canva-core-workflow-bOperate Canva assets, brand-template autofill, and folders with explicit rights and asynchronous reconciliation. Use when performing uploads, dataset validation, autofill jobs, or folder changes. Trigger with: "upload Canva asset", "autofill brand template", "manage Canva folder".
Independent GitHub snapshot · Automated classification · Original documentation governs
name: canva-core-workflow-b description: 'Operate Canva assets, brand-template autofill, and folders with explicit rights and asynchronous reconciliation. Use when performing uploads, dataset validation, autofill jobs, or folder changes. Trigger with: "upload Canva asset", "autofill brand template", "manage Canva folder".' allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[asset-template-or-folder-operation]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:
Treat asset upload, dataset discovery, autofill, and folder mutation as separate authorization domains. Re-read schemas and reconcile asynchronous jobs rather than assuming old fields or completion.
Identify upload, asset metadata change, template dataset read, autofill, or folder mutation. Do not bundle unrelated writes into one approval.
Confirm resource ownership, file type/size against the current endpoint, malware policy, template availability, and every requested explicit scope.
For binary or URL upload, record the operation and job ID, avoid logging source URLs or content, and poll the corresponding existing job.
Read the current template or design dataset immediately before autofill. Reject unknown required fields and disclose that nonexistent field names may be skipped.
Confirm current entitlement and preview status, validate each data value, submit once, and reconcile the job before exposing the resulting design.
Validate source/destination authorization and expected current state, make one bounded change, then read back metadata and record rollback.
Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.
An approved campaign asset is uploaded, a current brand-template dataset is fetched, authorized fields are autofilled, and the resulting design is moved only after each job and ownership check succeeds.
| Failure | Response |
|---|---|
| Dataset changed | Stop and revalidate input mapping |
| Upload job failed | Correct the documented cause before resubmitting |
| Autofill unavailable | Do not suggest a plan upgrade; report current capability evidence |
| Folder state diverged | Stop further moves and reconcile ownership |