primitive-admin 1.1.0-alpha.47 → 1.1.0-alpha.49

package/dist/src/commands/sync.js

@@ -13,9 +13,12 @@ import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneS
 import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
+import { serializeSection, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
+import { serializeAppSettings, collectAppSettingsPushErrors, } from "./sync-app-settings.js";
 import { applyWorkflowBody } from "../lib/workflow-apply.js";
 import { buildWorkflowPayloadFromToml } from "../lib/workflow-payload.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
+import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, SYNC_RESOURCE_TYPES, applyPrune, attemptFetch, classifyLocalOnly, hasUncommittedChanges, planPrune, preserveUnwrittenEntries, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import { confirmPrompt } from "../lib/confirm-prompt.js";
 import chalk from "chalk";
@@ -238,109 +241,35 @@ export function hashRemoteWorkflowForDiff(workflow, draft, configs) {
     const parsed = parseConfigToml(serialized);
     return hashWorkflowTomlForDiff(parsed);
 }
-// Boolean [auth] keys in app.toml that map 1:1 to app-settings fields.
-const AUTH_BOOLEAN_KEYS = [
-    "googleOAuthEnabled",
-    "passkeyEnabled",
-    "magicLinkEnabled",
-    "appleSignInEnabled",
-    "otpEnabled",
-];
-// Every recognized [auth] key. Single source of truth shared by pull
-// serialization, push parsing, and the unrecognized-key warning so the three
-// never drift apart. `appleAudiences` is a string array and `passkeys` is the
-// passkey RP config object; the rest are booleans.
-const RECOGNIZED_AUTH_KEYS = new Set([
-    ...AUTH_BOOLEAN_KEYS,
-    "appleAudiences",
-    "passkeys",
-]);
 /**
  * Build the [auth] block of app.toml from server settings (pull direction).
  *
- * Apple/OTP fields round-trip alongside the legacy google/passkey/magic-link
- * keys. Two asymmetries are handled deliberately:
- *  - `appleSignInEnabled` comes back as `boolean | null`; smol-toml throws on
- *    null, so an unset value (null) is omitted rather than written.
- *  - `appleAudiences` is omitted when empty. An empty array and an omitted key
- *    both mean "no audiences" (the server normalizes [] -> null), so omitting
- *    an empty list on pull is not lossy.
+ * Thin wrapper over the shared field descriptor
+ * (`cli/src/lib/app-settings-descriptor.ts`), which now owns the [auth] field
+ * set that `AUTH_BOOLEAN_KEYS`/`RECOGNIZED_AUTH_KEYS` used to hard-code. The
+ * descriptor drives all four sections in one place, so pull, push, and the
+ * unrecognized-key warning can never drift apart. `googleClientSecret` is a
+ * secret descriptor entry and is never written.
  */
 export function serializeAuthBlock(settings) {
-    const auth = {
-        googleOAuthEnabled: settings.googleOAuthEnabled,
-        passkeyEnabled: settings.passkeyEnabled,
-        magicLinkEnabled: settings.magicLinkEnabled,
-    };
-    if (typeof settings.appleSignInEnabled === "boolean") {
-        auth.appleSignInEnabled = settings.appleSignInEnabled;
-    }
-    if (Array.isArray(settings.appleAudiences) &&
-        settings.appleAudiences.length > 0) {
-        auth.appleAudiences = settings.appleAudiences;
-    }
-    if (typeof settings.otpEnabled === "boolean") {
-        auth.otpEnabled = settings.otpEnabled;
-    }
-    if (settings.passkeyRpConfig) {
-        auth.passkeys = settings.passkeyRpConfig;
-    }
-    return auth;
+    return serializeSection(settings, "auth");
 }
 /**
  * Translate the [auth] block of app.toml into app-settings fields (push
- * direction).
- *
- * Only keys actually present in the TOML are forwarded — an omitted key is left
- * untouched so it never overwrites server state (e.g. flipping a previously-true
- * flag to false). An explicit value, including `false`, is forwarded as-is.
- * `appleAudiences = []` is forwarded too; the server normalizes [] -> null
- * ("no audiences"). Keys outside RECOGNIZED_AUTH_KEYS produce a warning rather
- * than a hard error, so a typo or a future key doesn't silently drop.
+ * direction). Kept as a focused helper over the shared descriptor; the full
+ * push path uses `parseTomlToAppSettings` for every section. Only keys present
+ * in the TOML are forwarded, so an omitted key never overwrites server state.
+ * Descriptor errors (a secret key, a type mismatch) are surfaced alongside the
+ * unrecognized-key warnings.
  */
 export function parseAppAuthSettings(auth) {
-    const settings = {};
-    const warnings = [];
-    for (const key of AUTH_BOOLEAN_KEYS) {
-        if (key in auth)
-            settings[key] = auth[key];
-    }
-    if ("appleAudiences" in auth) {
-        settings.appleAudiences = auth.appleAudiences;
-    }
-    if ("passkeys" in auth) {
-        settings.passkeyRpConfig = auth.passkeys;
-    }
-    for (const key of Object.keys(auth)) {
-        if (!RECOGNIZED_AUTH_KEYS.has(key)) {
-            warnings.push(`Unrecognized [auth] key "${key}" in app.toml — ignored. ` +
-                `Recognized keys: ${[...RECOGNIZED_AUTH_KEYS].join(", ")}.`);
-        }
-    }
-    return { settings, warnings };
-}
-// TOML serialization helpers
-function serializeAppSettings(settings) {
-    const data = {
-        app: {
-            name: settings.name,
-            mode: settings.mode,
-            waitlistEnabled: settings.waitlistEnabled,
-            baseUrl: settings.baseUrl,
-        },
-        auth: serializeAuthBlock(settings),
-    };
-    if (settings.corsMode === "custom") {
-        data.cors = {
-            mode: settings.corsMode,
-            allowedOrigins: settings.corsAllowedOrigins,
-            allowCredentials: settings.corsAllowCredentials,
-            allowedMethods: settings.corsAllowedMethods,
-            maxAge: settings.corsMaxAge,
-        };
-    }
-    return stringifyConfigToml(data);
+    const { settings, warnings, errors } = parseTomlToAppSettings({ auth });
+    return { settings, warnings: [...warnings, ...errors] };
 }
+// `serializeAppSettings` (pull) and the app.toml push validation now live in
+// `sync-app-settings.ts`, shared with the `primitive settings` command — see
+// the imports above. Both directions stay descriptor-driven
+// (`cli/src/lib/app-settings-descriptor.ts`).
 // --- Config vars (issue #1423) ---------------------------------------------
 // Per-environment non-secret scalars, round-tripped as a single flat
 // `vars.toml` at the sync-dir root (like app.toml). They bind as
@@ -1417,8 +1346,15 @@ export async function pullScripts(client, appId, configDir, logger = () => { })
         items = result.items || [];
     }
     catch {
-        return { scriptEntities, count: 0 };
+        return {
+            scriptEntities,
+            count: 0,
+            presence: { ok: false },
+            listOk: false,
+            serverKeys: [],
+        };
     }
+    let detailsOk = true;
     let written = 0;
     for (const script of items) {
         const name = script?.name;
@@ -1437,6 +1373,7 @@ export async function pullScripts(client, appId, configDir, logger = () => { })
             full = await client.getScript(appId, script.scriptId);
         }
         catch {
+            detailsOk = false;
             logger(`  Skipped transforms/${name}.rhai (could not fetch config)`);
             continue;
         }
@@ -1461,7 +1398,11 @@ export async function pullScripts(client, appId, configDir, logger = () => { })
         written += 1;
         logger(`  Wrote transforms/${filename}`);
     }
-    return { scriptEntities, count: written };
+    const serverKeys = items.map((s) => s?.name).filter(Boolean);
+    const presence = detailsOk
+        ? { ok: true, serverKeys }
+        : { ok: false };
+    return { scriptEntities, count: written, presence, listOk: true, serverKeys };
 }
 async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, testCaseEntities, lookupMaps) {
     let testCases;
@@ -1827,6 +1768,7 @@ Directory Structure:
         .option("--app <app-id>", "App ID")
         .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .option("--json", "Output as JSON instead of writing files")
+        .option("--no-prune", "Keep local files for entities that are absent from the sync export (the next push will re-create them)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
         const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
@@ -1839,14 +1781,24 @@ Directory Structure:
         const client = new ApiClient();
         info(`Pulling configuration for app ${resolvedAppId}...`);
         try {
-            // Fetch all data
-            const [settings, integrationItems, promptItems, workflowItems, emailTemplatesResult] = await Promise.all([
+            // Fetch all data. Issue #1659: prune decides whether a local file's
+            // entity still exists server-side, so every fetch that establishes
+            // presence must report success or failure explicitly — an error that
+            // reads as an empty list would prune every local file of that type.
+            // `integrations`/`prompts`/`workflows` throw straight out of the pull
+            // on failure (no `.catch`), so reaching the prune pass at all proves
+            // their listings succeeded. The types that swallow errors below carry
+            // an explicit outcome instead.
+            const [settings, integrationItems, promptItems, workflowItems, emailTemplatesOutcome] = await Promise.all([
                 client.getAppSettings(resolvedAppId).catch(() => null),
                 fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
                 fetchAll((p) => client.listPrompts(resolvedAppId, p)),
                 fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
-                client.listEmailTemplates(resolvedAppId).catch(() => ({ templates: [] })),
+                attemptFetch(() => client.listEmailTemplates(resolvedAppId)),
             ]);
+            const emailTemplatesResult = emailTemplatesOutcome.ok
+                ? emailTemplatesOutcome.value
+                : { templates: [] };
             // Fetch details for each entity
             const integrations = await Promise.all(integrationItems.map((i) => client.getIntegration(resolvedAppId, i.integrationId)));
             const prompts = await Promise.all(promptItems.map((p) => client.getPrompt(resolvedAppId, p.promptId)));
@@ -1871,30 +1823,71 @@ Directory Structure:
                 }
                 return workflowData;
             }));
-            // Fetch full details for email template overrides
+            // Fetch full details for email template overrides. Only overrides get a
+            // local file, so they are the type's server key set. A detail fetch that
+            // fails leaves the override unwritten — presence for that key is no
+            // longer established, so the type is skipped for pruning (#1659).
             const emailTemplateOverrides = emailTemplatesResult.templates.filter((t) => t.hasOverride);
-            const emailTemplates = await Promise.all(emailTemplateOverrides.map((t) => client.getEmailTemplate(resolvedAppId, t.emailType).catch(() => null))).then((results) => results.filter(Boolean));
+            const emailTemplateOutcomes = await Promise.all(emailTemplateOverrides.map((t) => attemptFetch(() => client.getEmailTemplate(resolvedAppId, t.emailType))));
+            const emailTemplates = emailTemplateOutcomes
+                .map((o) => (o.ok ? o.value : null))
+                .filter(Boolean);
+            const emailTemplateDetailsOk = emailTemplateOutcomes.every((o) => o.ok && o.value);
+            const emailTemplatePresence = emailTemplatesOutcome.ok && emailTemplateDetailsOk
+                ? {
+                    ok: true,
+                    serverKeys: emailTemplateOverrides.map((t) => t.emailType),
+                }
+                : { ok: false };
             if (options.json) {
                 json({ settings, integrations, prompts, workflows, emailTemplates });
                 return;
             }
             // Fetch database config resources
-            const [databaseTypeConfigsResult, ruleSetsResult, groupTypeConfigsResult, collectionTypeConfigsResult, metadataCategoryConfigsResult,] = await Promise.all([
-                client.listDatabaseTypeConfigs(resolvedAppId).catch(() => []),
-                client.listRuleSets(resolvedAppId).catch(() => []),
-                client.listGroupTypeConfigs(resolvedAppId).catch(() => []),
-                client.listCollectionTypeConfigs(resolvedAppId).catch(() => []),
-                client.listMetadataCategoryConfigs(resolvedAppId).catch(() => []),
+            // These five listings previously used `.catch(() => [])`, which made a
+            // transient 401/500/network error indistinguishable from "the app has
+            // none of these". Pull still tolerates the failure the same way (it
+            // writes nothing for that type and carries on), but it now records the
+            // outcome so the prune pass can skip a type whose presence is unknown
+            // rather than delete every local file of it (#1659).
+            const [databaseTypeConfigsOutcome, ruleSetsOutcome, groupTypeConfigsOutcome, collectionTypeConfigsOutcome, metadataCategoryConfigsOutcome,] = await Promise.all([
+                attemptFetch(() => client.listDatabaseTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listRuleSets(resolvedAppId)),
+                attemptFetch(() => client.listGroupTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listCollectionTypeConfigs(resolvedAppId)),
+                attemptFetch(() => client.listMetadataCategoryConfigs(resolvedAppId)),
             ]);
+            const databaseTypeConfigsResult = databaseTypeConfigsOutcome.ok
+                ? databaseTypeConfigsOutcome.value
+                : [];
+            const ruleSetsResult = ruleSetsOutcome.ok ? ruleSetsOutcome.value : [];
+            const groupTypeConfigsResult = groupTypeConfigsOutcome.ok
+                ? groupTypeConfigsOutcome.value
+                : [];
+            const collectionTypeConfigsResult = collectionTypeConfigsOutcome.ok
+                ? collectionTypeConfigsOutcome.value
+                : [];
+            const metadataCategoryConfigsResult = metadataCategoryConfigsOutcome.ok
+                ? metadataCategoryConfigsOutcome.value
+                : [];
             // Fetch operations + subscriptions for each database type. Issue #803:
             // subscriptions are pulled symmetrically with operations so a
             // pull → push cycle round-trips `[[subscriptions]]` blocks without a
             // spurious diff. The list endpoint already excludes archived rows.
+            //
+            // A failed operation/subscription fetch also disqualifies the type from
+            // pruning (#1659): the file we write for it is then incomplete, so the
+            // pull's picture of that type is not one to reconcile against.
+            let databaseTypeDetailsOk = true;
             const databaseTypesWithOps = await Promise.all((Array.isArray(databaseTypeConfigsResult) ? databaseTypeConfigsResult : []).map(async (typeConfig) => {
-                const [ops, subs] = await Promise.all([
-                    client.listDatabaseTypeOperations(resolvedAppId, typeConfig.databaseType).catch(() => []),
-                    client.listDatabaseTypeSubscriptions(resolvedAppId, typeConfig.databaseType).catch(() => []),
+                const [opsOutcome, subsOutcome] = await Promise.all([
+                    attemptFetch(() => client.listDatabaseTypeOperations(resolvedAppId, typeConfig.databaseType)),
+                    attemptFetch(() => client.listDatabaseTypeSubscriptions(resolvedAppId, typeConfig.databaseType)),
                 ]);
+                if (!opsOutcome.ok || !subsOutcome.ok)
+                    databaseTypeDetailsOk = false;
+                const ops = opsOutcome.ok ? opsOutcome.value : [];
+                const subs = subsOutcome.ok ? subsOutcome.value : [];
                 return {
                     typeConfig,
                     operations: Array.isArray(ops) ? ops : [],
@@ -1945,6 +1938,12 @@ Directory Structure:
             ensureDir(join(configDir, "collection-type-configs"));
             ensureDir(join(configDir, "metadata-category-configs"));
             ensureDir(join(configDir, "email-templates"));
+            // The prior sync state is the record of which local files a previous
+            // pull wrote — the discriminator the prune pass keys off (#1659). Read
+            // it now: `saveSyncState` at the end of the pull overwrites it, and the
+            // files themselves are about to be rewritten.
+            const priorState = loadSyncState(configDir);
+            const priorEntities = priorState?.entities ?? {};
             // Write app settings
             if (settings) {
                 const appTomlPath = join(configDir, "app.toml");
@@ -1971,7 +1970,7 @@ Directory Structure:
             catch (varErr) {
                 varsOutcome = { ok: false, error: varErr };
             }
-            const varsPlan = planVarsPull(varsOutcome, varsOutcome.ok ? undefined : loadSyncState(configDir)?.entities?.vars);
+            const varsPlan = planVarsPull(varsOutcome, varsOutcome.ok ? undefined : priorEntities.vars);
             const varEntities = varsPlan.varEntities;
             if (varsPlan.write && varsPlan.content !== null) {
                 writeFileSync(varsTomlPathPull, varsPlan.content);
@@ -2013,15 +2012,13 @@ Directory Structure:
                 };
             }
             info(`  Pulled ${webhooks.length} webhook(s)`);
-            // Pull cron triggers
-            let cronTriggerItems = [];
-            try {
-                const cronResult = await client.listCronTriggers(resolvedAppId);
-                cronTriggerItems = cronResult.items || [];
-            }
-            catch {
-                // Cron triggers may not be available on older servers
-            }
+            // Pull cron triggers. An older server without the route (or any other
+            // failure) leaves the type unlisted — tolerated as before, but recorded
+            // so prune skips it rather than reading it as "no cron triggers".
+            const cronTriggersOutcome = await attemptFetch(() => client.listCronTriggers(resolvedAppId));
+            const cronTriggerItems = cronTriggersOutcome.ok
+                ? cronTriggersOutcome.value.items || []
+                : [];
             const cronTriggersDir = join(configDir, "cron-triggers");
             mkdirSync(cronTriggersDir, { recursive: true });
             const cronTriggerEntities = {};
@@ -2037,8 +2034,10 @@ Directory Structure:
             }
             info(`  Pulled ${cronTriggerItems.length} cron trigger(s)`);
             // Pull blob buckets
-            const blobBucketsResult = await client.listBlobBuckets(resolvedAppId).catch(() => ({ items: [] }));
-            const blobBucketItems = blobBucketsResult.items || [];
+            const blobBucketsOutcome = await attemptFetch(() => client.listBlobBuckets(resolvedAppId));
+            const blobBucketItems = blobBucketsOutcome.ok
+                ? blobBucketsOutcome.value.items || []
+                : [];
             const blobBucketsDir = join(configDir, "blob-buckets");
             mkdirSync(blobBucketsDir, { recursive: true });
             const blobBucketEntities = {};
@@ -2091,7 +2090,7 @@ Directory Structure:
             // `transforms/<name>.rhai`, and record `{id, modifiedAt,
             // contentHash}` under `entities.scripts[name]` so a subsequent
             // `sync push` round-trips without false diffs.
-            const { scriptEntities, count: pulledScriptsCount } = await pullScripts(client, resolvedAppId, configDir, info);
+            const { scriptEntities, count: pulledScriptsCount, presence: scriptPresence, listOk: scriptListOk, serverKeys: scriptServerKeys, } = await pullScripts(client, resolvedAppId, configDir, info);
             if (pulledScriptsCount > 0) {
                 info(`  Pulled ${pulledScriptsCount} transform(s)`);
             }
@@ -2143,19 +2142,10 @@ Directory Structure:
                 };
                 info(`  Wrote email-templates/${filename}`);
             }
-            // Clean up local email template files for remotely-deleted overrides
-            const emailTemplatesDir = join(configDir, "email-templates");
-            if (existsSync(emailTemplatesDir)) {
-                const pulledTypes = new Set(emailTemplates.map((t) => t.emailType));
-                const localFiles = readdirSync(emailTemplatesDir).filter((f) => f.endsWith(".toml"));
-                for (const file of localFiles) {
-                    const localType = basename(file, ".toml");
-                    if (!pulledTypes.has(localType)) {
-                        unlinkSync(join(emailTemplatesDir, file));
-                        info(`  Removed email-templates/${file} (override deleted on server)`);
-                    }
-                }
-            }
+            // Email-template files for removed overrides used to be cleaned up here
+            // by a hand-coded loop — the only type that pruned at all (#1659). It is
+            // now folded into the general prune pass below, under the same rules and
+            // the same `--no-prune` flag as every other type.
             // Pull test cases for prompts and workflows
             const testCaseEntities = {};
             let totalTestCases = 0;
@@ -2238,7 +2228,7 @@ Directory Structure:
             // Write rule sets
             const ruleSetEntities = {};
             for (const ruleSet of ruleSets) {
-                const fileKey = (ruleSet.name || ruleSet.ruleSetId).replace(/[/\\:*?"<>|]/g, "_");
+                const fileKey = ruleSetFileKey(ruleSet);
                 const filename = `${fileKey}.toml`;
                 const filePath = join(configDir, "rule-sets", filename);
                 writeFileSync(filePath, serializeRuleSet(ruleSet));
@@ -2294,6 +2284,182 @@ Directory Structure:
                 };
                 info(`  Wrote metadata-category-configs/${filename}`);
             }
+            // ── Prune reconciliation (issue #1659) ───────────────────────────────
+            //
+            // Every write above is done, so we now know which entities the server
+            // still exports. A local file is removed iff its key was MANAGED (a
+            // prior pull wrote it, so it is in `priorEntities[<slot>]`) and is
+            // ABSENT from this pull's server keys. A file that was never in prior
+            // state was hand-authored — it stays, and `sync diff` reports it as new.
+            //
+            // Presence comes from the server LISTING, never from "what we just
+            // wrote": several types legitimately skip writing a present entity (a
+            // script with no active config), and pruning those would delete a live
+            // entity's file. A type whose presence could not be established is
+            // skipped whole, and its prior state slot is preserved so the managed
+            // discriminator survives to the next pull.
+            //
+            // This runs after the pre-pull snapshot, so `sync revert` restores
+            // anything pruned in error.
+            const presenceBySlot = {
+                integrations: { ok: true, serverKeys: integrationItems.map((i) => i.integrationKey) },
+                webhooks: { ok: true, serverKeys: webhookItems.map((w) => w.webhookKey) },
+                prompts: { ok: true, serverKeys: promptItems.map((p) => p.promptKey) },
+                workflows: { ok: true, serverKeys: workflowItems.map((w) => w.workflowKey) },
+                cronTriggers: cronTriggersOutcome.ok
+                    ? { ok: true, serverKeys: cronTriggerItems.map((t) => t.triggerKey) }
+                    : { ok: false },
+                blobBuckets: blobBucketsOutcome.ok
+                    ? { ok: true, serverKeys: blobBucketItems.map((b) => b.bucketKey) }
+                    : { ok: false },
+                scripts: scriptPresence,
+                emailTemplates: emailTemplatePresence,
+                databaseTypes: databaseTypeConfigsOutcome.ok && databaseTypeDetailsOk
+                    ? { ok: true, serverKeys: databaseTypesWithOps.map((d) => d.typeConfig.databaseType) }
+                    : { ok: false },
+                ruleSets: ruleSetsOutcome.ok
+                    ? { ok: true, serverKeys: ruleSets.map((rs) => ruleSetFileKey(rs)) }
+                    : { ok: false },
+                groupTypeConfigs: groupTypeConfigsOutcome.ok
+                    ? { ok: true, serverKeys: groupTypeConfigs.map((c) => c.groupType) }
+                    : { ok: false },
+                collectionTypeConfigs: collectionTypeConfigsOutcome.ok
+                    ? { ok: true, serverKeys: collectionTypeConfigs.map((c) => c.collectionType) }
+                    : { ok: false },
+                metadataCategoryConfigs: metadataCategoryConfigsOutcome.ok
+                    ? {
+                        ok: true,
+                        serverKeys: metadataCategoryConfigs.map((c) => `${c.resourceType}#${c.category}`),
+                    }
+                    : { ok: false },
+            };
+            let prunedCount = 0;
+            // Keys whose file this prune deliberately left in place. They are absent
+            // server-side, so nothing wrote them into this pull's entity map — see
+            // the restore pass below `keepPrior`.
+            const keptKeysBySlot = {};
+            for (const resourceType of SYNC_RESOURCE_TYPES) {
+                const presence = presenceBySlot[resourceType.stateSlot] ?? { ok: false };
+                const plan = planPrune({
+                    resourceType,
+                    priorKeys: Object.keys(priorEntities[resourceType.stateSlot] ?? {}),
+                    presence,
+                    enabled: options.prune !== false,
+                });
+                if (plan.skipped) {
+                    // `--no-prune` is the operator's explicit choice — no warning for it.
+                    // A failed fetch is worth saying out loud: stale files survive this
+                    // pull, and the next push would re-create their entities.
+                    if (plan.skipReason === "fetch-failed" && Object.keys(priorEntities[resourceType.stateSlot] ?? {}).length > 0) {
+                        warn(`  Skipped pruning ${resourceType.dir} — could not establish which entities the server has; ` +
+                            "local files left untouched");
+                    }
+                    // Only worth saying when a file is actually being left behind:
+                    // this listing is incomplete on every pull, so warning
+                    // unconditionally would just train operators to ignore it.
+                    if (plan.skipReason === "listing-incomplete" && plan.unprunedAbsentKeys.length > 0) {
+                        warn(`  Skipped pruning ${plan.unprunedAbsentKeys.length} ${resourceType.dir} file(s) — ` +
+                            `the server's ${resourceType.dir} listing is not paginated, so an entity missing from it ` +
+                            "may still be live (#1668). Delete the file yourself if the entity is really gone: " +
+                            plan.unprunedAbsentKeys.join(", "));
+                    }
+                    // The files stayed, so their keys stay managed — same rule as the
+                    // kept-file restore below.
+                    if (plan.unprunedAbsentKeys.length > 0) {
+                        keptKeysBySlot[resourceType.stateSlot] = [...plan.unprunedAbsentKeys];
+                    }
+                    continue;
+                }
+                for (const key of plan.unsafeKeys) {
+                    warn(`  Skipped pruning ${resourceType.dir} entry "${key}" — its sync-state key does not map to a safe filename`);
+                }
+                const result = await applyPrune({
+                    configDir,
+                    resourceType,
+                    keys: plan.keys,
+                    testCaseEntities,
+                    logger: info,
+                });
+                prunedCount += result.prunedKeys.length;
+                const kept = [...result.keptWithLocalEdits, ...plan.unsafeKeys];
+                if (kept.length > 0) {
+                    keptKeysBySlot[resourceType.stateSlot] = kept;
+                }
+            }
+            // Preserve prior state for types whose listing failed: nothing was
+            // written for them, so the untouched local files must keep their
+            // managed marker (the same rule `planVarsPull` applies to vars.toml).
+            // For a type that listed fine but had a per-entity fetch failure, keep
+            // the prior entry for that one key — see `preserveUnwrittenEntries`.
+            const keepPrior = (ok, built, slot) => ok ? built : (priorEntities[slot] ?? built);
+            preserveUnwrittenEntries(scriptEntities, priorEntities.scripts, scriptServerKeys);
+            preserveUnwrittenEntries(emailTemplateEntities, priorEntities.emailTemplates, emailTemplatesOutcome.ok
+                ? emailTemplateOverrides.map((t) => t.emailType)
+                : []);
+            const finalCronTriggerEntities = keepPrior(cronTriggersOutcome.ok, cronTriggerEntities, "cronTriggers");
+            const finalBlobBucketEntities = keepPrior(blobBucketsOutcome.ok, blobBucketEntities, "blobBuckets");
+            const finalScriptEntities = keepPrior(scriptListOk, scriptEntities, "scripts");
+            const finalEmailTemplateEntities = keepPrior(emailTemplatesOutcome.ok, emailTemplateEntities, "emailTemplates");
+            const finalDatabaseTypeEntities = keepPrior(databaseTypeConfigsOutcome.ok, databaseTypeEntities, "databaseTypes");
+            const finalRuleSetEntities = keepPrior(ruleSetsOutcome.ok, ruleSetEntities, "ruleSets");
+            const finalGroupTypeConfigEntities = keepPrior(groupTypeConfigsOutcome.ok, groupTypeConfigEntities, "groupTypeConfigs");
+            const finalCollectionTypeConfigEntities = keepPrior(collectionTypeConfigsOutcome.ok, collectionTypeConfigEntities, "collectionTypeConfigs");
+            const finalMetadataCategoryConfigEntities = keepPrior(metadataCategoryConfigsOutcome.ok, metadataCategoryConfigEntities, "metadataCategoryConfigs");
+            // Keep the managed marker on every file prune deliberately left in
+            // place: uncommitted local edits, an unsafe filename, `--no-prune`, or
+            // a listing too incomplete to trust.
+            //
+            // Those keys are absent from the server, so this pull wrote no entry for
+            // them: `preserveUnwrittenEntries` only rescues keys the server LISTED,
+            // and `keepPrior` only fires when a whole listing failed. Without this
+            // pass the key drops out of `entities[<slot>]` here, and on the next pull
+            // the file is indistinguishable from a hand-authored one — never pruned,
+            // never warned about, and reported by `sync diff` as "local only" rather
+            // than absent-from-export. The skip-with-warning safety hatch would work
+            // once and then quietly stop, re-creating the entity on the next push.
+            // Carrying the prior entry forward keeps the file managed until it is
+            // actually gone.
+            const entitiesBySlot = {
+                integrations: integrationEntities,
+                webhooks: webhookEntities,
+                cronTriggers: finalCronTriggerEntities,
+                blobBuckets: finalBlobBucketEntities,
+                prompts: promptEntities,
+                workflows: workflowEntities,
+                scripts: finalScriptEntities,
+                emailTemplates: finalEmailTemplateEntities,
+                databaseTypes: finalDatabaseTypeEntities,
+                ruleSets: finalRuleSetEntities,
+                groupTypeConfigs: finalGroupTypeConfigEntities,
+                collectionTypeConfigs: finalCollectionTypeConfigEntities,
+                metadataCategoryConfigs: finalMetadataCategoryConfigEntities,
+            };
+            for (const [slot, keys] of Object.entries(keptKeysBySlot)) {
+                const built = entitiesBySlot[slot];
+                const prior = priorEntities[slot];
+                if (!built || !prior)
+                    continue;
+                for (const key of keys) {
+                    if (!(key in built) && key in prior) {
+                        built[key] = prior[key];
+                    }
+                }
+                // The block's sidecar test cases were not written either (the block is
+                // gone from the export), and its `<key>.tests/` files are still on disk
+                // because the block's own file was kept — so their records carry
+                // forward on the same rule.
+                const resourceType = SYNC_RESOURCE_TYPES.find((rt) => rt.stateSlot === slot);
+                const blockType = resourceType?.testBlockType;
+                if (!blockType || !priorEntities.testCases)
+                    continue;
+                for (const [tcKey, tcValue] of Object.entries(priorEntities.testCases)) {
+                    if (tcValue.blockType === blockType &&
+                        keys.includes(tcValue.blockKey) &&
+                        !(tcKey in testCaseEntities)) {
+                        testCaseEntities[tcKey] = tcValue;
+                    }
+                }
+            }
             // Save sync state
             const state = {
                 appId: resolvedAppId,
@@ -2303,22 +2469,22 @@ Directory Structure:
                     app: settings ? { modifiedAt: new Date().toISOString(), contentHash: computeFileHash(join(configDir, "app.toml")) } : undefined,
                     integrations: integrationEntities,
                     webhooks: webhookEntities,
-                    cronTriggers: Object.keys(cronTriggerEntities).length > 0 ? cronTriggerEntities : undefined,
-                    blobBuckets: Object.keys(blobBucketEntities).length > 0 ? blobBucketEntities : undefined,
+                    cronTriggers: Object.keys(finalCronTriggerEntities).length > 0 ? finalCronTriggerEntities : undefined,
+                    blobBuckets: Object.keys(finalBlobBucketEntities).length > 0 ? finalBlobBucketEntities : undefined,
                     prompts: promptEntities,
                     workflows: workflowEntities,
-                    scripts: Object.keys(scriptEntities).length > 0 ? scriptEntities : undefined,
-                    emailTemplates: Object.keys(emailTemplateEntities).length > 0 ? emailTemplateEntities : undefined,
+                    scripts: Object.keys(finalScriptEntities).length > 0 ? finalScriptEntities : undefined,
+                    emailTemplates: Object.keys(finalEmailTemplateEntities).length > 0 ? finalEmailTemplateEntities : undefined,
                     testCases: Object.keys(testCaseEntities).length > 0 ? testCaseEntities : undefined,
-                    databaseTypes: Object.keys(databaseTypeEntities).length > 0 ? databaseTypeEntities : undefined,
-                    ruleSets: Object.keys(ruleSetEntities).length > 0 ? ruleSetEntities : undefined,
+                    databaseTypes: Object.keys(finalDatabaseTypeEntities).length > 0 ? finalDatabaseTypeEntities : undefined,
+                    ruleSets: Object.keys(finalRuleSetEntities).length > 0 ? finalRuleSetEntities : undefined,
                     vars: Object.keys(varEntities).length > 0 ? varEntities : undefined,
-                    groupTypeConfigs: Object.keys(groupTypeConfigEntities).length > 0 ? groupTypeConfigEntities : undefined,
-                    collectionTypeConfigs: Object.keys(collectionTypeConfigEntities).length > 0
-                        ? collectionTypeConfigEntities
+                    groupTypeConfigs: Object.keys(finalGroupTypeConfigEntities).length > 0 ? finalGroupTypeConfigEntities : undefined,
+                    collectionTypeConfigs: Object.keys(finalCollectionTypeConfigEntities).length > 0
+                        ? finalCollectionTypeConfigEntities
                         : undefined,
-                    metadataCategoryConfigs: Object.keys(metadataCategoryConfigEntities).length > 0
-                        ? metadataCategoryConfigEntities
+                    metadataCategoryConfigs: Object.keys(finalMetadataCategoryConfigEntities).length > 0
+                        ? finalMetadataCategoryConfigEntities
                         : undefined,
                 },
             };
@@ -2340,6 +2506,7 @@ Directory Structure:
             keyValue("Group Type Configs", groupTypeConfigs.length);
             keyValue("Collection Type Configs", collectionTypeConfigs.length);
             keyValue("Metadata Category Configs", metadataCategoryConfigs.length);
+            keyValue("Pruned", prunedCount);
         }
         catch (err) {
             error(err.message);
@@ -2591,6 +2758,25 @@ Directory Structure:
                     }
                 }
             }
+            // Validate app.toml settings up-front (issue #1033). A hand-added
+            // `googleClientSecret` key or a mistyped value is a hard error that must
+            // abort BEFORE any mutation — same fail-before-mutate contract as the
+            // vars preflight below. The apply block re-parses for the payload.
+            const preflightAppTomlPath = join(configDir, "app.toml");
+            if (existsSync(preflightAppTomlPath)) {
+                try {
+                    const parsedApp = parseTomlFile(preflightAppTomlPath);
+                    const appErrors = collectAppSettingsPushErrors(parsedApp, {
+                        isCrossAppPush,
+                    });
+                    for (const e of appErrors) {
+                        preflightValidationErrors.push(`  app.toml: ${e}`);
+                    }
+                }
+                catch (err) {
+                    preflightValidationErrors.push(`  app.toml: ${err?.message || String(err)}`);
+                }
+            }
             // Validate config vars up-front (issue #1423 review). Parse vars.toml
             // and check the same key/value constraints the server enforces here, in
             // the preflight pass, so an invalid entry aborts BEFORE any mutation
@@ -2687,27 +2873,13 @@ Directory Structure:
                 }
                 else {
                     const tomlData = parseTomlFile(appTomlPath);
-                    const settings = {};
-                    if (tomlData.app) {
-                        Object.assign(settings, tomlData.app);
-                        // Don't overwrite the target app's name during cross-app push
-                        if (isCrossAppPush) {
-                            delete settings.name;
-                        }
-                    }
-                    if (tomlData.auth) {
-                        const { settings: authSettings, warnings: authWarnings } = parseAppAuthSettings(tomlData.auth);
-                        Object.assign(settings, authSettings);
-                        for (const w of authWarnings) {
-                            warn(`  ${w}`);
-                        }
-                    }
-                    if (tomlData.cors) {
-                        settings.corsMode = tomlData.cors.mode;
-                        settings.corsAllowedOrigins = tomlData.cors.allowedOrigins;
-                        settings.corsAllowCredentials = tomlData.cors.allowCredentials;
-                        settings.corsAllowedMethods = tomlData.cors.allowedMethods;
-                        settings.corsMaxAge = tomlData.cors.maxAge;
+                    // Descriptor-driven parse of every section ([app]/[auth]/[cors]/
+                    // [invitations]) — issue #1033. `name` is stripped on cross-app
+                    // push. Errors (secret key / type mismatch) already aborted the
+                    // push in the preflight pass above, so only warnings remain here.
+                    const { settings, warnings: appWarnings } = parseTomlToAppSettings(tomlData, { isCrossAppPush });
+                    for (const w of appWarnings) {
+                        warn(`  ${w}`);
                     }
                     changes.push({ type: "app", action: "update", key: "settings" });
                     if (!options.dryRun) {
@@ -5559,10 +5731,18 @@ Directory Structure:
             }
             // Compare
             const differences = [];
+            // Issue #1659: a local file with no server entity means one of two very
+            // different things, and the operator needs to tell them apart. If a
+            // prior pull managed the key, the entity was deleted server-side and
+            // this stale file will RE-create it on the next push.
+            // If it was never pulled, the operator authored it and push creating it
+            // is the point. Prior sync state is the discriminator, exactly as it is
+            // for the pull-side prune.
+            const localOnlyStatus = (slot, key) => classifyLocalOnly(syncState?.entities, slot, key);
             // Integrations
             for (const key of localIntegrations) {
                 if (!remoteIntegrations.has(key)) {
-                    differences.push({ type: "integration", key, status: "local only" });
+                    differences.push({ type: "integration", key, status: localOnlyStatus("integrations", key) });
                 }
                 else {
                     differences.push({ type: "integration", key, status: "exists" });
@@ -5576,7 +5756,7 @@ Directory Structure:
             // Webhooks
             for (const key of localWebhooks) {
                 if (!remoteWebhooks.has(key)) {
-                    differences.push({ type: "webhook", key, status: "local only" });
+                    differences.push({ type: "webhook", key, status: localOnlyStatus("webhooks", key) });
                 }
                 else {
                     differences.push({ type: "webhook", key, status: "exists" });
@@ -5590,7 +5770,7 @@ Directory Structure:
             // Cron Triggers
             for (const key of localCronTriggers) {
                 if (!remoteCronTriggers.has(key)) {
-                    differences.push({ type: "cron-trigger", key, status: "local only" });
+                    differences.push({ type: "cron-trigger", key, status: localOnlyStatus("cronTriggers", key) });
                 }
                 else {
                     differences.push({ type: "cron-trigger", key, status: "exists" });
@@ -5604,7 +5784,7 @@ Directory Structure:
             // Blob Buckets
             for (const key of localBlobBuckets) {
                 if (!remoteBlobBuckets.has(key)) {
-                    differences.push({ type: "blob-bucket", key, status: "local only" });
+                    differences.push({ type: "blob-bucket", key, status: localOnlyStatus("blobBuckets", key) });
                 }
                 else {
                     differences.push({ type: "blob-bucket", key, status: "exists" });
@@ -5618,7 +5798,7 @@ Directory Structure:
             // Prompts
             for (const key of localPrompts) {
                 if (!remotePrompts.has(key)) {
-                    differences.push({ type: "prompt", key, status: "local only" });
+                    differences.push({ type: "prompt", key, status: localOnlyStatus("prompts", key) });
                 }
                 else {
                     differences.push({ type: "prompt", key, status: "exists" });
@@ -5650,7 +5830,7 @@ Directory Structure:
             const remoteWorkflowIds = new Map(workflowItems.map((w) => [w.workflowKey, w.workflowId]));
             for (const key of localWorkflows) {
                 if (!remoteWorkflows.has(key)) {
-                    differences.push({ type: "workflow", key, status: "local only" });
+                    differences.push({ type: "workflow", key, status: localOnlyStatus("workflows", key) });
                     continue;
                 }
                 // Present on both sides → compare content.
@@ -5701,7 +5881,7 @@ Directory Structure:
             // Email Templates
             for (const key of localEmailTemplates) {
                 if (!remoteEmailTemplates.has(key)) {
-                    differences.push({ type: "email-template", key, status: "local only" });
+                    differences.push({ type: "email-template", key, status: localOnlyStatus("emailTemplates", key) });
                 }
                 else {
                     differences.push({ type: "email-template", key, status: "exists" });
@@ -5722,7 +5902,7 @@ Directory Structure:
             for (const [name, localBody] of localScripts) {
                 const remote = remoteScripts.get(name);
                 if (!remote) {
-                    differences.push({ type: "transform", key: name, status: "local only" });
+                    differences.push({ type: "transform", key: name, status: localOnlyStatus("scripts", name) });
                     continue;
                 }
                 let status = "exists";
@@ -5789,7 +5969,7 @@ Directory Structure:
                 }
                 for (const slug of localTestSlugs) {
                     if (!remoteTestNames.has(slug)) {
-                        testCaseDiffs.push({ blockType, blockKey, slug, status: "local only" });
+                        testCaseDiffs.push({ blockType, blockKey, slug, status: LOCAL_ONLY_NEW });
                     }
                     else {
                         testCaseDiffs.push({ blockType, blockKey, slug, status: "exists" });
@@ -5813,17 +5993,29 @@ Directory Structure:
                 }
             }
             divider();
-            const localOnly = differences.filter((d) => d.status === "local only");
+            const localOnly = differences.filter((d) => d.status === LOCAL_ONLY_NEW);
+            const localOnlyAbsent = differences.filter((d) => d.status === LOCAL_ONLY_ABSENT);
             const remoteOnly = differences.filter((d) => d.status === "remote only");
             const modified = differences.filter((d) => d.status === "modified");
             const existing = differences.filter((d) => d.status === "exists");
             if (localOnly.length > 0) {
-                info("Local only (will be created on push):");
+                info("Local only — new (will be created on push):");
                 for (const d of localOnly) {
                     console.log(`  ${chalk.green("+")} ${d.type}: ${d.key}`);
                 }
                 console.log();
             }
+            // #1659: these files were written by a prior pull, so their entity was
+            // deleted server-side afterwards. `sync pull` prunes them by
+            // default; they only survive under `--no-prune` or a skipped prune, and
+            // while they sit here the next push re-creates what was deleted.
+            if (localOnlyAbsent.length > 0) {
+                warn(`Local only — ${ABSENT_FROM_EXPORT}; push will RE-create these unless you remove them:`);
+                for (const d of localOnlyAbsent) {
+                    console.log(`  ${chalk.yellow("!")} ${d.type}: ${d.key}`);
+                }
+                console.log();
+            }
             if (remoteOnly.length > 0) {
                 warn("Remote only (not in local config):");
                 for (const d of remoteOnly) {
@@ -5850,7 +6042,7 @@ Directory Structure:
                 }
             }
             // Show test case differences
-            const tcLocalOnly = testCaseDiffs.filter((d) => d.status === "local only");
+            const tcLocalOnly = testCaseDiffs.filter((d) => d.status === LOCAL_ONLY_NEW);
             const tcRemoteOnly = testCaseDiffs.filter((d) => d.status === "remote only");
             const tcSynced = testCaseDiffs.filter((d) => d.status === "exists");
             if (tcLocalOnly.length > 0 || tcRemoteOnly.length > 0) {
@@ -5867,7 +6059,8 @@ Directory Structure:
                 }
             }
             divider();
-            keyValue("Local only", localOnly.length);
+            keyValue("Local only (new)", localOnly.length);
+            keyValue("Local only (absent from export)", localOnlyAbsent.length);
             keyValue("Remote only", remoteOnly.length);
             keyValue("Modified", modified.length);
             keyValue("Synced", existing.length);
@@ -6194,24 +6387,4 @@ Directory Structure:
         info("Run 'primitive sync diff' to inspect the restored state versus the server.");
     });
 }
-/**
- * Best-effort check for uncommitted git changes under `dir`. Used only to warn
- * before a revert overwrites local edits — never fatal. Returns false if git
- * isn't available, the dir isn't in a repo, or anything goes wrong.
- */
-async function hasUncommittedChanges(dir) {
-    if (!existsSync(dir))
-        return false;
-    try {
-        const { execSync } = await import("child_process");
-        const out = execSync(`git status --porcelain -- "${dir}"`, {
-            stdio: ["ignore", "pipe", "ignore"],
-            encoding: "utf-8",
-        });
-        return out.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
 //# sourceMappingURL=sync.js.map