primitive-admin 1.1.0-alpha.43 → 1.1.0-alpha.45

package/dist/src/commands/sync.js

@@ -1,10 +1,10 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from "fs";
 import { join, basename } from "path";
 import { createHash } from "crypto";
-import * as TOML from "@iarna/toml";
 import { lookup as mimeLookup } from "mime-types";
 import { ApiClient, ApiError, ConflictError, SchemaRequiredError, OperationRefError, SchemaBreaksOpsError, SchemaHasUncheckableOpsError, TomlParseError, OpsExistError, } from "../lib/api-client.js";
 import { buildDatabaseTypeTomlData, detectExistingOperationForms, normalizeOperationFromToml, normalizeSubscriptionFromToml, SubscriptionAccessKeyConflictError, } from "../lib/toml-database-config.js";
+import { canEmitNative } from "../lib/toml-native-form.js";
 import { parseMetadataCategoryToml, validateMetadataCategoryConfig, serializeMetadataCategoryConfig, parseDeclaredAccessManifestToml, validateDeclaredAccessManifest, serializeDeclaredAccessManifest, } from "../lib/toml-metadata-config.js";
 import { validateOperations, formatIssue, } from "../lib/toml-params-validator.js";
 import { getServerUrl, resolveAppId } from "../lib/config.js";
@@ -12,6 +12,7 @@ import { resolveSyncDir, resolveSnapshotsRoot, isAutoResolvedSyncDir, checkLegac
 import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneSnapshots, } from "../lib/snapshots.js";
 import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
+import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
 import { applyWorkflowBody } from "../lib/workflow-apply.js";
 import { buildWorkflowPayloadFromToml } from "../lib/workflow-payload.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
@@ -190,6 +191,25 @@ export function normalizeWorkflowTomlDefaults(parsed) {
             workflow[field] = defaultValue;
         }
     }
+    // Schema-form canonicalization (issue #1446): a legacy file carries
+    // `inputSchema` / `outputSchema` as a JSON string, while the native form (and
+    // the remote serialization) carries a parsed object. Parse the string form to
+    // its object here so the two forms hash equal — `sync diff` stays
+    // form-independent and an unchanged schema never shows a false `modified`
+    // during the transition. This runs only on the diff-hash path
+    // (`hashWorkflowTomlForDiff`); the stored-state hash path is untouched, so
+    // there is no forced one-time re-push after upgrade.
+    for (const field of ["inputSchema", "outputSchema"]) {
+        if (typeof workflow[field] === "string") {
+            try {
+                workflow[field] = JSON.parse(workflow[field]);
+            }
+            catch {
+                // Not valid JSON — leave the raw string so a genuinely malformed value
+                // still compares by its literal content.
+            }
+        }
+    }
     return { ...parsed, workflow };
 }
 /**
@@ -208,12 +228,14 @@ export function hashWorkflowTomlForDiff(parsed) {
  * `getWorkflow` + active `getWorkflowConfig`), mirroring exactly what a fresh
  * `sync pull` would write to disk. Serializes via `serializeWorkflow`, parses
  * the resulting TOML (remote serialized TOML never carries `include`s, so a
- * plain `TOML.parse` is sufficient — no fragment path needed), then hashes
+ * plain `parseConfigToml` is sufficient — no fragment path needed), then hashes
  * through `hashWorkflowTomlForDiff` so it lines up with the local-file hash.
  */
 export function hashRemoteWorkflowForDiff(workflow, draft, configs) {
     const serialized = serializeWorkflow(workflow, draft, configs || []);
-    const parsed = TOML.parse(serialized);
+    // serializeWorkflow emits via smol-toml (issue #1450) and may contain a
+    // heterogeneous array, so re-parse through the TOML 1.0-compliant facade.
+    const parsed = parseConfigToml(serialized);
     return hashWorkflowTomlForDiff(parsed);
 }
 // Boolean [auth] keys in app.toml that map 1:1 to app-settings fields.
@@ -238,7 +260,7 @@ const RECOGNIZED_AUTH_KEYS = new Set([
  *
  * Apple/OTP fields round-trip alongside the legacy google/passkey/magic-link
  * keys. Two asymmetries are handled deliberately:
- *  - `appleSignInEnabled` comes back as `boolean | null`; @iarna/toml throws on
+ *  - `appleSignInEnabled` comes back as `boolean | null`; smol-toml throws on
  *    null, so an unset value (null) is omitted rather than written.
  *  - `appleAudiences` is omitted when empty. An empty array and an omitted key
  *    both mean "no audiences" (the server normalizes [] -> null), so omitting
@@ -317,7 +339,7 @@ function serializeAppSettings(settings) {
             maxAge: settings.corsMaxAge,
         };
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeIntegration(integration) {
     const data = {
@@ -330,9 +352,9 @@ function serializeIntegration(integration) {
         },
         requestConfig: integration.requestConfig || {},
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
-function serializeWebhook(webhook) {
+export function serializeWebhook(webhook) {
     const data = {
         webhook: {
             key: webhook.webhookKey,
@@ -353,7 +375,9 @@ function serializeWebhook(webhook) {
     // the template shape here too so a masked or raw value can never be written
     // to TOML.
     if (typeof webhook.signingSecret === "string" &&
-        /\{\{secrets\.[A-Z][A-Z0-9_]{0,63}\}\}/.test(webhook.signingSecret)) {
+        // Whitespace-tolerant (#1468) to match the server's shared resolver, so a
+        // hand-authored spaced reference `{{ secrets.KEY }}` round-trips pull→push.
+        /\{\{\s*secrets\.[A-Z][A-Z0-9_]{0,63}\s*\}\}/.test(webhook.signingSecret)) {
         data.webhook.signingSecret = webhook.signingSecret;
     }
     // Parse JSON fields if they're strings
@@ -384,7 +408,7 @@ function serializeWebhook(webhook) {
         if (data.webhook[k] === undefined)
             delete data.webhook[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeCronTrigger(trigger) {
     const data = {
@@ -420,7 +444,7 @@ function serializeCronTrigger(trigger) {
         if (data.cronTrigger[k] === undefined)
             delete data.cronTrigger[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeBlobBucket(bucket) {
     const data = {
@@ -446,7 +470,32 @@ function serializeBlobBucket(bucket) {
         if (data.bucket[k] === undefined)
             delete data.bucket[k];
     });
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
+}
+/**
+ * Build the PATCH payload for a blob-bucket update from local TOML.
+ *
+ * EXACT extraction of the inline builder shared by the existing-update and
+ * 409-adopt branches — do NOT "clean up" the truthiness checks. The server
+ * treats `preset` and `accessPolicy` as mutually exclusive, only clears
+ * `ruleSetId` when a preset/accessPolicy is also present, and nulls
+ * `description` only when the key is explicitly present with a falsy value.
+ * `bucketKey` and `ttlTier` are immutable and never sent. Both call sites
+ * must go through this helper so their field sets never drift.
+ */
+function buildBlobBucketUpdatePayload(bucket) {
+    const updatePayload = {};
+    if (bucket.preset)
+        updatePayload.preset = bucket.preset;
+    else if (bucket.accessPolicy)
+        updatePayload.accessPolicy = bucket.accessPolicy;
+    if (bucket.ruleSetId)
+        updatePayload.ruleSetId = bucket.ruleSetId;
+    if (bucket.name)
+        updatePayload.name = bucket.name;
+    if (bucket.description !== undefined)
+        updatePayload.description = bucket.description || null;
+    return updatePayload;
 }
 function serializePrompt(prompt) {
     const data = {
@@ -469,9 +518,102 @@ function serializePrompt(prompt) {
             userPromptTemplate: config.userPromptTemplate,
         })),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
+}
+/**
+ * Emit a workflow schema field (`inputSchema` / `outputSchema`) for the TOML
+ * `[workflow]` table.
+ *
+ * Issue #1446: pull used to `JSON.stringify` both schema fields into a single
+ * escaped-JSON line — unreadable and undiffable. We now emit the parsed JSON
+ * Schema as a native `[workflow.inputSchema]` / `[workflow.outputSchema]`
+ * table whenever it round-trips faithfully (`canEmitNative === null`), falling
+ * back to the JSON string only for the values TOML silently drops (`null` /
+ * `undefined` anywhere in the schema). The empty-object schema `{}` is a real,
+ * distinct value ("accepts anything") and emits as an empty table.
+ *
+ * Returns `undefined` for an absent schema (the key is then omitted). The
+ * sponsor-approved decision is to always move to native aggressively — no
+ * form preservation — so this does not consult the existing file's form.
+ */
+function serializeWorkflowSchemaField(value, fieldName, workflowKey, log) {
+    if (value === undefined || value === null)
+        return undefined;
+    // Schemas arrive from the server GET as parsed objects; defensively accept a
+    // JSON string too (e.g. an inline-authored file re-serialized here).
+    let obj = value;
+    if (typeof value === "string") {
+        try {
+            obj = JSON.parse(value);
+        }
+        catch {
+            // Not valid JSON — keep the original string as the emitted value.
+            return value;
+        }
+    }
+    if (obj && typeof obj === "object") {
+        const reason = canEmitNative(obj);
+        if (reason) {
+            log(`Workflow '${workflowKey}': cannot emit \`${fieldName}\` as native TOML (${reason}); using JSON string.`);
+            return JSON.stringify(obj);
+        }
+        return obj;
+    }
+    // A non-object schema (unexpected) — preserve it as a JSON string.
+    return JSON.stringify(obj);
+}
+/**
+ * Rewrite a workflow TOML file's string-form `inputSchema` / `outputSchema` to
+ * native object form for `sync migrate-toml` (issue #1446).
+ *
+ * Purely local, no server fetch. Parses the raw source WITHOUT expanding
+ * fragment `include`s (so those directives survive the rewrite), swaps a
+ * JSON-string schema for its parsed object when it round-trips faithfully
+ * (`canEmitNative === null`), and re-serializes via `stringifyConfigToml`.
+ *
+ * Only rewrites when a field is actually converted: a file whose schemas are
+ * already native, absent, or un-representable (a `null` default) is returned
+ * with `changed: false` and its original bytes untouched — so migrate is
+ * idempotent and never reports a spurious migration or reformats a file it
+ * didn't need to touch.
+ */
+export function rewriteWorkflowSchemasToNative(rawToml, workflowKey = "", log = () => { }) {
+    const parsed = parseConfigToml(rawToml);
+    if (!parsed || typeof parsed !== "object" || !parsed.workflow) {
+        return { content: rawToml, changed: false };
+    }
+    const workflow = parsed.workflow;
+    let converted = false;
+    for (const field of ["inputSchema", "outputSchema"]) {
+        const value = workflow[field];
+        // Only a JSON-string schema is a migration candidate; an object is already
+        // native and an absent key needs nothing.
+        if (typeof value !== "string")
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(value);
+        }
+        catch {
+            // Not JSON — leave the literal string in place.
+            continue;
+        }
+        if (!obj || typeof obj !== "object")
+            continue;
+        const reason = canEmitNative(obj);
+        if (reason) {
+            log(`Workflow '${workflowKey}': cannot migrate \`${field}\` to native TOML (${reason}); leaving as JSON string.`);
+            continue;
+        }
+        workflow[field] = obj;
+        converted = true;
+    }
+    if (!converted)
+        return { content: rawToml, changed: false };
+    return { content: stringifyConfigToml(parsed), changed: true };
 }
-export function serializeWorkflow(workflow, draft, configs) {
+export function serializeWorkflow(workflow, draft, configs, logger) {
+    const log = logger ?? (() => { });
     // Find the active config or use the first one
     const activeConfigId = workflow.activeConfigId;
     const activeConfig = configs?.find((c) => c.configId === activeConfigId) || configs?.[0];
@@ -516,9 +658,11 @@ export function serializeWorkflow(workflow, draft, configs) {
             // they're safe to coerce here.
             requiresClientApply: workflow.requiresClientApply !== false,
             syncCallable: workflow.syncCallable === true,
-            // Schemas are at workflow level
-            inputSchema: workflow.inputSchema ? JSON.stringify(workflow.inputSchema) : undefined,
-            outputSchema: workflow.outputSchema ? JSON.stringify(workflow.outputSchema) : undefined,
+            // Schemas are at workflow level. Emit native `[workflow.inputSchema]` /
+            // `[workflow.outputSchema]` tables when representable, JSON string only
+            // as a data-loss fallback (issue #1446).
+            inputSchema: serializeWorkflowSchemaField(workflow.inputSchema, "inputSchema", workflow.workflowKey, log),
+            outputSchema: serializeWorkflowSchemaField(workflow.outputSchema, "outputSchema", workflow.workflowKey, log),
         },
         // Use active config steps, fall back to draft
         steps,
@@ -534,7 +678,7 @@ export function serializeWorkflow(workflow, draft, configs) {
         // a workflow's `md`/`secrets` declarations round-trip through pull → push.
         ...serializeDeclaredAccessManifest(workflow.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 // Database config serialization helpers
 //
@@ -543,15 +687,17 @@ export function serializeWorkflow(workflow, draft, configs) {
 // rows over JSON-strings stuffed into a single field. The form is sticky
 // per file — if the existing file uses the legacy JSON-string form, we
 // preserve it so we don't generate surprise diffs. New files default to
-// native. Un-TOMLable shapes (null, mixed-type arrays) fall back to JSON
-// string per field with a log message.
+// native. The round-trip serializes with `smol-toml` (TOML 1.0), so
+// heterogeneous arrays emit natively (issue #1450); only shapes that TOML
+// genuinely can't represent without data loss (null / undefined / an array
+// containing null) fall back to a JSON string per field with a log message.
 //
 // Issue #666: when the type has a stored `schema` (raw TOML of `[models.*]`
 // blocks), `buildDatabaseTypeTomlData` parses + merges it into the same TOML
 // object so the result round-trips as `[models.<Name>.fields.<field>]`.
 function serializeDatabaseType(typeConfig, operations, ruleSetIdToName, options = {}) {
     const data = buildDatabaseTypeTomlData(typeConfig, operations, ruleSetIdToName, options);
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeEmailTemplate(template) {
     // The API returns { emailType, hasOverride, override: { subject, htmlBody, textBody }, default: { ... } }
@@ -569,7 +715,7 @@ function serializeEmailTemplate(template) {
     if (override.textBody) {
         data.template.textBody = override.textBody;
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeRuleSet(ruleSet) {
     const data = {
@@ -586,7 +732,7 @@ function serializeRuleSet(ruleSet) {
     if (Object.keys(rules).length > 0) {
         data.rules = rules;
     }
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function serializeGroupTypeConfig(config, ruleSetIdToName) {
     const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
@@ -601,7 +747,7 @@ export function serializeGroupTypeConfig(config, ruleSetIdToName) {
         // round-trips, exactly like the collection/database/workflow type configs.
         ...serializeDeclaredAccessManifest(config.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 function serializeCollectionTypeConfig(config, ruleSetIdToName) {
     const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
@@ -614,7 +760,7 @@ function serializeCollectionTypeConfig(config, ruleSetIdToName) {
         // `[metadata]` + `secrets` fragments so a pull→push→pull cycle round-trips.
         ...serializeDeclaredAccessManifest(config.metadataManifest),
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function parseDatabaseTypeToml(tomlData) {
     const typeSection = tomlData.type || {};
@@ -680,7 +826,7 @@ export function parseDatabaseTypeToml(tomlData) {
     let schemaSerialized = null;
     if (tomlData.models && typeof tomlData.models === "object") {
         try {
-            schemaSerialized = TOML.stringify({ models: tomlData.models });
+            schemaSerialized = stringifyConfigToml({ models: tomlData.models });
         }
         catch {
             // Fall through — server-side parser will fail with a clear
@@ -769,7 +915,7 @@ export function parseCollectionTypeConfigToml(tomlData) {
 // the original object untouched.
 function parseTomlFile(filePath) {
     const content = readFileSync(filePath, "utf-8");
-    const parsed = TOML.parse(content);
+    const parsed = parseConfigToml(content);
     return expandWorkflowTomlData(parsed, filePath);
 }
 /**
@@ -861,7 +1007,7 @@ export function serializeTestCase(testCase, lookupMaps) {
             expectedJsonSubset: testCase.expectedJsonSubset || "{}",
         },
     };
-    return TOML.stringify(data);
+    return stringifyConfigToml(data);
 }
 export function parseTestCaseToml(tomlData) {
     const test = tomlData.test || {};
@@ -1587,7 +1733,7 @@ Directory Structure:
             for (const { workflow, draft, configs } of workflows) {
                 const filename = `${workflow.workflowKey}.toml`;
                 const filePath = join(configDir, "workflows", filename);
-                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || []));
+                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || [], (msg) => info(`  ${msg}`)));
                 // Hash the expanded (post-fragment-splice) form so subsequent pushes
                 // can detect fragment-only edits. See `computeExpandedContentHash`.
                 // Pulled workflows never carry `include`, so the expander is a
@@ -2562,30 +2708,27 @@ Directory Structure:
                     if (existingId) {
                         // #1020 (D8): idempotently apply preset/ruleSet/name/description
                         // changes via PATCH. bucketKey/ttlTier are immutable and not sent.
-                        const updatePayload = {};
-                        if (bucket.preset)
-                            updatePayload.preset = bucket.preset;
-                        else if (bucket.accessPolicy)
-                            updatePayload.accessPolicy = bucket.accessPolicy;
-                        if (bucket.ruleSetId)
-                            updatePayload.ruleSetId = bucket.ruleSetId;
-                        if (bucket.name)
-                            updatePayload.name = bucket.name;
-                        if (bucket.description !== undefined)
-                            updatePayload.description = bucket.description || null;
+                        const updatePayload = buildBlobBucketUpdatePayload(bucket);
                         changes.push({ type: "blob-bucket", action: "update", key });
                         if (!options.dryRun) {
                             try {
                                 await client.updateBlobBucket(resolvedAppId, existingId, updatePayload);
                                 info(`  Updated blob bucket: ${key}`);
+                                // #1459: stamp the content hash ONLY after a successful
+                                // update, and only when this is not a dry run. A failed
+                                // update (or a dry run) must leave the file pending rather
+                                // than mark it in-sync and suppress it on the next push.
+                                if (syncState?.entities?.blobBuckets?.[key]) {
+                                    syncState.entities.blobBuckets[key].contentHash =
+                                        computeFileHash(filePath);
+                                }
                             }
                             catch (err) {
+                                // Keep the warn-and-continue contract (sponsor decision):
+                                // do not abort the push, just don't stamp the hash.
                                 warn(`  Failed to update blob bucket ${key}: ${String(err?.message || err)}`);
                             }
                         }
-                        if (syncState?.entities?.blobBuckets?.[key]) {
-                            syncState.entities.blobBuckets[key].contentHash = computeFileHash(filePath);
-                        }
                     }
                     else {
                         const payload = {
@@ -2620,23 +2763,86 @@ Directory Structure:
                             catch (err) {
                                 const msg = String(err?.message || err);
                                 if (msg.includes("already exists") || err.statusCode === 409) {
-                                    info(`  Blob bucket already exists on server: ${key}`);
-                                    // Fetch the existing bucket to get its ID
+                                    // #1459: adopt-by-key on 409. A blob bucket can already
+                                    // exist on the server (an out-of-band create, or a prior
+                                    // push that aborted before recording it in sync state). The
+                                    // old handler stamped the LOCAL file's contentHash WITHOUT
+                                    // applying the local config, so a divergent bucket was
+                                    // silently marked in-sync and never reconciled. Mirror the
+                                    // cron/workflow adopt paths: look up the bucket by key,
+                                    // re-issue the local payload as an UPDATE, and stamp the
+                                    // hash ONLY after the update succeeds.
+                                    info(`  Blob bucket already exists on server, adopting by key: ${key}`);
+                                    let existing;
                                     try {
-                                        const existing = await client.getBlobBucket(resolvedAppId, key);
-                                        if (syncState && existing?.bucketId) {
-                                            if (!syncState.entities.blobBuckets) {
-                                                syncState.entities.blobBuckets = {};
-                                            }
-                                            syncState.entities.blobBuckets[key] = {
-                                                id: existing.bucketId,
-                                                modifiedAt: existing.modifiedAt || new Date().toISOString(),
-                                                contentHash: computeFileHash(filePath),
-                                            };
+                                        existing = await client.getBlobBucket(resolvedAppId, key);
+                                    }
+                                    catch (lookupErr) {
+                                        // A lookup failure after a 409 means we cannot adopt —
+                                        // surface it instead of swallowing it (the old silent
+                                        // `catch {}` left no sync-state entry, looping
+                                        // create→409 on every push).
+                                        throw wrapEntityError(new Error(`blob bucket "${key}" already exists but could not be adopted (lookup failed: ${String(lookupErr?.message || lookupErr)})`), "create", "blob bucket", key);
+                                    }
+                                    if (!existing?.bucketId) {
+                                        // 409 but no matching bucket found — surface the original
+                                        // create error rather than silently proceeding.
+                                        throw wrapEntityError(err, "create", "blob bucket", key);
+                                    }
+                                    // Verify the resolved bucket is actually the one we asked
+                                    // for. `getBlobBucket` resolves the identifier by primary id
+                                    // (appId, bucketId) BEFORE bucketKey, and a bucketKey may be
+                                    // a ULID-shaped string (the key regex permits it). If the
+                                    // local key collides with an unrelated bucket's bucketId,
+                                    // the lookup returns that unrelated bucket — patching and
+                                    // stamping it would overwrite the wrong resource. Require an
+                                    // exact key match, matching the cron/workflow adopt paths'
+                                    // exact-key equality (they list + filter by key for the same
+                                    // reason). Surface the mismatch via wrapEntityError; do NOT
+                                    // patch or stamp.
+                                    if (existing.bucketKey !== key) {
+                                        throw wrapEntityError(new Error(`blob bucket "${key}" already exists, but the server resolved a different bucket (bucketKey "${existing.bucketKey}", bucketId "${existing.bucketId}"); refusing to adopt. This happens when the local key collides with an unrelated bucket's id — rename the local bucket key so it does not match an existing bucket id.`), "create", "blob bucket", key);
+                                    }
+                                    // ttlTier is immutable and cannot be reconciled by an
+                                    // UPDATE. A local TOML whose retention tier diverges from
+                                    // the server must fail loudly (sponsor decision) rather
+                                    // than be silently blessed while the cosmetic fields
+                                    // converge.
+                                    if (bucket.ttlTier &&
+                                        existing.ttlTier &&
+                                        bucket.ttlTier !== existing.ttlTier) {
+                                        throw wrapEntityError(new Error(`blob bucket "${key}" ttlTier mismatch: local TOML has "${bucket.ttlTier}" but the server bucket has "${existing.ttlTier}". ttlTier is immutable; align the TOML with the server (or recreate the bucket) before pushing.`), "update", "blob bucket", key);
+                                    }
+                                    const updatePayload = buildBlobBucketUpdatePayload(bucket);
+                                    let updated;
+                                    if (Object.keys(updatePayload).length > 0) {
+                                        // Surface an update failure via wrapEntityError (no
+                                        // stamp) — matches the cron adopt path.
+                                        try {
+                                            updated = await client.updateBlobBucket(resolvedAppId, existing.bucketId, updatePayload);
+                                        }
+                                        catch (updateErr) {
+                                            throw wrapEntityError(updateErr, "update", "blob bucket", key);
                                         }
+                                        info(`  Adopted + updated blob bucket: ${key}`);
                                     }
-                                    catch {
-                                        // Ignore fetch errors
+                                    else {
+                                        // No mutable fields in the local TOML — the server
+                                        // rejects an empty update (400). Adopt the existing
+                                        // bucket without a PATCH.
+                                        info(`  Adopted blob bucket (no updatable fields): ${key}`);
+                                    }
+                                    if (syncState) {
+                                        if (!syncState.entities.blobBuckets) {
+                                            syncState.entities.blobBuckets = {};
+                                        }
+                                        syncState.entities.blobBuckets[key] = {
+                                            id: existing.bucketId,
+                                            modifiedAt: updated?.modifiedAt ||
+                                                existing.modifiedAt ||
+                                                new Date().toISOString(),
+                                            contentHash: computeFileHash(filePath),
+                                        };
                                     }
                                 }
                                 else {
@@ -5097,11 +5303,15 @@ Directory Structure:
     // Migrate-toml (issue #752): bulk-rewrite database-type TOML files from
     // the legacy JSON-string form for `definition`/`params` to the native
     // nested-table form. Idempotent: ops already in native form are left as
-    // is; ops that are un-TOMLable (mixed-type arrays, null values) fall
-    // back to JSON-string per field with a log message.
+    // is; the round-trip serializes with smol-toml (TOML 1.0, issue #1450), so
+    // heterogeneous arrays now converge to native form too — only shapes that
+    // TOML can't represent without data loss (null / undefined / an array
+    // containing null) fall back to JSON-string per field with a log message.
     sync
         .command("migrate-toml")
-        .description("Rewrite database-type TOML files to native [operations.definition] / [[operations.params]] form")
+        .description("Rewrite database-type and workflow TOML files to native form " +
+        "([operations.definition] / [[operations.params]] for database types; " +
+        "[workflow.inputSchema] / [workflow.outputSchema] for workflows)")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
         .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
@@ -5120,83 +5330,122 @@ Directory Structure:
             process.exit(1);
         }
         const dbTypesDir = join(configDir, "database-types");
-        if (!existsSync(dbTypesDir)) {
-            info("No database-types/ directory found; nothing to migrate.");
-            return;
-        }
-        const files = readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"));
-        if (files.length === 0) {
-            info("No database-type TOML files found; nothing to migrate.");
+        const workflowsDir = join(configDir, "workflows");
+        const dbFiles = existsSync(dbTypesDir)
+            ? readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"))
+            : [];
+        const workflowFiles = existsSync(workflowsDir)
+            ? readdirSync(workflowsDir).filter((f) => f.endsWith(".toml"))
+            : [];
+        // Restructured early-return (issue #1446): don't bail just because
+        // `database-types/` is absent — a workflow-only project still has
+        // `inputSchema`/`outputSchema` to migrate.
+        if (dbFiles.length === 0 && workflowFiles.length === 0) {
+            info("No database-type or workflow TOML files found; nothing to migrate.");
             return;
         }
-        // Hydrate ruleSetIdToName from local sync state so files that
-        // reference a rule set via the legacy `ruleSetId = "01..."` form
-        // round-trip with the correct `ruleSetName`. Without this, any user
-        // who runs migrate-toml against a file with a rule-set assignment
-        // would silently lose that reference (review feedback r3246633010).
-        //
-        // Files that use the modern key-based `ruleSetName = "..."` form
-        // don't need the map at all — `parseDatabaseTypeToml` stores the
-        // value in `typeConfig._ruleSetName` and the serializer now prefers
-        // that. The map is only load-bearing for the legacy ID-based form.
-        const ruleSetIdToName = new Map();
-        const migrateSyncState = loadSyncState(configDir);
-        if (migrateSyncState?.entities?.ruleSets) {
-            for (const [fileKey, entry] of Object.entries(migrateSyncState.entities.ruleSets)) {
-                if (entry && typeof entry === "object" && "id" in entry && entry.id) {
-                    // fileKey is the sanitized rule-set name (see sync pull at
-                    // sync.ts:1385). It's the same shape the server returned and
-                    // matches what a TOML file's ruleSetName field would carry.
-                    ruleSetIdToName.set(entry.id, fileKey);
-                }
-            }
-        }
         let migratedCount = 0;
         let unchangedCount = 0;
-        for (const file of files) {
-            const filePath = join(dbTypesDir, file);
-            const rawBefore = readFileSync(filePath, "utf-8");
-            const tomlData = parseTomlFile(filePath);
-            // `accessRule`/`access` conflicts surface as a clear error here too,
-            // rather than silently dropping the field during a migrate rewrite.
-            let typeConfig;
-            let operations;
-            let subscriptions;
-            try {
-                ({ typeConfig, operations, subscriptions } =
-                    parseDatabaseTypeToml(tomlData));
+        // ---- database-types/ pass ----
+        if (dbFiles.length > 0) {
+            // Hydrate ruleSetIdToName from local sync state so files that
+            // reference a rule set via the legacy `ruleSetId = "01..."` form
+            // round-trip with the correct `ruleSetName`. Without this, any user
+            // who runs migrate-toml against a file with a rule-set assignment
+            // would silently lose that reference (review feedback r3246633010).
+            //
+            // Files that use the modern key-based `ruleSetName = "..."` form
+            // don't need the map at all — `parseDatabaseTypeToml` stores the
+            // value in `typeConfig._ruleSetName` and the serializer now prefers
+            // that. The map is only load-bearing for the legacy ID-based form.
+            const ruleSetIdToName = new Map();
+            const migrateSyncState = loadSyncState(configDir);
+            if (migrateSyncState?.entities?.ruleSets) {
+                for (const [fileKey, entry] of Object.entries(migrateSyncState.entities.ruleSets)) {
+                    if (entry && typeof entry === "object" && "id" in entry && entry.id) {
+                        // fileKey is the sanitized rule-set name (see sync pull at
+                        // sync.ts:1385). It's the same shape the server returned and
+                        // matches what a TOML file's ruleSetName field would carry.
+                        ruleSetIdToName.set(entry.id, fileKey);
+                    }
+                }
             }
-            catch (err) {
-                if (err instanceof SubscriptionAccessKeyConflictError) {
-                    error(`  ${file}: ${err.message}`);
-                    error(`Aborting migrate-toml: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
-                    process.exit(1);
+            for (const file of dbFiles) {
+                const filePath = join(dbTypesDir, file);
+                const rawBefore = readFileSync(filePath, "utf-8");
+                const tomlData = parseTomlFile(filePath);
+                // `accessRule`/`access` conflicts surface as a clear error here too,
+                // rather than silently dropping the field during a migrate rewrite.
+                let typeConfig;
+                let operations;
+                let subscriptions;
+                try {
+                    ({ typeConfig, operations, subscriptions } =
+                        parseDatabaseTypeToml(tomlData));
+                }
+                catch (err) {
+                    if (err instanceof SubscriptionAccessKeyConflictError) {
+                        error(`  ${file}: ${err.message}`);
+                        error(`Aborting migrate-toml: subscription \`access\`/\`accessRule\` conflict in ${file}.`);
+                        process.exit(1);
+                    }
+                    throw err;
+                }
+                // Force-native: ignore existing hints so every TOMLable field
+                // ends up in nested-table form. Subscriptions are preserved on the
+                // rewrite (issue #803) so migrate-toml never drops them.
+                const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
+                    defaultForm: "native",
+                    logger: (msg) => info(`  ${msg}`),
+                    subscriptions,
+                });
+                if (rewritten === rawBefore) {
+                    unchangedCount++;
+                    continue;
                 }
-                throw err;
+                if (options.dryRun) {
+                    info(`Would migrate database-types/${file}`);
+                }
+                else {
+                    writeFileSync(filePath, rewritten);
+                    info(`Migrated database-types/${file}`);
+                    // Update content hash in sync state if we have an entry for it.
+                    const syncState = loadSyncState(configDir);
+                    const dbType = typeConfig.databaseType || basename(file, ".toml");
+                    if (syncState?.entities?.databaseTypes?.[dbType]) {
+                        syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                        saveSyncState(configDir, syncState);
+                    }
+                }
+                migratedCount++;
             }
-            // Force-native: ignore existing hints so every TOMLable field
-            // ends up in nested-table form. Subscriptions are preserved on the
-            // rewrite (issue #803) so migrate-toml never drops them.
-            const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
-                defaultForm: "native",
-                logger: (msg) => info(`  ${msg}`),
-                subscriptions,
-            });
-            if (rewritten === rawBefore) {
+        }
+        // ---- workflows/ pass (issue #1446) ----
+        // Convert string-form `inputSchema`/`outputSchema` to native tables.
+        // Purely local, mirroring the database-types pass. The stored workflow
+        // hash uses `computeExpandedContentHash` (parse then hash), NOT
+        // `computeFileHash`, matching the workflow convention on the pull/push
+        // paths — otherwise a push after migrate would spuriously re-push.
+        for (const file of workflowFiles) {
+            const filePath = join(workflowsDir, file);
+            const rawBefore = readFileSync(filePath, "utf-8");
+            const workflowKey = basename(file, ".toml");
+            const { content: rewritten, changed } = rewriteWorkflowSchemasToNative(rawBefore, workflowKey, (msg) => info(`  ${msg}`));
+            if (!changed) {
                 unchangedCount++;
                 continue;
             }
             if (options.dryRun) {
-                info(`Would migrate database-types/${file}`);
+                info(`Would migrate workflows/${file}`);
             }
             else {
                 writeFileSync(filePath, rewritten);
-                info(`Migrated database-types/${file}`);
-                // Update content hash in sync state if we have an entry for it.
+                info(`Migrated workflows/${file}`);
+                // Update the stored content hash so a subsequent push sees a no-op.
                 const syncState = loadSyncState(configDir);
-                const dbType = typeConfig.databaseType || basename(file, ".toml");
-                if (syncState?.entities?.databaseTypes?.[dbType]) {
-                    syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                if (syncState?.entities?.workflows?.[workflowKey]) {
+                    syncState.entities.workflows[workflowKey].contentHash =
+                        computeExpandedContentHash(parseTomlFile(filePath));
                     saveSyncState(configDir, syncState);
                 }
             }