primitive-admin 1.0.61 → 1.0.63

package/dist/src/lib/workflow-payload.js

@@ -3,8 +3,8 @@
  *
  * Background: the CLI built the create/update workflow payload in THREE
  * separate hand-enumerated literals — `workflows create --from-file`
- * (`cli/src/commands/workflows.ts`), the `sync push` create branch
- * (`cli/src/commands/sync.ts`), and the `sync push` update branch (the metadata
+ * (`cli/src/commands/workflows.ts`), the `config push` create branch
+ * (`cli/src/commands/sync.ts`), and the `config push` update branch (the metadata
  * PATCH in `cli/src/lib/workflow-apply.ts`). Because each site listed the
  * `[workflow]` fields by hand, they drifted apart: a field added to one path was
  * silently dropped by the others. `status` was the 4th field lost this way
@@ -27,19 +27,34 @@
  * Presence semantics, by mode:
  *   - create: optional strings coalesce absent/empty → `undefined` (omit; the
  *     server default applies). `capabilities` forwards the raw array (absent →
- *     omit). Schemas omit when absent.
- *   - update: optional strings distinguish explicit-clear from leave-unset via
- *     `x !== undefined ? (x || null) : undefined`. `status` forwards the bare
- *     value (matching the server's hasOwnProperty path). Schemas send `null`
- *     when absent so a cleared schema round-trips.
- *   - booleans (`requiresClientApply`, and `syncCallable` on create) are raw
- *     pass-through so an explicit `false` is preserved and only a truly-absent
- *     key drops.
- *   - `syncCallable` is OMITTED in `mode: "update"`: the server re-validates
- *     `syncCallable: true` against the CURRENTLY-active steps, so the update
- *     path must send it as a deferred second PATCH after the new steps are live
- *     (#807). `applyWorkflowBody` owns that second PATCH.
+ *     omit). Schemas omit when absent. Booleans are raw pass-through so an
+ *     explicit `false` is preserved and only a truly-absent key drops.
+ *   - update: ALWAYS-SEND (#2743). The workflow TOML fully describes the
+ *     workflow, so every update-mode field carries a definite value and
+ *     `undefined` never appears: a defaulted scalar (`status`, the queue
+ *     limits, `dequeueOrder`, `requiresClientApply`) sends its concrete model
+ *     default when the file omits it, and a nullable field (`description`,
+ *     `accessRule`, `runAs`, `capabilities`, the schemas, `lock`) sends `null`.
+ *     Deleting a line from the file therefore CONVERGES the server rather than
+ *     silently leaving the old value live (#1567's bug class). Optional strings
+ *     keep their `"" → null` coalescing, so an explicit clear and an omission
+ *     land on the same wire value.
+ *
+ *     Defaulted scalars deliberately travel as their default, not as `null`: a
+ *     server predating #2743 coerces a queue-limit `null` to `0`, while an
+ *     explicit default converges identically on both. The shared map lives in
+ *     `workflow-defaults.ts` (the diff normalizer reads the same copy).
+ *
+ *     Omit-preserve survives only as the SERVER's contract for other clients
+ *     (web-admin): the PATCH still leaves an absent key alone.
+ *   - `syncCallable` is OMITTED from the builder in `mode: "update"`: its
+ *     ordering relative to the steps write is `applyWorkflowBody`'s to decide
+ *     (#807 — enabling must validate against the NEW steps, so it is deferred
+ *     to a second PATCH; disabling rides the first PATCH). See that module.
  */
+import { writableFieldNames } from "./generated-config-surfaces.js";
+import { WORKFLOW_TABLE } from "./config-surface.js";
+import { WORKFLOW_MODEL_DEFAULTS } from "./workflow-defaults.js";
 /**
  * Parse a JSON schema field that TOML may present as a string OR (for an inline
  * table) as an already-parsed object. Kept here in `cli/src/lib` so the builder
@@ -75,31 +90,62 @@ export function parseWorkflowExpressionsToml(tomlData) {
     return Object.keys(out).length > 0 ? { cel: out } : undefined;
 }
 /**
- * The `[workflow]`-derived keys the builder emits, per mode. Exported so the
- * drift-guard unit test can assert the key set hasn't silently lost a field —
- * the recurring bug class this builder closes. `update` omits `syncCallable`
- * (deferred second PATCH, #807); everything else is shared.
+ * Fields the SERVER accepts on update but this BUILDER deliberately leaves to
+ * the caller. This is a sequencing invariant, not a statement about the server:
+ * `syncCallable: true` is re-validated against the CURRENTLY-active steps, so
+ * enabling it has to wait for a second PATCH once the new steps are live (#807
+ * — `applyWorkflowBody` owns the whole sequence, including the `false` case it
+ * puts in the FIRST PATCH). The definition correctly declares
+ * `writableOn: ["create", "update"]`; the exception lives here, where the
+ * ordering decision is.
  */
-export const WORKFLOW_PAYLOAD_FIELDS_CREATE = [
-    "name",
-    "description",
-    "status",
-    "accessRule",
-    "runAs",
-    "capabilities",
-    "perUserMaxRunning",
-    "perUserMaxQueued",
-    "perAppMaxRunning",
-    "perAppMaxQueued",
-    "queueTtlSeconds",
-    "dequeueOrder",
-    "requiresClientApply",
-    "inputSchema",
-    "outputSchema",
-    "lock",
-    "syncCallable",
-];
-export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.filter((f) => f !== "syncCallable");
+const CREATE_ONLY_ON_THE_WIRE = new Set(["syncCallable"]);
+/**
+ * The `[workflow]`-derived keys the builder emits, per mode — read from the
+ * vendored definition (#2644), not restated here. A field added to
+ * `src/config-surface/workflow.ts` is pushed with no edit to this file, which
+ * is what closes the recurring "CLI silently drops a new server field" bug.
+ */
+export function workflowPayloadFields(mode) {
+    const fields = writableFieldNames(WORKFLOW_TABLE, mode);
+    return mode === "create"
+        ? fields
+        : fields.filter((f) => !CREATE_ONLY_ON_THE_WIRE.has(f));
+}
+/**
+ * Per-field value producers, keyed by the definition's field name. A field with
+ * no entry is a scalar passthrough: on create the TOML value is forwarded as-is
+ * (absent → `undefined`, which `JSON.stringify` drops so the server default
+ * applies); on update it converges (absent → the field's model default, or
+ * `null` when it has none). That is what makes a passthrough field authorable
+ * by editing the definition alone (#2644 criterion 1); the entries below are
+ * the fields whose value semantics are genuinely their own.
+ */
+const PAYLOAD_VALUE = {
+    // accessRule / runAs / description — create coalesces absent/empty → omit;
+    // update coalesces both an explicit clear ("") and an omission to `null`,
+    // because the file is the whole truth (#2743). `value || null` also keeps a
+    // whitespace-only value out of the "set" state the server would trim to "".
+    accessRule: (value, create) => (create ? value || undefined : value || null),
+    runAs: (value, create) => (create ? value || undefined : value || null),
+    description: (value, create) => (create ? value : value || null),
+    // Schemas — parse a JSON string (or accept an inline table). Create omits
+    // when absent; update sends null so a cleared schema round-trips.
+    inputSchema: (value, create) => value ? safeJsonParse(value) : create ? undefined : null,
+    outputSchema: (value, create) => value ? safeJsonParse(value) : create ? undefined : null,
+    // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
+    // A TOML-owned nested-object field, mirroring the schemas above. Presence-
+    // keyed, not truthiness-keyed: forward the value whenever the KEY is present
+    // (`!== undefined`) — the server's create/PATCH accept an object OR a JSON
+    // string, so a present-but-malformed falsy value (`lock = false`/`0`) must
+    // be forwarded so the server surfaces its validation error, rather than
+    // being silently treated as absent (dropped on create, cleared on update).
+    // Absent on create → omit (server default: no lock); absent on update →
+    // null so removing `[workflow.lock]` clears the server-side lock
+    // (config-as-code). Before this the field was dropped from both sync paths,
+    // so a pull → push cycle silently lost the lock (#1972).
+    lock: (value, create) => value !== undefined ? value : create ? undefined : null,
+};
 /**
  * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML
  * `[workflow]` table. `workflow` is `tomlData.workflow` (already merged with any
@@ -109,79 +155,23 @@ export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.fil
  */
 export function buildWorkflowPayloadFromToml(workflow, { mode }) {
     const create = mode === "create";
-    const payload = {
-        name: workflow.name,
-        description: workflow.description,
-        // status — create coalesces absent/empty → omit (server default `draft`
-        // applies); update forwards the bare value so it round-trips and an
-        // explicit "" surfaces the server's validation error rather than a silent
-        // no-op (matches the pre-existing update path).
-        status: create ? workflow.status || undefined : workflow.status,
-        // accessRule / runAs — create coalesces absent/empty → omit; update
-        // distinguishes explicit clear ("" → null) from leave-unset (absent →
-        // undefined).
-        accessRule: create
-            ? workflow.accessRule || undefined
-            : workflow.accessRule !== undefined
-                ? workflow.accessRule || null
-                : undefined,
-        runAs: create
-            ? workflow.runAs || undefined
-            : workflow.runAs !== undefined
-                ? workflow.runAs || null
-                : undefined,
-        // capabilities — create forwards the raw array (absent → omit); update
-        // forwards presence-aware so an explicit array round-trips. (The server
-        // update PATCH persist for capabilities is tracked separately in #1232; the
-        // round-trip guard asserts capabilities on the create leg only.)
-        capabilities: create
-            ? workflow.capabilities
-            : workflow.capabilities !== undefined
-                ? workflow.capabilities
-                : undefined,
-        // Queue limits — raw numeric pass-through both modes (absent → omit).
-        perUserMaxRunning: workflow.perUserMaxRunning,
-        perUserMaxQueued: workflow.perUserMaxQueued,
-        perAppMaxRunning: workflow.perAppMaxRunning,
-        perAppMaxQueued: workflow.perAppMaxQueued,
-        queueTtlSeconds: workflow.queueTtlSeconds,
-        dequeueOrder: workflow.dequeueOrder,
-        // requiresClientApply — raw boolean pass-through so an explicit `false` is
-        // preserved and only a truly-absent key drops (server default applies).
-        requiresClientApply: workflow.requiresClientApply,
-        // Schemas — parse a JSON string (or accept an inline table). Create omits
-        // when absent; update sends null so a cleared schema round-trips.
-        inputSchema: workflow.inputSchema
-            ? safeJsonParse(workflow.inputSchema)
-            : create
-                ? undefined
-                : null,
-        outputSchema: workflow.outputSchema
-            ? safeJsonParse(workflow.outputSchema)
-            : create
-                ? undefined
-                : null,
-        // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
-        // A TOML-owned nested-object field, mirroring the schemas above. Presence-
-        // keyed, not truthiness-keyed: forward the value whenever the KEY is present
-        // (`!== undefined`) — the server's create/PATCH accept an object OR a JSON
-        // string, so a present-but-malformed falsy value (`lock = false`/`0`) must
-        // be forwarded so the server surfaces its validation error, rather than
-        // being silently treated as absent (dropped on create, cleared on update).
-        // Absent on create → omit (server default: no lock); absent on update →
-        // null so removing `[workflow.lock]` clears the server-side lock
-        // (config-as-code). Before this the field was dropped from both sync paths,
-        // so a pull → push cycle silently lost the lock (#1972).
-        lock: workflow.lock !== undefined
-            ? workflow.lock
+    const payload = {};
+    for (const field of workflowPayloadFields(mode)) {
+        const descriptor = WORKFLOW_TABLE.fields.find((f) => f.field === field);
+        const tomlKey = descriptor?.tomlKey ?? field;
+        const produce = PAYLOAD_VALUE[field];
+        const raw = workflow[tomlKey];
+        payload[field] = produce
+            ? produce(raw, create, workflow)
             : create
-                ? undefined
-                : null,
-    };
-    // syncCallable — create includes it (raw boolean pass-through); update omits
-    // it (deferred second PATCH, #807 — see module doc).
-    if (create) {
-        payload.syncCallable = workflow.syncCallable;
+                ? // Scalar passthrough on create: queue limits, dequeueOrder, name,
+                    // capabilities, and the boolean flags — raw so an explicit `false`
+                    // or `0` survives and only a truly-absent key drops.
+                    raw
+                : // Update converges (#2743): a field the file omits sends its concrete
+                    // model default, or `null` when it has none (`name`, `capabilities`).
+                    // `??` (not `||`) so an explicit `false` / `0` still wins.
+                    (raw ?? WORKFLOW_MODEL_DEFAULTS[field] ?? null);
     }
     return payload;
 }

package/dist/src/lib/workflow-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,MAAM;IACN,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,MAAM,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CACH,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEjC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,cAAc;QACd,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YAClC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC7B,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,MAAM;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,SAAS;QACf,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACvB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,0EAA0E;QAC1E,kEAAkE;QAClE,WAAW,EAAE,QAAQ,CAAC,WAAW;YAC/B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,4EAA4E;QAC5E,yDAAyD;QACzD,IAAI,EACF,QAAQ,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;KACb,CAAC;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa;IAEb,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,aAAa,GAGf;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IAC5E,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IACvE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC;IAChE,0EAA0E;IAC1E,kEAAkE;IAClE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAC7B,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;IAC1D,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAC9B,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;IAC1D,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACtB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;CAC1D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO;YACtB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;YAChC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kEAAkE;oBAClE,mEAAmE;oBACnE,qDAAqD;oBACrD,GAAG;gBACL,CAAC,CAAC,sEAAsE;oBACtE,sEAAsE;oBACtE,2DAA2D;oBAC3D,CAAC,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/lib/workflow-toml-validator.d.ts

@@ -57,6 +57,9 @@ export declare const KNOWN_KINDS_FOR_DRIFT_GUARD: ReadonlySet<string>;
  *  - `__workflow_system_access_rule__`: `[workflow] runAs = "system"` with a
  *    non-empty `accessRule` — dead config the server rejects (#1447/#1258).
  *    A workflow-level error (not tied to a step): `stepIndex: -1, stepId: null`.
+ *  - `__template_expression__`: a `{{ }}` expression that can never resolve
+ *    (#2689). The field itself is valid — the `hint` carries the expression's
+ *    location and the lint's message.
  * `hint` is a short, user-facing explanation (used by
  * `formatWorkflowTomlErrors` to render the multi-line diagnostic).
  * `parentStepId` is set when this error came from a `collect` step's
@@ -82,7 +85,7 @@ export type WorkflowTomlError = {
  * can only be started by the system and never evaluates its accessRule, so any
  * non-empty rule is inert. The server rejects this at save time (#1258,
  * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
- * `sync push` all-or-nothing instead of failing mid-push and leaving partial
+ * `config push` all-or-nothing instead of failing mid-push and leaving partial
  * server state (#1418 drift).
  *
  * Mirrors the server predicate byte-for-byte: returns the sentinel error only
@@ -95,6 +98,21 @@ export type WorkflowTomlError = {
  *   object (`tomlData.workflow || tomlData`). Non-object inputs return `null`.
  */
 export declare function validateWorkflowIdentity(workflow: any): WorkflowTomlError | null;
+/**
+ * #2643 — `templateMissingMarker` was removed from the platform. A workflow
+ * TOML that still sets it is rejected here, before the push, with the same
+ * sentence the server returns, rather than being silently dropped.
+ */
+export declare const REMOVED_TEMPLATE_MISSING_MARKER_MESSAGE: string;
+/**
+ * Non-blocking notes for a workflow TOML — things worth saying on a push that
+ * are not errors.
+ *
+ * #2643: `strict` / `strictParams` are accepted and ignored, because the
+ * failure they used to opt into now applies to every workflow. A definition
+ * that sets them keeps working unchanged, so this is a note, not an error.
+ */
+export declare function collectWorkflowTomlNotes(tomlData: any): string[];
 /** The runAs / accessRule pair the identity lint reads. */
 export interface WorkflowIdentityFields {
     runAs?: unknown;
@@ -105,19 +123,22 @@ export interface WorkflowIdentityFields {
  * identity that an `update --from-file` push will leave on the server — the
  * merge of the persisted record with the incoming file/flags.
  *
- * `applyWorkflowBody` omits undefined fields, so the server retains whichever
- * side of the runAs/accessRule pair the incoming payload doesn't set. Linting
- * the incoming payload alone therefore misses the case where the OTHER side is
- * already `system` / a stored rule: an existing `runAs="system"` workflow plus
- * a file adding only an `accessRule`, or a file flipping a workflow with a
- * stored rule to `runAs="system"`. Both pass a payload-only lint and are then
- * rejected by the server's PATCH. Merging the two before `validateWorkflowIdentity`
- * catches them locally at zero extra cost — the persisted record is already
- * fetched at the call site.
- *
- * Presence semantics mirror the update payload builder: a field PRESENT in
- * `incoming` (including an empty-string clear) overrides the stored value; an
- * ABSENT field (undefined) falls back to what the server keeps.
+ * The merge exists for a caller whose push OMITS one side of the
+ * runAs/accessRule pair and lets the server retain it. Linting the incoming
+ * payload alone misses the case where the OTHER side is already `system` / a
+ * stored rule: an existing `runAs="system"` workflow plus a file adding only an
+ * `accessRule`, or a file flipping a workflow with a stored rule to
+ * `runAs="system"`. Both pass a payload-only lint and are then rejected by the
+ * server's PATCH. Merging the two before `validateWorkflowIdentity` catches
+ * them locally at zero extra cost — the persisted record is already fetched at
+ * the call site.
+ *
+ * NOT `config push`, since #2743: its update is always-send, so the file alone IS
+ * the effective config (an omitted `accessRule` clears the stored rule rather
+ * than inheriting it) and its push-time lint of the file is exact. The merge
+ * semantics below are unchanged for any caller that does omit fields: a field
+ * PRESENT in `incoming` (including an empty-string clear) overrides the stored
+ * value; an ABSENT field (undefined) falls back to what the server keeps.
  */
 export declare function effectiveWorkflowIdentity(existing: WorkflowIdentityFields | null | undefined, incoming: WorkflowIdentityFields | null | undefined): WorkflowIdentityFields;
 /**
@@ -152,7 +173,7 @@ export declare function formatWorkflowTomlErrors(filePath: string, errors: Workf
 /**
  * #1614 — client-side mirror of the server's `validateWorkflowExpressions`
  * (`src/workflows/definition-store.ts`) for named `expr.*` CEL guards. Returns
- * structural errors so `sync push` fails fast with the same class of diagnostic
+ * structural errors so `config push` fails fast with the same class of diagnostic
  * the server would 400 on:
  *   1. every `expr.<name>` reference — in a definition body OR a step guard
  *      (`runIf` / `successWhen` / switch `when`) — names a DECLARED definition;
@@ -168,7 +189,7 @@ export declare function formatWorkflowTomlErrors(filePath: string, errors: Workf
  * #1614 — validate the RAW `[expr.cel]` table shape BEFORE
  * `parseWorkflowExpressionsToml` filters it. That parser drops any entry whose
  * body is not a string, so a mistyped `ready = true` would vanish and, with no
- * references left to fail on, `sync push` would succeed while omitting the whole
+ * references left to fail on, `config push` would succeed while omitting the whole
  * expression table. Surface non-string / empty / wrong-typed bodies (and a
  * non-table `cel`) as a hard CLI validation error instead. Mirrors the server's
  * `validateRawExpressionsShape` (`src/workflows/definition-store.ts`).

package/dist/src/lib/workflow-toml-validator.js

@@ -31,6 +31,11 @@
  * case. Regenerate with `node cli/scripts/gen-allowlist.mjs`.
  */
 import { GENERATED_ALLOWLISTED_FIELDS, GENERATED_KNOWN_KINDS, } from "./generated-allowlist.js";
+// #2689 — the static `{{ }}` template lint, generated verbatim from the server
+// module `src/workflows/runner/template-static-lint.ts` (see
+// `cli/scripts/gen-template-lint.mjs`) so push-time and save-time verdicts are
+// produced by the same code rather than a hand mirror.
+import { lintWorkflowStepTemplates } from "./generated-template-lint.js";
 /**
  * Universal-and-consumed allowlist of top-level fields permitted on a step
  * (known kinds). Generated from the runners; see header.
@@ -66,7 +71,7 @@ export const KNOWN_KINDS_FOR_DRIFT_GUARD = KNOWN_KINDS;
  * can only be started by the system and never evaluates its accessRule, so any
  * non-empty rule is inert. The server rejects this at save time (#1258,
  * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
- * `sync push` all-or-nothing instead of failing mid-push and leaving partial
+ * `config push` all-or-nothing instead of failing mid-push and leaving partial
  * server state (#1418 drift).
  *
  * Mirrors the server predicate byte-for-byte: returns the sentinel error only
@@ -99,24 +104,100 @@ export function validateWorkflowIdentity(workflow) {
     }
     return null;
 }
+/**
+ * #2643 — `templateMissingMarker` was removed from the platform. A workflow
+ * TOML that still sets it is rejected here, before the push, with the same
+ * sentence the server returns, rather than being silently dropped.
+ */
+export const REMOVED_TEMPLATE_MISSING_MARKER_MESSAGE = "templateMissingMarker is no longer supported. An unresolved template " +
+    "reference now fails the step on every workflow; mark individual " +
+    "expressions optional with `{{ x | default: '' }}` instead.";
+/**
+ * #2645 — named workflow configs moved to sidecar files
+ * (`workflows/<key>.configs/<name>.toml`), so an inline `[[configs]]` list is
+ * no longer read by anything.
+ *
+ * It fails the push rather than being ignored. A pull taken before this change
+ * wrote those blocks, and push now applies only the sidecars: tolerating the
+ * list would leave the file describing configurations the server does not have
+ * — silently, since the content hash deliberately excludes the legacy list, so
+ * the object would not even report as Modified. The whole point of authoring
+ * configuration in TOML is that the committed file describes the server.
+ */
+const RETIRED_INLINE_CONFIGS_MESSAGE = "`[[configs]]` is no longer read from a workflow file (#2645). Named " +
+    "configurations are authored one per file at " +
+    "`workflows/<key>.configs/<name>.toml`, and `[workflow].activeConfigName` " +
+    "selects the live one. Move each entry's body to its own sidecar file and " +
+    "delete the `[[configs]]` blocks.";
+function validateRetiredInlineConfigs(tomlData) {
+    const configs = tomlData?.configs;
+    if (!Array.isArray(configs) || configs.length === 0)
+        return null;
+    return {
+        stepIndex: -1,
+        stepId: null,
+        field: "__workflow_inline_configs__",
+        hint: RETIRED_INLINE_CONFIGS_MESSAGE,
+    };
+}
+function validateRemovedWorkflowFields(workflow) {
+    if (!workflow || typeof workflow !== "object")
+        return null;
+    if (!Object.prototype.hasOwnProperty.call(workflow, "templateMissingMarker")) {
+        return null;
+    }
+    return {
+        stepIndex: -1,
+        stepId: null,
+        field: "__workflow_removed_field__",
+        hint: REMOVED_TEMPLATE_MISSING_MARKER_MESSAGE,
+    };
+}
+/**
+ * Non-blocking notes for a workflow TOML — things worth saying on a push that
+ * are not errors.
+ *
+ * #2643: `strict` / `strictParams` are accepted and ignored, because the
+ * failure they used to opt into now applies to every workflow. A definition
+ * that sets them keeps working unchanged, so this is a note, not an error.
+ */
+export function collectWorkflowTomlNotes(tomlData) {
+    const notes = [];
+    const steps = tomlData?.steps;
+    if (!Array.isArray(steps))
+        return notes;
+    const usesStrict = steps.some((step) => step &&
+        typeof step === "object" &&
+        (Object.prototype.hasOwnProperty.call(step, "strict") ||
+            Object.prototype.hasOwnProperty.call(step, "strictParams")));
+    if (usesStrict) {
+        notes.push("Note: `strict` / `strictParams` no longer do anything — an unresolved " +
+            "template reference fails the step on every workflow (#2643). The keys " +
+            "are still accepted, so you can remove them at your convenience.");
+    }
+    return notes;
+}
 /**
  * #1447 (maintainer decision, 2026-07-21): compute the EFFECTIVE workflow
  * identity that an `update --from-file` push will leave on the server — the
  * merge of the persisted record with the incoming file/flags.
  *
- * `applyWorkflowBody` omits undefined fields, so the server retains whichever
- * side of the runAs/accessRule pair the incoming payload doesn't set. Linting
- * the incoming payload alone therefore misses the case where the OTHER side is
- * already `system` / a stored rule: an existing `runAs="system"` workflow plus
- * a file adding only an `accessRule`, or a file flipping a workflow with a
- * stored rule to `runAs="system"`. Both pass a payload-only lint and are then
- * rejected by the server's PATCH. Merging the two before `validateWorkflowIdentity`
- * catches them locally at zero extra cost — the persisted record is already
- * fetched at the call site.
+ * The merge exists for a caller whose push OMITS one side of the
+ * runAs/accessRule pair and lets the server retain it. Linting the incoming
+ * payload alone misses the case where the OTHER side is already `system` / a
+ * stored rule: an existing `runAs="system"` workflow plus a file adding only an
+ * `accessRule`, or a file flipping a workflow with a stored rule to
+ * `runAs="system"`. Both pass a payload-only lint and are then rejected by the
+ * server's PATCH. Merging the two before `validateWorkflowIdentity` catches
+ * them locally at zero extra cost — the persisted record is already fetched at
+ * the call site.
  *
- * Presence semantics mirror the update payload builder: a field PRESENT in
- * `incoming` (including an empty-string clear) overrides the stored value; an
- * ABSENT field (undefined) falls back to what the server keeps.
+ * NOT `config push`, since #2743: its update is always-send, so the file alone IS
+ * the effective config (an omitted `accessRule` clears the stored rule rather
+ * than inheriting it) and its push-time lint of the file is exact. The merge
+ * semantics below are unchanged for any caller that does omit fields: a field
+ * PRESENT in `incoming` (including an empty-string clear) overrides the stored
+ * value; an ABSENT field (undefined) falls back to what the server keeps.
  */
 export function effectiveWorkflowIdentity(existing, incoming) {
     const ex = existing ?? {};
@@ -166,6 +247,20 @@ export function validateWorkflowToml(tomlData, opts) {
         if (identityError)
             errors.push(identityError);
     }
+    // #2643 — a `[workflow]` key the platform has removed. Checked with the same
+    // `tomlData.workflow || tomlData` fallback as the identity lint so the
+    // unwrapped root-level form is caught too, and BEFORE the `steps`
+    // early-returns so a metadata-only file is still flagged.
+    const removedFieldError = validateRemovedWorkflowFields(tomlData.workflow || tomlData);
+    if (removedFieldError)
+        errors.push(removedFieldError);
+    // #2645 — an inline `[[configs]]` list, which named configs left behind when
+    // they moved to sidecar files. Read from the document root (not the
+    // `[workflow]` table) and before the `steps` early-returns, so a
+    // configs-only file is flagged too.
+    const inlineConfigsError = validateRetiredInlineConfigs(tomlData);
+    if (inlineConfigsError)
+        errors.push(inlineConfigsError);
     const steps = tomlData.steps;
     // No steps section at all → nothing to validate. This is fine for
     // partial TOML files (some commands accept a metadata-only file).
@@ -229,6 +324,25 @@ export function validateWorkflowToml(tomlData, opts) {
             validateStepObject(step.step, i, outerStepId, errors);
         }
     }
+    // #2689 — statically-dead `{{ }}` expressions (unknown root, undeclared
+    // `steps.<id>` / `outputs.<name>`) are guaranteed run-time failures since
+    // #2643. Reject them here so `config push` reports them before anything is
+    // pushed, instead of after a deploy-and-run cycle.
+    //
+    // `knownKinds` carries the #998 skew posture into the lint: an old CLI must
+    // not judge a NEWER server's step kind, whose runner may bind template roots
+    // this copy of the lint has never heard of. The server-side check in
+    // `validateWorkflowSteps` scans every step and stays authoritative.
+    for (const finding of lintWorkflowStepTemplates(steps, {
+        knownKinds: KNOWN_KINDS,
+    })) {
+        errors.push({
+            stepIndex: finding.stepIndex,
+            stepId: finding.stepId,
+            field: "__template_expression__",
+            hint: `${finding.location}: ${finding.message}`,
+        });
+    }
     return errors;
 }
 /**
@@ -388,9 +502,20 @@ export function formatWorkflowTomlErrors(filePath, errors) {
             lines.push(`  steps[${err.stepIndex}] is malformed: ${err.hint}`);
             continue;
         }
+        // #2689 — a statically-dead `{{ }}` expression. The offending FIELD is
+        // fine; its contents are not, so the "unknown field" wording would be
+        // actively misleading. Render the step slot plus the lint's message, which
+        // already names the expression, the problem and the fix.
+        if (err.field === "__template_expression__") {
+            const idPart = err.stepId ? ` (id="${err.stepId}")` : "";
+            lines.push(`  steps[${err.stepIndex}]${idPart}:`);
+            lines.push(`  ${err.hint}`);
+            continue;
+        }
         // #1447 — workflow-level error, not tied to a step. Render the bare hint
         // (no `steps[N]` prefix) under the file header.
-        if (err.field === "__workflow_system_access_rule__") {
+        if (err.field === "__workflow_system_access_rule__" ||
+            err.field === "__workflow_removed_field__") {
             lines.push(`  ${err.hint}`);
             continue;
         }
@@ -426,7 +551,7 @@ export function formatWorkflowTomlErrors(filePath, errors) {
 /**
  * #1614 — client-side mirror of the server's `validateWorkflowExpressions`
  * (`src/workflows/definition-store.ts`) for named `expr.*` CEL guards. Returns
- * structural errors so `sync push` fails fast with the same class of diagnostic
+ * structural errors so `config push` fails fast with the same class of diagnostic
  * the server would 400 on:
  *   1. every `expr.<name>` reference — in a definition body OR a step guard
  *      (`runIf` / `successWhen` / switch `when`) — names a DECLARED definition;
@@ -442,7 +567,7 @@ export function formatWorkflowTomlErrors(filePath, errors) {
  * #1614 — validate the RAW `[expr.cel]` table shape BEFORE
  * `parseWorkflowExpressionsToml` filters it. That parser drops any entry whose
  * body is not a string, so a mistyped `ready = true` would vanish and, with no
- * references left to fail on, `sync push` would succeed while omitting the whole
+ * references left to fail on, `config push` would succeed while omitting the whole
  * expression table. Surface non-string / empty / wrong-typed bodies (and a
  * non-table `cel`) as a hard CLI validation error instead. Mirrors the server's
  * `validateRawExpressionsShape` (`src/workflows/definition-store.ts`).