kalup 0.2.0 → 0.3.0

package/README.md

@@ -53,7 +53,7 @@ Commit `kalup.config.ts` and `hubspot/`. Keep `.kalup/`, plan files and `.env` o
 
 `kalup <command> --help` lists each command's flags.
 
-## What 0.2 covers
+## What it covers
 
 - Reads and writes properties and property groups on standard and custom objects. Custom object schemas are read and compared, not written.
 - Every property definition field HubSpot lets you write, such as display hints, `hidden`, `displayOrder` and calculation formulas, checked against a live developer test account.
@@ -61,7 +61,7 @@ Commit `kalup.config.ts` and `hubspot/`. Keep `.kalup/`, plan files and `.env` o
 - State local to your machine by default, or committed with `state: 'repo'`. Monorepos and git worktrees.
 - Every command takes `--json` and prints one `envelope/1` document with stable issue codes and exit codes. The JSON Schemas ship as `kalup/schemas/<file>`.
 
-The pull, plan, apply and drift workflow passed [live runs](https://github.com/scopiousdigital/kalup/blob/main/docs/hubspot.md#live-runs) on a HubSpot developer test account; other account types are not verified yet. Pipelines, custom object schema writes and association labels are next. Before 1.0, a minor release may change the config grammar or the JSON output, and its release notes say so.
+The pull, plan, apply and drift workflow passed [live runs](https://github.com/scopiousdigital/kalup/blob/main/docs/hubspot.md#live-runs) on a HubSpot developer test account. Start on a test account or sandbox. Pipelines, custom object schema writes and association labels are next. Before 1.0, a minor release may change the config grammar or the JSON output, and its release notes say so.
 
 ## Docs
 

package/dist/{commands-Bk1w1oup.mjs → commands-T4j_GVBD.mjs}

@@ -1252,6 +1252,15 @@ const TYPE_FIELDS = {
 	currencyPropertyName: ["number"],
 	textDisplayHint: ["string", "phone_number"]
 };
+/**
+* The name prefixes HubSpot reserves: `hs_` for its own properties and `a<appId>_` for an integration's. A create with
+* either is refused (400, live runs 2026-10-01). Kalup never manages such a property; pull writes it as a reference.
+*/
+const RESERVED_PREFIX = /^(hs_|a\d+_)/;
+/** The reserved prefix a name carries, or undefined. */
+function reservedPrefix(name) {
+	return RESERVED_PREFIX.exec(name)?.[1];
+}
 const ADDRESS = /^[a-z]+:\S+$/;
 /** Whether `value` is an address: a lowercase type, a colon and a path without whitespace. */
 function isAddress(value) {
@@ -2692,7 +2701,7 @@ function validate$2(loaded, options = {}) {
 	});
 	if (loaded.layout.legacy) warnings.push({
 		code: "W_LEGACY_DIR",
-		message: `the object files are in ${LEGACY_DIR}/, the folder Kalup 0.1 used; the default is now ${DEFAULT_DIR}/`,
+		message: `the object files are in ${LEGACY_DIR}/, the old default folder; the default is now ${DEFAULT_DIR}/`,
 		file: CONFIG$2$1,
 		fix: `add dir: '${LEGACY_DIR}' to ${CONFIG$2$1}, or move ${LEGACY_DIR}/ to ${DEFAULT_DIR}/`
 	});
@@ -2807,9 +2816,10 @@ function checkProperty$1(loaded, address, resource, keys, { issues, warnings })
 		fix: "list the options, or drop .strict()"
 	});
 	checkLifecycle(resource, d, at, issues);
-	if (resource.managed && name.startsWith("hs_")) issues.push({
+	const reserved = reservedPrefix(name);
+	if (resource.managed && reserved !== void 0) issues.push({
 		code: "E_HS_PREFIX",
-		message: `'${name}' starts with hs_, the prefix HubSpot uses for its own properties`,
+		message: `'${name}' starts with ${reserved}, a prefix HubSpot reserves (hs_ for its own properties, a<digits>_ for an integration's)`,
 		...at(),
 		fix: "rename the property, or drop label, group and fieldType to reference it"
 	});
@@ -3077,7 +3087,13 @@ function definitionRules(codec, d) {
 		message: `calculationFormula needs fieldType '${CALCULATION}': HubSpot turns the property into a calculation`,
 		fix: `set fieldType: '${CALCULATION}', or remove calculationFormula`
 	});
-	if (d.currencyPropertyName !== void 0 && d.showCurrencySymbol !== true) rules.push({
+	if (d.currencyPropertyName === "") rules.push({
+		field: "currencyPropertyName",
+		reads: ["currencyPropertyName"],
+		message: "currencyPropertyName '' is not nothing: HubSpot stores it and then never turns showCurrencySymbol off",
+		fix: "remove currencyPropertyName, or name a currency property"
+	});
+	else if (d.currencyPropertyName !== void 0 && d.showCurrencySymbol !== true) rules.push({
 		field: "currencyPropertyName",
 		reads: ["currencyPropertyName", "showCurrencySymbol"],
 		message: "HubSpot takes currencyPropertyName only with showCurrencySymbol: true",
@@ -3262,10 +3278,11 @@ function rules(blueprint) {
 	}
 	return issues;
 }
-/** A group or property name: plain, and never HubSpot's own `hs_`. */
+/** A group or property name: plain, and never a prefix HubSpot reserves (`hs_`, `a<digits>_`). */
 function checkName(report, at, type, name) {
+	const reserved = reservedPrefix(name);
 	if (!NAME.test(name)) report(at, `${type} name '${name}' is not lowercase letters, digits and underscores starting with a letter`);
-	else if (name.startsWith("hs_")) report(at, `${type} name '${name}' starts with hs_, the prefix HubSpot uses for its own names`);
+	else if (reserved !== void 0) report(at, `${type} name '${name}' starts with ${reserved}, a prefix HubSpot reserves`);
 }
 function checkProperty(report, at, object, resource) {
 	const d = resource.definition;
@@ -3454,6 +3471,16 @@ const registry = {
 			tag: "read"
 		} }
 	},
+	tokenInfo: {
+		family: "oauth.private-apps",
+		version: "v2",
+		status: "ga",
+		paths: { read: {
+			method: "POST",
+			path: "/oauth/v2/private-apps/get/access-token-info",
+			tag: "read"
+		} }
+	},
 	limits: {
 		family: "crm.limits",
 		version: "2026-09",
@@ -3501,9 +3528,10 @@ const scopeExceptions = {
 	users: "crm.objects.users.read"
 };
 /**
-* The write counterpart of each read exception. Unverified: the scope list of HubSpot's 2026-09 create-property
-* reference names crm.schemas.commercepayments.write, e-commerce and crm.objects.users.write, and none of the others,
-* so they mirror the read exceptions until a live write checks them.
+* The write counterpart of each read exception. The scope list of HubSpot's 2026-09 create-property reference names
+* crm.schemas.commercepayments.write, e-commerce and crm.objects.users.write, and none of the others, so they mirror
+* the read exceptions until a live write checks them. A key with crm.schemas.companies.write alone creates, updates
+* and archives company properties and reads nothing (live runs, 2026-10-01).
 */
 const writeScopeExceptions = {
 	commerce_payments: "crm.schemas.commercepayments.write",
@@ -3606,6 +3634,8 @@ const MILESTONE_3_WRITES = [
 		path: "delete"
 	}
 ];
+/** How many `errors` entries an outcome keeps: a property used in hundreds of places must not balloon it. */
+const ERRORS_MAX = 50;
 var HubSpotApiError = class extends KalupError {
 	status;
 	category;
@@ -3919,14 +3949,16 @@ function outcomeOf(answer, context) {
 const REJECTED_MESSAGE_MAX = 400;
 function rejectedOf(status, body, context) {
 	const { key, method, path, scope } = context;
-	const { category, correlationId, subCategory } = body;
+	const { category, correlationId, subCategory, context: fields, errors } = body;
 	return {
 		kind: "rejected",
 		status,
 		...category === void 0 ? {} : { category },
 		...subCategory === void 0 ? {} : { subCategory },
 		...correlationId === void 0 ? {} : { correlationId },
-		message: issueOf(status, body, method, path, key, scope, REJECTED_MESSAGE_MAX).message
+		message: issueOf(status, body, method, path, key, scope, REJECTED_MESSAGE_MAX).message,
+		...fields === void 0 ? {} : { context: fields },
+		...errors === void 0 ? {} : { errors }
 	};
 }
 function retryAfterMs(headers) {
@@ -3966,13 +3998,33 @@ function errorBody(text, key) {
 }
 function fieldsOf(body, key) {
 	if (typeof body !== "object" || body === null) return {};
-	const { category, correlationId, message, policyName, subCategory } = body;
+	const { category, context, correlationId, errors, message, policyName, subCategory } = body;
+	const fields = contextOf(context, key);
+	const details = Array.isArray(errors) ? errors.slice(0, ERRORS_MAX).map((item) => detailOf(item, key)) : void 0;
 	return {
 		...typeof category === "string" ? { category: quote(category, key) } : {},
 		...typeof subCategory === "string" ? { subCategory: quote(subCategory, key) } : {},
 		...typeof correlationId === "string" ? { correlationId: quote(correlationId, key) } : {},
 		...typeof message === "string" ? { message } : {},
-		...typeof policyName === "string" ? { policyName } : {}
+		...typeof policyName === "string" ? { policyName } : {},
+		...fields === void 0 ? {} : { context: fields },
+		...details === void 0 ? {} : { errors: details }
+	};
+}
+function contextOf(context, key) {
+	if (typeof context !== "object" || context === null || Array.isArray(context)) return;
+	const out = {};
+	for (const [name, value] of Object.entries(context)) if (Array.isArray(value) && value.every((item) => typeof item === "string")) out[quote(name, key)] = value.map((item) => quote(item, key));
+	return out;
+}
+function detailOf(item, key) {
+	if (typeof item !== "object" || item === null) return {};
+	const { context, message, subCategory } = item;
+	const fields = contextOf(context, key);
+	return {
+		...typeof subCategory === "string" ? { subCategory: quote(subCategory, key) } : {},
+		...typeof message === "string" ? { message: quote(message, key) } : {},
+		...fields === void 0 ? {} : { context: fields }
 	};
 }
 function issueOf(status, body, method, path, key, scope, max) {
@@ -4013,6 +4065,114 @@ function portalMidnight(now, timeZone) {
 	const offset = Date.UTC(part.year ?? 0, (part.month ?? 1) - 1, part.day, part.hour, part.minute, part.second) - Math.floor(now.getTime() / 1e3) * 1e3;
 	return new Date(Date.UTC(part.year ?? 0, (part.month ?? 1) - 1, (part.day ?? 1) + 1) - offset).toISOString();
 }
+/**
+* The objects whose properties the properties API lists by name. A config key outside this set names a custom object
+* schema. The set is the 2026-09 `crm.schemas.<object>.read` scope list plus the objects that carry their own scopes
+* (products, leads, goals, marketing events, feedback submissions, users).
+*/
+const STANDARD_OBJECTS = /* @__PURE__ */ new Set([
+	"appointments",
+	"calls",
+	"carts",
+	"commerce_payments",
+	"communications",
+	"companies",
+	"contacts",
+	"courses",
+	"deals",
+	"emails",
+	"feedback_submissions",
+	"goals",
+	"invoices",
+	"leads",
+	"line_items",
+	"listings",
+	"marketing_events",
+	"meetings",
+	"notes",
+	"orders",
+	"postal_mail",
+	"products",
+	"projects",
+	"quotes",
+	"services",
+	"subscriptions",
+	"tasks",
+	"tickets",
+	"users"
+]);
+/**
+* The object type ID of each standard object, by config key. Limits Tracking keys its per-object entries by these.
+* Source: "Object type ID values", retrieved 2026-09-24:
+* https://developers.hubspot.com/docs/api-reference/latest/crm/understanding-the-crm
+* A plain record: look a key up with `Object.hasOwn`, so `constructor` finds nothing.
+*/
+const STANDARD_OBJECT_TYPE_IDS = {
+	appointments: "0-421",
+	calls: "0-48",
+	carts: "0-142",
+	commerce_payments: "0-101",
+	communications: "0-18",
+	companies: "0-2",
+	contacts: "0-1",
+	courses: "0-410",
+	deals: "0-3",
+	emails: "0-49",
+	feedback_submissions: "0-19",
+	goals: "0-74",
+	invoices: "0-53",
+	leads: "0-136",
+	line_items: "0-8",
+	listings: "0-420",
+	marketing_events: "0-54",
+	meetings: "0-47",
+	notes: "0-46",
+	orders: "0-123",
+	postal_mail: "0-116",
+	products: "0-7",
+	projects: "0-970",
+	quotes: "0-14",
+	services: "0-162",
+	subscriptions: "0-69",
+	tasks: "0-27",
+	tickets: "0-5",
+	users: "0-115"
+};
+/** One object's pull scope from its settings under `objects` and the property names its object file defines. */
+function scopeOf(scope = {}, defined = []) {
+	return {
+		custom: scope.custom ?? true,
+		defined: new Set(defined),
+		exclude: excluder(scope.exclude),
+		include: new Set(scope.include ?? [])
+	};
+}
+/** The names of the properties the object files define on `object`, references included. */
+function definedOn(ir, object) {
+	const prefix = `property:${object}/`;
+	return Object.keys(ir.resources).filter((address) => address.startsWith(prefix)).map((address) => address.slice(prefix.length));
+}
+/**
+* A portal property is in scope when the object files define it or `include` names it, whatever `custom` and
+* `exclude` say, or when it is custom, `custom` is on and `exclude` does not name it. validate refuses a name both
+* `include` and `exclude` hold.
+*/
+function inScope(scope, property) {
+	const { name } = property;
+	return scope.defined.has(name) || scope.include.has(name) || scope.custom && !property.hubspotDefined && !scope.exclude(name);
+}
+/** The `exclude` patterns of one object as a predicate over internal names. */
+function excluder(patterns = []) {
+	const matchers = patterns.map(addressMatcher);
+	return (name) => matchers.some((matches) => matches(name));
+}
+/** The --only glob as a predicate over addresses. `*` matches any run of characters, `/` included. */
+function addressMatcher(glob) {
+	if (glob === void 0) return () => true;
+	const literals = glob.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+	const pattern = new RegExp(`^${literals.join(".*")}$`);
+	return (address) => pattern.test(address);
+}
 const SETS$1 = /* @__PURE__ */ new Set(["requiredProperties", "searchableProperties"]);
 /** Every unit desired owns that observed holds, sorted by unit. */
 function classify(base, desired, observed, rules) {
@@ -4934,7 +5094,7 @@ function normalizeProperties(object, raw, issues, warn = () => true) {
 	for (const p of raw) {
 		if (p.archived) continue;
 		const hubspotDefined = Boolean(p.hubspotDefined);
-		const reference = Boolean(p.hubspotDefined || p.calculated && p.fieldType !== "calculation_equation");
+		const reference = Boolean(p.hubspotDefined || p.calculated && p.fieldType !== "calculation_equation" || RESERVED_PREFIX.test(p.name));
 		const external = p.externalOptions === true || p.referencedObjectType === "OWNER";
 		const kind = builderOf(p, external);
 		if (kind === void 0 || !(reference || writable(p, kind, external))) {
@@ -5011,7 +5171,8 @@ function metaOf(p) {
 		modificationMetadata,
 		createdAt: text(p.createdAt),
 		updatedAt: text(p.updatedAt),
-		options: options?.length ? options : void 0
+		options: options?.length ? options : void 0,
+		currencyPropertyName: text(p.currencyPropertyName)
 	});
 }
 function definitionOf$1(p, reference, options) {
@@ -5074,114 +5235,6 @@ function normalizeSchema(schema) {
 function compact$4(value) {
 	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
 }
-/**
-* The objects whose properties the properties API lists by name. A config key outside this set names a custom object
-* schema. The set is the 2026-09 `crm.schemas.<object>.read` scope list plus the objects that carry their own scopes
-* (products, leads, goals, marketing events, feedback submissions, users).
-*/
-const STANDARD_OBJECTS = /* @__PURE__ */ new Set([
-	"appointments",
-	"calls",
-	"carts",
-	"commerce_payments",
-	"communications",
-	"companies",
-	"contacts",
-	"courses",
-	"deals",
-	"emails",
-	"feedback_submissions",
-	"goals",
-	"invoices",
-	"leads",
-	"line_items",
-	"listings",
-	"marketing_events",
-	"meetings",
-	"notes",
-	"orders",
-	"postal_mail",
-	"products",
-	"projects",
-	"quotes",
-	"services",
-	"subscriptions",
-	"tasks",
-	"tickets",
-	"users"
-]);
-/**
-* The object type ID of each standard object, by config key. Limits Tracking keys its per-object entries by these.
-* Source: "Object type ID values", retrieved 2026-09-24:
-* https://developers.hubspot.com/docs/api-reference/latest/crm/understanding-the-crm
-* A plain record: look a key up with `Object.hasOwn`, so `constructor` finds nothing.
-*/
-const STANDARD_OBJECT_TYPE_IDS = {
-	appointments: "0-421",
-	calls: "0-48",
-	carts: "0-142",
-	commerce_payments: "0-101",
-	communications: "0-18",
-	companies: "0-2",
-	contacts: "0-1",
-	courses: "0-410",
-	deals: "0-3",
-	emails: "0-49",
-	feedback_submissions: "0-19",
-	goals: "0-74",
-	invoices: "0-53",
-	leads: "0-136",
-	line_items: "0-8",
-	listings: "0-420",
-	marketing_events: "0-54",
-	meetings: "0-47",
-	notes: "0-46",
-	orders: "0-123",
-	postal_mail: "0-116",
-	products: "0-7",
-	projects: "0-970",
-	quotes: "0-14",
-	services: "0-162",
-	subscriptions: "0-69",
-	tasks: "0-27",
-	tickets: "0-5",
-	users: "0-115"
-};
-/** One object's pull scope from its settings under `objects` and the property names its object file defines. */
-function scopeOf(scope = {}, defined = []) {
-	return {
-		custom: scope.custom ?? true,
-		defined: new Set(defined),
-		exclude: excluder(scope.exclude),
-		include: new Set(scope.include ?? [])
-	};
-}
-/** The names of the properties the object files define on `object`, references included. */
-function definedOn(ir, object) {
-	const prefix = `property:${object}/`;
-	return Object.keys(ir.resources).filter((address) => address.startsWith(prefix)).map((address) => address.slice(prefix.length));
-}
-/**
-* A portal property is in scope when the object files define it or `include` names it, whatever `custom` and
-* `exclude` say, or when it is custom, `custom` is on and `exclude` does not name it. validate refuses a name both
-* `include` and `exclude` hold.
-*/
-function inScope(scope, property) {
-	const { name } = property;
-	return scope.defined.has(name) || scope.include.has(name) || scope.custom && !property.hubspotDefined && !scope.exclude(name);
-}
-/** The `exclude` patterns of one object as a predicate over internal names. */
-function excluder(patterns = []) {
-	const matchers = patterns.map(addressMatcher);
-	return (name) => matchers.some((matches) => matches(name));
-}
-/** The --only glob as a predicate over addresses. `*` matches any run of characters, `/` included. */
-function addressMatcher(glob) {
-	if (glob === void 0) return () => true;
-	const literals = glob.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
-	const pattern = new RegExp(`^${literals.join(".*")}$`);
-	return (address) => pattern.test(address);
-}
 const CONFIG$1$1 = "kalup.config.ts";
 /** HubSpot lists only non-sensitive properties unless asked, and takes one sensitivity per request. */
 const SENSITIVITIES$1 = [
@@ -5497,6 +5550,7 @@ function pinWarnings(rows, now = Date.now()) {
 	const out = [];
 	const seen = /* @__PURE__ */ new Set();
 	for (const row of rows) {
+		if (row.expires === void 0) continue;
 		const pin = `${row.family} ${row.version}`;
 		const expires = /* @__PURE__ */ new Date(`${row.expires}-01T00:00:00Z`);
 		if (seen.has(pin) || expires.getTime() - now > pinWarningDays * 864e5) continue;
@@ -5617,23 +5671,23 @@ function fieldOf(unit) {
 /**
 * Why HubSpot cannot take an adopt or update of `kind`, or undefined when it can. A difference in `type` or
 * `hasUniqueValue` blocks whatever else the step holds, since the property has to be migrated. Written units must be
-* writable, a read-only definition blocks writing its fields, and read-only options block writing an option.
-* `observed` is the portal's resource: HubSpot answers 400 to turning showCurrencySymbol off while it holds a
-* currencyPropertyName (observed, docs/hubspot.md), which config may leave out.
+* writable, a read-only definition blocks writing its fields, and read-only options block writing an option. HubSpot
+* answers 400 to turning showCurrencySymbol off once the property ever had a currencyPropertyName, `''` included, and
+* nothing clears it (observed 2026-10-01); `meta` carries the value as HubSpot returned it, which config may leave out.
 */
-function writeBlock(kind, units, written, meta, observed) {
+function writeBlock(kind, units, written, meta) {
 	const fixed = kind === "property" ? units.filter((u) => FIXED.has(u.unit) && u.class !== "converged") : [];
 	if (fixed.length > 0) return {
 		short: `${fixed.map((u) => u.unit).join(" and ")} ${fixed.length > 1 ? "differ" : "differs"}`,
 		detail: fixed.map((u) => `config has ${u.unit} ${JSON.stringify(u.desired)} and the portal ${JSON.stringify(u.observed)}`).join("; "),
 		fix: `change the builder to match the portal, or migrate: create a new property, copy the values over, point what uses this one at the new one, then run ${bin} rm on this one`
 	};
-	const currency = observed?.definition?.currencyPropertyName;
+	const currency = meta?.currencyPropertyName;
 	const symbolOff = units.some((u) => u.unit === "showCurrencySymbol" && u.desired !== true);
-	if (written.includes("showCurrencySymbol") && symbolOff && typeof currency === "string" && currency !== "") return {
+	if (written.includes("showCurrencySymbol") && symbolOff && currency !== void 0) return {
 		short: "currency property set",
-		detail: `HubSpot does not turn showCurrencySymbol off while the property has currencyPropertyName ${JSON.stringify(currency)}`,
-		fix: "keep showCurrencySymbol: true, or clear the currency property in HubSpot first"
+		detail: `HubSpot never turns showCurrencySymbol off once the property had a currencyPropertyName; this one holds ${JSON.stringify(currency)}, and clearing it does not lift the refusal`,
+		fix: `keep showCurrencySymbol: true, or migrate: create a new property under another name, copy the values over, point what uses this one at the new one, then run ${bin} rm on this one`
 	};
 	const unwritable = written.filter((unit) => !WRITABLE[kind].has(fieldOf(unit)));
 	if (unwritable.length > 0) return {
@@ -5657,9 +5711,10 @@ function writeBlock(kind, units, written, meta, observed) {
 }
 /**
 * Why a delete cannot run, or undefined when it can: HubSpot marks the property not archivable, or, for a group,
-* properties still name it, active or archived, apart from those the same plan deletes first. On a developer test
-* account (2026-09-29) HubSpot refused to archive a group that held an active property, and archived one whose
-* properties were all archived; what a later restore of those properties then does is not confirmed.
+* active properties still name it, apart from those the same plan deletes first. HubSpot refuses to archive a group
+* that holds an active property and archives one whose properties are all archived (observed 2026-09-29 and
+* 2026-10-01); an archived group never comes back, and its archived properties can only be restored into another
+* group, so archived members do not block.
 */
 function deleteBlock(meta, members) {
 	if (meta?.modificationMetadata?.archivable === false) return {
@@ -5669,12 +5724,11 @@ function deleteBlock(meta, members) {
 	};
 	if (members === void 0) return;
 	const active = members.active.filter((name) => !members.deleted.has(name));
-	const archived = members.archived.filter((name) => !members.deleted.has(name));
-	if (active.length === 0 && archived.length === 0) return;
+	if (active.length === 0) return;
 	return {
 		short: "group still holds properties",
-		detail: `properties in HubSpot still name this group: ${[...active.length > 0 ? [active.join(", ")] : [], ...archived.length > 0 ? [`archived: ${archived.join(", ")}`] : []].join("; ")}`,
-		fix: "move them to another group or delete them first; HubSpot refused to archive a group that held an active property on a developer test account (2026-09-29)"
+		detail: `properties in HubSpot still name this group: ${active.join(", ")}`,
+		fix: "move them to another group or delete them first; HubSpot archives a group only once every property in it is archived"
 	};
 }
 function classOf(change, context) {
@@ -6678,8 +6732,8 @@ function plan$1(input) {
 }
 /**
 * What the command reads between the observation and plan: the Limits Tracking readings for the creates it plans, and
-* the archived properties of each object that exists and gets a property create, holds a property state owns that
-* HubSpot no longer has, or gets a group delete an entry owns.
+* the archived properties of each object that exists and gets a property create or holds a property state owns that
+* HubSpot no longer has.
 */
 function planReads(input) {
 	const { observation } = input;
@@ -6691,14 +6745,9 @@ function planReads(input) {
 	}, coverage);
 	const creates = decided.steps.filter((s) => s.action === "create" && s.risk !== "blocked" && kindOf$3(s.address) === "property").map((s) => s.address);
 	const gone = decided.gone.filter((g) => kindOf$3(g.address) === "property");
-	const groupDeletes = decided.steps.filter((s) => s.action === "delete" && s.blocked?.reason !== "not-owned" && kindOf$3(s.address) === "group");
 	const ids = objectTypeIds(observation);
 	const archived = {};
-	for (const key of [
-		...creates,
-		...gone.map((g) => g.address),
-		...groupDeletes.map((s) => s.address)
-	].map(objectOf)) {
+	for (const key of [...creates, ...gone.map((g) => g.address)].map(objectOf)) {
 		const objectType = own$2(ids, key) ?? (STANDARD_OBJECTS.has(key) ? key : void 0);
 		if (objectType !== void 0) archived[key] = objectType;
 	}
@@ -7053,7 +7102,7 @@ function present(context, address, resource, owner) {
 function referenced(context, address) {
 	const { target } = context.input;
 	const short = "HubSpot-defined or calculated";
-	return blocked(address, "adopt", "unsupported", short, `${short} in this portal; run ${bin} pull to make it a reference`, `run ${pullCommand(target, address)}`);
+	return blocked(address, "adopt", "unsupported", short, `${short} in this portal, or named with a prefix HubSpot reserves; run ${bin} pull to make it a reference`, `run ${pullCommand(target, address)}`);
 }
 function settle$1(context, r) {
 	const { action, address, kind, observed, owner, units } = r;
@@ -7069,7 +7118,7 @@ function settle$1(context, r) {
 	if (bins.refused) return blocked(address, action, "unsupported", "schema writes not supported", `${NO_SCHEMA_WRITES}, so --take config cannot write its units`, "leave it out of --take");
 	const meta = context.input.observation.meta?.[address];
 	reorder(r, changes, meta);
-	const block = writeBlock(kind, units, changes.map((c) => c.unit), meta, observed);
+	const block = writeBlock(kind, units, changes.map((c) => c.unit), meta);
 	if (block) return blocked(address, action, "unsupported", block.short, block.detail, block.fix);
 	const takeover = takeoverUnits(context, r, changes);
 	const refused = takeover.size > 0 ? takeoverBlock(context, address, action, [...takeover]) : void 0;
@@ -7295,16 +7344,10 @@ function takeoverDelete(context, address, deleted) {
 		...notes
 	});
 	if (!context.coverage.complete) return noted(blocked(address, "delete", "scope", "read incomplete", `takeover would archive ${name}, and the read of target ${target} was incomplete, so takeover removes nothing there`, INCOMPLETE_FIX));
-	let members;
-	if (kindOf$3(address) === "group") {
-		const archived = own$2(input.archivedProperties, key);
-		if (archived === void 0) return noted(blocked(address, "delete", "unsupported", "members unknown", `the archived properties of ${key} were not read, so whether any names this group is unknown`));
-		members = {
-			active: own$2(observation.members?.[key] ?? {}, name) ?? [],
-			archived: archived.filter((p) => p.groupName === name).map((p) => p.name),
-			deleted: deleted.get(key) ?? /* @__PURE__ */ new Set()
-		};
-	}
+	const members = kindOf$3(address) === "group" ? {
+		active: own$2(observation.members?.[key] ?? {}, name) ?? [],
+		deleted: deleted.get(key) ?? /* @__PURE__ */ new Set()
+	} : void 0;
 	const block = deleteBlock(observation.meta?.[address], members);
 	if (block) return noted(blocked(address, "delete", "unsupported", block.short, block.detail, block.fix));
 	if (!policy.allowDestroy) return noted(blocked(address, "delete", "policy", "deletes not allowed", `takeover archives ${name}, and target ${target} does not allow deletes`, `keep it in config: run ${pullCommand(target, address)}; or leave it unmanaged: add '${name}' to objects.${key}.exclude; or archive it: set allowDestroy: true under targets.${target} in kalup.config.ts`));
@@ -7391,16 +7434,10 @@ function destroy(context, address, entry, deleted) {
 	const key = objectOf(address);
 	if (!observed.managed) return blocked(address, "delete", "unsupported", "HubSpot-defined or calculated", "HubSpot-defined or calculated in this portal, so Kalup does not delete it");
 	const name = portalName$1(context, address);
-	let members;
-	if (kindOf$3(address) === "group") {
-		const archived = own$2(input.archivedProperties, key);
-		if (archived === void 0) return blocked(address, "delete", "unsupported", "members unknown", `the archived properties of ${key} were not read, so whether any names this group is unknown`);
-		members = {
-			active: own$2(input.observation.members?.[key] ?? {}, name) ?? [],
-			archived: archived.filter((p) => p.groupName === name).map((p) => p.name),
-			deleted: deleted.get(key) ?? /* @__PURE__ */ new Set()
-		};
-	}
+	const members = kindOf$3(address) === "group" ? {
+		active: own$2(input.observation.members?.[key] ?? {}, name) ?? [],
+		deleted: deleted.get(key) ?? /* @__PURE__ */ new Set()
+	} : void 0;
 	const block = deleteBlock(input.observation.meta?.[address], members);
 	if (block) return blocked(address, "delete", "unsupported", block.short, block.detail, block.fix);
 	if (!policy.allowDestroy) return blocked(address, "delete", "policy", "deletes not allowed", `target ${input.target} does not allow deletes`, `set allowDestroy: true under targets.${input.target} in kalup.config.ts, or change the tombstone's action to release`);
@@ -7887,7 +7924,7 @@ function recordObject(out, address, resource) {
 	else out.unsupported.push(address);
 }
 function needsArchived(step) {
-	return step.action === "create" && kindOf$2(step.address) === "property" || step.action === "delete";
+	return step.action === "create" && kindOf$2(step.address) === "property";
 }
 async function checkBindings(plan, read, overrides) {
 	const effects = plan.steps.filter(hasEffect);
@@ -8466,7 +8503,7 @@ function writeRefusal(step, trusted, observation) {
 	if (unsupported || observed?.managed === false) return unsupported ? "Kalup does not write this kind of property" : "it is HubSpot-defined or calculated";
 	const units = unitsOf$1(step, trusted, observed);
 	const written = (step.changes ?? []).map((c) => c.unit);
-	return writeBlock(kindOf$1(step.address), units, written, observation.meta[step.address], observed)?.detail;
+	return writeBlock(kindOf$1(step.address), units, written, observation.meta[step.address])?.detail;
 }
 function deleteRefusal(plan, step, { owner, overrides }, observation) {
 	const takeover = step.labels?.includes("takeover") === true;
@@ -8483,14 +8520,11 @@ function deleteRefusal(plan, step, { owner, overrides }, observation) {
 		const kept = takeover ? keptByRead(overrides, plan.target.name, step.address, observed, observation.schemaNamed[key] ?? []) : void 0;
 		return kept === void 0 ? deleteBlock(observation.meta[step.address])?.detail : `takeover never archives it: ${kept}`;
 	}
-	const archived = observation.archived[key];
-	if (archived === void 0) return `the archived properties of ${key} were not read`;
 	const name = names.portalName(step.address);
 	if (takeover && (observation.members[key]?.[name] ?? []).length === 0) return "it held no property when apply read it, and HubSpot marks no group as its own, so takeover never archives an empty group";
 	const deleted = new Set(runOrder(plan).filter((s) => s.action === "delete" && kindOf$1(s.address) === "property" && objectOf(s.address) === key).map((s) => names.portalName(s.address)));
 	return deleteBlock(void 0, {
 		active: observation.members[key]?.[name] ?? [],
-		archived: archived.filter((p) => p.groupName === name).map((p) => p.name),
 		deleted
 	})?.detail;
 }
@@ -8673,6 +8707,8 @@ const LINE_MAX$1 = 1e3;
 const SCOPE = /the scope (\S+)\./;
 const TEXT_MAX = 400;
 const USES = /used in (\d+) places?/;
+const USES_SHOWN = 5;
+const USE_MAX = 60;
 /** Thrown by a request made after the signal aborted. */
 var Stopped = class extends Error {};
 /**
@@ -9078,13 +9114,32 @@ function rejected(run, step, sent) {
 	};
 }
 function refusal(run, step, sent, plan, otherwise) {
+	if (sent.status === 403 && sent.message.includes("sensitive-data-property-create")) {
+		const key = objectOf(step.address);
+		const object = STANDARD_OBJECTS.has(key) ? key : "custom";
+		const level = step.desired?.dataSensitivity === "highly_sensitive" ? "highly_sensitive" : "sensitive";
+		return {
+			why: `HubSpot refuses the create because the key lacks the sensitive data scope for ${key}`,
+			fix: `add the scope crm.objects.${object}.${level}.write to the write key, then run ${plan}`
+		};
+	}
 	const reason = reasonOf(sent);
+	if (reason === "PORTAL_NOT_ENABLED_FOR_SENSITIVE_DATA") return {
+		why: "HubSpot has sensitive data turned off for this portal",
+		fix: `turn it on under Settings > Privacy & Consent > Sensitive data, then run ${plan}`
+	};
+	if (reason === "ONLY_CURRENCY_PROPERTIES_CAN_SPECIFY_CURRENCY") return {
+		why: `HubSpot never turns showCurrencySymbol off once ${portalName(run, step)} had a currencyPropertyName`,
+		fix: `keep showCurrencySymbol: true, or migrate to a new property under another name, then run ${plan}`
+	};
 	if (reason === "CANNOT_DELETE_PROPERTY_IN_USE") {
-		const count = USES.exec(sent.message)?.[1];
+		const count = sent.context?.usageCount?.[0] ?? USES.exec(sent.message)?.[1];
 		const counted = count === void 0 ? "" : ` (HubSpot counts ${count} use${count === "1" ? "" : "s"})`;
+		const uses = usesOf(sent);
+		const where = uses.length === 0 ? "" : ` (${uses.join(", ")})`;
 		return {
 			why: `HubSpot refuses to archive ${portalName(run, step)} because it is in use${counted}`,
-			fix: `remove those uses in HubSpot first, then run ${plan}`
+			fix: `remove those uses in HubSpot first${where}, then run ${plan}`
 		};
 	}
 	if (reason === "GROUP_WITH_ACTIVE_PROPERTIES") return {
@@ -9097,6 +9152,13 @@ function refusal(run, step, sent, plan, otherwise) {
 	};
 	return otherwise;
 }
+function usesOf(sent) {
+	const uses = (sent.errors ?? []).filter((e) => e.subCategory?.endsWith("PROPERTY_USAGE")).map((e) => {
+		return sanitize(`${(e.context?.parentDisplayType?.[0] ?? e.context?.parentType?.[0] ?? "use").toLowerCase().replaceAll("_", " ")} ${e.context?.parentName?.[0] ?? ""}`.trim(), USE_MAX);
+	});
+	const rest = uses.length - USES_SHOWN;
+	return rest > 0 ? [...uses.slice(0, USES_SHOWN), `and ${rest} more`] : uses;
+}
 function reasonOf(sent) {
 	return sent.subCategory?.split(".").at(-1);
 }
@@ -12507,6 +12569,28 @@ function pick$4(d, fields) {
 function own(record, key) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
+/** The key's scopes, or undefined when HubSpot refused the request, gave no answer, or answered without a scope list. */
+async function readTokenInfo(http, key) {
+	let answer;
+	try {
+		answer = await http.request({
+			type: "tokenInfo",
+			path: "read",
+			body: { tokenKey: key }
+		});
+	} catch (error) {
+		if (error instanceof KalupError) return;
+		throw error;
+	}
+	const scopes = typeof answer === "object" && answer !== null ? answer.scopes : void 0;
+	if (!(Array.isArray(scopes) && scopes.every((scope) => typeof scope === "string"))) return;
+	return { scopes: scopes.map((scope) => sanitize(scope)) };
+}
+/** Whether `held` names `scope`, as is or with a version suffix HubSpot adds (`.sensitive.write.v2`). */
+function holdsScope(held, scope) {
+	return held.some((name) => name === scope || name.replace(VERSION_SUFFIX, "") === scope);
+}
+const VERSION_SUFFIX = /\.v\d+$/;
 /**
 * The target for `requested`, the name a command was given, or the reason there is none. An unknown requested name
 * never falls back to the default, and the first of several targets is never chosen. Choices are in declaration order.
@@ -12643,7 +12727,7 @@ function projectLayout(root) {
 		code: "E_DIR_AMBIGUOUS",
 		message: `both ${DEFAULT_DIR}/ and ${LEGACY_DIR}/ hold .ts files, and ${configFile} does not say which one holds the object files`,
 		file: configFile,
-		fix: `add dir: '${LEGACY_DIR}' to ${configFile} to keep the 0.1 folder, or dir: '${DEFAULT_DIR}' when the object files are there`
+		fix: `add dir: '${LEGACY_DIR}' to ${configFile} to keep the old folder, or dir: '${DEFAULT_DIR}' when the object files are there`
 	}, exitCodes.invalid);
 }
 function holdsTs(dir) {
@@ -16361,19 +16445,23 @@ async function status(ctx) {
 		});
 	};
 	const names = ctx.flags.target === void 0 ? Object.keys(loaded.config.targets) : [ctx.flags.target];
+	const recommended = {
+		scope: limitScope(Object.keys(loaded.config.objects)),
+		neededFor: ["the property limit check in plan"]
+	};
+	const writeScopes = scopeLines(Object.keys(loaded.config.objects), "write");
+	const wanted = {
+		recommended,
+		writeScopes
+	};
 	const targets = [];
-	for (const name of names) targets.push(await checkTarget(root, name, loaded, found, warn));
+	for (const name of names) targets.push(await checkTarget(root, name, loaded, wanted, found, warn));
 	found.push(...pinWarnings(Object.values(registry)));
 	const counts = {
 		objects: Object.keys(loaded.config.objects).length,
 		properties: count(loaded.ir, "property"),
 		groups: count(loaded.ir, "group")
 	};
-	const recommended = {
-		scope: limitScope(Object.keys(loaded.config.objects)),
-		neededFor: ["the property limit check in plan"]
-	};
-	const writeScopes = scopeLines(Object.keys(loaded.config.objects), "write");
 	const exitCode = exitCodeOf(targets);
 	const lines = [
 		`${bin} ${version}`,
@@ -16396,7 +16484,7 @@ async function status(ctx) {
 		text: `${lines.join("\n")}\n`
 	};
 }
-async function checkTarget(root, name, loaded, issues, warn) {
+async function checkTarget(root, name, loaded, wanted, issues, warn) {
 	const target = loaded.config.targets[name] ?? {};
 	const keyVariable = target.credentials?.read.env ?? "HUBSPOT_SERVICE_KEY";
 	const writeVariable = target.credentials?.write?.env ?? keyVariable;
@@ -16425,9 +16513,11 @@ async function checkTarget(root, name, loaded, issues, warn) {
 		write
 	};
 	let http;
+	let key;
 	try {
+		({key} = resolveReadKey(target, root));
 		http = createHttp({
-			key: resolveReadKey(target, root).key,
+			key,
 			warn
 		});
 	} catch (error) {
@@ -16445,7 +16535,35 @@ async function checkTarget(root, name, loaded, issues, warn) {
 	}
 	out.protected = policyOf(target, out.account.accountType).protected;
 	out.protectedBy = target.protected === void 0 ? "default" : "config";
+	let info;
+	try {
+		info = await readTokenInfo(http, key);
+	} catch (error) {
+		return fail(out, "unreachable", error, issues);
+	}
 	for (const probe of probes(loaded)) out.scopes.push(await checkScope(http, probe, issues));
+	if (info !== void 0) out.keyScopes = keyScopesOf(info.scopes, out, wanted, issues);
+	return out;
+}
+function keyScopesOf(held, t, wanted, issues) {
+	const { recommended, writeScopes } = wanted;
+	const out = {
+		held,
+		recommended: {
+			...recommended,
+			ok: holdsScope(held, recommended.scope)
+		}
+	};
+	if (t.write.separate) return out;
+	out.write = writeScopes.map((line) => ({
+		...line,
+		ok: holdsScope(held, line.scope)
+	}));
+	for (const missing of out.write.filter((s) => !s.ok)) issues.push({
+		code: "W_WRITE_SCOPE",
+		message: `the key in ${t.keyVariable} does not hold ${missing.scope}, which apply needs for ${missing.neededFor.join(", ")}`,
+		fix: `add the scope ${missing.scope} to the key`
+	});
 	return out;
 }
 async function checkScope(http, probe, issues) {
@@ -16570,18 +16688,21 @@ function describe(root, t, recommended, writeScopes) {
 	const a = t.account;
 	const scopes = t.scopes.map(scopeText);
 	const why = t.protectedBy === "default" ? ` (${a?.accountType} account, default)` : "";
+	const limit = t.keyScopes === void 0 ? ", not checked" : checkedText(t.keyScopes.recommended.ok);
 	return [
 		`${head}: portal ${t.portalId} matches, ${a?.accountType}, ${a?.uiDomain}, ${a?.timeZone}, protected: ${t.protected ? "yes" : "no"}${why}`,
 		`  Scopes: ${scopes.length > 0 ? scopes.join(", ") : "none needed"}`,
-		`  Also recommended: ${recommended}, not checked (the property limit check in plan)`,
+		`  Also recommended: ${recommended}${limit} (the property limit check in plan)`,
 		writeLine(t, writeScopes),
 		stateLine(root, t.state)
 	];
 }
 function writeLine(t, writeScopes) {
-	const scopes = writeScopes.map((s) => s.scope).join(", ");
+	const checked = t.keyScopes?.write;
+	const scopes = checked === void 0 ? writeScopes.map((s) => s.scope).join(", ") : checked.map((s) => `${s.scope} ${s.ok ? "ok" : "missing"}`).join(", ");
 	const needs = t.write.separate ? `, which needs the read scopes and ${scopes}` : `, which also needs ${scopes}`;
-	return `  Write: apply uses ${t.write.keyVariable}${scopes === "" ? "" : `${needs}, not checked`}`;
+	const tail = checked === void 0 ? ", not checked" : "";
+	return `  Write: apply uses ${t.write.keyVariable}${scopes === "" ? "" : `${needs}${tail}`}`;
 }
 function stateLine(root, state) {
 	const rel = relative(root, state.path);
@@ -16594,6 +16715,9 @@ function stateLine(root, state) {
 	else if (last) applied = `plan ${sanitize(last.planId)} at ${sanitize(last.at)}, ${last.outcome}`;
 	return `  State: ${path}, lineage ${state.lineage}, serial ${state.serial}. Last apply: ${applied}`;
 }
+function checkedText(ok) {
+	return ok ? " ok" : " missing";
+}
 function scopeText(s) {
 	if (s.ok) return `${s.scope} ok`;
 	return s.error ? `${s.scope} failed (${s.error})` : `${s.scope} missing (needed for ${s.neededFor.join(", ")})`;
@@ -16868,7 +16992,7 @@ var FmtCommand = class extends KalupCommand {
 	static flags = {
 		check: Flags.boolean({ summary: "Report what would change, write nothing, and exit 2 when a file would change." }),
 		"exit-code": Flags.boolean({
-			summary: "Accepted for 0.1 scripts: --check exits 2 on changes already.",
+			summary: "Accepted for older scripts: --check exits 2 on changes already.",
 			hidden: true
 		})
 	};

package/dist/commands.d.mts

@@ -1,4 +1,4 @@
-import { n as Prompter, r as Result, t as Handler } from "./context-8pARDYRR.mjs";
+import { n as Prompter, r as Result, t as Handler } from "./context-C1tH5K0x.mjs";
 import { Command } from "@oclif/core";
 //#region src/host/commands.d.ts
 /**

package/dist/commands.mjs

@@ -1,2 +1,2 @@
-import { _ as TargetRebindCommand, a as CompareCommand, c as InitCommand, d as PlanCommand, f as PullCommand, g as StatusCommand, h as StateRebuildCommand, i as COMMANDS, l as IrCommand, m as SnapshotCommand, n as ApplyCommand, o as DocsCommand, p as RmCommand, r as BlueprintUpgradeCommand, s as FmtCommand, t as AddCommand, u as KalupCommand, v as ValidateCommand } from "./commands-Bk1w1oup.mjs";
+import { _ as TargetRebindCommand, a as CompareCommand, c as InitCommand, d as PlanCommand, f as PullCommand, g as StatusCommand, h as StateRebuildCommand, i as COMMANDS, l as IrCommand, m as SnapshotCommand, n as ApplyCommand, o as DocsCommand, p as RmCommand, r as BlueprintUpgradeCommand, s as FmtCommand, t as AddCommand, u as KalupCommand, v as ValidateCommand } from "./commands-T4j_GVBD.mjs";
 export { AddCommand, ApplyCommand, BlueprintUpgradeCommand, COMMANDS, CompareCommand, DocsCommand, FmtCommand, InitCommand, IrCommand, KalupCommand, PlanCommand, PullCommand, RmCommand, SnapshotCommand, StateRebuildCommand, StatusCommand, TargetRebindCommand, ValidateCommand };

package/dist/{context-8pARDYRR.d.mts → context-C1tH5K0x.d.mts}

@@ -1237,6 +1237,16 @@ declare const issues: {
       output: string[];
     };
   };
+  W_WRITE_SCOPE: {
+    exit: string;
+    title: string;
+    summary: string;
+    when: string[];
+    fix: string[];
+    example: {
+      output: string[];
+    };
+  };
 };
 type IssueCode = keyof typeof issues;
 /** One entry of a command's issues[], as the envelope contract defines it. */

package/dist/{host-BoqS00po.mjs → host-CDDeLV5T.mjs}

@@ -1,4 +1,4 @@
-import { A as sanitize, C as usageError, D as disclaimer, E as bin, O as escapeJson, S as versionText, T as KalupError, b as formats, k as exitCodes, u as KalupCommand, w as IssueError, x as version, y as PATH_MAX } from "./commands-Bk1w1oup.mjs";
+import { A as sanitize, C as usageError, D as disclaimer, E as bin, O as escapeJson, S as versionText, T as KalupError, b as formats, k as exitCodes, u as KalupCommand, w as IssueError, x as version, y as PATH_MAX } from "./commands-T4j_GVBD.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/host.d.mts

@@ -1,4 +1,4 @@
-import { i as ExitCode, n as Prompter, r as Result } from "./context-8pARDYRR.mjs";
+import { i as ExitCode, n as Prompter, r as Result } from "./context-C1tH5K0x.mjs";
 //#region src/host/host.d.ts
 interface Out {
   write: (text: string) => unknown;

package/dist/host.mjs

@@ -1,2 +1,2 @@
-import { n as isInteractive, r as run, t as execute } from "./host-BoqS00po.mjs";
+import { n as isInteractive, r as run, t as execute } from "./host-CDDeLV5T.mjs";
 export { execute, isInteractive, run };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isInteractive, r as run } from "./host-BoqS00po.mjs";
+import { n as isInteractive, r as run } from "./host-CDDeLV5T.mjs";
 //#region src/index.ts
 process.exitCode = await run(process.argv.slice(2), {
 	cwd: process.cwd(),

package/docs/apply.md

@@ -61,4 +61,4 @@ There is no resume and no rollback. After a run that did not finish, run `kalup
 
 ## Limits
 
-A read and the write after it are not atomic: an edit in HubSpot between the two is overwritten for that field. The lock keeps apart one user's commands on one machine only; in CI, one workflow per portal applies, in a concurrency group. A delete checks no use first; HubSpot refused to archive a property a calculation property used (developer test account, 2026-09-29).
+A read and the write after it are not atomic: an edit in HubSpot between the two is overwritten for that field. The lock keeps apart one user's commands on one machine only; in CI, one workflow per portal applies, in a concurrency group. A delete checks no use first; HubSpot refuses to archive a property a workflow, list, form or calculation uses, and apply names each use.

package/docs/config.md

@@ -56,7 +56,7 @@ A definition with `label`, `group` and `fieldType` is managed: the fields presen
 - On `p.string`, `p.stringArray`, `p.json` and `p.phoneNumber`: `textDisplayHint` (`unformatted_single_line`, `multi_line`, `email`, `phone_number`, `domain_name`, `ip_address`, `physical_address`, `postal_code`). HubSpot takes no value that removes a hint.
 - `calculationFormula` with `fieldType: 'calculation_equation'`, in HubSpot's formula syntax. HubSpot stores its own spelling (`a+1` as `a + 1`); write it as pull does, or plan notes the difference. A formula change is risky.
 
-A field another builder or field rules out is `E_DEFINITION_FIELD`. HubSpot ignores `dateDisplayHint`, so it is no field. `group` must name a group declared under `groups` for the same object, in any export or file (`E_UNKNOWN_GROUP`). A managed internal name starting with `hs_` is `E_HS_PREFIX`.
+A field another builder or field rules out is `E_DEFINITION_FIELD`. HubSpot ignores `dateDisplayHint`, so it is no field. `group` must name a group declared under `groups` for the same object, in any export or file (`E_UNKNOWN_GROUP`). A managed internal name starting with `hs_` or `a<digits>_` is `E_HS_PREFIX`: HubSpot reserves `hs_` for its own properties and `a<appId>_` for an integration's, and refuses a create with either. A reference may carry the prefix, and pull writes such properties as references.
 
 No definition makes a reference: never created, changed or removed. `p.enum` or `p.multiEnum` with `options` and nothing else is a reference with typed options, which pull refreshes.
 

package/docs/errors/E_BLUEPRINT_SCHEMA.md

@@ -4,7 +4,7 @@ A blueprint is not a valid `blueprint/1` document. Exit 1. Nothing was written.
 
 ## When
 
-`kalup add` and `kalup blueprint upgrade` parse the source as JSON, never as code. Another `blueprintVersion` is refused first. Then they check `blueprint-1.schema.json` and the rules the schema cannot state: addresses of the form `group:<object>/<name>` or `property:<object>/<name>` that match their type, plain names that never start with `hs_` (a group `$ref` names a plain group too), unique option values, aliases that name an option, and a codec that fits the HubSpot type and field type. Text that is not JSON or UTF-8 is refused, and so are names a prefix makes invalid. Each issue names its path; quoted text is sanitized.
+`kalup add` and `kalup blueprint upgrade` parse the source as JSON, never as code. Another `blueprintVersion` is refused first. Then they check `blueprint-1.schema.json` and the rules the schema cannot state: addresses of the form `group:<object>/<name>` or `property:<object>/<name>` that match their type, plain names that never start with a prefix HubSpot reserves, `hs_` or `a<digits>_` (a group `$ref` names a plain group too), unique option values, aliases that name an option, and a codec that fits the HubSpot type and field type. Text that is not JSON or UTF-8 is refused, and so are names a prefix makes invalid. Each issue names its path; quoted text is sanitized.
 
 ## Fix
 
@@ -13,5 +13,5 @@ A blueprint is third-party data: ask its author for a version that passes, `blue
 ## Example
 
 ```
-E_BLUEPRINT_SCHEMA: property name 'hs_renewal_flag' starts with hs_, the prefix HubSpot uses for its own names (fix: a blueprint is third-party data: ask its author for a version that passes, or fix your own copy of the file) (docs: errors/E_BLUEPRINT_SCHEMA.md)
+E_BLUEPRINT_SCHEMA: property name 'hs_renewal_flag' starts with hs_, a prefix HubSpot reserves (fix: a blueprint is third-party data: ask its author for a version that passes, or fix your own copy of the file) (docs: errors/E_BLUEPRINT_SCHEMA.md)
 ```

package/docs/errors/E_DEFINITION_FIELD.md

@@ -8,7 +8,7 @@ A property definition states a field HubSpot would refuse or misread for this pr
 
 - `numberDisplayHint`, `showCurrencySymbol` and `currencyPropertyName` belong to `p.number`, and `textDisplayHint` to `p.string`, `p.stringArray`, `p.json` and `p.phoneNumber`. HubSpot stores them on any property but shows them only on those.
 - `calculationFormula` needs `fieldType: 'calculation_equation'`. Sent with another field type, HubSpot turns the property into a calculation.
-- `currencyPropertyName` needs `showCurrencySymbol: true`. HubSpot refuses it otherwise (`ONLY_CURRENCY_PROPERTIES_CAN_SPECIFY_CURRENCY`).
+- `currencyPropertyName` needs `showCurrencySymbol: true`. HubSpot refuses it otherwise (`ONLY_CURRENCY_PROPERTIES_CAN_SPECIFY_CURRENCY`), and an empty `''` is refused by Kalup: HubSpot stores it as a value and then never turns the symbol off again (live runs, 2026-10-01).
 - `displayOrder` is an integer from -1 up.
 - `p.owner` takes no `options`: HubSpot fills them with the account's users and refuses a create that sends any.
 

package/docs/errors/E_DIR_AMBIGUOUS.md

@@ -1,17 +1,17 @@
 # E_DIR_AMBIGUOUS
 
-Both `hubspot/` and the 0.1 folder `kalup/` hold .ts files, and `kalup.config.ts` does not say which one holds the object files. Exit 3. Nothing was read or written.
+Both `hubspot/` and the old default folder `kalup/` hold .ts files, and `kalup.config.ts` does not say which one holds the object files. Exit 3. Nothing was read or written.
 
 ## When
 
-Without `dir` in `kalup.config.ts`, Kalup reads `hubspot/`, or a 0.1 project's `kalup/` while `hubspot/` holds no .ts file (`W_LEGACY_DIR`). When both hold .ts files, such as a half-done move or a HubSpot developer project in `hubspot/`, Kalup does not guess: reading the wrong folder would make everything in the other look removed from config.
+Without `dir` in `kalup.config.ts`, Kalup reads `hubspot/`, or an older project's `kalup/` while `hubspot/` holds no .ts file (`W_LEGACY_DIR`). When both hold .ts files, such as a half-done move or a HubSpot developer project in `hubspot/`, Kalup does not guess: reading the wrong folder would make everything in the other look removed from config.
 
 ## Fix
 
-Add `dir: 'kalup'` to `kalup.config.ts` to keep the 0.1 folder, or `dir: 'hubspot'` when the object files are there. Then move or remove the other folder's copy of the object files.
+Add `dir: 'kalup'` to `kalup.config.ts` to keep the old folder, or `dir: 'hubspot'` when the object files are there. Then move or remove the other folder's copy of the object files.
 
 ## Example
 
 ```
-kalup.config.ts: E_DIR_AMBIGUOUS: both hubspot/ and kalup/ hold .ts files, and kalup.config.ts does not say which one holds the object files (fix: add dir: 'kalup' to kalup.config.ts to keep the 0.1 folder, or dir: 'hubspot' when the object files are there) (docs: errors/E_DIR_AMBIGUOUS.md)
+kalup.config.ts: E_DIR_AMBIGUOUS: both hubspot/ and kalup/ hold .ts files, and kalup.config.ts does not say which one holds the object files (fix: add dir: 'kalup' to kalup.config.ts to keep the old folder, or dir: 'hubspot' when the object files are there) (docs: errors/E_DIR_AMBIGUOUS.md)
 ```

package/docs/errors/E_HS_PREFIX.md

@@ -1,10 +1,10 @@
 # E_HS_PREFIX
 
-A managed property's internal name starts with `hs_`. Exit 3.
+A managed property's internal name starts with `hs_` or `a<digits>_`. Exit 3.
 
 ## When
 
-HubSpot uses `hs_` for its own properties. Kalup never claims that prefix for a property it would own. Whether HubSpot refuses such a create is not confirmed. A reference (no definition) may carry the prefix.
+HubSpot reserves `hs_` for its own properties and `a<appId>_` for an integration's, and refuses a create with either (400, live runs 2026-10-01). Kalup never claims those prefixes for a property it would own; `pull` writes such a property as a reference. A reference (no definition) may carry the prefix.
 
 ## Fix
 
@@ -17,5 +17,5 @@ plotCount: p.number('hs_plot_count', { label: 'Plot count', group: 'orchard', fi
 ```
 
 ```
-hubspot/objects/companies.ts:9: E_HS_PREFIX: 'hs_plot_count' starts with hs_, the prefix HubSpot uses for its own properties (fix: rename the property, or drop label, group and fieldType to reference it) (docs: errors/E_HS_PREFIX.md)
+hubspot/objects/companies.ts:9: E_HS_PREFIX: 'hs_plot_count' starts with hs_, a prefix HubSpot reserves (hs_ for its own properties, a<digits>_ for an integration's) (fix: rename the property, or drop label, group and fieldType to reference it) (docs: errors/E_HS_PREFIX.md)
 ```

package/docs/errors/E_HTTP.md

@@ -4,7 +4,7 @@ HubSpot returned an error Kalup has no other code for. Exit 1.
 
 ## When
 
-A 400, a 404, a 5xx that three retries did not clear, or a success whose body is not JSON (often a proxy's HTML page). The issue holds the status, the method, the path and HubSpot's message when it sent one. In `apply`, a refusal whose reason HubSpot names and Kalup knows says it in plain words: a property in use, a group that still holds properties, or a property name that exists.
+A 400, a 404, a 5xx that three retries did not clear, or a success whose body is not JSON (often a proxy's HTML page). The issue holds the status, the method, the path and HubSpot's message when it sent one. In `apply`, a refusal whose reason HubSpot names and Kalup knows says it in plain words: a property in use (each workflow, list, form or calculation named), a group that still holds active properties, a property name that exists, a currency symbol HubSpot never turns off again, or a sensitive property on a portal with sensitive data turned off.
 
 ## Fix
 

package/docs/errors/E_PULL_INVALID.md

@@ -6,7 +6,7 @@ The files `pull` merged would not load or validate, so it wrote nothing. Exit 3,
 
 Pull merges the portal into the object files, then loads and validates the whole project as it would write it, before saving anything. The issues after this one are what `validate` would report, with the file and line in the merged text, not the file on disk.
 
-Two examples: a property HubSpot does not define whose name starts with `hs_` (`E_HS_PREFIX`), and a new property whose key is taken twice (`E_DUPLICATE_KEY`).
+An example: a new property whose internal name another key of the same object already uses (`E_DUPLICATE_KEY`).
 
 ## Fix
 
@@ -16,5 +16,5 @@ Change the portal or the file so the two agree, then pull again. To pull everyth
 
 ```
 E_PULL_INVALID: the pulled project would not validate; nothing was written (fix: the issues that follow point at the files as pull would write them: change the portal or the file so they agree, or leave the resource out with --only) (docs: errors/E_PULL_INVALID.md)
-hubspot/objects/companies.ts:20: E_HS_PREFIX: 'hs_orchard_score' starts with hs_, the prefix HubSpot uses for its own properties (fix: rename the property, or drop label, group and fieldType to reference it) (docs: errors/E_HS_PREFIX.md)
+hubspot/objects/companies.ts:20: E_DUPLICATE_KEY: internal name 'plot_count' is used by two keys of Company: 'plotCount' and 'plotTotal' (fix: remove or rename one of the two entries) (docs: errors/E_DUPLICATE_KEY.md)
 ```

package/docs/errors/W_LEGACY_DIR.md

@@ -4,7 +4,7 @@ A warning from every command that reads the project: the object files are in `ka
 
 ## When
 
-Kalup 0.2 keeps the object files in the folder `dir` in `kalup.config.ts` names, `hubspot/` by default. When `dir` is not set, `kalup/` holds .ts files and `hubspot/` holds none, Kalup keeps reading and writing `kalup/` and warns once per command. When both hold .ts files it stops with `E_DIR_AMBIGUOUS` instead.
+Kalup keeps the object files in the folder `dir` in `kalup.config.ts` names, `hubspot/` by default. When `dir` is not set, `kalup/` holds .ts files and `hubspot/` holds none, Kalup keeps reading and writing `kalup/` and warns once per command. When both hold .ts files it stops with `E_DIR_AMBIGUOUS` instead.
 
 ## Fix
 
@@ -13,5 +13,5 @@ Add `dir: 'kalup'` to `kalup.config.ts` to keep the folder, or move `kalup/` to
 ## Example
 
 ```
-kalup.config.ts: W_LEGACY_DIR: the object files are in kalup/, the folder Kalup 0.1 used; the default is now hubspot/ (fix: add dir: 'kalup' to kalup.config.ts, or move kalup/ to hubspot/) (docs: errors/W_LEGACY_DIR.md)
+kalup.config.ts: W_LEGACY_DIR: the object files are in kalup/, the old default folder; the default is now hubspot/ (fix: add dir: 'kalup' to kalup.config.ts, or move kalup/ to hubspot/) (docs: errors/W_LEGACY_DIR.md)
 ```

package/docs/errors/W_LIMIT_UNREADABLE.md

@@ -4,11 +4,11 @@ A warning from `plan`, and from `apply` without a plan file: the plan creates pr
 
 ## When
 
-Before it plans a property create, `plan` reads HubSpot's Limits Tracking API for the custom property limit (W_LIMIT_HEADROOM). On a developer test account (2026-09-29) that read answered 403 to a key with `crm.schemas.*` scopes only. The message gives HubSpot's status, or the issue code for another error or a 200 without a limit and a usage (`E_HTTP`). A create past the limit then fails in `apply` instead of being blocked in the plan.
+Before it plans a property create, `plan` reads HubSpot's Limits Tracking API for the custom property limit (W_LIMIT_HEADROOM). That read answers 403 to a key with `crm.schemas.*` scopes only, and 200 once the key holds one `crm.objects.<object>.read` scope of any object (live runs, 2026-09-29 and 2026-10-01). The message gives HubSpot's status, or the issue code for another error or a 200 without a limit and a usage (`E_HTTP`). A create past the limit then fails in `apply` instead of being blocked in the plan.
 
 ## Fix
 
-Add a `crm.objects.<object>.read` scope to the key, such as `crm.objects.companies.read` (Development > Keys > Service keys); it also lets the key read that object's records, which Kalup never requests. Whether one such scope is enough is not yet confirmed live.
+Add a `crm.objects.<object>.read` scope to the key, such as `crm.objects.companies.read` (Development > Keys > Service keys); it also lets the key read that object's records, which Kalup never requests. One such scope, of any object, is enough for every Limits Tracking reading.
 
 ## Example
 

package/docs/errors/W_RATE_HEADERS.md

@@ -8,7 +8,7 @@ From `status`: HubSpot sent no rate-limit headers, so Kalup sends at most 8 requ
 
 From `plan`: HubSpot sent no daily figure, or one that is not a whole number of requests (empty, fractional, negative), so `budget.dailyRemaining` is `null` and the plan cannot weigh its calls against the daily limit. From `apply`: the same, so it cannot refuse a run that would use more than half of what is left (`E_BUDGET`).
 
-A service key's answers carried the daily headers on a developer test account (2026-09-29). Other account types are not confirmed, so this warning may still appear.
+A service key's answers carry the daily headers (live runs, 2026-09-29 and 2026-10-01), so this warning is not expected with one; the fallback stays for an answer without them.
 
 ## Fix
 

package/docs/errors/W_RATE_LIMIT.md

@@ -4,7 +4,7 @@ A warning from `pull`, `plan`, `snapshot` or `compare`: HubSpot sent no rate-lim
 
 ## When
 
-Kalup paces requests from HubSpot's rate-limit headers. Without them it sends at most 8 requests per second. A service key's answers carried them on a developer test account (2026-09-29); other account types are not confirmed. `status` reports the same thing as W_RATE_HEADERS.
+Kalup paces requests from HubSpot's rate-limit headers. Without them it sends at most 8 requests per second. A service key's answers carry them (live runs, 2026-09-29 and 2026-10-01), so this warning is not expected with one. `status` reports the same thing as W_RATE_HEADERS.
 
 ## Fix
 

package/docs/errors/W_WRITE_SCOPE.md

@@ -0,0 +1,17 @@
+# W_WRITE_SCOPE
+
+A warning from `status`: HubSpot's token introspection lists the read key's scopes, and a write scope apply needs is not among them. Exit stays 0.
+
+## When
+
+`status` reads the scopes a service key holds through HubSpot's token introspection (the key goes in the request body, as HubSpot requires) and checks the write scopes `init` lists against them by name, when apply writes with the same key. A separate write key is never resolved or sent, so its scopes stay unchecked and the line says so. When introspection answers nothing, status checks no write scope.
+
+## Fix
+
+Add the scope the message names to the key (Development > Keys > Service keys), then run `kalup status` again.
+
+## Example
+
+```
+W_WRITE_SCOPE: the key in HUBSPOT_SANDBOX_KEY does not hold crm.schemas.companies.write, which apply needs for companies (fix: add the scope crm.schemas.companies.write to the key) (docs: errors/W_WRITE_SCOPE.md)
+```

package/docs/plan.md

@@ -10,7 +10,7 @@ This page is the reference. For the walk-through with examples, see [kalup plan]
 2. The read key, then the portal guard (`E_TARGET_PORTAL_MISMATCH`, exit 4).
 3. State for that portal, `.kalup/state/portal-<portalId>.json`; an unusable file is `E_STATE_INVALID`.
 4. Pull's read and scope, plus tombstoned properties. A 403 leaves that object unread (`E_SCOPE`).
-5. Limits Tracking (403 without a `crm.objects.*` scope, developer test account 2026-09-29; `W_LIMIT_UNREADABLE` for property creates), then the three `archived=true` lists of each object with a property create, an owned property HubSpot no longer holds, or an owned group delete. A 403 there is exit 1.
+5. Limits Tracking (403 without a `crm.objects.*` scope; `W_LIMIT_UNREADABLE` for property creates), then the three `archived=true` lists of each object with a property create or an owned property HubSpot no longer holds. A group delete reads no archived list: only active properties block it. A 403 there is exit 1.
 6. The plan, checked against `plan-1.schema.json` (`E_PLAN_SCHEMA` is a bug).
 
 ## State and the base
@@ -46,10 +46,10 @@ The first rule that matches: a `skip` override (no step, `coverage.excluded`); a
 `hubspot/removed.ts` tombstones name properties and groups:
 
 - `release`: a `release` step drops the entry, even one naming another portal name; nothing is sent.
-- `destroy`, present: a `delete`, risk `destructive`, labelled `existed-before-kalup` for an adopted resource, expecting every base unit's live value. Blocked with `policy` without `allowDestroy: true`, `unsupported` when it is not archivable or a group still holds properties (active or archived) the plan does not delete, `not-owned` without an owning entry.
+- `destroy`, present: a `delete`, risk `destructive`, labelled `existed-before-kalup` for an adopted resource, expecting every base unit's live value. Blocked with `policy` without `allowDestroy: true`, `unsupported` when it is not archivable or a group still holds active properties the plan does not delete (archived ones do not block: HubSpot archives a group once every property in it is archived), `not-owned` without an owning entry.
 - `destroy`, absent by a complete read: a release expecting `exists: false`.
 
-Under takeover (config.md), a `delete` labelled `takeover` archives each custom property and group in the pull scope that config lacks, with a `mode` note naming the statement that asked for it; an option removal takeover asks for carries the note too. One `Takeover on <objects>` heading precedes the first such step and says whether each is confirmed at a terminal or all are blocked. Blocked with `policy` without `allowDestroy`, `scope` after an incomplete read, `unsupported` when not archivable or a group keeps a property. The `policy` fix leads with `kalup pull --target <t> --only <address>`, which keeps it in config, then `exclude` or `lifecycle: { options: 'additive' }` to leave it unmanaged, then `allowDestroy`. A delete expects every captured field's live value. Apply checks the same rules against its own read (a skipped group, a schema's properties, an empty group).
+Under takeover (config.md), a `delete` labelled `takeover` archives each custom property and group in the pull scope that config lacks, with a `mode` note naming the statement that asked for it; an option removal takeover asks for carries the note too. One `Takeover on <objects>` heading precedes the first such step and says whether each is confirmed at a terminal or all are blocked. Blocked with `policy` without `allowDestroy`, `scope` after an incomplete read, `unsupported` when not archivable or a group keeps an active property. The `policy` fix leads with `kalup pull --target <t> --only <address>`, which keeps it in config, then `exclude` or `lifecycle: { options: 'additive' }` to leave it unmanaged, then `allowDestroy`. A delete expects every captured field's live value. Apply checks the same rules against its own read (a skipped group, a schema's properties, an empty group).
 
 Releases follow the config steps, then deletes, the tombstones' and then takeover's, properties before groups.
 

package/docs/targets.md

@@ -38,7 +38,7 @@ The first of several targets is never chosen, and no choice is remembered. Text
 
 `credentials.read.env` names the variable that holds the read key. Without `credentials` it is `HUBSPOT_SERVICE_KEY`, the variable the target `init` writes names. `init` itself needs no key. The key comes from the environment, else from the project's `.env`. A missing key is `E_MISSING_KEY`. No output carries a key.
 
-The key goes out as `Authorization: Bearer`. `init` prints the read scopes the pull scope needs; `status` checks each. Both recommend one `crm.objects.<object>.read` scope too: Limits Tracking answered 403 to `crm.schemas.*` scopes alone and 200 with `crm.objects.companies.read` added (developer test account, 2026-09-29); without it `plan` cannot check the property limit (`W_LIMIT_UNREADABLE`). `credentials.write` names the key apply, `state rebuild --write` and `target rebind` use (apply.md); without it they use the read key. That key needs the read scopes and `crm.schemas.<object>.write` per object (`crm.schemas.custom.write` for custom objects), which `init` and `status` list. Neither checks them: read commands never resolve the write key, and no request can check a write scope.
+The key goes out as `Authorization: Bearer`. `init` prints the read scopes the pull scope needs; `status` checks each. Both recommend one `crm.objects.<object>.read` scope too: Limits Tracking answers 403 to `crm.schemas.*` scopes alone and 200 once one `crm.objects.<object>.read` scope of any object is added; without it `plan` cannot check the property limit (`W_LIMIT_UNREADABLE`). `credentials.write` names the key apply, `state rebuild --write` and `target rebind` use (apply.md); without it they use the read key. That key needs the read scopes and `crm.schemas.<object>.write` per object (`crm.schemas.custom.write` for custom objects), which `init` and `status` list. `status` reads the scopes a key holds through HubSpot's token introspection and checks the recommended scope and, when the write key is the read key, each write scope by name; a separate write key is never resolved by a read command, so its scopes stay unchecked.
 
 ## Overrides
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kalup",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Configuration as code for HubSpot: pull, compare, plan and apply properties and property groups",
   "keywords": [
     "hubspot",
@@ -62,8 +62,8 @@
     }
   },
   "dependencies": {
-    "@oclif/core": "^5.0.0",
-    "@kalup/core": "0.2.0"
+    "@oclif/core": "^5.1.2",
+    "@kalup/core": "0.3.0"
   },
   "engines": {
     "node": ">=22.13.1"