primitive-admin 1.1.0-alpha.41 → 1.1.0-alpha.42

package/dist/src/lib/workflow-apply.js

@@ -18,19 +18,11 @@
  *   3. a SECOND `syncCallable` PATCH — issued AFTER the new steps are active,
  *      so it validates against the new (compatible) steps.
  */
-/**
- * Safely parse a JSON field that may be a string or already an object. TOML can
- * parse inline tables as objects, so we accept both. (Same semantics as the
- * `safeJsonParse` in sync.ts — kept here so the shared apply helper owns its
- * own parse decision without importing back into a command module.)
- */
-export function safeJsonParse(value) {
-    if (value === undefined || value === null)
-        return undefined;
-    if (typeof value === "string")
-        return JSON.parse(value);
-    return value; // Already an object (TOML parsed it as a table)
-}
+import { buildWorkflowPayloadFromToml, safeJsonParse } from "./workflow-payload.js";
+// #1177: `safeJsonParse` now lives in the shared `workflow-payload` lib module
+// (the builder needs it too); re-exported here so existing importers of this
+// module keep working. Both `cli/src/lib` modules; no dep-direction problem.
+export { safeJsonParse };
 /**
  * Apply a parsed workflow body (metadata + steps) to an existing workflow,
  * preserving the key/id. `workflow` is the TOML's `[workflow]` table (already
@@ -40,27 +32,15 @@ export function safeJsonParse(value) {
  */
 export async function applyWorkflowBody(client, appId, workflowId, workflow, steps, opts = {}) {
     const { expectedModifiedAt, activeConfigId, force } = opts;
-    // 1. Metadata PATCH — note: NO `syncCallable` here (deferred to step 3).
-    //    `requiresClientApply` has no step-dependent validation, so it stays.
+    // 1. Metadata PATCH — note: NO `syncCallable` here (deferred to step 3). The
+    //    shared builder (#1177, `mode: "update"`) omits `syncCallable` for exactly
+    //    this reason and applies the presence-aware clear-vs-leave semantics for
+    //    `accessRule` / `runAs` / `capabilities` / schemas. `requiresClientApply`
+    //    has no step-dependent validation, so the builder keeps it here. The
+    //    `metadataManifest` declared-access manifest (#1304) is call-site-specific
+    //    and attached below, not owned by the shared builder.
     const updated = await client.updateWorkflow(appId, workflowId, {
-        name: workflow.name,
-        description: workflow.description,
-        status: workflow.status,
-        accessRule: workflow.accessRule !== undefined ? workflow.accessRule || null : undefined,
-        // #1081 — workflow principal mode. Absent key → undefined (server leaves
-        // it untouched); explicit value/empty is forwarded so it round-trips.
-        runAs: workflow.runAs !== undefined ? workflow.runAs || null : undefined,
-        // #1233 — opt-in capability grants. Absent key → undefined (server's
-        // hasOwnProperty guard leaves it untouched); an explicit array is
-        // forwarded so a pull → push round-trips it. Mirrors `runAs` above so
-        // both `sync push` and `workflows update --from-file` apply it the same.
-        capabilities: workflow.capabilities !== undefined ? workflow.capabilities : undefined,
-        perUserMaxRunning: workflow.perUserMaxRunning,
-        perUserMaxQueued: workflow.perUserMaxQueued,
-        dequeueOrder: workflow.dequeueOrder,
-        requiresClientApply: workflow.requiresClientApply,
-        inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
-        outputSchema: workflow.outputSchema ? safeJsonParse(workflow.outputSchema) : null,
+        ...buildWorkflowPayloadFromToml(workflow, { mode: "update" }),
         // #1304 (P-C): declared-access manifest. Absent key → undefined (server's
         // hasOwnProperty guard leaves it untouched); a parsed value/null is
         // forwarded so a pull → push round-trips it (null clears). `sync push`
@@ -96,6 +76,36 @@ export async function applyWorkflowBody(client, appId, workflowId, workflow, ste
     const fullWorkflow = await client.getWorkflow(appId, workflowId);
     return { latestModifiedAt, updateSlotLabel, fullWorkflow };
 }
+/**
+ * #1232 — parse the `workflows update --capabilities` flag into the array the
+ * server's update handler expects. This is the CLI fallback the issue asked
+ * for ("workflows update has no capability flag"): a grant/revoke channel for
+ * an existing workflow, since `sync push` create deliberately does not forward
+ * capabilities (#1233, Q2) and there was otherwise no way to set them on an
+ * existing workflow.
+ *
+ * Semantics (mirrors how the server normalizes the field):
+ *   --capabilities membership          → ["membership"]        (grant)
+ *   --capabilities membership,secrets  → ["membership","secrets"]
+ *   --capabilities " membership , x "  → ["membership","x"]     (trimmed)
+ *   --capabilities ""                  → []                     (revoke all;
+ *                                        server stores empty as null)
+ *
+ * The set of grantable capability names ("membership" / "secrets") is validated
+ * server-side by `validateWorkflowIdentityConfig`; the CLI intentionally does
+ * NOT duplicate that allowlist so it can't drift from the server. An unknown
+ * name is surfaced via the server's structured `details[]` error.
+ *
+ * The caller applies presence-guarded plumbing (`options.capabilities !==
+ * undefined`) so an omitted flag never reaches the payload — the server's
+ * `hasOwnProperty` guard then leaves the existing grant untouched.
+ */
+export function parseCapabilitiesFlag(value) {
+    return value
+        .split(",")
+        .map((cap) => cap.trim())
+        .filter((cap) => cap.length > 0);
+}
 /**
  * Fork 2 (#1249): a TOML pushed at a specific `<id>` may also declare a `key` /
  * `workflowKey`. If it differs from the target's actual key, that's almost

package/dist/src/lib/workflow-apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-apply.js","sourceRoot":"","sources":["../../../src/lib/workflow-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,QAAa,EACb,KAAY,EACZ,OAAiC,EAAE;IAEnC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE3D,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,KAAK,EACL,UAAU,EACV;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EACR,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7E,yEAAyE;QACzE,sEAAsE;QACtE,KAAK,EAAE,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,YAAY,EACV,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACzE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9E,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QACjF,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,gBAAgB,EACd,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;KAClF,EACD,kBAAkB,CACnB,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,gBAAgB,GAAuB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;IAEzE,qEAAqE;IACrE,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE;YAClD,KAAK;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/E,CAAC,CAAC;QACH,eAAe,GAAG,gBAAgB,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,cAAc,CACrD,KAAK,EACL,UAAU,EACV,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,EACvC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CACrC,CAAC;QACF,IAAI,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC9C,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAiB,EACjB,mBAAuC;IAEvC,MAAM,OAAO,GAAG,YAAY,EAAE,GAAG,IAAI,YAAY,EAAE,WAAW,CAAC;IAC/D,IAAI,OAAO,IAAI,mBAAmB,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,OAAO,CACL,sBAAsB,OAAO,6CAA6C;YAC1E,IAAI,mBAAmB,uDAAuD;YAC9E,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"workflow-apply.js","sourceRoot":"","sources":["../../../src/lib/workflow-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEpF,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,OAAO,EAAE,aAAa,EAAE,CAAC;AAwBzB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,QAAa,EACb,KAAY,EACZ,OAAiC,EAAE;IAEnC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE3D,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,KAAK,EACL,UAAU,EACV;QACE,GAAG,4BAA4B,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7D,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,gBAAgB,EACd,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;KAClF,EACD,kBAAkB,CACnB,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,gBAAgB,GAAuB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;IAEzE,qEAAqE;IACrE,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE;YAClD,KAAK;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/E,CAAC,CAAC;QACH,eAAe,GAAG,gBAAgB,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,cAAc,CACrD,KAAK,EACL,UAAU,EACV,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,EACvC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CACrC,CAAC;QACF,IAAI,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC9C,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAiB,EACjB,mBAAuC;IAEvC,MAAM,OAAO,GAAG,YAAY,EAAE,GAAG,IAAI,YAAY,EAAE,WAAW,CAAC;IAC/D,IAAI,OAAO,IAAI,mBAAmB,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,OAAO,CACL,sBAAsB,OAAO,6CAA6C;YAC1E,IAAI,mBAAmB,uDAAuD;YAC9E,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/workflow-payload.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Shared TOML → workflow-payload builder (#1177).
+ *
+ * Background: the CLI built the create/update workflow payload in THREE
+ * separate hand-enumerated literals — `workflows create --from-file`
+ * (`cli/src/commands/workflows.ts`), the `sync push` create branch
+ * (`cli/src/commands/sync.ts`), and the `sync push` update branch (the metadata
+ * PATCH in `cli/src/lib/workflow-apply.ts`). Because each site listed the
+ * `[workflow]` fields by hand, they drifted apart: a field added to one path was
+ * silently dropped by the others. `status` was the 4th field lost this way
+ * (after `syncCallable` #807, `accessRule` #571, `runAs` #1081); the audit also
+ * found `capabilities` (#1172) and `perAppMaxRunning` / `perAppMaxQueued` /
+ * `queueTtlSeconds` dropped from at least one path.
+ *
+ * The fix: one shared builder that owns the `[workflow]`-derived field list.
+ * All three call-sites spread its output; only the per-field presence coalescing
+ * and the create-only `syncCallable` inclusion differ by `mode`, so the field
+ * list itself lives in exactly one place and can't drift again. A unit
+ * drift-guard asserts the builder's key set (see
+ * `cli/tests/unit/workflow-payload-fields.test.ts`).
+ *
+ * What the builder does NOT own (structural / call-site-specific wiring the
+ * callers still attach): `workflowKey`, `steps`, and the `metadataManifest`
+ * declared-access manifest (#1304) — the sync paths always attach it, create
+ * --from-file never does.
+ *
+ * Presence semantics, by mode:
+ *   - create: optional strings coalesce absent/empty → `undefined` (omit; the
+ *     server default applies). `capabilities` forwards the raw array (absent →
+ *     omit). Schemas omit when absent.
+ *   - update: optional strings distinguish explicit-clear from leave-unset via
+ *     `x !== undefined ? (x || null) : undefined`. `status` forwards the bare
+ *     value (matching the server's hasOwnProperty path). Schemas send `null`
+ *     when absent so a cleared schema round-trips.
+ *   - booleans (`requiresClientApply`, and `syncCallable` on create) are raw
+ *     pass-through so an explicit `false` is preserved and only a truly-absent
+ *     key drops.
+ *   - `syncCallable` is OMITTED in `mode: "update"`: the server re-validates
+ *     `syncCallable: true` against the CURRENTLY-active steps, so the update
+ *     path must send it as a deferred second PATCH after the new steps are live
+ *     (#807). `applyWorkflowBody` owns that second PATCH.
+ */
+export type WorkflowPayloadMode = "create" | "update";
+/**
+ * Parse a JSON schema field that TOML may present as a string OR (for an inline
+ * table) as an already-parsed object. Kept here in `cli/src/lib` so the builder
+ * owns its own parse decision rather than importing back into a command module
+ * (#1177 dependency-direction decision).
+ */
+export declare function safeJsonParse(value: any): any;
+/**
+ * The `[workflow]`-derived keys the builder emits, per mode. Exported so the
+ * drift-guard unit test can assert the key set hasn't silently lost a field —
+ * the recurring bug class this builder closes. `update` omits `syncCallable`
+ * (deferred second PATCH, #807); everything else is shared.
+ */
+export declare const WORKFLOW_PAYLOAD_FIELDS_CREATE: readonly ["name", "description", "status", "accessRule", "runAs", "capabilities", "perUserMaxRunning", "perUserMaxQueued", "perAppMaxRunning", "perAppMaxQueued", "queueTtlSeconds", "dequeueOrder", "requiresClientApply", "inputSchema", "outputSchema", "syncCallable"];
+export declare const WORKFLOW_PAYLOAD_FIELDS_UPDATE: ReadonlyArray<string>;
+/**
+ * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML
+ * `[workflow]` table. `workflow` is `tomlData.workflow` (already merged with any
+ * explicit CLI flag overrides by the caller). Callers spread the result into
+ * the create/update payload and attach the structural fields themselves
+ * (`workflowKey`, `steps`, `metadataManifest`).
+ */
+export declare function buildWorkflowPayloadFromToml(workflow: any, { mode }: {
+    mode: WorkflowPayloadMode;
+}): Record<string, any>;

package/dist/src/lib/workflow-payload.js

@@ -0,0 +1,150 @@
+/**
+ * Shared TOML → workflow-payload builder (#1177).
+ *
+ * Background: the CLI built the create/update workflow payload in THREE
+ * separate hand-enumerated literals — `workflows create --from-file`
+ * (`cli/src/commands/workflows.ts`), the `sync push` create branch
+ * (`cli/src/commands/sync.ts`), and the `sync push` update branch (the metadata
+ * PATCH in `cli/src/lib/workflow-apply.ts`). Because each site listed the
+ * `[workflow]` fields by hand, they drifted apart: a field added to one path was
+ * silently dropped by the others. `status` was the 4th field lost this way
+ * (after `syncCallable` #807, `accessRule` #571, `runAs` #1081); the audit also
+ * found `capabilities` (#1172) and `perAppMaxRunning` / `perAppMaxQueued` /
+ * `queueTtlSeconds` dropped from at least one path.
+ *
+ * The fix: one shared builder that owns the `[workflow]`-derived field list.
+ * All three call-sites spread its output; only the per-field presence coalescing
+ * and the create-only `syncCallable` inclusion differ by `mode`, so the field
+ * list itself lives in exactly one place and can't drift again. A unit
+ * drift-guard asserts the builder's key set (see
+ * `cli/tests/unit/workflow-payload-fields.test.ts`).
+ *
+ * What the builder does NOT own (structural / call-site-specific wiring the
+ * callers still attach): `workflowKey`, `steps`, and the `metadataManifest`
+ * declared-access manifest (#1304) — the sync paths always attach it, create
+ * --from-file never does.
+ *
+ * Presence semantics, by mode:
+ *   - create: optional strings coalesce absent/empty → `undefined` (omit; the
+ *     server default applies). `capabilities` forwards the raw array (absent →
+ *     omit). Schemas omit when absent.
+ *   - update: optional strings distinguish explicit-clear from leave-unset via
+ *     `x !== undefined ? (x || null) : undefined`. `status` forwards the bare
+ *     value (matching the server's hasOwnProperty path). Schemas send `null`
+ *     when absent so a cleared schema round-trips.
+ *   - booleans (`requiresClientApply`, and `syncCallable` on create) are raw
+ *     pass-through so an explicit `false` is preserved and only a truly-absent
+ *     key drops.
+ *   - `syncCallable` is OMITTED in `mode: "update"`: the server re-validates
+ *     `syncCallable: true` against the CURRENTLY-active steps, so the update
+ *     path must send it as a deferred second PATCH after the new steps are live
+ *     (#807). `applyWorkflowBody` owns that second PATCH.
+ */
+/**
+ * Parse a JSON schema field that TOML may present as a string OR (for an inline
+ * table) as an already-parsed object. Kept here in `cli/src/lib` so the builder
+ * owns its own parse decision rather than importing back into a command module
+ * (#1177 dependency-direction decision).
+ */
+export function safeJsonParse(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return JSON.parse(value);
+    return value; // Already an object (TOML parsed it as a table)
+}
+/**
+ * The `[workflow]`-derived keys the builder emits, per mode. Exported so the
+ * drift-guard unit test can assert the key set hasn't silently lost a field —
+ * the recurring bug class this builder closes. `update` omits `syncCallable`
+ * (deferred second PATCH, #807); everything else is shared.
+ */
+export const WORKFLOW_PAYLOAD_FIELDS_CREATE = [
+    "name",
+    "description",
+    "status",
+    "accessRule",
+    "runAs",
+    "capabilities",
+    "perUserMaxRunning",
+    "perUserMaxQueued",
+    "perAppMaxRunning",
+    "perAppMaxQueued",
+    "queueTtlSeconds",
+    "dequeueOrder",
+    "requiresClientApply",
+    "inputSchema",
+    "outputSchema",
+    "syncCallable",
+];
+export const WORKFLOW_PAYLOAD_FIELDS_UPDATE = WORKFLOW_PAYLOAD_FIELDS_CREATE.filter((f) => f !== "syncCallable");
+/**
+ * Build the workflow payload's `[workflow]`-derived fields from a parsed TOML
+ * `[workflow]` table. `workflow` is `tomlData.workflow` (already merged with any
+ * explicit CLI flag overrides by the caller). Callers spread the result into
+ * the create/update payload and attach the structural fields themselves
+ * (`workflowKey`, `steps`, `metadataManifest`).
+ */
+export function buildWorkflowPayloadFromToml(workflow, { mode }) {
+    const create = mode === "create";
+    const payload = {
+        name: workflow.name,
+        description: workflow.description,
+        // status — create coalesces absent/empty → omit (server default `draft`
+        // applies); update forwards the bare value so it round-trips and an
+        // explicit "" surfaces the server's validation error rather than a silent
+        // no-op (matches the pre-existing update path).
+        status: create ? workflow.status || undefined : workflow.status,
+        // accessRule / runAs — create coalesces absent/empty → omit; update
+        // distinguishes explicit clear ("" → null) from leave-unset (absent →
+        // undefined).
+        accessRule: create
+            ? workflow.accessRule || undefined
+            : workflow.accessRule !== undefined
+                ? workflow.accessRule || null
+                : undefined,
+        runAs: create
+            ? workflow.runAs || undefined
+            : workflow.runAs !== undefined
+                ? workflow.runAs || null
+                : undefined,
+        // capabilities — create forwards the raw array (absent → omit); update
+        // forwards presence-aware so an explicit array round-trips. (The server
+        // update PATCH persist for capabilities is tracked separately in #1232; the
+        // round-trip guard asserts capabilities on the create leg only.)
+        capabilities: create
+            ? workflow.capabilities
+            : workflow.capabilities !== undefined
+                ? workflow.capabilities
+                : undefined,
+        // Queue limits — raw numeric pass-through both modes (absent → omit).
+        perUserMaxRunning: workflow.perUserMaxRunning,
+        perUserMaxQueued: workflow.perUserMaxQueued,
+        perAppMaxRunning: workflow.perAppMaxRunning,
+        perAppMaxQueued: workflow.perAppMaxQueued,
+        queueTtlSeconds: workflow.queueTtlSeconds,
+        dequeueOrder: workflow.dequeueOrder,
+        // requiresClientApply — raw boolean pass-through so an explicit `false` is
+        // preserved and only a truly-absent key drops (server default applies).
+        requiresClientApply: workflow.requiresClientApply,
+        // Schemas — parse a JSON string (or accept an inline table). Create omits
+        // when absent; update sends null so a cleared schema round-trips.
+        inputSchema: workflow.inputSchema
+            ? safeJsonParse(workflow.inputSchema)
+            : create
+                ? undefined
+                : null,
+        outputSchema: workflow.outputSchema
+            ? safeJsonParse(workflow.outputSchema)
+            : create
+                ? undefined
+                : null,
+    };
+    // syncCallable — create includes it (raw boolean pass-through); update omits
+    // it (deferred second PATCH, #807 — see module doc).
+    if (create) {
+        payload.syncCallable = workflow.syncCallable;
+    }
+    return payload;
+}
+//# sourceMappingURL=workflow-payload.js.map

package/dist/src/lib/workflow-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-payload.js","sourceRoot":"","sources":["../../../src/lib/workflow-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAU;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,MAAM,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CACH,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAa,EACb,EAAE,IAAI,EAAiC;IAEvC,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEjC,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,cAAc;QACd,UAAU,EAAE,MAAM;YAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YAClC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC7B,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,MAAM;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,SAAS;QACf,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACvB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,0EAA0E;QAC1E,kEAAkE;QAClE,WAAW,EAAE,QAAQ,CAAC,WAAW;YAC/B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;KACX,CAAC;IAEF,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.1.0-alpha.41",
+  "version": "1.1.0-alpha.42",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {