
+        }
+        catch (err) {
+            if (onError !== "continue")
+                throw err;
+            // continue: swallow and retry next tick
+        }
+        await delay(options.intervalMs, options.signal);
+    }
+}
+/**
+ * Snapshot redraw. Each tick fetches the full current snapshot and hands it to
+ * the renderer, which owns any clearing/redraw. No checkpoint, no dedup.
+ */
+export async function watchLoop(snapshot, options) {
+    const onError = options.onError ?? "continue";
+    while (!options.signal.aborted) {
+        try {
+            const items = await snapshot();
+            options.render(items);
+        }
+        catch (err) {
+            if (onError !== "continue")
+                throw err;
+        }
+        await delay(options.intervalMs, options.signal);
+    }
+}
+//# sourceMappingURL=watch.js.map

package/dist/src/lib/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../../src/lib/watch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6CAA6C,oBAAoB,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAuB,EACvB,IAA2B,EAC3B,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC3C,IAAI,IAAmB,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,UAAU;gBAAE,SAAS;YACrC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,8EAA8E;IAC9E,sCAAsC;IACtC,IAAI,CAAC,SAAS;QAAE,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;IACrC,OAAO,IAAS,CAAC;AACnB,CAAC;AAgDD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAuB,EACvB,OAAyB;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAEtE,2DAA2D;IAC3D,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,KAAK,UAAU;YAAE,MAAM,GAAG,CAAC;QACtC,WAAW,GAAG,EAAE,CAAC,CAAC,iDAAiD;IACrE,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,KAAK,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC;gBAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC;gBAClD,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;gBAC/B,KAAK,EAAE,CAAC;gBACR,kEAAkE;gBAClE,+DAA+D;gBAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;oBAAE,MAAM;YACxC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC;YACtC,wCAAwC;QAC1C,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAA4B,EAC5B,OAAwB;IAExB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/src/lib/web-url.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The app's web counterpart, as a normalized web origin (#2982).
+ *
+ * One environment value with two jobs on the iOS side: the emailed sign-in
+ * link points at `<webUrl>/oauth/callback`, and the same origin is what an
+ * incoming universal link is trusted from. Both jobs need an ORIGIN, not just
+ * a URL that parses:
+ *
+ *   - https except loopback, the same rule the server applies to every
+ *     redirect URI (`src/auth/redirect-uri.ts`) — an origin that cannot be
+ *     allow-listed turns every sign-in request into a 400;
+ *   - no path, query or fragment: the web client derives its callback from its
+ *     own origin plus `/oauth/callback` and has no base-path mode, and the
+ *     `apple-app-site-association` component matches that exact path;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateServerUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt.
+ *
+ * This is the surface that EXPLAINS a rejection. The same rule is applied
+ * silently — value or nothing — by every reader that feeds `primitive.json`
+ * without going through the CLI: `normalizeWebOrigin` in `env-resolver-core.ts`
+ * (which cannot import this file; it is copied verbatim into a package that
+ * must not depend on the CLI), its bash/python3 port in the Swift template's
+ * `resolve-primitive-config.sh`, and `PrimitiveAppState.linksBaseURL` as the
+ * app's own floor. `web-url-parity` in the project-config tests pins that the
+ * two TypeScript halves accept and normalize exactly the same values.
+ */
+/**
+ * Validates a web origin. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export declare function validateWebUrl(value: string): string | true;
+/**
+ * The origin form of an already-validated web URL: lowercased host, explicit
+ * port kept, no trailing slash — so `https://app.example.com/` and
+ * `https://app.example.com` are stored, compared and joined identically.
+ */
+export declare function normalizeWebUrl(value: string): string;

package/dist/src/lib/web-url.js

@@ -0,0 +1,76 @@
+/**
+ * The app's web counterpart, as a normalized web origin (#2982).
+ *
+ * One environment value with two jobs on the iOS side: the emailed sign-in
+ * link points at `<webUrl>/oauth/callback`, and the same origin is what an
+ * incoming universal link is trusted from. Both jobs need an ORIGIN, not just
+ * a URL that parses:
+ *
+ *   - https except loopback, the same rule the server applies to every
+ *     redirect URI (`src/auth/redirect-uri.ts`) — an origin that cannot be
+ *     allow-listed turns every sign-in request into a 400;
+ *   - no path, query or fragment: the web client derives its callback from its
+ *     own origin plus `/oauth/callback` and has no base-path mode, and the
+ *     `apple-app-site-association` component matches that exact path;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateServerUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt.
+ *
+ * This is the surface that EXPLAINS a rejection. The same rule is applied
+ * silently — value or nothing — by every reader that feeds `primitive.json`
+ * without going through the CLI: `normalizeWebOrigin` in `env-resolver-core.ts`
+ * (which cannot import this file; it is copied verbatim into a package that
+ * must not depend on the CLI), its bash/python3 port in the Swift template's
+ * `resolve-primitive-config.sh`, and `PrimitiveAppState.linksBaseURL` as the
+ * app's own floor. `web-url-parity` in the project-config tests pins that the
+ * two TypeScript halves accept and normalize exactly the same values.
+ */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+/** The example every message ends with, so a rejection is actionable. */
+const SHAPE = "e.g. https://app.example.com (or http://localhost:5173 in dev)";
+/**
+ * Validates a web origin. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export function validateWebUrl(value) {
+    if (typeof value !== "string" || !value.trim()) {
+        return `Web URL cannot be empty — ${SHAPE}`;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return `Please enter an absolute URL — ${SHAPE}`;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        return `Web URL must be http(s) — ${SHAPE}`;
+    }
+    if (url.protocol === "http:" && !LOOPBACK_HOSTS.has(url.hostname)) {
+        return `Web URL must use https outside localhost — the server refuses a non-loopback http redirect URI (${SHAPE})`;
+    }
+    if (url.username || url.password) {
+        return `Web URL must not carry credentials — ${SHAPE}`;
+    }
+    if (url.pathname !== "/" && url.pathname !== "") {
+        return `Web URL must be an origin with no path — the web app serves its sign-in callback on its own origin (${SHAPE})`;
+    }
+    if (url.search) {
+        return `Web URL must not carry a query — ${SHAPE}`;
+    }
+    if (url.hash) {
+        return `Web URL must not carry a fragment — ${SHAPE}`;
+    }
+    return true;
+}
+/**
+ * The origin form of an already-validated web URL: lowercased host, explicit
+ * port kept, no trailing slash — so `https://app.example.com/` and
+ * `https://app.example.com` are stored, compared and joined identically.
+ */
+export function normalizeWebUrl(value) {
+    return new URL(value).origin;
+}
+//# sourceMappingURL=web-url.js.map

package/dist/src/lib/web-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-url.js","sourceRoot":"","sources":["../../../src/lib/web-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,gEAAgE,CAAC;AAE/E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,6BAA6B,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,OAAO,6BAA6B,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,mGAAmG,KAAK,GAAG,CAAC;IACrH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,wCAAwC,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,uGAAuG,KAAK,GAAG,CAAC;IACzH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,oCAAoC,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,uCAAuC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC"}

package/dist/src/lib/workflow-apply.d.ts

@@ -1,22 +1,38 @@
 /**
  * Shared "apply a TOML body to an existing workflow" helper.
  *
- * Extracted from the `sync push` update-existing path (#1249, Fork 4) so that
- * both `sync push` and `workflows update --from-file` push a revised body the
+ * Extracted from the `config push` update-existing path (#1249, Fork 4) so that
+ * both `config push` and `workflows update --from-file` push a revised body the
  * same way. A second inlined copy would regress #807: the update is
  * ordering-sensitive and a naive metadata-then-body sequence rejects valid
  * sync-callable edits.
  *
- * Ordering invariant (#807 / codex review):
- *   1. metadata PATCH — WITHOUT `syncCallable`. The server re-validates
- *      `syncCallable: true` against the workflow's CURRENTLY-active server
- *      steps (`loadCurrentActiveSteps`, src/admin-api.ts:4734), not the steps
- *      being pushed in the same call. So enabling sync-callable in the first
- *      PATCH would validate against the stale active steps and be rejected.
+ * Ordering invariant (#807 / codex review, revised by #2743). `syncCallable` is
+ * sequenced BY TARGET VALUE, because the two directions have opposite
+ * constraints:
+ *   1. metadata PATCH — carries `syncCallable: false` when the target is false
+ *      (the TOML omits the key or sets it to `false`), and NOTHING when the
+ *      target is true. Enabling here would be validated against the workflow's
+ *      CURRENTLY-active server steps (`loadCurrentActiveSteps`,
+ *      src/admin-api.ts), not the steps being pushed in the same call, so it
+ *      would be rejected on the stale list. Disabling has no such check — the
+ *      server re-validates steps only when flipping TO true — and it must
+ *      happen here, because the step-write endpoints
+ *      (`updateWorkflowDraft` / `updateWorkflowConfig`) reject
+ *      sync-incompatible steps while the STORED flag is still true. Clearing
+ *      the flag first is what lets a single push both drop `syncCallable` and
+ *      introduce an incompatible step.
  *   2. body write — steps to the active config (config-model) or the legacy
  *      draft slot (no active config).
- *   3. a SECOND `syncCallable` PATCH — issued AFTER the new steps are active,
- *      so it validates against the new (compatible) steps.
+ *   3. a SECOND `syncCallable` PATCH, for ENABLING only — issued AFTER the new
+ *      steps are active, so it validates against the new (compatible) steps.
+ *      Skipped when the first PATCH's response already reports the flag on;
+ *      sent unconditionally when that response is unreadable (fail closed
+ *      toward convergence).
+ *
+ * #2743 also removed the "only send it when the TOML carries the key"
+ * no-clobber rule: the file fully describes the workflow, so deleting
+ * `syncCallable = true` from it disables the flag in one push.
  */
 import type { ApiClient } from "./api-client.js";
 import { safeJsonParse } from "./workflow-payload.js";
@@ -33,6 +49,49 @@ export interface ApplyWorkflowBodyOptions {
     /** When true, skip the optimistic-concurrency check (mirrors `--force`). */
     force?: boolean;
 }
+/** The slot label a body gets when the workflow has no active config. */
+export declare const LEGACY_DRAFT_SLOT_LABEL = "draft (legacy)";
+/** What the push knows about the workflow once every write has landed. */
+export interface LegacyDraftSlotState {
+    /** The workflow's active configuration once the push finished, if any. */
+    activeConfigId?: string | null;
+    /**
+     * Whether THIS push activated that configuration — the TOML carried a
+     * sidecar plus `activeConfigName`, so the authored body is what runs now.
+     */
+    activatedByPush?: boolean;
+    /** The workflow's latest legacy revision, when it has one. */
+    latestRevision?: string | null;
+}
+/**
+ * The warning a push owes the user when its body landed in the legacy draft
+ * slot and is NOT what the workflow runs (#2768).
+ *
+ * `workflows publish`, the one thing that promoted that slot, is gone, so those
+ * steps sit there unread — a silent no-op otherwise, since the push reports
+ * success either way.
+ *
+ * Reading a workflow is not neutral, which is why this takes more than an
+ * active config id. `getAppWorkflow` (src/admin-api.ts) auto-migrates a
+ * workflow that has NO configurations: it copies the latest revision — or, only
+ * when there is none, the draft slot — into a configuration and activates it.
+ * `applyWorkflowBody` reads the workflow immediately after writing the draft,
+ * so a legacy workflow WITH a published revision comes back carrying a
+ * brand-new `activeConfigId` holding the OLD body. Keyed on that id alone, the
+ * warning stayed silent for exactly the population it exists for. So:
+ *
+ * - the push activated a configuration itself (sidecar + `activeConfigName`):
+ *   silent — that push IS the migration;
+ * - an active configuration and no revision behind it: silent — the server
+ *   adopted the draft this push just wrote, and it is live;
+ * - an active configuration with a revision behind it: warn — that revision is
+ *   what runs, not the pushed steps;
+ * - no active configuration at all: warn, and name the TOML migration.
+ *
+ * Exported for testability — the end-to-end path needs a workflow that can no
+ * longer be created through the API.
+ */
+export declare function legacyDraftSlotWarning(updateSlotLabel: string, state: LegacyDraftSlotState): string | null;
 export interface ApplyWorkflowBodyResult {
     /** The freshest workflow `modifiedAt` after all PATCHes (for sync state). */
     latestModifiedAt?: string;
@@ -49,38 +108,3 @@ export interface ApplyWorkflowBodyResult {
  * and returns the latest `modifiedAt`, the slot label, and a fresh workflow.
  */
 export declare function applyWorkflowBody(client: ApiClient, appId: string, workflowId: string, workflow: any, steps: any[], opts?: ApplyWorkflowBodyOptions): Promise<ApplyWorkflowBodyResult>;
-/**
- * #1232 — parse the `workflows update --capabilities` flag into the array the
- * server's update handler expects. This is the CLI fallback the issue asked
- * for ("workflows update has no capability flag"): a grant/revoke channel for
- * an existing workflow, since `sync push` create deliberately does not forward
- * capabilities (#1233, Q2) and there was otherwise no way to set them on an
- * existing workflow.
- *
- * Semantics (mirrors how the server normalizes the field):
- *   --capabilities membership          → ["membership"]        (grant)
- *   --capabilities membership,secrets  → ["membership","secrets"]
- *   --capabilities " membership , x "  → ["membership","x"]     (trimmed)
- *   --capabilities ""                  → []                     (revoke all;
- *                                        server stores empty as null)
- *
- * The set of grantable capability names ("membership" / "secrets") is validated
- * server-side by `validateWorkflowIdentityConfig`; the CLI intentionally does
- * NOT duplicate that allowlist so it can't drift from the server. An unknown
- * name is surfaced via the server's structured `details[]` error.
- *
- * The caller applies presence-guarded plumbing (`options.capabilities !==
- * undefined`) so an omitted flag never reaches the payload — the server's
- * `hasOwnProperty` guard then leaves the existing grant untouched.
- */
-export declare function parseCapabilitiesFlag(value: string): string[];
-/**
- * Fork 2 (#1249): a TOML pushed at a specific `<id>` may also declare a `key` /
- * `workflowKey`. If it differs from the target's actual key, that's almost
- * certainly the wrong file — error rather than silently ignoring it. An absent
- * TOML key is advisory and allowed (the operation targets `<id>`).
- *
- * Returns an error message string when there is a mismatch, otherwise null.
- * Pure function for unit testing.
- */
-export declare function workflowKeyMismatchError(tomlWorkflow: any, existingWorkflowKey: string | undefined): string | null;

package/dist/src/lib/workflow-apply.js

@@ -1,28 +1,95 @@
 /**
  * Shared "apply a TOML body to an existing workflow" helper.
  *
- * Extracted from the `sync push` update-existing path (#1249, Fork 4) so that
- * both `sync push` and `workflows update --from-file` push a revised body the
+ * Extracted from the `config push` update-existing path (#1249, Fork 4) so that
+ * both `config push` and `workflows update --from-file` push a revised body the
  * same way. A second inlined copy would regress #807: the update is
  * ordering-sensitive and a naive metadata-then-body sequence rejects valid
  * sync-callable edits.
  *
- * Ordering invariant (#807 / codex review):
- *   1. metadata PATCH — WITHOUT `syncCallable`. The server re-validates
- *      `syncCallable: true` against the workflow's CURRENTLY-active server
- *      steps (`loadCurrentActiveSteps`, src/admin-api.ts:4734), not the steps
- *      being pushed in the same call. So enabling sync-callable in the first
- *      PATCH would validate against the stale active steps and be rejected.
+ * Ordering invariant (#807 / codex review, revised by #2743). `syncCallable` is
+ * sequenced BY TARGET VALUE, because the two directions have opposite
+ * constraints:
+ *   1. metadata PATCH — carries `syncCallable: false` when the target is false
+ *      (the TOML omits the key or sets it to `false`), and NOTHING when the
+ *      target is true. Enabling here would be validated against the workflow's
+ *      CURRENTLY-active server steps (`loadCurrentActiveSteps`,
+ *      src/admin-api.ts), not the steps being pushed in the same call, so it
+ *      would be rejected on the stale list. Disabling has no such check — the
+ *      server re-validates steps only when flipping TO true — and it must
+ *      happen here, because the step-write endpoints
+ *      (`updateWorkflowDraft` / `updateWorkflowConfig`) reject
+ *      sync-incompatible steps while the STORED flag is still true. Clearing
+ *      the flag first is what lets a single push both drop `syncCallable` and
+ *      introduce an incompatible step.
  *   2. body write — steps to the active config (config-model) or the legacy
  *      draft slot (no active config).
- *   3. a SECOND `syncCallable` PATCH — issued AFTER the new steps are active,
- *      so it validates against the new (compatible) steps.
+ *   3. a SECOND `syncCallable` PATCH, for ENABLING only — issued AFTER the new
+ *      steps are active, so it validates against the new (compatible) steps.
+ *      Skipped when the first PATCH's response already reports the flag on;
+ *      sent unconditionally when that response is unreadable (fail closed
+ *      toward convergence).
+ *
+ * #2743 also removed the "only send it when the TOML carries the key"
+ * no-clobber rule: the file fully describes the workflow, so deleting
+ * `syncCallable = true` from it disables the flag in one push.
  */
 import { buildWorkflowPayloadFromToml, safeJsonParse } from "./workflow-payload.js";
 // #1177: `safeJsonParse` now lives in the shared `workflow-payload` lib module
 // (the builder needs it too); re-exported here so existing importers of this
 // module keep working. Both `cli/src/lib` modules; no dep-direction problem.
 export { safeJsonParse };
+/** The slot label a body gets when the workflow has no active config. */
+export const LEGACY_DRAFT_SLOT_LABEL = "draft (legacy)";
+/**
+ * The warning a push owes the user when its body landed in the legacy draft
+ * slot and is NOT what the workflow runs (#2768).
+ *
+ * `workflows publish`, the one thing that promoted that slot, is gone, so those
+ * steps sit there unread — a silent no-op otherwise, since the push reports
+ * success either way.
+ *
+ * Reading a workflow is not neutral, which is why this takes more than an
+ * active config id. `getAppWorkflow` (src/admin-api.ts) auto-migrates a
+ * workflow that has NO configurations: it copies the latest revision — or, only
+ * when there is none, the draft slot — into a configuration and activates it.
+ * `applyWorkflowBody` reads the workflow immediately after writing the draft,
+ * so a legacy workflow WITH a published revision comes back carrying a
+ * brand-new `activeConfigId` holding the OLD body. Keyed on that id alone, the
+ * warning stayed silent for exactly the population it exists for. So:
+ *
+ * - the push activated a configuration itself (sidecar + `activeConfigName`):
+ *   silent — that push IS the migration;
+ * - an active configuration and no revision behind it: silent — the server
+ *   adopted the draft this push just wrote, and it is live;
+ * - an active configuration with a revision behind it: warn — that revision is
+ *   what runs, not the pushed steps;
+ * - no active configuration at all: warn, and name the TOML migration.
+ *
+ * Exported for testability — the end-to-end path needs a workflow that can no
+ * longer be created through the API.
+ */
+export function legacyDraftSlotWarning(updateSlotLabel, state) {
+    if (updateSlotLabel !== LEGACY_DRAFT_SLOT_LABEL)
+        return null;
+    const { activeConfigId, activatedByPush, latestRevision } = state;
+    if (activatedByPush)
+        return null;
+    if (activeConfigId && !latestRevision)
+        return null;
+    const retired = "nothing promotes that slot any more ('workflows publish' was removed in #2768)";
+    if (activeConfigId) {
+        return (`Steps landed in the legacy draft slot, and ${retired}. Reading the workflow ` +
+            "migrated it onto the configurations model from its LATEST REVISION, so what " +
+            "runs is that revision, not the steps just pushed.\n" +
+            "Push again ('primitive config push --force') to write them to the active " +
+            "configuration, after checking that the file's body is the one you want live.");
+    }
+    return ("Steps landed in the legacy draft slot: this workflow has no active configuration, " +
+        `and ${retired}, so the pushed body will not run.\n` +
+        "Migrate it in TOML: put the body in workflows/<key>.configs/<name>.toml, set " +
+        'activeConfigName = "<name>" in workflows/<key>.toml, and push again.');
+}
 /**
  * Apply a parsed workflow body (metadata + steps) to an existing workflow,
  * preserving the key/id. `workflow` is the TOML's `[workflow]` table (already
@@ -32,18 +99,24 @@ export { safeJsonParse };
  */
 export async function applyWorkflowBody(client, appId, workflowId, workflow, steps, opts = {}) {
     const { expectedModifiedAt, activeConfigId, force } = opts;
-    // 1. Metadata PATCH — note: NO `syncCallable` here (deferred to step 3). The
-    //    shared builder (#1177, `mode: "update"`) omits `syncCallable` for exactly
-    //    this reason and applies the presence-aware clear-vs-leave semantics for
-    //    `accessRule` / `runAs` / `capabilities` / schemas. `requiresClientApply`
-    //    has no step-dependent validation, so the builder keeps it here. The
-    //    `metadataManifest` declared-access manifest (#1304) is call-site-specific
-    //    and attached below, not owned by the shared builder.
+    // #2743 — the target `syncCallable` state the file declares. Only an explicit
+    // `true` enables (mirroring the server's opt-in handler), so a TOML that
+    // omits the key targets `false` and converges a server that has it on.
+    const targetSyncCallable = workflow.syncCallable === true;
+    // 1. Metadata PATCH — always-send (#2743): the builder (`mode: "update"`)
+    //    emits every `[workflow]` field with a definite value, so a line deleted
+    //    from the file clears or resets it server-side instead of being silently
+    //    preserved. `syncCallable` is the one field the builder leaves out,
+    //    because its position in the sequence depends on the target value: a
+    //    disable rides along here (before the steps write), an enable waits for
+    //    step 3. The `metadataManifest` declared-access manifest (#1304) is
+    //    call-site-specific and attached below, not owned by the shared builder.
     const updated = await client.updateWorkflow(appId, workflowId, {
         ...buildWorkflowPayloadFromToml(workflow, { mode: "update" }),
+        ...(targetSyncCallable ? {} : { syncCallable: false }),
         // #1304 (P-C): declared-access manifest. Absent key → undefined (server's
         // hasOwnProperty guard leaves it untouched); a parsed value/null is
-        // forwarded so a pull → push round-trips it (null clears). `sync push`
+        // forwarded so a pull → push round-trips it (null clears). `config push`
         // always attaches this (null when the TOML drops `[metadata]`); the
         // `workflows update --from-file` caller may leave it undefined.
         metadataManifest: workflow.metadataManifest !== undefined ? workflow.metadataManifest : undefined,
@@ -72,13 +145,15 @@ export async function applyWorkflowBody(client, appId, workflowId, workflow, ste
             expressions,
             inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
         });
-        updateSlotLabel = "draft (legacy)";
+        updateSlotLabel = LEGACY_DRAFT_SLOT_LABEL;
     }
-    // 3. Deferred `syncCallable` PATCH — now that the new steps are active (#807).
-    //    Only sent when the TOML actually carries the key; an absent key stays
-    //    `undefined` and the call is skipped, preserving no-clobber discipline.
-    if (workflow.syncCallable !== undefined) {
-        const syncCallableUpdated = await client.updateWorkflow(appId, workflowId, { syncCallable: workflow.syncCallable }, force ? undefined : latestModifiedAt);
+    // 3. Deferred `syncCallable` PATCH — ENABLING only, now that the new steps
+    //    are active (#807). Disabling already landed in step 1. Skipped when the
+    //    first PATCH's response reports the flag already on (nothing to converge,
+    //    and the call would cost a `modifiedAt` bump for no change); sent when
+    //    the response shape is unreadable, because "unreadable" is not evidence.
+    if (targetSyncCallable && updated?.workflow?.syncCallable !== true) {
+        const syncCallableUpdated = await client.updateWorkflow(appId, workflowId, { syncCallable: true }, force ? undefined : latestModifiedAt);
         if (syncCallableUpdated?.workflow?.modifiedAt) {
             latestModifiedAt = syncCallableUpdated.workflow.modifiedAt;
         }
@@ -86,52 +161,4 @@ export async function applyWorkflowBody(client, appId, workflowId, workflow, ste
     const fullWorkflow = await client.getWorkflow(appId, workflowId);
     return { latestModifiedAt, updateSlotLabel, fullWorkflow };
 }
-/**
- * #1232 — parse the `workflows update --capabilities` flag into the array the
- * server's update handler expects. This is the CLI fallback the issue asked
- * for ("workflows update has no capability flag"): a grant/revoke channel for
- * an existing workflow, since `sync push` create deliberately does not forward
- * capabilities (#1233, Q2) and there was otherwise no way to set them on an
- * existing workflow.
- *
- * Semantics (mirrors how the server normalizes the field):
- *   --capabilities membership          → ["membership"]        (grant)
- *   --capabilities membership,secrets  → ["membership","secrets"]
- *   --capabilities " membership , x "  → ["membership","x"]     (trimmed)
- *   --capabilities ""                  → []                     (revoke all;
- *                                        server stores empty as null)
- *
- * The set of grantable capability names ("membership" / "secrets") is validated
- * server-side by `validateWorkflowIdentityConfig`; the CLI intentionally does
- * NOT duplicate that allowlist so it can't drift from the server. An unknown
- * name is surfaced via the server's structured `details[]` error.
- *
- * The caller applies presence-guarded plumbing (`options.capabilities !==
- * undefined`) so an omitted flag never reaches the payload — the server's
- * `hasOwnProperty` guard then leaves the existing grant untouched.
- */
-export function parseCapabilitiesFlag(value) {
-    return value
-        .split(",")
-        .map((cap) => cap.trim())
-        .filter((cap) => cap.length > 0);
-}
-/**
- * Fork 2 (#1249): a TOML pushed at a specific `<id>` may also declare a `key` /
- * `workflowKey`. If it differs from the target's actual key, that's almost
- * certainly the wrong file — error rather than silently ignoring it. An absent
- * TOML key is advisory and allowed (the operation targets `<id>`).
- *
- * Returns an error message string when there is a mismatch, otherwise null.
- * Pure function for unit testing.
- */
-export function workflowKeyMismatchError(tomlWorkflow, existingWorkflowKey) {
-    const tomlKey = tomlWorkflow?.key ?? tomlWorkflow?.workflowKey;
-    if (tomlKey && existingWorkflowKey && tomlKey !== existingWorkflowKey) {
-        return (`TOML workflow key "${tomlKey}" does not match the target workflow's key ` +
-            `"${existingWorkflowKey}". This usually means you pointed --from-file at the ` +
-            `wrong workflow id. Remove the key from the TOML or target the matching id.`);
-    }
-    return null;
-}
 //# sourceMappingURL=workflow-apply.js.map