primitive-admin 1.1.0-alpha.37 → 1.1.0-alpha.39

package/dist/src/lib/toml-params-validator.d.ts

@@ -47,6 +47,33 @@ export interface ValidationResult {
  * doc-comment for the rationale.
  */
 export declare function collectParamRefs(value: any): string[];
+/**
+ * Collect bare `params.X` references from a CEL string (issue #1239).
+ *
+ * Access rules reference operation params with the bare `params.X` form (no
+ * `$` prefix), unlike `definition`, which uses `$params.X` (scanned by
+ * {@link collectParamRefs}). This helper feeds the operation's `access` CEL
+ * and each per-param `access` CEL into the "referenced" set so a param used
+ * only by an access rule is not wrongly flagged "declared but not referenced".
+ *
+ * Supported forms, all whitespace-tolerant:
+ *   - dot notation:     `params.claimedUserId`, `params . claimedUserId`
+ *   - dot path:         `params.config.subField` → first segment `config`
+ *   - bracket notation: `params["claimedUserId"]`, `params['claimedUserId']`
+ *
+ * Word-boundary guard: a `params` preceded by an identifier char, `$`, or `.`
+ * is NOT a match, so `$params.x` (definition syntax), `myparams.x`, and a
+ * dotted member access like `database.metadata.params.userId` are ignored —
+ * `params` only counts as the params root when it's a standalone root
+ * identifier. To avoid counting a `params.` that merely appears inside a quoted
+ * string literal (e.g. `note == "see params.docs"`), bracket keys are scanned
+ * first (they legitimately contain quotes), then string literals are stripped
+ * before the dot-notation scan.
+ *
+ * Purely additive: this only grows the referenced set, loosening the soft
+ * warning. The blocking `$params` error path is untouched.
+ */
+export declare function collectCelParamRefs(cel: any): string[];
 /**
  * Normalize a `params` value (object, array, or JSON string) into the
  * set of declared param names.
@@ -74,6 +101,13 @@ export interface ValidateOptions {
         name: string;
         definition: any;
         params?: any;
+        /**
+         * The operation-level `access` CEL rule, if any (issue #1239). Params
+         * referenced here via bare `params.X` count as "referenced" so they are
+         * not wrongly flagged "declared but not referenced". May be null/absent
+         * when the operation inherits the type's `defaultAccess`.
+         */
+        access?: any;
     }>;
 }
 /**

package/dist/src/lib/toml-params-validator.js

@@ -29,6 +29,7 @@
  *     `$params.config.subKey` without listing every sub-field
  *     individually (review feedback r3246635661).
  */
+import { collectUnknownOperators } from "./query-operators.js";
 /**
  * Walk an arbitrary JSON-ish value and collect `$params.X` references
  * found in string-valued leaves, returning only the first dotted segment
@@ -58,6 +59,88 @@ export function collectParamRefs(value) {
     }
     return refs;
 }
+/**
+ * Collect bare `params.X` references from a CEL string (issue #1239).
+ *
+ * Access rules reference operation params with the bare `params.X` form (no
+ * `$` prefix), unlike `definition`, which uses `$params.X` (scanned by
+ * {@link collectParamRefs}). This helper feeds the operation's `access` CEL
+ * and each per-param `access` CEL into the "referenced" set so a param used
+ * only by an access rule is not wrongly flagged "declared but not referenced".
+ *
+ * Supported forms, all whitespace-tolerant:
+ *   - dot notation:     `params.claimedUserId`, `params . claimedUserId`
+ *   - dot path:         `params.config.subField` → first segment `config`
+ *   - bracket notation: `params["claimedUserId"]`, `params['claimedUserId']`
+ *
+ * Word-boundary guard: a `params` preceded by an identifier char, `$`, or `.`
+ * is NOT a match, so `$params.x` (definition syntax), `myparams.x`, and a
+ * dotted member access like `database.metadata.params.userId` are ignored —
+ * `params` only counts as the params root when it's a standalone root
+ * identifier. To avoid counting a `params.` that merely appears inside a quoted
+ * string literal (e.g. `note == "see params.docs"`), bracket keys are scanned
+ * first (they legitimately contain quotes), then string literals are stripped
+ * before the dot-notation scan.
+ *
+ * Purely additive: this only grows the referenced set, loosening the soft
+ * warning. The blocking `$params` error path is untouched.
+ */
+export function collectCelParamRefs(cel) {
+    if (typeof cel !== "string" || cel.length === 0)
+        return [];
+    const refs = [];
+    // Bracket notation: params["X"] / params['X']. Run before stripping string
+    // literals so the quoted key survives.
+    const bracketRe = /(?<![\w$.])params\s*\[\s*["']([^"']+)["']\s*\]/g;
+    let m;
+    while ((m = bracketRe.exec(cel)) !== null) {
+        const first = m[1].split(/[.\[]/)[0];
+        if (first)
+            refs.push(first);
+    }
+    // Drop string literals so `params.` inside a quoted string is not counted.
+    const withoutStrings = cel.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, "");
+    // Dot notation: params.X (first segment only, mirroring collectParamRefs).
+    const dotRe = /(?<![\w$.])params\s*\.\s*([A-Za-z_$][\w$]*)/g;
+    while ((m = dotRe.exec(withoutStrings)) !== null) {
+        refs.push(m[1]);
+    }
+    return refs;
+}
+/**
+ * Collect the per-param `access` CEL strings from an operation's `params`
+ * value (object, array, or JSON string form). Used by issue #1239 to count
+ * params referenced only inside another param's `access` rule.
+ */
+function collectParamAccessCels(params) {
+    const cels = [];
+    if (params == null)
+        return cels;
+    let value = params;
+    if (typeof value === "string") {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return cels;
+        }
+    }
+    if (Array.isArray(value)) {
+        for (const row of value) {
+            if (row && typeof row === "object" && typeof row.access === "string") {
+                cels.push(row.access);
+            }
+        }
+    }
+    else if (typeof value === "object" && value !== null) {
+        for (const entry of Object.values(value)) {
+            if (entry && typeof entry === "object" && typeof entry.access === "string") {
+                cels.push(entry.access);
+            }
+        }
+    }
+    return cels;
+}
 /**
  * Normalize a `params` value (object, array, or JSON string) into the
  * set of declared param names.
@@ -146,9 +229,24 @@ export function validateOperations(opts) {
         if (!op || !op.name)
             continue;
         const declared = declaredParamNames(op.params);
-        const refs = new Set(collectParamRefs(op.definition));
+        // `definitionRefs` drives the BLOCKING error loop and must stay limited to
+        // `$params.X` references inside `definition` — access CEL refs are NOT
+        // declarations, so they must never produce an "undeclared" error.
+        const definitionRefs = new Set(collectParamRefs(op.definition));
+        // Issue #1239: a param referenced only by an access CEL rule (bare
+        // `params.X`) is still referenced. The "declared but not referenced"
+        // warning uses a wider set that also counts the operation-level `access`
+        // and each per-param `access` CEL. Purely additive — the blocking error
+        // path below is built only from `definitionRefs`.
+        const referenced = new Set(definitionRefs);
+        for (const ref of collectCelParamRefs(op.access))
+            referenced.add(ref);
+        for (const cel of collectParamAccessCels(op.params)) {
+            for (const ref of collectCelParamRefs(cel))
+                referenced.add(ref);
+        }
         const line = locateOperationLine(opts.rawToml, op.name);
-        for (const ref of refs) {
+        for (const ref of definitionRefs) {
             if (!declared.has(ref)) {
                 errors.push({
                     file: opts.filePath,
@@ -159,7 +257,7 @@ export function validateOperations(opts) {
             }
         }
         for (const name of declared) {
-            if (!refs.has(name)) {
+            if (!referenced.has(name)) {
                 warnings.push({
                     file: opts.filePath,
                     line,
@@ -168,6 +266,23 @@ export function validateOperations(opts) {
                 });
             }
         }
+        // Issue #1255 (Fork 4): warn on unknown filter operators. The server only
+        // checks that `filter` is an object at push time, so a typo like
+        // `$gt` → `$gte` or an invented `$foo` slips through and throws
+        // `InvalidOperatorError` only at query execution. We warn (not error) to
+        // avoid CLI/server divergence — the operator set could drift, and the
+        // server stays authoritative.
+        const filter = op.definition && typeof op.definition === "object"
+            ? op.definition.filter
+            : undefined;
+        for (const badOp of collectUnknownOperators(filter)) {
+            warnings.push({
+                file: opts.filePath,
+                line,
+                op: op.name,
+                message: `unknown filter operator '${badOp}' in operation '${op.name}' — not a recognized query operator; it will fail at query execution`,
+            });
+        }
     }
     return { errors, warnings };
 }

package/dist/src/lib/toml-params-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"toml-params-validator.js","sourceRoot":"","sources":["../../../src/lib/toml-params-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAcH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAU;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACvF,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,WAAW,GAAG,yDAAyD,EAAE,CAAC,IAAI,GAAG;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,UAAU,IAAI,+CAA+C,EAAE,CAAC,IAAI,GAAG;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"toml-params-validator.js","sourceRoot":"","sources":["../../../src/lib/toml-params-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAc/D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAU;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,SAAS,GAAG,iDAAiD,CAAC;IACpE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IAE/E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,8CAA8C,CAAC;IAC7D,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAW;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpF,IAAI,CAAC,IAAI,CAAE,KAAa,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACvF,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,WAAW,GAAG,yDAAyD,EAAE,CAAC,IAAI,GAAG;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,UAAU,IAAI,+CAA+C,EAAE,CAAC,IAAI,GAAG;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,gEAAgE;QAChE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;YAC/D,CAAC,CAAE,EAAE,CAAC,UAAkB,CAAC,MAAM;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,IAAI;gBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;gBACX,OAAO,EAAE,4BAA4B,KAAK,mBAAmB,EAAE,CAAC,IAAI,sEAAsE;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC"}

package/dist/src/lib/workflow-apply.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Shared "apply a TOML body to an existing workflow" helper.
+ *
+ * Extracted from the `sync push` update-existing path (#1249, Fork 4) so that
+ * both `sync push` and `workflows update --from-file` push a revised body the
+ * same way. A second inlined copy would regress #807: the update is
+ * ordering-sensitive and a naive metadata-then-body sequence rejects valid
+ * sync-callable edits.
+ *
+ * Ordering invariant (#807 / codex review):
+ *   1. metadata PATCH — WITHOUT `syncCallable`. The server re-validates
+ *      `syncCallable: true` against the workflow's CURRENTLY-active server
+ *      steps (`loadCurrentActiveSteps`, src/admin-api.ts:4734), not the steps
+ *      being pushed in the same call. So enabling sync-callable in the first
+ *      PATCH would validate against the stale active steps and be rejected.
+ *   2. body write — steps to the active config (config-model) or the legacy
+ *      draft slot (no active config).
+ *   3. a SECOND `syncCallable` PATCH — issued AFTER the new steps are active,
+ *      so it validates against the new (compatible) steps.
+ */
+import type { ApiClient } from "./api-client.js";
+/**
+ * Safely parse a JSON field that may be a string or already an object. TOML can
+ * parse inline tables as objects, so we accept both. (Same semantics as the
+ * `safeJsonParse` in sync.ts — kept here so the shared apply helper owns its
+ * own parse decision without importing back into a command module.)
+ */
+export declare function safeJsonParse(value: any): any;
+export interface ApplyWorkflowBodyOptions {
+    /** Optimistic-concurrency guard for the metadata + syncCallable PATCHes. */
+    expectedModifiedAt?: string;
+    /**
+     * Active config to overwrite in place (config-model workflows). When absent,
+     * the body falls back to the legacy draft slot — non-live for config-model
+     * workflows, which the server rejects with 409 WORKFLOW_CONFIG_MODEL.
+     */
+    activeConfigId?: string;
+    /** When true, skip the optimistic-concurrency check (mirrors `--force`). */
+    force?: boolean;
+}
+export interface ApplyWorkflowBodyResult {
+    /** The freshest workflow `modifiedAt` after all PATCHes (for sync state). */
+    latestModifiedAt?: string;
+    /** Which slot the steps landed in: "active config" or "draft (legacy)". */
+    updateSlotLabel: string;
+    /** A fresh `getWorkflow` result so callers can read back configs/state. */
+    fullWorkflow: any;
+}
+/**
+ * Apply a parsed workflow body (metadata + steps) to an existing workflow,
+ * preserving the key/id. `workflow` is the TOML's `[workflow]` table (already
+ * merged with any explicit CLI flag overrides by the caller); `steps` is the
+ * TOML's `steps` array. The function performs the three-step ordered update
+ * and returns the latest `modifiedAt`, the slot label, and a fresh workflow.
+ */
+export declare function applyWorkflowBody(client: ApiClient, appId: string, workflowId: string, workflow: any, steps: any[], opts?: ApplyWorkflowBodyOptions): Promise<ApplyWorkflowBodyResult>;
+/**
+ * Fork 2 (#1249): a TOML pushed at a specific `<id>` may also declare a `key` /
+ * `workflowKey`. If it differs from the target's actual key, that's almost
+ * certainly the wrong file — error rather than silently ignoring it. An absent
+ * TOML key is advisory and allowed (the operation targets `<id>`).
+ *
+ * Returns an error message string when there is a mismatch, otherwise null.
+ * Pure function for unit testing.
+ */
+export declare function workflowKeyMismatchError(tomlWorkflow: any, existingWorkflowKey: string | undefined): string | null;

package/dist/src/lib/workflow-apply.js

@@ -0,0 +1,117 @@
+/**
+ * Shared "apply a TOML body to an existing workflow" helper.
+ *
+ * Extracted from the `sync push` update-existing path (#1249, Fork 4) so that
+ * both `sync push` and `workflows update --from-file` push a revised body the
+ * same way. A second inlined copy would regress #807: the update is
+ * ordering-sensitive and a naive metadata-then-body sequence rejects valid
+ * sync-callable edits.
+ *
+ * Ordering invariant (#807 / codex review):
+ *   1. metadata PATCH — WITHOUT `syncCallable`. The server re-validates
+ *      `syncCallable: true` against the workflow's CURRENTLY-active server
+ *      steps (`loadCurrentActiveSteps`, src/admin-api.ts:4734), not the steps
+ *      being pushed in the same call. So enabling sync-callable in the first
+ *      PATCH would validate against the stale active steps and be rejected.
+ *   2. body write — steps to the active config (config-model) or the legacy
+ *      draft slot (no active config).
+ *   3. a SECOND `syncCallable` PATCH — issued AFTER the new steps are active,
+ *      so it validates against the new (compatible) steps.
+ */
+/**
+ * Safely parse a JSON field that may be a string or already an object. TOML can
+ * parse inline tables as objects, so we accept both. (Same semantics as the
+ * `safeJsonParse` in sync.ts — kept here so the shared apply helper owns its
+ * own parse decision without importing back into a command module.)
+ */
+export function safeJsonParse(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return JSON.parse(value);
+    return value; // Already an object (TOML parsed it as a table)
+}
+/**
+ * Apply a parsed workflow body (metadata + steps) to an existing workflow,
+ * preserving the key/id. `workflow` is the TOML's `[workflow]` table (already
+ * merged with any explicit CLI flag overrides by the caller); `steps` is the
+ * TOML's `steps` array. The function performs the three-step ordered update
+ * and returns the latest `modifiedAt`, the slot label, and a fresh workflow.
+ */
+export async function applyWorkflowBody(client, appId, workflowId, workflow, steps, opts = {}) {
+    const { expectedModifiedAt, activeConfigId, force } = opts;
+    // 1. Metadata PATCH — note: NO `syncCallable` here (deferred to step 3).
+    //    `requiresClientApply` has no step-dependent validation, so it stays.
+    const updated = await client.updateWorkflow(appId, workflowId, {
+        name: workflow.name,
+        description: workflow.description,
+        status: workflow.status,
+        accessRule: workflow.accessRule !== undefined ? workflow.accessRule || null : undefined,
+        // #1081 — workflow principal mode. Absent key → undefined (server leaves
+        // it untouched); explicit value/empty is forwarded so it round-trips.
+        runAs: workflow.runAs !== undefined ? workflow.runAs || null : undefined,
+        // #1233 — opt-in capability grants. Absent key → undefined (server's
+        // hasOwnProperty guard leaves it untouched); an explicit array is
+        // forwarded so a pull → push round-trips it. Mirrors `runAs` above so
+        // both `sync push` and `workflows update --from-file` apply it the same.
+        capabilities: workflow.capabilities !== undefined ? workflow.capabilities : undefined,
+        perUserMaxRunning: workflow.perUserMaxRunning,
+        perUserMaxQueued: workflow.perUserMaxQueued,
+        dequeueOrder: workflow.dequeueOrder,
+        requiresClientApply: workflow.requiresClientApply,
+        inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
+        outputSchema: workflow.outputSchema ? safeJsonParse(workflow.outputSchema) : null,
+        // #1304 (P-C): declared-access manifest. Absent key → undefined (server's
+        // hasOwnProperty guard leaves it untouched); a parsed value/null is
+        // forwarded so a pull → push round-trips it (null clears). `sync push`
+        // always attaches this (null when the TOML drops `[metadata]`); the
+        // `workflows update --from-file` caller may leave it undefined.
+        metadataManifest: workflow.metadataManifest !== undefined ? workflow.metadataManifest : undefined,
+    }, expectedModifiedAt);
+    // The first PATCH bumps `modifiedAt`; the syncCallable PATCH (if any) bumps
+    // it again. The config/step update does NOT touch the workflow definition's
+    // `modifiedAt`.
+    let latestModifiedAt = updated?.workflow?.modifiedAt;
+    // 2. Body write — active config (config-model) or legacy draft slot.
+    let updateSlotLabel = "active config";
+    if (activeConfigId) {
+        await client.updateWorkflowConfig(appId, workflowId, activeConfigId, { steps });
+    }
+    else {
+        await client.updateWorkflowDraft(appId, workflowId, {
+            steps,
+            inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
+        });
+        updateSlotLabel = "draft (legacy)";
+    }
+    // 3. Deferred `syncCallable` PATCH — now that the new steps are active (#807).
+    //    Only sent when the TOML actually carries the key; an absent key stays
+    //    `undefined` and the call is skipped, preserving no-clobber discipline.
+    if (workflow.syncCallable !== undefined) {
+        const syncCallableUpdated = await client.updateWorkflow(appId, workflowId, { syncCallable: workflow.syncCallable }, force ? undefined : latestModifiedAt);
+        if (syncCallableUpdated?.workflow?.modifiedAt) {
+            latestModifiedAt = syncCallableUpdated.workflow.modifiedAt;
+        }
+    }
+    const fullWorkflow = await client.getWorkflow(appId, workflowId);
+    return { latestModifiedAt, updateSlotLabel, fullWorkflow };
+}
+/**
+ * Fork 2 (#1249): a TOML pushed at a specific `<id>` may also declare a `key` /
+ * `workflowKey`. If it differs from the target's actual key, that's almost
+ * certainly the wrong file — error rather than silently ignoring it. An absent
+ * TOML key is advisory and allowed (the operation targets `<id>`).
+ *
+ * Returns an error message string when there is a mismatch, otherwise null.
+ * Pure function for unit testing.
+ */
+export function workflowKeyMismatchError(tomlWorkflow, existingWorkflowKey) {
+    const tomlKey = tomlWorkflow?.key ?? tomlWorkflow?.workflowKey;
+    if (tomlKey && existingWorkflowKey && tomlKey !== existingWorkflowKey) {
+        return (`TOML workflow key "${tomlKey}" does not match the target workflow's key ` +
+            `"${existingWorkflowKey}". This usually means you pointed --from-file at the ` +
+            `wrong workflow id. Remove the key from the TOML or target the matching id.`);
+    }
+    return null;
+}
+//# sourceMappingURL=workflow-apply.js.map

package/dist/src/lib/workflow-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-apply.js","sourceRoot":"","sources":["../../../src/lib/workflow-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,QAAa,EACb,KAAY,EACZ,OAAiC,EAAE;IAEnC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE3D,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,KAAK,EACL,UAAU,EACV;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EACR,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7E,yEAAyE;QACzE,sEAAsE;QACtE,KAAK,EAAE,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,YAAY,EACV,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACzE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9E,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QACjF,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,gBAAgB,EACd,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;KAClF,EACD,kBAAkB,CACnB,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,gBAAgB,GAAuB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;IAEzE,qEAAqE;IACrE,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE;YAClD,KAAK;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/E,CAAC,CAAC;QACH,eAAe,GAAG,gBAAgB,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,cAAc,CACrD,KAAK,EACL,UAAU,EACV,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,EACvC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CACrC,CAAC;QACF,IAAI,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC9C,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAiB,EACjB,mBAAuC;IAEvC,MAAM,OAAO,GAAG,YAAY,EAAE,GAAG,IAAI,YAAY,EAAE,WAAW,CAAC;IAC/D,IAAI,OAAO,IAAI,mBAAmB,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,OAAO,CACL,sBAAsB,OAAO,6CAA6C;YAC1E,IAAI,mBAAmB,uDAAuD;YAC9E,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/workflow-toml-validator.js

@@ -227,6 +227,42 @@ function validateStepObject(step, stepIndex, parentStepId, errors) {
             parentStepId,
         });
     }
+    // #1252 — form-urlencoded body conflict. `[steps.request.form]` encodes an
+    // `application/x-www-form-urlencoded` body; it cannot coexist with a
+    // `request.body` or a raw/multipart `bodyMode`. The runtime rejects the same
+    // combination, but catching it at push time gives a clearer, earlier
+    // diagnostic. (`request.form` itself needs no allowlist entry — the validator
+    // only checks top-level step fields, and `request` is already allowlisted.)
+    if (step.kind === "integration.call" &&
+        step.request !== null &&
+        typeof step.request === "object" &&
+        !Array.isArray(step.request)) {
+        const req = step.request;
+        const hasForm = req.form !== undefined && req.form !== null;
+        if (hasForm) {
+            if (req.body !== undefined && req.body !== null) {
+                errors.push({
+                    stepIndex,
+                    stepId,
+                    field: "request.form",
+                    hint: "`request.form` (application/x-www-form-urlencoded) cannot be combined with `request.body`. " +
+                        "Use one request body — either the JSON `body` or the `form` table.",
+                    parentStepId,
+                });
+            }
+            const mode = step.bodyMode;
+            if (mode === "raw" || mode === "multipart") {
+                errors.push({
+                    stepIndex,
+                    stepId,
+                    field: "request.form",
+                    hint: `\`request.form\` (application/x-www-form-urlencoded) cannot be combined with bodyMode "${mode}". ` +
+                        "Remove `form` or the `bodyMode`.",
+                    parentStepId,
+                });
+            }
+        }
+    }
 }
 /**
  * Render a multi-line diagnostic for a list of errors. Designed for the

package/dist/src/lib/workflow-toml-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-toml-validator.js","sourceRoot":"","sources":["../../../src/lib/workflow-toml-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAAkB,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwB,WAAW,CAAC;AA4B5E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EACF,sJAAsJ;aACzJ,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,oEAAoE,OAAO,KAAK,IAAI;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,eAAe;QACf,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,mDACJ,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAClE,GAAG;aACJ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE7D,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,oEAAoE;QACpE,mEAAmE;QACnE,2CAA2C;QAC3C,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EACzB,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,IAAS,EACT,SAAiB,EACjB,YAA2B,EAC3B,MAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAExB,oEAAoE;QACpE,qEAAqE;QACrE,wDAAwD;QACxD,6DAA6D;QAC7D,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,qBAAqB,GACzB,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACnE,MAAM,eAAe,GACnB,MAAM,KAAK,IAAI;YACf,GAAG,KAAK,MAAM;YACd,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,CAAC,qBAAqB,CAAC;QAEzB,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,SAAS;QAEX,kEAAkE;QAClE,YAAY;QACZ,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,mEAAmE;QACnE,iDAAiD;QACjD,EAAE;QACF,sEAAsE;QACtE,IAAI,IAAY,CAAC;QACjB,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,IAAI,SAAS,CAAC;YACvC,IAAI;gBACF,4CAA4C,MAAM,IAAI,UAAU,uBAAuB,UAAU,KAAK;oBACtG,0DAA0D,UAAU,qCAAqC,CAAC;QAC9G,CAAC;aAAM,CAAC;YACN,IAAI;gBACF,KAAK,GAAG,qCAAqC;oBAC7C,wEAAwE,GAAG,mEAAmE,GAAG,IAAI,CAAC;QAC1J,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,SAAS;YACT,MAAM;YACN,KAAK,EAAE,GAAG;YACV,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,MAA2B;IAE3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAa,CAAC,YAAY,QAAQ,GAAG,CAAC,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,SAAS,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,WAAW;YACtB,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,QAAQ;YAChC,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,GACd,WAAW,IAAI,GAAG,CAAC,YAAY;YAC7B,CAAC,CAAC,6BAA6B,GAAG,CAAC,YAAY,IAAI;YACnD,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,GAAG,MAAM,GAAG,UAAU,uBAAuB,GAAG,CAAC,KAAK,IAAI,CACpE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"workflow-toml-validator.js","sourceRoot":"","sources":["../../../src/lib/workflow-toml-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAAkB,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwB,WAAW,CAAC;AA4B5E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EACF,sJAAsJ;aACzJ,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,oEAAoE,OAAO,KAAK,IAAI;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,eAAe;QACf,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,mDACJ,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAClE,GAAG;aACJ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE7D,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,oEAAoE;QACpE,mEAAmE;QACnE,2CAA2C;QAC3C,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EACzB,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,IAAS,EACT,SAAiB,EACjB,YAA2B,EAC3B,MAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAExB,oEAAoE;QACpE,qEAAqE;QACrE,wDAAwD;QACxD,6DAA6D;QAC7D,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,qBAAqB,GACzB,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACnE,MAAM,eAAe,GACnB,MAAM,KAAK,IAAI;YACf,GAAG,KAAK,MAAM;YACd,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,CAAC,qBAAqB,CAAC;QAEzB,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,SAAS;QAEX,kEAAkE;QAClE,YAAY;QACZ,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,mEAAmE;QACnE,iDAAiD;QACjD,EAAE;QACF,sEAAsE;QACtE,IAAI,IAAY,CAAC;QACjB,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,IAAI,SAAS,CAAC;YACvC,IAAI;gBACF,4CAA4C,MAAM,IAAI,UAAU,uBAAuB,UAAU,KAAK;oBACtG,0DAA0D,UAAU,qCAAqC,CAAC;QAC9G,CAAC;aAAM,CAAC;YACN,IAAI;gBACF,KAAK,GAAG,qCAAqC;oBAC7C,wEAAwE,GAAG,mEAAmE,GAAG,IAAI,CAAC;QAC1J,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,SAAS;YACT,MAAM;YACN,KAAK,EAAE,GAAG;YACV,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,4EAA4E;IAC5E,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAChC,IAAI,CAAC,OAAO,KAAK,IAAI;QACrB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAC5B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAkC,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,cAAc;oBACrB,IAAI,EACF,6FAA6F;wBAC7F,oEAAoE;oBACtE,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,cAAc;oBACrB,IAAI,EACF,0FAA0F,IAAI,KAAK;wBACnG,kCAAkC;oBACpC,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,MAA2B;IAE3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAa,CAAC,YAAY,QAAQ,GAAG,CAAC,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,SAAS,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,WAAW;YACtB,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,QAAQ;YAChC,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,GACd,WAAW,IAAI,GAAG,CAAC,YAAY;YAC7B,CAAC,CAAC,6BAA6B,GAAG,CAAC,YAAY,IAAI;YACnD,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,GAAG,MAAM,GAAG,UAAU,uBAAuB,GAAG,CAAC,KAAK,IAAI,CACpE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/types/index.d.ts

@@ -41,6 +41,9 @@ export interface AppSettings {
     }> | null;
     hasPasskey?: boolean;
     magicLinkEnabled?: boolean;
+    appleSignInEnabled?: boolean | null;
+    appleAudiences?: string[] | null;
+    otpEnabled?: boolean;
 }
 export interface User {
     userId: string;
@@ -489,6 +492,10 @@ export interface SyncState {
             modifiedAt: string;
             contentHash?: string;
         }>;
+        metadataCategoryConfigs?: Record<string, {
+            modifiedAt: string;
+            contentHash?: string;
+        }>;
         webhooks?: Record<string, {
             id: string;
             modifiedAt: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.1.0-alpha.37",
+  "version": "1.1.0-alpha.39",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {