primitive-admin 1.1.0-alpha.53 → 1.1.0-alpha.55

package/dist/src/commands/sync.js

@@ -105,6 +105,15 @@ function canonicalJsonStringify(value) {
     if (Array.isArray(value)) {
         return "[" + value.map((v) => canonicalJsonStringify(v)).join(",") + "]";
     }
+    // Honor `toJSON` before the key walk. A `Date` — or smol-toml's `TomlDate`,
+    // what a TOML datetime literal parses to — has no enumerable own keys, so
+    // the `Object.keys()` walk below would collapse it to "{}" and every
+    // datetime would hash identically (issue #1919). Both implement `toJSON`,
+    // returning the ISO string; recursing on it makes date-like values (nested
+    // ones too) participate in the hash. Matches JSON.stringify's own semantics.
+    if (typeof value.toJSON === "function") {
+        return canonicalJsonStringify(value.toJSON());
+    }
     const keys = Object.keys(value).sort();
     return ("{" +
         keys
@@ -249,8 +258,7 @@ export function hashRemoteWorkflowForDiff(workflow, draft, configs) {
  * (`cli/src/lib/app-settings-descriptor.ts`), which now owns the [auth] field
  * set that `AUTH_BOOLEAN_KEYS`/`RECOGNIZED_AUTH_KEYS` used to hard-code. The
  * descriptor drives all four sections in one place, so pull, push, and the
- * unrecognized-key warning can never drift apart. `googleClientSecret` is a
- * secret descriptor entry and is never written.
+ * unrecognized-key warning can never drift apart.
  */
 export function serializeAuthBlock(settings) {
     return serializeSection(settings, "auth");
@@ -260,7 +268,7 @@ export function serializeAuthBlock(settings) {
  * direction). Kept as a focused helper over the shared descriptor; the full
  * push path uses `parseTomlToAppSettings` for every section. Only keys present
  * in the TOML are forwarded, so an omitted key never overwrites server state.
- * Descriptor errors (a secret key, a type mismatch) are surfaced alongside the
+ * Descriptor errors (a type mismatch) are surfaced alongside the
  * unrecognized-key warnings.
  */
 export function parseAppAuthSettings(auth) {
@@ -590,6 +598,69 @@ function serializeIntegration(integration) {
     };
     return stringifyConfigToml(data);
 }
+/**
+ * Map a webhook's stored verification `config` blob to/from the TOML
+ * `[verification.<scheme>]` table.
+ *
+ * The storage shapes differ per scheme and the mapping has to be explicit:
+ * `discord` keeps its key material flat at `config.publicKey`, while the
+ * JWT-family schemes nest theirs under `config.<scheme>`. Without this the
+ * whole `config` blob was dropped on both pull and push, which is why a
+ * `discord` webhook could not be configured through the CLI at all.
+ */
+/**
+ * Schemes whose stored `config` nests under the scheme name (what the server
+ * validates) — the JWT family, including the `plaid` preset (#2109).
+ * Everything else — `discord` and any scheme carrying a plain config blob — is
+ * stored flat. `webhookConfigToTomlTable` and `tomlTableToWebhookConfig` both
+ * read this list, so the two directions cannot disagree: reading the shape off
+ * the data on one side and off a different list on the other is what let a
+ * pull -> push on a flat-config `stripe`/`custom`/`none` webhook re-shape a
+ * config it never meant to change.
+ */
+const NESTED_CONFIG_SCHEMES = new Set(["jwt", "plaid"]);
+export function webhookConfigToTomlTable(scheme, config) {
+    const parsed = parseWebhookConfigValue(config);
+    if (!parsed)
+        return undefined;
+    if (NESTED_CONFIG_SCHEMES.has(scheme)) {
+        const nested = parsed[scheme];
+        if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+            return nested;
+        }
+    }
+    // Flat shape (everything else). An empty object means "nothing to write".
+    return Object.keys(parsed).length > 0 ? parsed : undefined;
+}
+export function tomlTableToWebhookConfig(scheme, table) {
+    if (!table || typeof table !== "object" || Array.isArray(table)) {
+        return undefined;
+    }
+    if (Object.keys(table).length === 0)
+        return undefined;
+    // Only the schemes listed nest under their own name; every other scheme
+    // stores its config flat. The two directions read the same list, so a
+    // pull -> push round-trip cannot re-shape a config it did not change.
+    return NESTED_CONFIG_SCHEMES.has(scheme) ? { [scheme]: table } : { ...table };
+}
+function parseWebhookConfigValue(config) {
+    if (!config)
+        return undefined;
+    if (typeof config === "string") {
+        try {
+            const parsed = JSON.parse(config);
+            return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+                ? parsed
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (typeof config === "object" && !Array.isArray(config))
+        return config;
+    return undefined;
+}
 export function serializeWebhook(webhook) {
     const data = {
         webhook: {
@@ -602,18 +673,19 @@ export function serializeWebhook(webhook) {
             toleranceSeconds: webhook.toleranceSeconds,
             deduplicationEnabled: webhook.deduplicationEnabled,
             deduplicationWindowMs: webhook.deduplicationWindowMs,
+            // Per-webhook inbound body cap in bytes. Omitted from TOML when unset so
+            // the webhook keeps the platform default (5 MiB); a value round-trips.
+            maxBodyBytes: webhook.maxBodyBytes ?? undefined,
             secretGracePeriodMs: webhook.secretGracePeriodMs,
         },
     };
-    // Re-emit a `{{secrets.KEY}}` reference so a pull→push round-trip is lossless
-    // (#1235). The server only returns `signingSecret` when it is such a
-    // reference (a real secret is returned masked, never in plaintext); guard on
-    // the template shape here too so a masked or raw value can never be written
-    // to TOML.
-    if (typeof webhook.signingSecret === "string" &&
-        // Whitespace-tolerant (#1468) to match the server's shared resolver, so a
-        // hand-authored spaced reference `{{ secrets.KEY }}` round-trips pull→push.
-        /\{\{\s*secrets\.[A-Z][A-Z0-9_]{0,63}\s*\}\}/.test(webhook.signingSecret)) {
+    // Re-emit the `{{secrets.KEY}}` reference so a pull→push round-trip is
+    // lossless (#1235). `signingSecret` is reference-only (#2254), so the server
+    // returns either the reference verbatim or `null` — it never emits secret
+    // material, which is why the CLI applies no filtering of its own here. A
+    // webhook whose stored value is a legacy literal gets no line at all, and
+    // `signingSecretStatus` is what warns the operator about it (see `sync pull`).
+    if (typeof webhook.signingSecret === "string" && webhook.signingSecret) {
         data.webhook.signingSecret = webhook.signingSecret;
     }
     // Parse JSON fields if they're strings
@@ -639,6 +711,15 @@ export function serializeWebhook(webhook) {
         }
         catch { }
     }
+    // Per-scheme verification settings, e.g.
+    //   [verification.jwt]     header = "..."  algorithms = ["ES256"]  …
+    //   [verification.discord] publicKey = "…"
+    // `{{secrets.KEY}}` references inside round-trip verbatim, the same rule
+    // `signingSecret` follows.
+    const verificationTable = webhookConfigToTomlTable(webhook.verificationScheme, webhook.config);
+    if (verificationTable) {
+        data.verification = { [webhook.verificationScheme]: verificationTable };
+    }
     // Remove undefined values
     Object.keys(data.webhook).forEach(k => {
         if (data.webhook[k] === undefined)
@@ -913,6 +994,16 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
             // as a data-loss fallback (issue #1446).
             inputSchema: serializeWorkflowSchemaField(workflow.inputSchema, "inputSchema", workflow.workflowKey, log),
             outputSchema: serializeWorkflowSchemaField(workflow.outputSchema, "outputSchema", workflow.workflowKey, log),
+            // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
+            // The GET response returns `lock` parsed (an object, null when unset —
+            // like `metadataManifest`). Emit the nested `[workflow.lock]` table only
+            // when present so a fresh pull → push round-trips it and an unset lock
+            // doesn't write a noisy empty table (nor a false `sync diff`). Before this
+            // pull dropped the lock entirely, so a pull → push cycle silently cleared
+            // a server-side lock.
+            lock: workflow.lock && typeof workflow.lock === "object"
+                ? workflow.lock
+                : undefined,
         },
         // Use active config steps, fall back to draft
         steps,
@@ -2292,6 +2383,14 @@ Directory Structure:
                     modifiedAt: webhook.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
                 };
+                // A row still holding a raw secret from before signing secrets became
+                // reference-only (#2254). It is never written to TOML, and every
+                // delivery to it is rejected — pull time is the only place an
+                // operator finds out before the rejections start.
+                if (webhook.signingSecretStatus === "legacy-literal") {
+                    warn(`  webhooks/${filename}: signingSecret still holds a raw value, so every signed delivery to '${webhook.webhookKey}' is rejected. ` +
+                        `Store the value with \`primitive secrets set KEY --value <value>\` and set signingSecret = "{{secrets.KEY}}".`);
+                }
             }
             info(`  Pulled ${webhooks.length} webhook(s)`);
             // Pull cron triggers. An older server without the route (or any other
@@ -3024,7 +3123,8 @@ Directory Structure:
             // (no more `process.exit` bypass class). The per-loop validators below
             // remain as defense-in-depth but are converted to throws too.
             const preflightValidationErrors = [];
-            // Validate all workflow TOMLs (issue #685 misnested-header check).
+            // Validate all workflow TOMLs (#685 misnested-header check and the
+            // #1447 system + accessRule lint).
             const preflightWorkflowsDir = join(configDir, "workflows");
             if (existsSync(preflightWorkflowsDir)) {
                 for (const file of readdirSync(preflightWorkflowsDir).filter((f) => f.endsWith(".toml"))) {
@@ -3107,10 +3207,10 @@ Directory Structure:
                     }
                 }
             }
-            // Validate app.toml settings up-front (issue #1033). A hand-added
-            // `googleClientSecret` key or a mistyped value is a hard error that must
-            // abort BEFORE any mutation — same fail-before-mutate contract as the
-            // vars preflight below. The apply block re-parses for the payload.
+            // Validate app.toml settings up-front (issue #1033). A mistyped value
+            // is a hard error that must abort BEFORE any mutation — same
+            // fail-before-mutate contract as the vars preflight below. The apply
+            // block re-parses for the payload.
             const preflightAppTomlPath = join(configDir, "app.toml");
             if (existsSync(preflightAppTomlPath)) {
                 try {
@@ -3224,7 +3324,7 @@ Directory Structure:
                     const tomlData = parseTomlFile(appTomlPath);
                     // Descriptor-driven parse of every section ([app]/[auth]/[cors]/
                     // [invitations]) — issue #1033. `name` is stripped on cross-app
-                    // push. Errors (secret key / type mismatch) already aborted the
+                    // push. Errors (type mismatch) already aborted the
                     // push in the preflight pass above, so only warnings remain here.
                     const { settings, warnings: appWarnings } = parseTomlToAppSettings(tomlData, { isCrossAppPush });
                     for (const w of appWarnings) {
@@ -3648,6 +3748,10 @@ Directory Structure:
                         toleranceSeconds: webhook.toleranceSeconds,
                         deduplicationEnabled: webhook.deduplicationEnabled,
                         deduplicationWindowMs: webhook.deduplicationWindowMs,
+                        // Body cap is TOML-owned: send `?? null` so removing it from the
+                        // TOML clears the override on the server (back to the 5 MiB
+                        // default); a declared value is forwarded through the same PATCH.
+                        maxBodyBytes: webhook.maxBodyBytes ?? null,
                         secretGracePeriodMs: webhook.secretGracePeriodMs,
                     };
                     // Forward the declared signing secret so a `{{secrets.KEY}}`
@@ -3668,6 +3772,30 @@ Directory Structure:
                     if (tomlData.metadata) {
                         payload.metadata = JSON.stringify(tomlData.metadata);
                     }
+                    // Forward the declared `[verification.<scheme>]` table so scheme
+                    // configuration reaches the server. Without this the table is
+                    // silently dropped and a scheme whose key material lives in
+                    // `config` (discord, jwt, plaid) can never be configured from TOML.
+                    const declaredVerification = tomlData.verification?.[webhook.verificationScheme];
+                    const verificationConfig = tomlTableToWebhookConfig(webhook.verificationScheme, declaredVerification);
+                    // Once a file declares a `[verification]` section, that section
+                    // owns the stored config — so removing the scheme's table clears
+                    // it (`?? null`, the same pattern as `description` above).
+                    // Otherwise revoking a compromised key through the supported path
+                    // would silently no-op: an omitted `config` is dropped from the
+                    // request and the old key keeps verifying deliveries.
+                    //
+                    // A file with no `[verification]` section at all is treated as "not
+                    // managed here" and leaves the stored config alone, so a TOML
+                    // written before this section existed still pushes unrelated edits.
+                    // To clear the config from such a file, add a bare `[verification]`
+                    // table with no scheme sub-table.
+                    if (tomlData.verification !== undefined) {
+                        payload.config = verificationConfig ?? null;
+                    }
+                    else if (verificationConfig) {
+                        payload.config = verificationConfig;
+                    }
                     if (existingId) {
                         changes.push({ type: "webhook", action: "update", key });
                         if (!options.dryRun) {
@@ -4445,10 +4573,12 @@ Directory Structure:
                         info(`  Skipped workflows/${file} — platform-owned workflow "${platformOwnedKey}" (managed by the platform)`);
                         continue;
                     }
-                    // Issue #685: reject misnested headers (e.g.
-                    // [steps.<id>.request]) before pushing. The runtime silently
-                    // ignores fields outside the allowlist, so this is the only
-                    // place to catch the footgun. Validation happens BEFORE the
+                    // Reject misnested headers (#685, e.g. [steps.<id>.request]) and
+                    // the #1447 runAs="system" + accessRule dead-config combo before
+                    // pushing. The runtime silently ignores fields outside the
+                    // allowlist, so this is the only place to catch the footgun, and
+                    // the server rejects a system accessRule (#1258) — flagging it
+                    // here keeps the push all-or-nothing. Validation happens BEFORE the
                     // skip-if-unchanged check so a previously-pushed-but-broken
                     // file gets a clear diagnostic on every push attempt.
                     // Issue #976: validation is now front-loaded before any apply
@@ -4936,6 +5066,28 @@ Directory Structure:
                     const validateExpectedModifiedAt = options.force
                         ? undefined
                         : existingEntry?.modifiedAt;
+                    // Issue #1336 (codex round-1 P1): the final post-push rule content
+                    // of every op this push lands. When the push ALSO changes the
+                    // manifest, the server re-lints child ops against the new manifest;
+                    // forwarding each op's proposed `access`/`params` lets that re-lint
+                    // evaluate the op's post-push form instead of the stale stored row,
+                    // so an atomic manifest-rename + op-rewrite push is not falsely
+                    // rejected. A field is sent as value-or-null (config-as-code: the
+                    // TOML op IS the final state).
+                    const pendingOpUpdates = operations.map((op) => ({
+                        name: op.name,
+                        access: typeof op.access === "string" ? op.access : null,
+                        params: op.params ?? null,
+                    }));
+                    // Issue #1336 (codex round-1 P1/P2): the declared-access manifest
+                    // this push proposes (the parsed object, or null when the type
+                    // declares none / is clearing it). Forwarded as
+                    // `metadataManifestOverride` on the op dry-runs so op-access lints
+                    // run against the manifest the same push is landing, not the stale
+                    // stored one (existing type: a newly-declared key is honored; fresh
+                    // type: an undeclared ref is caught instead of skipped).
+                    const proposedManifest = typeConfig.metadataManifest ??
+                        null;
                     try {
                         // 1. Schema-edit gate (type-config PATCH dry-run) — only when the
                         //    type already exists on the server and we'd actually PATCH a
@@ -4948,13 +5100,53 @@ Directory Structure:
                         //    type-config dry-run at all.
                         if (existingEntry && typeLevelChange) {
                             const validateUpdateData = computeTypeUpdateData();
-                            {
-                                await client.updateDatabaseTypeConfig(resolvedAppId, dbType, pendingOpDeletes.length > 0
-                                    ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
-                                    : validateUpdateData, validateExpectedModifiedAt, {
-                                    dryRun: true,
-                                    acceptWarnings: !!options.acceptWarnings,
-                                });
+                            const baseValidate = pendingOpDeletes.length > 0
+                                ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
+                                : validateUpdateData;
+                            await client.updateDatabaseTypeConfig(resolvedAppId, dbType, 
+                            // Issue #1336 (P1): forward the pending op rewrites so the
+                            // server's child-op re-lint uses each op's post-push content.
+                            { ...baseValidate, pendingOpUpdates }, validateExpectedModifiedAt, {
+                                dryRun: true,
+                                acceptWarnings: !!options.acceptWarnings,
+                            });
+                        }
+                        else if (!existingEntry) {
+                            // Fresh type: run the config CREATE dry-run (issue #1336, codex
+                            // round-1 P2). Before this, a brand-new type's inline config
+                            // rules (`defaultAccess`, `metadataAccess`, autoPopulatedFields,
+                            // triggers) and its manifest were never dry-run — a malformed
+                            // rule reported a clean `sync push --dry-run` then failed only on
+                            // the real POST. Mirror the apply-path create payload below.
+                            const createDryRunData = { databaseType: dbType };
+                            if (typeConfig.ruleSetId)
+                                createDryRunData.ruleSetId = typeConfig.ruleSetId;
+                            if (typeConfig.triggers)
+                                createDryRunData.triggers = typeConfig.triggers;
+                            if (typeConfig.metadataAccess)
+                                createDryRunData.metadataAccess = typeConfig.metadataAccess;
+                            if (typeConfig.defaultAccess)
+                                createDryRunData.defaultAccess = typeConfig.defaultAccess;
+                            if (typeConfig.autoPopulatedFields)
+                                createDryRunData.autoPopulatedFields =
+                                    typeConfig.autoPopulatedFields;
+                            if (typeConfig.timestamps)
+                                createDryRunData.timestamps = typeConfig.timestamps;
+                            if (typeConfig.schema)
+                                createDryRunData.schema = typeConfig.schema;
+                            if (typeConfig.metadataManifest)
+                                createDryRunData.metadataManifest = typeConfig.metadataManifest;
+                            try {
+                                await client.createDatabaseTypeConfig(resolvedAppId, createDryRunData, { dryRun: true });
+                            }
+                            catch (createErr) {
+                                // A 409 means the type already exists server-side (local sync
+                                // state was lost); the fresh-type inline-rule validation does
+                                // not apply and the real push reconciles separately. Any other
+                                // error is a genuine create-time validation failure — re-throw
+                                // so the catch below reports it.
+                                if (createErr?.statusCode !== 409)
+                                    throw createErr;
                             }
                         }
                         // 2. Op-edit gate (op create/update dry-run) for every op in the
@@ -5012,7 +5204,14 @@ Directory Structure:
                                         access: op.access,
                                         definition: op.definition,
                                         params: op.params,
-                                    }, options.force ? undefined : existingOp.modifiedAt, { dryRun: true, schemaOverride: proposedSchema });
+                                    }, options.force ? undefined : existingOp.modifiedAt, {
+                                        dryRun: true,
+                                        schemaOverride: proposedSchema,
+                                        // Issue #1336 (P1/P2): gate the op-access lint against
+                                        // the manifest THIS push is landing, not the stale
+                                        // stored one.
+                                        metadataManifestOverride: proposedManifest,
+                                    });
                                 }
                                 else {
                                     await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
@@ -5025,6 +5224,10 @@ Directory Structure:
                                     }, {
                                         dryRun: true,
                                         schemaOverride: proposedSchema,
+                                        // Issue #1336 (P1/P2): as above — a fresh-type op dry-run
+                                        // now lints against the proposed manifest instead of
+                                        // skipping the lint entirely.
+                                        metadataManifestOverride: proposedManifest,
                                         // Issue #915 (defect a, follow-up): for a fresh type the
                                         // server has no stored config to read `defaultAccess`
                                         // from, so an op that omits `access` to inherit the
@@ -5209,6 +5412,18 @@ Directory Structure:
                                     // exclusion (see derivation above).
                                     updateData.finalOpNames = finalOpNames;
                                 }
+                                // Issue #1336 (codex round-2 P1): forward the pending op
+                                // rewrites on the REAL mutating PATCH too, mirroring the
+                                // dry-run validate pass above. Without this, when the same
+                                // push replaces a manifest key AND rewrites an op that
+                                // references the old key, the server's child-op re-lint runs
+                                // against the stale stored op → INVALID_RULE → the config
+                                // PATCH aborts before the op PATCH lands. Sending the final
+                                // op forms lets the re-lint evaluate each op's post-push
+                                // content, so the atomic manifest-rename + op-rewrite push
+                                // converges. Sent unconditionally (as the dry-run does); a
+                                // field absent from a claim means "not changed" server-side.
+                                updateData.pendingOpUpdates = pendingOpUpdates;
                                 if (typeLevelChange) {
                                     changes.push({ type: "database-type", action: "update", key: dbType });
                                     const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {