primitive-admin 1.1.0-alpha.43 → 1.1.0-alpha.44

package/dist/src/commands/sync.js

@@ -1,10 +1,10 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from "fs";
 import { join, basename } from "path";
 import { createHash } from "crypto";
-import * as TOML from "@iarna/toml";
 import { lookup as mimeLookup } from "mime-types";
 import { ApiClient, ApiError, ConflictError, SchemaRequiredError, OperationRefError, SchemaBreaksOpsError, SchemaHasUncheckableOpsError, TomlParseError, OpsExistError, } from "../lib/api-client.js";
 import { buildDatabaseTypeTomlData, detectExistingOperationForms, normalizeOperationFromToml, normalizeSubscriptionFromToml, SubscriptionAccessKeyConflictError, } from "../lib/toml-database-config.js";
+import { canEmitNative } from "../lib/toml-native-form.js";
 import { parseMetadataCategoryToml, validateMetadataCategoryConfig, serializeMetadataCategoryConfig, parseDeclaredAccessManifestToml, validateDeclaredAccessManifest, serializeDeclaredAccessManifest, } from "../lib/toml-metadata-config.js";
 import { validateOperations, formatIssue, } from "../lib/toml-params-validator.js";
 import { getServerUrl, resolveAppId } from "../lib/config.js";
@@ -12,6 +12,7 @@ import { resolveSyncDir, resolveSnapshotsRoot, isAutoResolvedSyncDir, checkLegac
 import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneSnapshots, } from "../lib/snapshots.js";
 import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
+import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
 import { applyWorkflowBody } from "../lib/workflow-apply.js";
 import { buildWorkflowPayloadFromToml } from "../lib/workflow-payload.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
@@ -190,6 +191,25 @@ export function normalizeWorkflowTomlDefaults(parsed) {
             workflow[field] = defaultValue;
         }
     }
+    // Schema-form canonicalization (issue #1446): a legacy file carries
+    // `inputSchema` / `outputSchema` as a JSON string, while the native form (and
+    // the remote serialization) carries a parsed object. Parse the string form to
+    // its object here so the two forms hash equal — `sync diff` stays
+    // form-independent and an unchanged schema never shows a false `modified`
+    // during the transition. This runs only on the diff-hash path
+    // (`hashWorkflowTomlForDiff`); the stored-state hash path is untouched, so
+    // there is no forced one-time re-push after upgrade.
+    for (const field of ["inputSchema", "outputSchema"]) {
+        if (typeof workflow[field] === "string") {
+            try {
+                workflow[field] = JSON.parse(workflow[field]);
+            }
+            catch {
+                // Not valid JSON — leave the raw string so a genuinely malformed value
+                // still compares by its literal content.
+            }
+        }
+    }
     return { ...parsed, workflow };
 }
 /**
@@ -208,12 +228,14 @@ export function hashWorkflowTomlForDiff(parsed) {
  * `getWorkflow` + active `getWorkflowConfig`), mirroring exactly what a fresh
  * `sync pull` would write to disk. Serializes via `serializeWorkflow`, parses
  * the resulting TOML (remote serialized TOML never carries `include`s, so a
- * plain `TOML.parse` is sufficient — no fragment path needed), then hashes
+ * plain `parseConfigToml` is sufficient — no fragment path needed), then hashes
  * through `hashWorkflowTomlForDiff` so it lines up with the local-file hash.
  */
 export function hashRemoteWorkflowForDiff(workflow, draft, configs) {
     const serialized = serializeWorkflow(workflow, draft, configs || []);
-    const parsed = TOML.parse(serialized);
+    // serializeWorkflow emits via smol-toml (issue #1450) and may contain a
+    // heterogeneous array, so re-parse through the TOML 1.0-compliant facade.
+    const parsed = parseConfigToml(serialized);
     return hashWorkflowTomlForDiff(parsed);
 }
 // Boolean [auth] keys in app.toml that map 1:1 to app-settings fields.
@@ -238,7 +260,7 @@ const RECOGNIZED_AUTH_KEYS = new Set([
  *
  * Apple/OTP fields round-trip alongside the legacy google/passkey/magic-link
  * keys. Two asymmetries are handled deliberately:
- *  - `appleSignInEnabled` comes back as `boolean | null`; @iarna/toml throws on
+ *  - `appleSignInEnabled` comes back as `boolean | null`; smol-toml throws on
  *    null, so an unset value (null) is omitted rather than written.
  *  - `appleAudiences` is omitted when empty. An empty array and an omitted key
  *    both mean "no audiences" (the server normalizes [] -> null), so omitting
@@ -317,7 +339,7 @@ function serializeAppSettings(settings) {
             maxAge: settings.corsMaxAge,
         };
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeIntegration(integration) {
     const data = {
@@ -330,9 +352,9 @@ function serializeIntegration(integration) {
         },
         requestConfig: integration.requestConfig || {},
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
-function serializeWebhook(webhook) {
+export function serializeWebhook(webhook) {
     const data = {
         webhook: {
             key: webhook.webhookKey,
@@ -353,7 +375,9 @@ function serializeWebhook(webhook) {
     // the template shape here too so a masked or raw value can never be written
     // to TOML.
     if (typeof webhook.signingSecret === "string" &&
-        /\{\{secrets\.[A-Z][A-Z0-9_]{0,63}\}\}/.test(webhook.signingSecret)) {
+        // Whitespace-tolerant (#1468) to match the server's shared resolver, so a
+        // hand-authored spaced reference `{{ secrets.KEY }}` round-trips pull→push.
+        /\{\{\s*secrets\.[A-Z][A-Z0-9_]{0,63}\s*\}\}/.test(webhook.signingSecret)) {
         data.webhook.signingSecret = webhook.signingSecret;
     }
     // Parse JSON fields if they're strings
@@ -384,7 +408,7 @@ function serializeWebhook(webhook) {
         if (data.webhook[k] === undefined)
             delete data.webhook[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeCronTrigger(trigger) {
     const data = {
@@ -420,7 +444,7 @@ function serializeCronTrigger(trigger) {
         if (data.cronTrigger[k] === undefined)
             delete data.cronTrigger[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeBlobBucket(bucket) {
     const data = {
@@ -446,7 +470,7 @@ function serializeBlobBucket(bucket) {
         if (data.bucket[k] === undefined)
             delete data.bucket[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializePrompt(prompt) {
     const data = {
@@ -469,9 +493,102 @@ function serializePrompt(prompt) {
             userPromptTemplate: config.userPromptTemplate,
         })),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
+}
+/**
+ * Emit a workflow schema field (`inputSchema` / `outputSchema`) for the TOML
+ * `[workflow]` table.
+ *
+ * Issue #1446: pull used to `JSON.stringify` both schema fields into a single
+ * escaped-JSON line — unreadable and undiffable. We now emit the parsed JSON
+ * Schema as a native `[workflow.inputSchema]` / `[workflow.outputSchema]`
+ * table whenever it round-trips faithfully (`canEmitNative === null`), falling
+ * back to the JSON string only for the values TOML silently drops (`null` /
+ * `undefined` anywhere in the schema). The empty-object schema `{}` is a real,
+ * distinct value ("accepts anything") and emits as an empty table.
+ *
+ * Returns `undefined` for an absent schema (the key is then omitted). The
+ * sponsor-approved decision is to always move to native aggressively — no
+ * form preservation — so this does not consult the existing file's form.
+ */
+function serializeWorkflowSchemaField(value, fieldName, workflowKey, log) {
+    if (value === undefined || value === null)
+        return undefined;
+    // Schemas arrive from the server GET as parsed objects; defensively accept a
+    // JSON string too (e.g. an inline-authored file re-serialized here).
+    let obj = value;
+    if (typeof value === "string") {
+        try {
+            obj = JSON.parse(value);
+        }
+        catch {
+            // Not valid JSON — keep the original string as the emitted value.
+            return value;
+        }
+    }
+    if (obj && typeof obj === "object") {
+        const reason = canEmitNative(obj);
+        if (reason) {
+            log(`Workflow '${workflowKey}': cannot emit \`${fieldName}\` as native TOML (${reason}); using JSON string.`);
+            return JSON.stringify(obj);
+        }
+        return obj;
+    }
+    // A non-object schema (unexpected) — preserve it as a JSON string.
+    return JSON.stringify(obj);
+}
+/**
+ * Rewrite a workflow TOML file's string-form `inputSchema` / `outputSchema` to
+ * native object form for `sync migrate-toml` (issue #1446).
+ *
+ * Purely local, no server fetch. Parses the raw source WITHOUT expanding
+ * fragment `include`s (so those directives survive the rewrite), swaps a
+ * JSON-string schema for its parsed object when it round-trips faithfully
+ * (`canEmitNative === null`), and re-serializes via `stringifyConfigToml`.
+ *
+ * Only rewrites when a field is actually converted: a file whose schemas are
+ * already native, absent, or un-representable (a `null` default) is returned
+ * with `changed: false` and its original bytes untouched — so migrate is
+ * idempotent and never reports a spurious migration or reformats a file it
+ * didn't need to touch.
+ */
+export function rewriteWorkflowSchemasToNative(rawToml, workflowKey = "", log = () => { }) {
+    const parsed = parseConfigToml(rawToml);
+    if (!parsed || typeof parsed !== "object" || !parsed.workflow) {
+        return { content: rawToml, changed: false };
+    }
+    const workflow = parsed.workflow;
+    let converted = false;
+    for (const field of ["inputSchema", "outputSchema"]) {
+        const value = workflow[field];
+        // Only a JSON-string schema is a migration candidate; an object is already
+        // native and an absent key needs nothing.
+        if (typeof value !== "string")
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(value);
+        }
+        catch {
+            // Not JSON — leave the literal string in place.
+            continue;
+        }
+        if (!obj || typeof obj !== "object")
+            continue;
+        const reason = canEmitNative(obj);
+        if (reason) {
+            log(`Workflow '${workflowKey}': cannot migrate \`${field}\` to native TOML (${reason}); leaving as JSON string.`);
+            continue;
+        }
+        workflow[field] = obj;
+        converted = true;
+    }
+    if (!converted)
+        return { content: rawToml, changed: false };
+    return { content: stringifyConfigToml(parsed), changed: true };
 }
-export function serializeWorkflow(workflow, draft, configs) {
+export function serializeWorkflow(workflow, draft, configs, logger) {
+    const log = logger ?? (() => { });
     // Find the active config or use the first one
     const activeConfigId = workflow.activeConfigId;
     const activeConfig = configs?.find((c) => c.configId === activeConfigId) || configs?.[0];
@@ -516,9 +633,11 @@ export function serializeWorkflow(workflow, draft, configs) {
             // they're safe to coerce here.
             requiresClientApply: workflow.requiresClientApply !== false,
             syncCallable: workflow.syncCallable === true,
-            // Schemas are at workflow level
-            inputSchema: workflow.inputSchema ? JSON.stringify(workflow.inputSchema) : undefined,
-            outputSchema: workflow.outputSchema ? JSON.stringify(workflow.outputSchema) : undefined,
+            // Schemas are at workflow level. Emit native `[workflow.inputSchema]` /
+            // `[workflow.outputSchema]` tables when representable, JSON string only
+            // as a data-loss fallback (issue #1446).
+            inputSchema: serializeWorkflowSchemaField(workflow.inputSchema, "inputSchema", workflow.workflowKey, log),
+            outputSchema: serializeWorkflowSchemaField(workflow.outputSchema, "outputSchema", workflow.workflowKey, log),
         },
         // Use active config steps, fall back to draft
         steps,
@@ -534,7 +653,7 @@ export function serializeWorkflow(workflow, draft, configs) {
         // a workflow's `md`/`secrets` declarations round-trip through pull → push.
         ...serializeDeclaredAccessManifest(workflow.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 // Database config serialization helpers
 //
@@ -543,15 +662,17 @@ export function serializeWorkflow(workflow, draft, configs) {
 // rows over JSON-strings stuffed into a single field. The form is sticky
 // per file — if the existing file uses the legacy JSON-string form, we
 // preserve it so we don't generate surprise diffs. New files default to
-// native. Un-TOMLable shapes (null, mixed-type arrays) fall back to JSON
-// string per field with a log message.
+// native. The round-trip serializes with `smol-toml` (TOML 1.0), so
+// heterogeneous arrays emit natively (issue #1450); only shapes that TOML
+// genuinely can't represent without data loss (null / undefined / an array
+// containing null) fall back to a JSON string per field with a log message.
 //
 // Issue #666: when the type has a stored `schema` (raw TOML of `[models.*]`
 // blocks), `buildDatabaseTypeTomlData` parses + merges it into the same TOML
 // object so the result round-trips as `[models.<Name>.fields.<field>]`.
 function serializeDatabaseType(typeConfig, operations, ruleSetIdToName, options = {}) {
     const data = buildDatabaseTypeTomlData(typeConfig, operations, ruleSetIdToName, options);
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeEmailTemplate(template) {
     // The API returns { emailType, hasOverride, override: { subject, htmlBody, textBody }, default: { ... } }
@@ -569,7 +690,7 @@ function serializeEmailTemplate(template) {
     if (override.textBody) {
         data.template.textBody = override.textBody;
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeRuleSet(ruleSet) {
     const data = {
@@ -586,7 +707,7 @@ function serializeRuleSet(ruleSet) {
     if (Object.keys(rules).length > 0) {
         data.rules = rules;
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function serializeGroupTypeConfig(config, ruleSetIdToName) {
     const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
@@ -601,7 +722,7 @@ export function serializeGroupTypeConfig(config, ruleSetIdToName) {
         // round-trips, exactly like the collection/database/workflow type configs.
         ...serializeDeclaredAccessManifest(config.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeCollectionTypeConfig(config, ruleSetIdToName) {
     const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
@@ -614,7 +735,7 @@ function serializeCollectionTypeConfig(config, ruleSetIdToName) {
         // `[metadata]` + `secrets` fragments so a pull→push→pull cycle round-trips.
         ...serializeDeclaredAccessManifest(config.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function parseDatabaseTypeToml(tomlData) {
     const typeSection = tomlData.type || {};
@@ -680,7 +801,7 @@ export function parseDatabaseTypeToml(tomlData) {
     let schemaSerialized = null;
     if (tomlData.models && typeof tomlData.models === "object") {
         try {
-            schemaSerialized = TOML.stringify({ models: tomlData.models });
+            schemaSerialized = stringifyConfigToml({ models: tomlData.models });
         }
         catch {
             // Fall through — server-side parser will fail with a clear
@@ -769,7 +890,7 @@ export function parseCollectionTypeConfigToml(tomlData) {
 // the original object untouched.
 function parseTomlFile(filePath) {
     const content = readFileSync(filePath, "utf-8");
-    const parsed = TOML.parse(content);
+    const parsed = parseConfigToml(content);
     return expandWorkflowTomlData(parsed, filePath);
 }
 /**
@@ -861,7 +982,7 @@ export function serializeTestCase(testCase, lookupMaps) {
             expectedJsonSubset: testCase.expectedJsonSubset || "{}",
         },
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function parseTestCaseToml(tomlData) {
     const test = tomlData.test || {};
@@ -1587,7 +1708,7 @@ Directory Structure:
             for (const { workflow, draft, configs } of workflows) {
                 const filename = `${workflow.workflowKey}.toml`;
                 const filePath = join(configDir, "workflows", filename);
-                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || []));
+                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || [], (msg) => info(`  ${msg}`)));
                 // Hash the expanded (post-fragment-splice) form so subsequent pushes
                 // can detect fragment-only edits. See `computeExpandedContentHash`.
                 // Pulled workflows never carry `include`, so the expander is a
@@ -5097,11 +5218,15 @@ Directory Structure:
     // Migrate-toml (issue #752): bulk-rewrite database-type TOML files from
     // the legacy JSON-string form for `definition`/`params` to the native
     // nested-table form. Idempotent: ops already in native form are left as
-    // is; ops that are un-TOMLable (mixed-type arrays, null values) fall
-    // back to JSON-string per field with a log message.
+    // is; the round-trip serializes with smol-toml (TOML 1.0, issue #1450), so
+    // heterogeneous arrays now converge to native form too — only shapes that
+    // TOML can't represent without data loss (null / undefined / an array
+    // containing null) fall back to JSON-string per field with a log message.
     sync
         .command("migrate-toml")
-        .description("Rewrite database-type TOML files to native [operations.definition] / [[operations.params]] form")
+        .description("Rewrite database-type and workflow TOML files to native form " +
+        "([operations.definition] / [[operations.params]] for database types; " +
+        "[workflow.inputSchema] / [workflow.outputSchema] for workflows)")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
         .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
@@ -5120,83 +5245,122 @@ Directory Structure:
             process.exit(1);
         }
         const dbTypesDir = join(configDir, "database-types");
-        if (!existsSync(dbTypesDir)) {
-            info("No database-types/ directory found; nothing to migrate.");
+        const workflowsDir = join(configDir, "workflows");
+        const dbFiles = existsSync(dbTypesDir)
+            ? readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"))
+            : [];
+        const workflowFiles = existsSync(workflowsDir)
+            ? readdirSync(workflowsDir).filter((f) => f.endsWith(".toml"))
+            : [];
+        // Restructured early-return (issue #1446): don't bail just because
+        // `database-types/` is absent — a workflow-only project still has
+        // `inputSchema`/`outputSchema` to migrate.
+        if (dbFiles.length === 0 && workflowFiles.length === 0) {
+            info("No database-type or workflow TOML files found; nothing to migrate.");
             return;
         }
-        const files = readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"));
-        if (files.length === 0) {
-            info("No database-type TOML files found; nothing to migrate.");
-            return;
-        }
-        // Hydrate ruleSetIdToName from local sync state so files that
-        // reference a rule set via the legacy `ruleSetId = "01..."` form
-        // round-trip with the correct `ruleSetName`. Without this, any user
-        // who runs migrate-toml against a file with a rule-set assignment
-        // would silently lose that reference (review feedback r3246633010).
-        //
-        // Files that use the modern key-based `ruleSetName = "..."` form
-        // don't need the map at all — `parseDatabaseTypeToml` stores the
-        // value in `typeConfig._ruleSetName` and the serializer now prefers
-        // that. The map is only load-bearing for the legacy ID-based form.
-        const ruleSetIdToName = new Map();
-        const migrateSyncState = loadSyncState(configDir);
-        if (migrateSyncState?.entities?.ruleSets) {
-            for (const [fileKey, entry] of Object.entries(migrateSyncState.entities.ruleSets)) {
-                if (entry && typeof entry === "object" && "id" in entry && entry.id) {
-                    // fileKey is the sanitized rule-set name (see sync pull at
-                    // sync.ts:1385). It's the same shape the server returned and
-                    // matches what a TOML file's ruleSetName field would carry.
-                    ruleSetIdToName.set(entry.id, fileKey);
-                }
-            }
-        }
         let migratedCount = 0;
         let unchangedCount = 0;
-        for (const file of files) {
-            const filePath = join(dbTypesDir, file);
-            const rawBefore = readFileSync(filePath, "utf-8");
-            const tomlData = parseTomlFile(filePath);
-            // `accessRule`/`access` conflicts surface as a clear error here too,
-            // rather than silently dropping the field during a migrate rewrite.
-            let typeConfig;
-            let operations;
-            let subscriptions;
-            try {
-                ({ typeConfig, operations, subscriptions } =
-                    parseDatabaseTypeToml(tomlData));
+        // ---- database-types/ pass ----
+        if (dbFiles.length > 0) {
+            // Hydrate ruleSetIdToName from local sync state so files that
+            // reference a rule set via the legacy `ruleSetId = "01..."` form
+            // round-trip with the correct `ruleSetName`. Without this, any user
+            // who runs migrate-toml against a file with a rule-set assignment
+            // would silently lose that reference (review feedback r3246633010).
+            //
+            // Files that use the modern key-based `ruleSetName = "..."` form
+            // don't need the map at all — `parseDatabaseTypeToml` stores the
+            // value in `typeConfig._ruleSetName` and the serializer now prefers
+            // that. The map is only load-bearing for the legacy ID-based form.
+            const ruleSetIdToName = new Map();
+            const migrateSyncState = loadSyncState(configDir);
+            if (migrateSyncState?.entities?.ruleSets) {
+                for (const [fileKey, entry] of Object.entries(migrateSyncState.entities.ruleSets)) {
+                    if (entry && typeof entry === "object" && "id" in entry && entry.id) {
+                        // fileKey is the sanitized rule-set name (see sync pull at
+                        // sync.ts:1385). It's the same shape the server returned and
+                        // matches what a TOML file's ruleSetName field would carry.
+                        ruleSetIdToName.set(entry.id, fileKey);
+                    }
+                }
             }
-            catch (err) {
-                if (err instanceof SubscriptionAccessKeyConflictError) {
-                    error(`  ${file}: ${err.message}`);
-                    error(`Aborting migrate-toml: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
-                    process.exit(1);
+            for (const file of dbFiles) {
+                const filePath = join(dbTypesDir, file);
+                const rawBefore = readFileSync(filePath, "utf-8");
+                const tomlData = parseTomlFile(filePath);
+                // `accessRule`/`access` conflicts surface as a clear error here too,
+                // rather than silently dropping the field during a migrate rewrite.
+                let typeConfig;
+                let operations;
+                let subscriptions;
+                try {
+                    ({ typeConfig, operations, subscriptions } =
+                        parseDatabaseTypeToml(tomlData));
                 }
-                throw err;
+                catch (err) {
+                    if (err instanceof SubscriptionAccessKeyConflictError) {
+                        error(`  ${file}: ${err.message}`);
+                        error(`Aborting migrate-toml: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
+                        process.exit(1);
+                    }
+                    throw err;
+                }
+                // Force-native: ignore existing hints so every TOMLable field
+                // ends up in nested-table form. Subscriptions are preserved on the
+                // rewrite (issue #803) so migrate-toml never drops them.
+                const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
+                    defaultForm: "native",
+                    logger: (msg) => info(`  ${msg}`),
+                    subscriptions,
+                });
+                if (rewritten === rawBefore) {
+                    unchangedCount++;
+                    continue;
+                }
+                if (options.dryRun) {
+                    info(`Would migrate database-types/${file}`);
+                }
+                else {
+                    writeFileSync(filePath, rewritten);
+                    info(`Migrated database-types/${file}`);
+                    // Update content hash in sync state if we have an entry for it.
+                    const syncState = loadSyncState(configDir);
+                    const dbType = typeConfig.databaseType || basename(file, ".toml");
+                    if (syncState?.entities?.databaseTypes?.[dbType]) {
+                        syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                        saveSyncState(configDir, syncState);
+                    }
+                }
+                migratedCount++;
             }
-            // Force-native: ignore existing hints so every TOMLable field
-            // ends up in nested-table form. Subscriptions are preserved on the
-            // rewrite (issue #803) so migrate-toml never drops them.
-            const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
-                defaultForm: "native",
-                logger: (msg) => info(`  ${msg}`),
-                subscriptions,
-            });
-            if (rewritten === rawBefore) {
+        }
+        // ---- workflows/ pass (issue #1446) ----
+        // Convert string-form `inputSchema`/`outputSchema` to native tables.
+        // Purely local, mirroring the database-types pass. The stored workflow
+        // hash uses `computeExpandedContentHash` (parse then hash), NOT
+        // `computeFileHash`, matching the workflow convention on the pull/push
+        // paths — otherwise a push after migrate would spuriously re-push.
+        for (const file of workflowFiles) {
+            const filePath = join(workflowsDir, file);
+            const rawBefore = readFileSync(filePath, "utf-8");
+            const workflowKey = basename(file, ".toml");
+            const { content: rewritten, changed } = rewriteWorkflowSchemasToNative(rawBefore, workflowKey, (msg) => info(`  ${msg}`));
+            if (!changed) {
                 unchangedCount++;
                 continue;
             }
             if (options.dryRun) {
-                info(`Would migrate database-types/${file}`);
+                info(`Would migrate workflows/${file}`);
             }
             else {
                 writeFileSync(filePath, rewritten);
-                info(`Migrated database-types/${file}`);
-                // Update content hash in sync state if we have an entry for it.
+                info(`Migrated workflows/${file}`);
+                // Update the stored content hash so a subsequent push sees a no-op.
                 const syncState = loadSyncState(configDir);
-                const dbType = typeConfig.databaseType || basename(file, ".toml");
-                if (syncState?.entities?.databaseTypes?.[dbType]) {
-                    syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                if (syncState?.entities?.workflows?.[workflowKey]) {
+                    syncState.entities.workflows[workflowKey].contentHash =
+                        computeExpandedContentHash(parseTomlFile(filePath));
                     saveSyncState(configDir, syncState);
                 }
             }