@factorialco/fcode-cli 3.5.1 → 3.6.1

package/README.md

@@ -20,7 +20,7 @@ $ npm install -g @factorialco/fcode-cli
 $ fcode COMMAND
 running command...
 $ fcode (--version)
-@factorialco/fcode-cli/3.5.1 linux-x64 node-v22.22.3
+@factorialco/fcode-cli/3.6.1 linux-x64 node-v22.23.4
 $ fcode --help [COMMAND]
 USAGE
   $ fcode COMMAND

package/dist/commands/http.d.ts

@@ -14,7 +14,8 @@ export default class Http extends Command {
      * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
      * configuration names a variable, whose value is looked up in the workspace variables and compared
      * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
-     * or a webhook inheriting a workspace configuration that settings.json does not have, is rejected.
+     * or a webhook inheriting a workspace configuration that is cleared or neither set nor inherited, is
+     * rejected.
      * Returns true when the request may proceed, false after writing a 403.
      */
     private _checkWebhookAuth;

package/dist/commands/http.js

@@ -122,7 +122,8 @@ class Http extends core_1.Command {
      * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
      * configuration names a variable, whose value is looked up in the workspace variables and compared
      * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
-     * or a webhook inheriting a workspace configuration that settings.json does not have, is rejected.
+     * or a webhook inheriting a workspace configuration that is cleared or neither set nor inherited, is
+     * rejected.
      * Returns true when the request may proceed, false after writing a 403.
      */
     async _checkWebhookAuth(req, res, processRepository, settingsRepository, slug) {
@@ -137,9 +138,10 @@ class Http extends core_1.Command {
         // Read per request, like the process metadata above, so editing settings.json while the server
         // runs takes effect without a restart.
         const teamWebhookAuth = (await settingsRepository.find()).webhookAuth;
+        const inheritedTeamWebhookAuth = settingsRepository.findInherited().webhookAuth;
         let effectiveAuth;
         try {
-            effectiveAuth = (0, webhook_auth_1.resolveEffectiveAuth)(webhook, teamWebhookAuth);
+            effectiveAuth = (0, webhook_auth_1.resolveEffectiveAuth)(webhook, teamWebhookAuth, inheritedTeamWebhookAuth);
         }
         catch (error) {
             // Fails closed, and says why: otherwise this reads as a wrong token rather than a local

package/dist/commands/processes/push.js

@@ -5,6 +5,7 @@ const processes_command_1 = require("../../core/commands/processes-command");
 const types_1 = require("../../core/types");
 const cli_1 = require("../../utils/cli");
 const settings_1 = require("../../config/settings");
+const retired_app_role_1 = require("../../services/retired-app-role");
 class ProcessesPush extends processes_command_1.default {
     async pushVersioned() {
         const processes = (await this._resourceRepository.findAll()).filter((process) => process.id && !process.deletion);
@@ -25,6 +26,10 @@ class ProcessesPush extends processes_command_1.default {
         await Promise.allSettled(allPromises);
     }
     async run() {
+        const appRoleError = (0, retired_app_role_1.retiredAppRoleError)(await this.getLocalResources());
+        if (appRoleError) {
+            this.error(appRoleError);
+        }
         await super.pushResources();
         const ignoreProcessVersions = (await this.globalConfig.getSetting(settings_1.SettingKeys.IGNORE_PROCESS_VERSIONS)) === 'true';
         if (!ignoreProcessVersions) {

package/dist/commands/settings/pull.js

@@ -5,6 +5,7 @@ const api_client_command_1 = require("../../core/commands/api-client-command");
 const settings_1 = require("../../repositories/settings");
 const types_1 = require("../../core/types");
 const cli_1 = require("../../utils/cli");
+const gitignore_1 = require("../../utils/gitignore");
 class SettingsPullCommand extends api_client_command_1.default {
     constructor() {
         super(...arguments);
@@ -32,6 +33,10 @@ class SettingsPullCommand extends api_client_command_1.default {
         const settings = await this._settingsRepository.fromRaw(raw);
         this._settingsRepository.applyCloudVersioning(settings, versions, aliases);
         this._settingsRepository.save(settings);
+        this._settingsRepository.saveInherited(await this._settingsRepository.inheritedFromRaw(raw));
+        // A read-only copy of the parents' values: keep it out of git even when this command runs on
+        // its own rather than inside `fcode pull`.
+        await (0, gitignore_1.syncInheritedGitignore)();
         await this.workspaceConfig.setSettingsStoredHash(settings.contentHash);
     }
 }

package/dist/commands/settings/push.d.ts

@@ -8,6 +8,12 @@ export default class SettingsPushCommand extends ApiClientCommand {
     };
     _settingsRepository: SettingsRepository;
     run(): Promise<void>;
+    /**
+     * A settings.json some CLI synced (there is a stored hash) without marking it inheritance-aware was
+     * written by a CLI older than settings inheritance, with every effective value in it. Only a
+     * workspace with parents is affected: without any, its effective settings are its own.
+     */
+    private pulledByAPreInheritanceCli;
     /** Makes the cloud's versions/aliases match settings.json; returns failed manifest entries. */
     private syncVersioning;
 }

package/dist/commands/settings/push.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const color_1 = require("@oclif/color");
 const api_client_command_1 = require("../../core/commands/api-client-command");
+const errors_1 = require("../../core/errors");
 const settings_1 = require("../../repositories/settings");
 const types_1 = require("../../core/types");
 const team_versioning_1 = require("../../services/team-versioning");
 const cli_1 = require("../../utils/cli");
+const gitignore_1 = require("../../utils/gitignore");
 class SettingsPushCommand extends api_client_command_1.default {
     constructor() {
         super(...arguments);
@@ -23,30 +25,19 @@ class SettingsPushCommand extends api_client_command_1.default {
             cli_1.default.log('Workspace settings already up to date');
             return;
         }
-        const update = { parentTeams: settings.parentTeams };
-        if (settings.zoneId !== undefined) {
-            update.zoneId = settings.zoneId;
+        if (await this.pulledByAPreInheritanceCli(settings, storedHash)) {
+            throw new errors_1.PreInheritanceSettingsFile();
         }
-        if (settings.errorHandlerConfig) {
-            const processId = await this._settingsRepository.resolveSlugToId(settings.errorHandlerConfig.processSlug);
-            update.executionErrorHandlerConfig = { processId, tag: settings.errorHandlerConfig.tag ?? null };
-        }
-        // Sent unconditionally, null arm included: settings.json is the source of truth, so removing
-        // webhookAuth from it must clear the cloud configuration rather than leave it dangling.
-        update.webhookAuth = settings.webhookAuth
-            ? { headerName: settings.webhookAuth.headerName ?? null, variableKey: settings.webhookAuth.variableKey }
-            : { variableKey: null };
-        // Sent unconditionally for the same reason as webhookAuth: settings.json is the source of truth,
-        // so removing primaryLocale from it must clear the cloud setting. Empty string is the clear.
-        update.primaryLocale = settings.primaryLocale ?? '';
-        await this._fcodeGraphQLClient.pushTeam(update);
+        const pushed = await this._fcodeGraphQLClient.pushTeam(await this._settingsRepository.toTeamUpdate(settings));
+        // What the workspace now inherits follows from what was just pushed.
+        this._settingsRepository.saveInherited(await this._settingsRepository.inheritedFromRaw(pushed));
+        // A read-only copy of the parents' values: keep it out of git even when this command runs on
+        // its own rather than inside `fcode pull`.
+        await (0, gitignore_1.syncInheritedGitignore)();
         const failedEntities = await this.syncVersioning(settings, force);
         // Re-read the cloud state so server-assigned fields (createdAt) and declined deletions
         // land back in settings.json, then hash exactly what was written.
-        const [versions, aliases] = await Promise.all([
-            this._fcodeGraphQLClient.allTeamVersions(),
-            this._fcodeGraphQLClient.allTeamVersionAliases(),
-        ]);
+        const [versions, aliases] = await Promise.all([this._fcodeGraphQLClient.allTeamVersions(), this._fcodeGraphQLClient.allTeamVersionAliases()]);
         this._settingsRepository.applyCloudVersioning(settings, versions, aliases);
         this._settingsRepository.save(settings);
         await this.workspaceConfig.setSettingsStoredHash(settings.contentHash);
@@ -57,12 +48,17 @@ class SettingsPushCommand extends api_client_command_1.default {
             this.error(`workspace versions pushed with ${failedEntities} failed entities`, { exit: 1 });
         }
     }
+    /**
+     * A settings.json some CLI synced (there is a stored hash) without marking it inheritance-aware was
+     * written by a CLI older than settings inheritance, with every effective value in it. Only a
+     * workspace with parents is affected: without any, its effective settings are its own.
+     */
+    async pulledByAPreInheritanceCli(settings, storedHash) {
+        return storedHash !== undefined && settings.parentTeams.length > 0 && !(await this.workspaceConfig.isSettingsInheritanceAware());
+    }
     /** Makes the cloud's versions/aliases match settings.json; returns failed manifest entries. */
     async syncVersioning(settings, force) {
-        const [cloudVersions, cloudAliases] = await Promise.all([
-            this._fcodeGraphQLClient.allTeamVersions(),
-            this._fcodeGraphQLClient.allTeamVersionAliases(),
-        ]);
+        const [cloudVersions, cloudAliases] = await Promise.all([this._fcodeGraphQLClient.allTeamVersions(), this._fcodeGraphQLClient.allTeamVersionAliases()]);
         const plan = (0, team_versioning_1.planTeamVersioningSync)(settings, cloudVersions, cloudAliases);
         if ((0, team_versioning_1.teamVersioningSyncPlanIsEmpty)(plan)) {
             return 0;
@@ -96,8 +92,7 @@ class SettingsPushCommand extends api_client_command_1.default {
         return failedEntities;
     }
 }
-SettingsPushCommand.description = 'Update cloud workspace settings (timezone, error handler, inheritance, webhook auth) and sync ' +
-    'workspace versions/aliases from settings.json';
+SettingsPushCommand.description = 'Update cloud workspace settings (timezone, error handler, inheritance, webhook auth) and sync ' + 'workspace versions/aliases from settings.json';
 SettingsPushCommand.examples = ['$ fcode settings:push'];
 SettingsPushCommand.flags = types_1.ForceFlag;
 exports.default = SettingsPushCommand;

package/dist/config/workspace.d.ts

@@ -21,6 +21,12 @@ declare class WorkspaceConfig extends Config {
     getStoredHash(resource: Resource): Promise<string>;
     getSettingsStoredHash(): Promise<string | undefined>;
     setSettingsStoredHash(contentHash: string): Promise<void>;
+    /**
+     * Whether settings.json was last pulled or pushed by a CLI that knows settings inherit. One that
+     * did not wrote the values the workspace inherits as if they were its own, and records the hash
+     * without this mark.
+     */
+    isSettingsInheritanceAware(): Promise<boolean>;
     add(resourceType: string, resourceMetadata: ResourceMetadata): Promise<void>;
     remove(resourceType: string, slug: string): Promise<void>;
 }

package/dist/config/workspace.js

@@ -139,7 +139,15 @@ class WorkspaceConfig extends index_1.default {
     }
     async setSettingsStoredHash(contentHash) {
         const team = await this.getActiveTeam();
-        await this.setTeam({ ...team, team: { contentHash } });
+        await this.setTeam({ ...team, team: { contentHash, inheritanceAware: true } });
+    }
+    /**
+     * Whether settings.json was last pulled or pushed by a CLI that knows settings inherit. One that
+     * did not wrote the values the workspace inherits as if they were its own, and records the hash
+     * without this mark.
+     */
+    async isSettingsInheritanceAware() {
+        return (await this.getActiveTeam()).team?.inheritanceAware === true;
     }
     async add(resourceType, resourceMetadata) {
         const team = await this.getActiveTeam();

package/dist/core/errors.d.ts

@@ -54,6 +54,13 @@ export declare class TeamAccessDenied extends CLIError {
 export declare class NotFcodeWorkspace extends CLIError {
     constructor();
 }
+/**
+ * settings.json was last synced by a CLI older than settings inheritance, which wrote the settings
+ * the workspace inherits as if they were its own: pushing it would stop the workspace inheriting them.
+ */
+export declare class PreInheritanceSettingsFile extends CLIError {
+    constructor();
+}
 export declare class DependenciesNotInstalled extends CLIError {
     constructor(programmingLanguage: ProgrammingLanguage);
 }
@@ -63,3 +70,10 @@ export declare class ProcessDependenciesNotInstalled extends CLIError {
 export declare class ErrorExecutingProcess extends CLIError {
     constructor(message: string);
 }
+/**
+ * The platform answered without the team's inheritable settings: it predates settings inheritance,
+ * and reading its settings would take every one of them for inherited.
+ */
+export declare class PlatformPredatesSettingsInheritance extends CLIError {
+    constructor();
+}

package/dist/core/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ErrorExecutingProcess = exports.ProcessDependenciesNotInstalled = exports.DependenciesNotInstalled = exports.NotFcodeWorkspace = exports.TeamAccessDenied = exports.NotAuthenticated = exports.CloudProgrammingLanguageManifestNotFound = exports.LocalProgrammingLanguageManifestNotFound = exports.CloudLocaleNotFound = exports.LocalLocaleNotFound = exports.CloudVariableNotFound = exports.LocalVariableNotFound = exports.CloudScriptLibraryNotFound = exports.LocalScriptLibraryNotFound = exports.CloudProcessNotFound = exports.LocalProcessNotFound = exports.ResourceNotFound = exports.CLIError = void 0;
+exports.PlatformPredatesSettingsInheritance = exports.ErrorExecutingProcess = exports.ProcessDependenciesNotInstalled = exports.DependenciesNotInstalled = exports.PreInheritanceSettingsFile = exports.NotFcodeWorkspace = exports.TeamAccessDenied = exports.NotAuthenticated = exports.CloudProgrammingLanguageManifestNotFound = exports.LocalProgrammingLanguageManifestNotFound = exports.CloudLocaleNotFound = exports.LocalLocaleNotFound = exports.CloudVariableNotFound = exports.LocalVariableNotFound = exports.CloudScriptLibraryNotFound = exports.LocalScriptLibraryNotFound = exports.CloudProcessNotFound = exports.LocalProcessNotFound = exports.ResourceNotFound = exports.CLIError = void 0;
 exports.teamAccessDeniedMessage = teamAccessDeniedMessage;
 const global_1 = require("../config/global");
 class CLIError extends Error {
@@ -145,6 +145,25 @@ class NotFcodeWorkspace extends CLIError {
     }
 }
 exports.NotFcodeWorkspace = NotFcodeWorkspace;
+/**
+ * settings.json was last synced by a CLI older than settings inheritance, which wrote the settings
+ * the workspace inherits as if they were its own: pushing it would stop the workspace inheriting them.
+ */
+class PreInheritanceSettingsFile extends CLIError {
+    constructor() {
+        super('settings.json was last synced by an fcode CLI that predates settings inheritance: it holds the settings this ' +
+            'workspace inherits from its parent workspaces as if they were its own, and pushing it would stop the ' +
+            'workspace inheriting them.', {
+            code: 'ERR_PRE_INHERITANCE_SETTINGS_FILE',
+            exit: 1,
+            suggestions: [
+                'fcode settings:pull, then push again',
+                'fcode settings:pull --force if settings.json has local changes, then reapply them and push again',
+            ],
+        });
+    }
+}
+exports.PreInheritanceSettingsFile = PreInheritanceSettingsFile;
 class DependenciesNotInstalled extends CLIError {
     constructor(programmingLanguage) {
         super(`Dependencies not installed.`, {
@@ -175,3 +194,18 @@ class ErrorExecutingProcess extends CLIError {
     }
 }
 exports.ErrorExecutingProcess = ErrorExecutingProcess;
+/**
+ * The platform answered without the team's inheritable settings: it predates settings inheritance,
+ * and reading its settings would take every one of them for inherited.
+ */
+class PlatformPredatesSettingsInheritance extends CLIError {
+    constructor() {
+        super('This Factorial Code platform predates settings inheritance, which this fcode CLI requires to read and ' +
+            'push workspace settings.', {
+            code: 'ERR_PLATFORM_PREDATES_SETTINGS_INHERITANCE',
+            exit: 1,
+            suggestions: ['Wait for the platform to be updated, or use an fcode CLI older than 3.6.0 until then'],
+        });
+    }
+}
+exports.PlatformPredatesSettingsInheritance = PlatformPredatesSettingsInheritance;

package/dist/core/types.d.ts

@@ -49,6 +49,7 @@ export interface TeamMetadata {
     };
     team?: {
         contentHash?: string;
+        inheritanceAware?: boolean;
     };
 }
 export interface RemoteMetadata {
@@ -141,6 +142,10 @@ export type AppRole = 'INSTALL' | 'SETTINGS' | 'USER_FACING_FORM' | 'UNINSTALL'
 export type FormAuthMode = 'NONE' | 'FACTORIAL';
 export interface ProcessForm {
     enabled: boolean;
+    /**
+     * @deprecated Retired: push refuses it and pull no longer writes it. Kept so a metadata.json that
+     * still carries it can be read and reported.
+     */
     appRole?: AppRole;
     authMode?: FormAuthMode;
 }
@@ -397,24 +402,34 @@ export interface ParentTeamRef {
     slug: string;
     version?: string;
 }
-/** The workspace's settings.json: what `fcode settings:pull|push` syncs against the cloud team. */
+/**
+ * The workspace's settings.json: what `fcode settings:pull|push` syncs against the cloud team. It
+ * holds the team's own values only: an absent setting inherits, and null (error handler and webhook
+ * auth only) clears it, a parent's value included.
+ */
 export declare class WorkspaceSettings extends Resource {
     id: string | undefined;
     slug: string;
     zoneId?: string;
-    errorHandlerConfig?: ErrorHandlerConfig;
+    errorHandlerConfig?: ErrorHandlerConfig | null;
     parentTeams: ParentTeamRef[];
-    webhookAuth?: WebhookAuth;
+    webhookAuth?: WebhookAuth | null;
     primaryLocale?: string;
     versions?: TeamVersionFileEntry[];
     aliases?: TeamAliasFileEntry[];
-    constructor(slug: string, parentTeams: ParentTeamRef[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig, webhookAuth?: WebhookAuth, primaryLocale?: string);
+    constructor(slug: string, parentTeams: ParentTeamRef[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig | null, webhookAuth?: WebhookAuth | null, primaryLocale?: string);
     get contentHash(): string;
 }
 export interface RawErrorHandlerConfig {
     processId: string;
     tag?: string | null;
 }
+export type InheritableSetting = 'ERROR_HANDLER' | 'PARAMS_SCHEMA_VALIDATION' | 'PRIMARY_LOCALE' | 'WEBHOOK_AUTH' | 'ZONE_ID';
+export type SettingMode = 'INHERIT' | 'NONE' | 'OWN';
+export interface SettingOrigin {
+    mode: SettingMode;
+    from?: string | null;
+}
 export interface RawTeamSettings {
     slug: string;
     zoneId?: string;
@@ -422,16 +437,34 @@ export interface RawTeamSettings {
     parentTeams: ParentTeamRef[];
     webhookAuth?: WebhookAuth | null;
     primaryLocale?: string | null;
+    origins?: Record<InheritableSetting, SettingOrigin>;
 }
-export interface TeamUpdateInput {
+export interface InheritedWorkspaceSettings {
     zoneId?: string;
-    parentTeams?: ParentTeamRef[];
-    executionErrorHandlerConfig?: RawErrorHandlerConfig | null;
-    webhookAuth?: {
-        headerName?: string | null;
-        variableKey?: string | null;
-    } | null;
+    errorHandlerConfig?: ErrorHandlerConfig;
+    webhookAuth?: WebhookAuth;
     primaryLocale?: string;
+    inheritedFrom: Record<string, string>;
+}
+export type SettingInput<T> = {
+    mode: 'INHERIT';
+} | {
+    mode: 'NONE';
+} | {
+    mode: 'OWN';
+    value: T;
+};
+export interface TeamUpdateInput {
+    parentTeams?: ParentTeamRef[];
+    inheritableSettings?: {
+        zoneId?: SettingInput<string>;
+        errorHandlerConfig?: SettingInput<RawErrorHandlerConfig>;
+        webhookAuth?: SettingInput<{
+            headerName?: string | null;
+            variableKey: string;
+        }>;
+        primaryLocale?: SettingInput<string>;
+    };
 }
 export type ResourceMetadata = {
     [key: string]: any;

package/dist/core/types.js

@@ -261,7 +261,11 @@ class ProgrammingLanguageManifest extends Resource {
     }
 }
 exports.ProgrammingLanguageManifest = ProgrammingLanguageManifest;
-/** The workspace's settings.json: what `fcode settings:pull|push` syncs against the cloud team. */
+/**
+ * The workspace's settings.json: what `fcode settings:pull|push` syncs against the cloud team. It
+ * holds the team's own values only: an absent setting inherits, and null (error handler and webhook
+ * auth only) clears it, a parent's value included.
+ */
 class WorkspaceSettings extends Resource {
     constructor(slug, parentTeams, zoneId, errorHandlerConfig, webhookAuth, primaryLocale) {
         super();
@@ -293,6 +297,14 @@ class WorkspaceSettings extends Resource {
         if (this.primaryLocale) {
             payload.primaryLocale = this.primaryLocale;
         }
+        // Cleared settings hash apart from inherited ones; inserted only when any is cleared.
+        const cleared = [
+            ...(this.errorHandlerConfig === null ? ['ERROR_HANDLER'] : []),
+            ...(this.webhookAuth === null ? ['WEBHOOK_AUTH'] : []),
+        ];
+        if (cleared.length > 0) {
+            payload.cleared = cleared;
+        }
         // Versions hash only their tags and aliases their name->tag pairs: createdAt is
         // server-assigned and a comment is immutable once published (there is no update mutation),
         // so neither can represent a pushable local change. Inserted only when non-empty, again to

package/dist/repositories/settings.d.ts

@@ -1,6 +1,7 @@
-import { RawTeamSettings, TeamVersion, TeamVersionAlias, WorkspaceSettings } from '../core/types';
+import { InheritedWorkspaceSettings, RawTeamSettings, TeamUpdateInput, TeamVersion, TeamVersionAlias, WorkspaceSettings } from '../core/types';
 import WorkspaceConfig from '../config/workspace';
 export declare const SETTINGS_FILENAME = "settings.json";
+export declare const INHERITED_SETTINGS_FILENAME = "settings.inherited.json";
 /**
  * Workspaces cloned before the file was renamed carry team.json. Renaming it on first access keeps
  * the stored sync hash valid (it is computed over the content, not the name), so the workspace does
@@ -22,8 +23,23 @@ export default class SettingsRepository {
     exists(): boolean;
     find(): Promise<WorkspaceSettings>;
     save(settings: WorkspaceSettings): void;
-    /** Builds the settings from the cloud's raw payload, resolving the error-handler id to a slug. */
+    /** The settings a local run inherits; empty when the workspace inherits none. */
+    findInherited(): InheritedWorkspaceSettings;
+    /** Writes settings.inherited.json, or removes it when the workspace inherits no setting. */
+    saveInherited(inherited: InheritedWorkspaceSettings | undefined): void;
+    /**
+     * Builds the settings.json view of the cloud's raw payload: only the team's own values, null for a
+     * cleared setting, and nothing for an inherited or default one. Resolves the error-handler id to a
+     * slug.
+     */
     fromRaw(raw: RawTeamSettings): Promise<WorkspaceSettings>;
+    /** The settings.inherited.json view of the cloud's raw payload; undefined when nothing is inherited. */
+    inheritedFromRaw(raw: RawTeamSettings): Promise<InheritedWorkspaceSettings | undefined>;
+    /**
+     * settings.json is the source of truth for the team's own values: a setting absent from it is
+     * reset to inherit, null leaves the team with none (a parent's included), and a value sets it.
+     */
+    toTeamUpdate(settings: WorkspaceSettings): Promise<TeamUpdateInput>;
     /**
      * Writes the cloud's workspace versions and aliases into the settings as the settings.json
      * versioning fields (sorted for stable git diffs). Cloud entries always carry a createdAt; only
@@ -32,6 +48,10 @@ export default class SettingsRepository {
     applyCloudVersioning(settings: WorkspaceSettings, versions: TeamVersion[], aliases: TeamVersionAlias[]): void;
     resolveSlugToId(processSlug: string): Promise<string>;
     resolveIdToSlug(processId: string): Promise<string>;
+    /** Where each setting comes from; an API without it predates settings inheritance. */
+    private originsOf;
+    private resolveErrorHandler;
+    private parseString;
     private parseErrorHandler;
     /**
      * settings.json is hand-edited to declare versions, so entries without a tag are dropped and a

package/dist/repositories/settings.js

@@ -1,13 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SETTINGS_FILENAME = void 0;
+exports.INHERITED_SETTINGS_FILENAME = exports.SETTINGS_FILENAME = void 0;
 exports.migrateLegacySettingsFile = migrateLegacySettingsFile;
 const fs = require("fs-extra");
 const path = require("node:path");
 const types_1 = require("../core/types");
 const workspace_1 = require("../config/workspace");
+const errors_1 = require("../core/errors");
 const file_utils_1 = require("../utils/file-utils");
 exports.SETTINGS_FILENAME = 'settings.json';
+exports.INHERITED_SETTINGS_FILENAME = 'settings.inherited.json';
+/** The inheritable settings settings.json manages, by their field name there. */
+const SETTING_FIELDS = {
+    ZONE_ID: 'zoneId',
+    ERROR_HANDLER: 'errorHandlerConfig',
+    WEBHOOK_AUTH: 'webhookAuth',
+    PRIMARY_LOCALE: 'primaryLocale',
+};
 const LEGACY_SETTINGS_FILENAME = 'team.json';
 /**
  * Workspaces cloned before the file was renamed carry team.json. Renaming it on first access keeps
@@ -22,6 +31,14 @@ function migrateLegacySettingsFile(workspaceDir = process.cwd()) {
         fs.renameSync(legacy, current);
     }
 }
+/** A setting settings.json holds a value of or leaves out: its own value, or inherit. */
+function ownOrInherit(value) {
+    return value === undefined ? { mode: 'INHERIT' } : { mode: 'OWN', value };
+}
+/** A setting settings.json leaves out (inherit) or sets to null (none). */
+function noneOrInherit(value) {
+    return value === null ? { mode: 'NONE' } : { mode: 'INHERIT' };
+}
 /**
  * Reads/writes the singleton settings.json (timezone, error handler, inheritance, webhook auth) at
  * the workspace root. Unlike collection resources this is not a ResourceRepositoryBase:
@@ -47,7 +64,7 @@ class SettingsRepository {
             raw = fs.readJsonSync(exports.SETTINGS_FILENAME) || {};
         }
         catch { }
-        const settings = new types_1.WorkspaceSettings(slug, this.parseParentTeams(raw.parentTeams), raw.zoneId, this.parseErrorHandler(raw.errorHandlerConfig), this.parseWebhookAuth(raw.webhookAuth), typeof raw.primaryLocale === 'string' && raw.primaryLocale.length > 0 ? raw.primaryLocale : undefined);
+        const settings = new types_1.WorkspaceSettings(slug, this.parseParentTeams(raw.parentTeams), this.parseString(raw.zoneId), raw.errorHandlerConfig === null ? null : this.parseErrorHandler(raw.errorHandlerConfig), raw.webhookAuth === null ? null : this.parseWebhookAuth(raw.webhookAuth), this.parseString(raw.primaryLocale));
         if (Array.isArray(raw.versions)) {
             settings.versions = this.parseVersions(raw.versions);
         }
@@ -60,16 +77,97 @@ class SettingsRepository {
         migrateLegacySettingsFile();
         (0, file_utils_1.outputFileSyncIfChanged)(exports.SETTINGS_FILENAME, JSON.stringify(this.toFile(settings), null, 2));
     }
-    /** Builds the settings from the cloud's raw payload, resolving the error-handler id to a slug. */
+    /** The settings a local run inherits; empty when the workspace inherits none. */
+    findInherited() {
+        let raw = {};
+        try {
+            raw = fs.readJsonSync(exports.INHERITED_SETTINGS_FILENAME) || {};
+        }
+        catch { }
+        return {
+            zoneId: this.parseString(raw.zoneId),
+            errorHandlerConfig: this.parseErrorHandler(raw.errorHandlerConfig),
+            webhookAuth: this.parseWebhookAuth(raw.webhookAuth),
+            primaryLocale: this.parseString(raw.primaryLocale),
+            inheritedFrom: raw.inheritedFrom ?? {},
+        };
+    }
+    /** Writes settings.inherited.json, or removes it when the workspace inherits no setting. */
+    saveInherited(inherited) {
+        if (!inherited) {
+            if (fs.pathExistsSync(exports.INHERITED_SETTINGS_FILENAME)) {
+                // Written read-only, so it has to be made writable before it can go.
+                fs.chmodSync(exports.INHERITED_SETTINGS_FILENAME, 0o644);
+                fs.removeSync(exports.INHERITED_SETTINGS_FILENAME);
+            }
+            return;
+        }
+        // Read-only like the other inherited files: the values belong to a parent workspace.
+        (0, file_utils_1.outputFileSyncIfChanged)(exports.INHERITED_SETTINGS_FILENAME, JSON.stringify(inherited, null, 2), { readOnly: true });
+    }
+    /**
+     * Builds the settings.json view of the cloud's raw payload: only the team's own values, null for a
+     * cleared setting, and nothing for an inherited or default one. Resolves the error-handler id to a
+     * slug.
+     */
     async fromRaw(raw) {
-        let errorHandlerConfig;
-        if (raw.errorHandlerConfig?.processId) {
-            errorHandlerConfig = {
-                processSlug: await this.resolveIdToSlug(raw.errorHandlerConfig.processId),
-                tag: raw.errorHandlerConfig.tag ?? null,
-            };
+        const origins = this.originsOf(raw);
+        const own = (setting, value) => {
+            const { mode } = origins[setting];
+            if (mode === 'NONE') {
+                return null;
+            }
+            return mode === 'OWN' ? value() : undefined;
+        };
+        return new types_1.WorkspaceSettings(raw.slug, raw.parentTeams ?? [], own('ZONE_ID', () => this.parseString(raw.zoneId)) ?? undefined, await own('ERROR_HANDLER', () => this.resolveErrorHandler(raw)), own('WEBHOOK_AUTH', () => this.parseWebhookAuth(raw.webhookAuth)), own('PRIMARY_LOCALE', () => this.parseString(raw.primaryLocale)) ?? undefined);
+    }
+    /** The settings.inherited.json view of the cloud's raw payload; undefined when nothing is inherited. */
+    async inheritedFromRaw(raw) {
+        const origins = this.originsOf(raw);
+        const inheritedFrom = {};
+        for (const [setting, field] of Object.entries(SETTING_FIELDS)) {
+            const { mode, from } = origins[setting];
+            if (mode === 'INHERIT' && from) {
+                inheritedFrom[field] = from;
+            }
+        }
+        if (Object.keys(inheritedFrom).length === 0) {
+            return undefined;
         }
-        return new types_1.WorkspaceSettings(raw.slug, raw.parentTeams ?? [], raw.zoneId, errorHandlerConfig, this.parseWebhookAuth(raw.webhookAuth), raw.primaryLocale ?? undefined);
+        // JSON.stringify drops the settings left undefined, so the file lists only inherited ones.
+        return {
+            zoneId: inheritedFrom.zoneId ? this.parseString(raw.zoneId) : undefined,
+            errorHandlerConfig: inheritedFrom.errorHandlerConfig ? await this.resolveErrorHandler(raw) : undefined,
+            webhookAuth: inheritedFrom.webhookAuth ? this.parseWebhookAuth(raw.webhookAuth) : undefined,
+            primaryLocale: inheritedFrom.primaryLocale ? this.parseString(raw.primaryLocale) : undefined,
+            inheritedFrom,
+        };
+    }
+    /**
+     * settings.json is the source of truth for the team's own values: a setting absent from it is
+     * reset to inherit, null leaves the team with none (a parent's included), and a value sets it.
+     */
+    async toTeamUpdate(settings) {
+        const { errorHandlerConfig, webhookAuth } = settings;
+        return {
+            parentTeams: settings.parentTeams,
+            inheritableSettings: {
+                zoneId: ownOrInherit(settings.zoneId),
+                errorHandlerConfig: errorHandlerConfig === undefined || errorHandlerConfig === null
+                    ? noneOrInherit(errorHandlerConfig)
+                    : {
+                        mode: 'OWN',
+                        value: {
+                            processId: await this.resolveSlugToId(errorHandlerConfig.processSlug),
+                            tag: errorHandlerConfig.tag ?? null,
+                        },
+                    },
+                webhookAuth: webhookAuth === undefined || webhookAuth === null
+                    ? noneOrInherit(webhookAuth)
+                    : { mode: 'OWN', value: { headerName: webhookAuth.headerName ?? null, variableKey: webhookAuth.variableKey } },
+                primaryLocale: ownOrInherit(settings.primaryLocale),
+            },
+        };
     }
     /**
      * Writes the cloud's workspace versions and aliases into the settings as the settings.json
@@ -99,6 +197,25 @@ class SettingsRepository {
         const match = Object.values(processes).find((process) => process.id === processId);
         return match?.slug ?? processId;
     }
+    /** Where each setting comes from; an API without it predates settings inheritance. */
+    originsOf(raw) {
+        if (!raw.origins) {
+            throw new errors_1.PlatformPredatesSettingsInheritance();
+        }
+        return raw.origins;
+    }
+    async resolveErrorHandler(raw) {
+        if (!raw.errorHandlerConfig?.processId) {
+            return undefined;
+        }
+        return {
+            processSlug: await this.resolveIdToSlug(raw.errorHandlerConfig.processId),
+            tag: raw.errorHandlerConfig.tag ?? null,
+        };
+    }
+    parseString(raw) {
+        return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
+    }
     parseErrorHandler(raw) {
         if (!raw || !raw.processSlug) {
             return undefined;
@@ -194,7 +311,8 @@ class SettingsRepository {
         if (settings.errorHandlerConfig !== undefined) {
             file.errorHandlerConfig = settings.errorHandlerConfig;
         }
-        // Last, so adding webhook auth to an existing settings.json is a purely additive diff.
+        // Last, so adding webhook auth to an existing settings.json is a purely additive diff. null
+        // (cleared) is written as is: absent means inherit.
         if (settings.webhookAuth !== undefined) {
             file.webhookAuth = settings.webhookAuth;
         }

package/dist/services/fcode-graphql-client.d.ts

@@ -88,9 +88,9 @@ declare class FcodeGraphQLClient {
     private mapFactorialSettings;
     mapProcess({ id, slug, name, description, tags, script, readme, manifest, settings, triggers, resolvingTeamSlug, lifecycleRole, deletedAt, retainingVersionTags, }: any): Process;
     /**
-     * GraphQL nests the webhook configuration under `settings`, while settings.json and the REST API
-     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
-     * undefined.
+     * The team's inheritable settings, each read from its `{ mode, value, from }`: the value in effect
+     * and where it comes from. An API that predates settings inheritance has no such field, and leaves
+     * `origins` undefined so the settings commands refuse instead of reading every setting as inherited.
      */
     mapTeamSettings(team: any): RawTeamSettings;
     mapTeamVersion(teamVersion: any): TeamVersion;
@@ -105,6 +105,11 @@ declare class FcodeGraphQLClient {
     verifyTeamAccess(): Promise<void>;
     team(): Promise<RawTeamSettings>;
     pushTeam(update: TeamUpdateInput): Promise<RawTeamSettings>;
+    /**
+     * An API that predates settings inheritance rejects the query naming `inheritableSettings` as a
+     * schema error; that reads better as what it means than as GraphQL validation output.
+     */
+    cleanTeamSettingsError(error: any): any;
     mapProgrammingLanguageManifest(programmingLanguageManifest: any): ProgrammingLanguageManifest;
     private mapDependencies;
     /**

package/dist/services/fcode-graphql-client.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const graphql_request_1 = require("graphql-request");
 const types_1 = require("../core/types");
 const locale_merger_1 = require("./locale-merger");
+const cli_version_1 = require("../utils/cli-version");
+const errors_1 = require("../core/errors");
 const _ = require("lodash");
 // Source code travels base64 encoded: Cloudflare's WAF blocks requests whose body
 // looks like an attack payload, which source code often does. sourceCodeEncoding tells the
@@ -137,6 +139,17 @@ const PROCESS_FIELDS = `
     }
   }
 `;
+// Each inheritable setting of a team: its mode, the value in effect and the parent it comes from.
+const INHERITABLE_SETTINGS_SELECTION = `
+  inheritableSettings {
+    zoneId { mode value from }
+    paramsSchemaValidationEnabled { mode value from }
+    errorHandlerConfig { mode value { processId tag } from }
+    webhookAuth { mode value { headerName variableKey } from }
+    primaryLocale { mode value from }
+  }
+`;
+const UNKNOWN_FIELD_ERROR = /FieldUndefined|WrongType|is undefined|not present|not in type/;
 const NETWORK_ERROR_CODES = ['ECONNREFUSED', 'ENOTFOUND', 'ECONNRESET', 'ETIMEDOUT', 'EAI_AGAIN'];
 class FcodeGraphQLClient {
     constructor(options) {
@@ -152,6 +165,7 @@ class FcodeGraphQLClient {
             headers: {
                 'Fcode-Team': options.teamSlug,
                 authorization: `Bearer ${options.accessToken}`,
+                [cli_version_1.CLI_VERSION_HEADER]: (0, cli_version_1.cliVersion)(),
             },
         });
     }
@@ -1005,10 +1019,9 @@ class FcodeGraphQLClient {
             metadata.webhook = webhook;
         }
         if (settings?.formSettings) {
+            // `appRole` is retired and push refuses it, so it is not written back: a role the cloud
+            // already holds stays there, and `factorial.form.appTool` carries the user-facing one.
             metadata.form = { enabled: Boolean(settings.formSettings.enabled) };
-            if (settings.formSettings.appRole && settings.formSettings.appRole !== 'NONE') {
-                metadata.form.appRole = settings.formSettings.appRole;
-            }
             if (settings.formSettings.authMode && settings.formSettings.authMode !== 'NONE') {
                 metadata.form.authMode = settings.formSettings.authMode;
             }
@@ -1039,27 +1052,37 @@ class FcodeGraphQLClient {
         return process;
     }
     /**
-     * GraphQL nests the webhook configuration under `settings`, while settings.json and the REST API
-     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
-     * undefined.
+     * The team's inheritable settings, each read from its `{ mode, value, from }`: the value in effect
+     * and where it comes from. An API that predates settings inheritance has no such field, and leaves
+     * `origins` undefined so the settings commands refuse instead of reading every setting as inherited.
      */
     mapTeamSettings(team) {
         const settings = {
             slug: team.slug,
-            zoneId: team.zoneId,
-            errorHandlerConfig: team.errorHandlerConfig,
             parentTeams: team.parentTeams ?? [],
         };
-        const webhookAuth = team.settings?.webhookAuth;
+        const inheritable = team.inheritableSettings;
+        if (!inheritable) {
+            return settings;
+        }
+        settings.zoneId = inheritable.zoneId?.value ?? undefined;
+        settings.errorHandlerConfig = inheritable.errorHandlerConfig?.value ?? null;
+        settings.primaryLocale = inheritable.primaryLocale?.value ?? null;
+        const webhookAuth = inheritable.webhookAuth?.value;
         if (webhookAuth?.variableKey) {
             settings.webhookAuth = { variableKey: webhookAuth.variableKey };
             if (webhookAuth.headerName && webhookAuth.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
                 settings.webhookAuth.headerName = webhookAuth.headerName;
             }
         }
-        if (team.settings?.primaryLocale) {
-            settings.primaryLocale = team.settings.primaryLocale;
-        }
+        const origin = (setting) => ({ mode: setting?.mode ?? 'INHERIT', from: setting?.from ?? null });
+        settings.origins = {
+            ZONE_ID: origin(inheritable.zoneId),
+            PARAMS_SCHEMA_VALIDATION: origin(inheritable.paramsSchemaValidationEnabled),
+            ERROR_HANDLER: origin(inheritable.errorHandlerConfig),
+            WEBHOOK_AUTH: origin(inheritable.webhookAuth),
+            PRIMARY_LOCALE: origin(inheritable.primaryLocale),
+        };
         return settings;
     }
     mapTeamVersion(teamVersion) {
@@ -1195,28 +1218,17 @@ class FcodeGraphQLClient {
           query team($slug: ID!) {
             team(slug: $slug) {
               slug
-              zoneId
-              errorHandlerConfig {
-                processId
-                tag
-              }
               parentTeams {
                 slug
                 version
               }
-              settings {
-                webhookAuth {
-                  headerName
-                  variableKey
-                }
-                primaryLocale
-              }
+              ${INHERITABLE_SETTINGS_SELECTION}
             }
           }
         `, { slug: this.teamSlug })
             .then(({ team }) => this.mapTeamSettings(team))
             .catch((error) => {
-            return Promise.reject(this.cleanError(error));
+            return Promise.reject(this.cleanTeamSettingsError(error));
         });
     }
     pushTeam(update) {
@@ -1225,30 +1237,32 @@ class FcodeGraphQLClient {
           mutation updateTeam($slug: String!, $update: TeamUpdateInput!) {
             updateTeam(slug: $slug, update: $update) {
               slug
-              zoneId
-              errorHandlerConfig {
-                processId
-                tag
-              }
               parentTeams {
                 slug
                 version
               }
-              settings {
-                webhookAuth {
-                  headerName
-                  variableKey
-                }
-                primaryLocale
-              }
+              ${INHERITABLE_SETTINGS_SELECTION}
             }
           }
         `, { slug: this.teamSlug, update })
             .then(({ updateTeam: team }) => this.mapTeamSettings(team))
             .catch((error) => {
-            return Promise.reject(this.cleanError(error));
+            return Promise.reject(this.cleanTeamSettingsError(error));
         });
     }
+    /**
+     * An API that predates settings inheritance rejects the query naming `inheritableSettings` as a
+     * schema error; that reads better as what it means than as GraphQL validation output.
+     */
+    cleanTeamSettingsError(error) {
+        const message = error?.response?.errors?.[0]?.message ?? '';
+        // Only the schema errors an older API answers with (an unknown output field, an unknown input
+        // field): the API's own validation errors also name inheritableSettings, and mean something else.
+        if (message.includes('inheritableSettings') && UNKNOWN_FIELD_ERROR.test(message)) {
+            return new errors_1.PlatformPredatesSettingsInheritance();
+        }
+        return this.cleanError(error);
+    }
     mapProgrammingLanguageManifest(programmingLanguageManifest) {
         const allDependencies = programmingLanguageManifest.nextInstallation?.dependencies || programmingLanguageManifest.dependencies;
         return new types_1.ProgrammingLanguageManifest(programmingLanguageManifest.id, programmingLanguageManifest.programmingLanguage, programmingLanguageManifest.programmingLanguage, this.mapDependencies(allDependencies), 

package/dist/services/locale-resolver.js

@@ -71,16 +71,20 @@ function readLocale(workspaceDir, locale) {
         ...readLocaleFile(workspaceDir, locale),
     };
 }
-function chosenPrimaryLocaleOf(workspaceDir) {
+function primaryLocaleIn(workspaceDir, fileName) {
     try {
         (0, settings_1.migrateLegacySettingsFile)(workspaceDir);
-        const settings = fs.readJsonSync(path.join(workspaceDir, settings_1.SETTINGS_FILENAME));
+        const settings = fs.readJsonSync(path.join(workspaceDir, fileName));
         return typeof settings?.primaryLocale === 'string' && settings.primaryLocale.length > 0 ? settings.primaryLocale : undefined;
     }
     catch {
         return undefined;
     }
 }
+/** The workspace's own choice, or the one it inherits when settings.json makes none. */
+function chosenPrimaryLocaleOf(workspaceDir) {
+    return primaryLocaleIn(workspaceDir, settings_1.SETTINGS_FILENAME) ?? primaryLocaleIn(workspaceDir, settings_1.INHERITED_SETTINGS_FILENAME);
+}
 /** Every locale file in the workspace, own and inherited: `pull` writes them all to `i18n/`. */
 function localeFileSlugs(workspaceDir) {
     const directory = path.join(workspaceDir, I18N_DIRECTORY);

package/dist/services/retired-app-role.d.ts

@@ -0,0 +1,15 @@
+import { Process } from '../core/types';
+/**
+ * Refuses to push a process that still declares `form.appRole`.
+ *
+ * The role is retired: a lifecycle form is named by its reserved slug, and the form offered from
+ * the app's page is `factorial.form.appTool`. Writing the role kept agents copying it into new
+ * Apps, where it beats the slug and, set by `appTool`, took the install role away. A process that
+ * already holds a role in the cloud keeps it when the line is deleted, since a push only sends the
+ * role when metadata.json names it — so legacy Apps need no rename to push again.
+ *
+ * Inherited and deleted processes are not pushed, so they are not checked.
+ *
+ * @returns the message to fail the push with, or undefined when no process declares a role.
+ */
+export declare function retiredAppRoleError(processes: Array<Process>): string | undefined;

package/dist/services/retired-app-role.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.retiredAppRoleError = retiredAppRoleError;
+const types_1 = require("../core/types");
+const LIFECYCLE_SLUGS = ['install', 'settings', 'uninstall'];
+/**
+ * Refuses to push a process that still declares `form.appRole`.
+ *
+ * The role is retired: a lifecycle form is named by its reserved slug, and the form offered from
+ * the app's page is `factorial.form.appTool`. Writing the role kept agents copying it into new
+ * Apps, where it beats the slug and, set by `appTool`, took the install role away. A process that
+ * already holds a role in the cloud keeps it when the line is deleted, since a push only sends the
+ * role when metadata.json names it — so legacy Apps need no rename to push again.
+ *
+ * Inherited and deleted processes are not pushed, so they are not checked.
+ *
+ * @returns the message to fail the push with, or undefined when no process declares a role.
+ */
+function retiredAppRoleError(processes) {
+    const offenders = processes.filter((process) => !(0, types_1.isReadOnly)(process) && process.form?.appRole && process.form.appRole !== 'NONE');
+    if (offenders.length === 0) {
+        return undefined;
+    }
+    const lines = offenders.map((process) => `  - processes/${process.slug}: ${fixFor(process)}`);
+    return [
+        '`form.appRole` is no longer supported. Remove it from metadata.json:',
+        ...lines,
+        `Install, settings and uninstall forms are the processes named ${LIFECYCLE_SLUGS.map((slug) => `'${slug}'`).join(', ')}.`,
+    ].join('\n');
+}
+function fixFor(process) {
+    const role = process.form.appRole;
+    if (role === 'USER_FACING_FORM') {
+        return 'set `factorial.form.appTool: true` instead.';
+    }
+    const slug = role.toLowerCase();
+    if (process.slug === slug) {
+        return `the '${slug}' slug already makes it the ${slug} form.`;
+    }
+    if (process.id) {
+        return `the cloud keeps the ${role} role it already has once the line is gone.`;
+    }
+    return `rename the process to '${slug}'.`;
+}

package/dist/services/webhook-auth.d.ts

@@ -13,9 +13,11 @@ export type WebhookAuthResult = {
  */
 export declare function findHeader(headers: http.IncomingHttpHeaders, name: string): string | undefined;
 /**
- * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM. The
+ * workspace's is its own (settings.json) or, when settings.json leaves it out, the inherited one
+ * (settings.inherited.json); null in settings.json clears it, a parent's included.
  * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
  * because treating it as public would silently unprotect a webhook its owner chose to protect.
  */
-export declare function resolveEffectiveAuth(webhook: ProcessWebhook | undefined, teamWebhookAuth: WebhookAuth | undefined): WebhookAuth | null;
+export declare function resolveEffectiveAuth(webhook: ProcessWebhook | undefined, teamWebhookAuth: WebhookAuth | null | undefined, inheritedTeamWebhookAuth?: WebhookAuth): WebhookAuth | null;
 export declare function checkWebhookAuth(effectiveAuth: WebhookAuth | null, headers: http.IncomingHttpHeaders, variableValue: string | undefined): WebhookAuthResult;

package/dist/services/webhook-auth.js

@@ -26,20 +26,26 @@ function findHeader(headers, name) {
     return undefined;
 }
 /**
- * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM. The
+ * workspace's is its own (settings.json) or, when settings.json leaves it out, the inherited one
+ * (settings.inherited.json); null in settings.json clears it, a parent's included.
  * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
  * because treating it as public would silently unprotect a webhook its owner chose to protect.
  */
-function resolveEffectiveAuth(webhook, teamWebhookAuth) {
+function resolveEffectiveAuth(webhook, teamWebhookAuth, inheritedTeamWebhookAuth) {
     const authMode = webhook?.authMode;
     if (!authMode || authMode === 'NONE') {
         return null;
     }
     if (authMode === 'TEAM') {
-        if (!teamWebhookAuth) {
-            throw new Error('this webhook inherits the workspace webhook auth, which is not set in settings.json');
+        if (teamWebhookAuth === null) {
+            throw new Error('this webhook inherits the workspace webhook auth, which settings.json sets to none');
         }
-        return teamWebhookAuth;
+        const workspaceAuth = teamWebhookAuth ?? inheritedTeamWebhookAuth;
+        if (!workspaceAuth) {
+            throw new Error('this webhook inherits the workspace webhook auth, which is not set in settings.json nor inherited');
+        }
+        return workspaceAuth;
     }
     if (!webhook?.auth?.variableKey) {
         throw new Error('this webhook uses the CUSTOM auth mode but names no variable in metadata.json');

package/dist/utils/cli-version.d.ts

@@ -0,0 +1,7 @@
+/** The header the CLI reports its version in, so the platform can refuse a CLI too old for a request. */
+export declare const CLI_VERSION_HEADER = "Fcode-Cli-Version";
+/**
+ * The installed CLI's own version, read from its package.json: two levels above this file both in
+ * src/utils (tests) and dist/utils (the published package, which always ships package.json).
+ */
+export declare function cliVersion(): string;

package/dist/utils/cli-version.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_VERSION_HEADER = void 0;
+exports.cliVersion = cliVersion;
+const fs = require("node:fs");
+const path = require("node:path");
+/** The header the CLI reports its version in, so the platform can refuse a CLI too old for a request. */
+exports.CLI_VERSION_HEADER = 'Fcode-Cli-Version';
+let cached;
+/**
+ * The installed CLI's own version, read from its package.json: two levels above this file both in
+ * src/utils (tests) and dist/utils (the published package, which always ships package.json).
+ */
+function cliVersion() {
+    if (cached === undefined) {
+        const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'));
+        cached = String(packageJson.version);
+    }
+    return cached;
+}

package/dist/utils/gitignore.d.ts

@@ -16,6 +16,7 @@ export declare function renderGitignoreWithInherited(existing: string, inherited
  * current workspace metadata, so resources that stop being inherited drop out.
  * Inherited variable values live in one file, which is ignored as soon as the
  * workspace inherits any variable; inherited locales are one file each, like modules;
- * inherited dependencies are one file per language, like variables.
+ * inherited dependencies are one file per language, like variables; inherited settings are one
+ * file.
  */
 export declare function syncInheritedGitignore(workspaceDir?: string): Promise<void>;

package/dist/utils/gitignore.js

@@ -9,6 +9,7 @@ const workspace_1 = require("../config/workspace");
 const global_1 = require("../config/global");
 const settings_1 = require("../config/settings");
 const programming_language_manifest_1 = require("../repositories/programming-language-manifest");
+const settings_2 = require("../repositories/settings");
 const filenamify_1 = require("./filenamify");
 const file_utils_1 = require("./file-utils");
 exports.INHERITED_BLOCK_START = '# BEGIN fcode inherited resources (auto-generated, do not edit)';
@@ -51,7 +52,8 @@ function stripManagedBlock(content) {
  * current workspace metadata, so resources that stop being inherited drop out.
  * Inherited variable values live in one file, which is ignored as soon as the
  * workspace inherits any variable; inherited locales are one file each, like modules;
- * inherited dependencies are one file per language, like variables.
+ * inherited dependencies are one file per language, like variables; inherited settings are one
+ * file.
  */
 async function syncInheritedGitignore(workspaceDir = process.cwd()) {
     const team = await new workspace_1.default(workspaceDir).getActiveTeam();
@@ -71,6 +73,8 @@ async function syncInheritedGitignore(workspaceDir = process.cwd()) {
         // inherit — checked on disk because the manifest metadata tracks the workspace's own list, not
         // what its parents contribute.
         ...exports.INHERITED_DEPENDENCY_FILES.filter((file) => fs.existsSync(path.join(workspaceDir, file))),
+        // Written only when the workspace inherits a setting, so checked on disk like dependencies.
+        ...(fs.existsSync(path.join(workspaceDir, settings_2.INHERITED_SETTINGS_FILENAME)) ? [settings_2.INHERITED_SETTINGS_FILENAME] : []),
     ];
     const gitignorePath = path.join(workspaceDir, '.gitignore');
     const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, 'utf8') : '';

package/oclif.manifest.json

@@ -2516,5 +2516,5 @@
       ]
     }
   },
-  "version": "3.5.1"
+  "version": "3.6.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/fcode-cli",
-  "version": "3.5.1",
+  "version": "3.6.1",
   "packageManager": "pnpm@11.7.0",
   "description": "Factorial Code Command Line Interface",
   "homepage": "https://code.factorialhr.com/docs/cli/",