primitive-admin 1.1.0-alpha.55 → 1.1.0-alpha.56

package/dist/src/commands/sessions.js

@@ -1,6 +1,8 @@
+import { Option } from "commander";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
 import { error, info, formatTable, formatDate, json, } from "../lib/output.js";
+import { resolveUserSelector } from "../lib/user-selector.js";
 export function registerSessionsCommands(program) {
     const sessions = program
         .command("sessions")
@@ -11,19 +13,29 @@ expired — an expired session that has not yet been swept still appears, with
 ACTIVE = false. Authentication tokens are never returned.
 
 Examples:
-  $ primitive sessions list --user 01HXY...
-  $ primitive sessions list --user 01HXY... --limit 50
-  $ primitive sessions list --user 01HXY... --json
+  $ primitive sessions list --user-id 01HXY...
+  $ primitive sessions list --user-id 01HXY... --limit 50
+  $ primitive sessions list --user-id 01HXY... --json
 `);
     sessions
         .command("list")
         .description("List a user's sessions")
         .option("--app <app-id>", "App ID (uses current app if not specified)")
-        .requiredOption("--user <user-id>", "List sessions for this user")
+        // `--user-id` is canonical (#2357). It cannot be a `requiredOption` any
+        // more, because the deprecated `--user` alias also satisfies the
+        // requirement — commander would reject `--user 01H…` before the alias
+        // resolution runs. The explicit check below keeps the same contract.
+        .option("--user-id <user-id>", "List sessions for this user")
+        .addOption(new Option("--user <user-id>", "Deprecated alias of --user-id").hideHelp())
         .option("--limit <n>", "Maximum rows to return (default 25, max 100)")
         .option("--cursor <cursor>", "Pagination cursor from a previous page")
         .option("--json", "Output as JSON")
         .action(async (options) => {
+        const userId = resolveUserSelector(options, "sessions list");
+        if (!userId) {
+            error("required option '--user-id <user-id>' not specified");
+            process.exit(1);
+        }
         const resolvedAppId = resolveAppId(undefined, options);
         const client = new ApiClient();
         const limit = options.limit ? Number(options.limit) : undefined;
@@ -33,7 +45,7 @@ Examples:
             process.exit(1);
         }
         try {
-            const { items, nextCursor } = await client.listSessions(resolvedAppId, options.user, { limit, cursor: options.cursor });
+            const { items, nextCursor } = await client.listSessions(resolvedAppId, userId, { limit, cursor: options.cursor });
             if (options.json) {
                 json({ items, nextCursor });
                 return;

package/dist/src/commands/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/commands/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,KAAK,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,0CAA0C,CAAC;SACvD,WAAW,CACV,OAAO,EACP;;;;;;;;;CASL,CACI,CAAC;IAEJ,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,EACpD,CAAC;YACD,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CACrD,aAAa,EACb,OAAO,CAAC,IAAI,EACZ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAClC,CAAC;YAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,KAA8B,EAAE;gBAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;gBAC3D,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE;gBACpE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/commands/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,KAAK,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,0CAA0C,CAAC;SACvD,WAAW,CACV,OAAO,EACP;;;;;;;;;CASL,CACI,CAAC;IAEJ,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,qEAAqE;SACpE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,SAAS,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC,QAAQ,EAAE,CAAC;SACrF,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,EACpD,CAAC;YACD,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CACrD,aAAa,EACb,MAAM,EACN,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAClC,CAAC;YAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,KAA8B,EAAE;gBAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;gBAC3D,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE;gBACpE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sync-app-settings.d.ts

@@ -41,6 +41,25 @@ export declare function serializeAppSettings(settings: any): string;
  * the same hash.
  */
 export declare function writeAppSettingsToml(configDir: string, settings: any): string;
+/**
+ * The pull-time warning for a `googleClientSecret` the server withheld, or
+ * `null` when the stored value is a reference (or unset).
+ *
+ * Shared by `settings pull` and `sync pull` so both report the same thing —
+ * neither one could say anything at all before (#2307). A withheld value is
+ * absent from the `app.toml` they just wrote AND absent from a push built out
+ * of that file, and a settings write that does not carry a `googleClientSecret`
+ * is exactly what the server rejects while the stored value is unmigrated
+ * (`validateGoogleClientSecretMigration`). So the pulled file is not pushable
+ * until the field is migrated, and pull is where the operator can still act on
+ * that.
+ *
+ * `subject` lets `sync pull` name the file and match the indentation of its
+ * other per-entity lines.
+ */
+export declare function pulledGoogleClientSecretWarning(settings: any, options?: {
+    subject?: string;
+}): string | null;
 /**
  * Validate a parsed `app.toml` for push and return the fatal errors (a type
  * mismatch). An empty array means the push may proceed. Warnings (unrecognized

package/dist/src/commands/sync-app-settings.js

@@ -29,6 +29,7 @@ import { createHash } from "crypto";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
 import { APP_SETTINGS_DESCRIPTOR, APP_SETTINGS_SECTIONS, serializeAppSettingsToToml, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
 import { getServerUrl } from "../lib/config.js";
+import { googleClientSecretStatusWarning } from "../lib/google-client-secret-status.js";
 import { success, error, info, warn, json, result as printResult, divider, } from "../lib/output.js";
 /** The app-settings file name inside a sync directory. */
 export const APP_TOML_FILENAME = "app.toml";
@@ -62,6 +63,29 @@ export function writeAppSettingsToml(configDir, settings) {
     writeFileSync(path, serializeAppSettings(settings));
     return contentHashOfFile(path);
 }
+/**
+ * The pull-time warning for a `googleClientSecret` the server withheld, or
+ * `null` when the stored value is a reference (or unset).
+ *
+ * Shared by `settings pull` and `sync pull` so both report the same thing —
+ * neither one could say anything at all before (#2307). A withheld value is
+ * absent from the `app.toml` they just wrote AND absent from a push built out
+ * of that file, and a settings write that does not carry a `googleClientSecret`
+ * is exactly what the server rejects while the stored value is unmigrated
+ * (`validateGoogleClientSecretMigration`). So the pulled file is not pushable
+ * until the field is migrated, and pull is where the operator can still act on
+ * that.
+ *
+ * `subject` lets `sync pull` name the file and match the indentation of its
+ * other per-entity lines.
+ */
+export function pulledGoogleClientSecretWarning(settings, options = {}) {
+    return googleClientSecretStatusWarning(settings?.googleClientSecretStatus, {
+        subject: options.subject ?? "googleClientSecret",
+        withheldFrom: "the app.toml just written",
+        blocks: "pushing this app.toml back is rejected",
+    });
+}
 /**
  * Validate a parsed `app.toml` for push and return the fatal errors (a type
  * mismatch). An empty array means the push may proceed. Warnings (unrecognized
@@ -168,12 +192,14 @@ export async function showAppSettings(client, appId, options = {}) {
         }
         // `googleClientSecretStatus` is not a descriptor field (it is derived, and
         // never written back), so it prints here rather than in a section.
-        if (settings.googleClientSecretStatus === "legacy-literal") {
+        const statusWarning = googleClientSecretStatusWarning(settings.googleClientSecretStatus, {
+            subject: "googleClientSecret",
+            withheldFrom: "this output",
+            blocks: "the next settings write will be rejected",
+        });
+        if (statusWarning) {
             divider();
-            warn("googleClientSecret still holds a raw value rather than a {{secrets.KEY}} reference, " +
-                "so it is withheld from this output. Google sign-in keeps working, but the value is " +
-                "deprecated and the next settings write will be rejected until it is migrated. " +
-                'Store the value with `primitive secrets set KEY --value <value>` and set googleClientSecret = "{{secrets.KEY}}".');
+            warn(statusWarning);
         }
     }
     catch (err) {
@@ -195,6 +221,14 @@ export async function pullAppSettings(client, appId, configDir, options = {}) {
         ensureDir(configDir);
         const contentHash = writeAppSettingsToml(configDir, settings);
         stampAppContentHash(configDir, appId, contentHash);
+        // A withheld value is never written to the TOML, so pull is where an
+        // operator finds out the app is still on an unmigrated literal — and that
+        // pushing the file back will be rejected until it is fixed. Emitted before
+        // the `--json` return because `warn` writes to stderr: the JSON payload on
+        // stdout stays machine-readable either way.
+        const statusWarning = pulledGoogleClientSecretWarning(settings);
+        if (statusWarning)
+            warn(statusWarning);
         if (options.json) {
             json({ wrote: true, path: appTomlPath(configDir), contentHash });
             return;

package/dist/src/commands/sync-app-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-app-settings.js","sourceRoot":"","sources":["../../../src/commands/sync-app-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,GAEvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,MAAM,IAAI,WAAW,EACrB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,OAAO,mBAAmB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAAa;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA6B,EAC7B,UAAwC,EAAE;IAE1C,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAEhF,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,KAAgB;IACxD,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACjE,MAAM,KAAK,GACT,QAAQ,IAAI,CAAC,eAAe;QAC1B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC;YACE,KAAK;YACL,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,YAAY,EAAE;YAChD,YAAY,EAAE,GAAG;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;IACR,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACtD,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,CAAU,EAAE,CAAU;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAM,OAA6B,CACpD,CAAC;YACF,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,CAAE,QAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,QAAQ,CAAC,wBAAwB,KAAK,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,IAAI,CACF,sFAAsF;gBACpF,qFAAqF;gBACrF,gFAAgF;gBAChF,kHAAkH,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,gCAAgC,KAAK,GAAG,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC9D,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAAiE,EAAE;IAEnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,wCAAwC,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAE1D,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,QAAQ,EAAE;YACtE,cAAc;SACf,CAAC,CAAC;QAEH,+CAA+C;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,6BAA6B,CACzG,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC;QACtC,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,sCAAsC,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,wCAAwC,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CACH,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAE1D,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,QAAQ,EAAE;YACnE,cAAc;SACf,CAAC,CAAC;QAEH,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,gCAAgC,CAC5G,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,SAAS,GAAI,MAA8B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,oBAAoB,iBAAiB,2BAA2B,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,iBAAiB,kBAAkB,CAAC,CAAC;QACrF,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"sync-app-settings.js","sourceRoot":"","sources":["../../../src/commands/sync-app-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,GAEvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAExF,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,MAAM,IAAI,WAAW,EACrB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,OAAO,mBAAmB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAAa;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAa,EACb,UAAgC,EAAE;IAElC,OAAO,+BAA+B,CAAC,QAAQ,EAAE,wBAAwB,EAAE;QACzE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,oBAAoB;QAChD,YAAY,EAAE,2BAA2B;QACzC,MAAM,EAAE,wCAAwC;KACjD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA6B,EAC7B,UAAwC,EAAE;IAE1C,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAEhF,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,KAAgB;IACxD,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACjE,MAAM,KAAK,GACT,QAAQ,IAAI,CAAC,eAAe;QAC1B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC;YACE,KAAK;YACL,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,YAAY,EAAE;YAChD,YAAY,EAAE,GAAG;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;IACR,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACtD,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,CAAU,EAAE,CAAU;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAM,OAA6B,CACpD,CAAC;YACF,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,CAAE,QAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,+BAA+B,CACnD,QAAQ,CAAC,wBAAwB,EACjC;YACE,OAAO,EAAE,oBAAoB;YAC7B,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,0CAA0C;SACnD,CACF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,aAAa,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,gCAAgC,KAAK,GAAG,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC9D,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEnD,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,4CAA4C;QAC5C,MAAM,aAAa,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,aAAa;YAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAAiE,EAAE;IAEnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,wCAAwC,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAE1D,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,QAAQ,EAAE;YACtE,cAAc;SACf,CAAC,CAAC;QAEH,+CAA+C;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,6BAA6B,CACzG,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC;QACtC,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,sCAAsC,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,wCAAwC,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CACH,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAE1D,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,QAAQ,EAAE;YACnE,cAAc;SACf,CAAC,CAAC;QAEH,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,gCAAgC,CAC5G,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,SAAS,GAAI,MAA8B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,oBAAoB,iBAAiB,2BAA2B,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,iBAAiB,kBAAkB,CAAC,CAAC;QACrF,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/src/commands/sync.d.ts

@@ -119,6 +119,44 @@ export declare function planVarsPull(outcome: {
     content: string | null;
     varEntities: Record<string, VarEntity>;
 };
+/**
+ * Validate a `sync push`'s webhook writes against the server's per-app cap.
+ * Returns a list of human-readable errors (empty when the push may proceed).
+ *
+ * Run in `sync push`'s up-front preflight (the `planVarsPush` cap pattern) so a
+ * push that would run past the cap aborts BEFORE any mutation. Without it the
+ * push creates webhooks one at a time until the server rejects one at the cap,
+ * leaving a partial push.
+ *
+ * **Only creates are capped.** The server grandfathers apps that already hold
+ * more webhooks than the cap: it refuses new creates and nothing else. A plain
+ * file count would break that — `sync pull` writes one toml per webhook, so a
+ * grandfathered app pulls more files than the cap and could then never push
+ * again, its workflows, databases and vars included. So the check compares the
+ * local keys against the keys already on the server: a push that creates
+ * nothing new is always allowed, however far over the cap the app is, and a
+ * push that does create is rejected only when the resulting row count would
+ * exceed the cap.
+ *
+ * The remote key list this runs against comes from `GET
+ * /admin/api/apps/{appId}/webhooks`, which applies no default status filter, so
+ * archived rows are in `remoteKeys` exactly as they are in the server's count.
+ * The two therefore agree on what is already on the server.
+ *
+ * Still advisory rather than authoritative: this counts creates the way the
+ * *config dir* implies, while the apply loop decides create-vs-update from
+ * local sync state, so a checkout with missing sync state issues creates this
+ * check did not predict. Those creates name keys the server already holds, and
+ * the server does not cap a create that adds no row — it answers 409
+ * `WEBHOOK_KEY_EXISTS`, which `adoptByKeyOnCreate409` converges on. A push
+ * allowed here can still be rejected server-side (concurrent writes, a stale
+ * list); that rejection carries `WEBHOOK_LIMIT_REACHED` and names the limit.
+ *
+ * Planned prunes are deliberately NOT netted out of the count: `--prune` runs
+ * after the webhook create loop, so a push that only fits once its prunes land
+ * would still fail mid-apply. Prune first, then push the additions.
+ */
+export declare function validateWebhookCapForPush(localKeys: string[], remoteKeys: string[]): string[];
 /**
  * Validate a parsed `vars.toml` table against the same key/value constraints
  * the server enforces (key format, string type, non-empty, size cap) plus the

package/dist/src/commands/sync.js

@@ -14,14 +14,17 @@ import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneS
 import { validateWorkflowToml, formatWorkflowTomlErrors, validateWorkflowExpressionsToml, validateWorkflowExpressionsRawToml, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
+import { canonicalJsonStringify } from "../lib/canonical-json.js";
+import { reconcileWorkflowIncludes } from "../lib/workflow-include-preserve.js";
 import { serializeSection, parseTomlToAppSettings, } from "../lib/app-settings-descriptor.js";
-import { serializeAppSettings, collectAppSettingsPushErrors, } from "./sync-app-settings.js";
+import { serializeAppSettings, collectAppSettingsPushErrors, pulledGoogleClientSecretWarning, } from "./sync-app-settings.js";
 import { applyWorkflowBody } from "../lib/workflow-apply.js";
 import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../lib/workflow-payload.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
 import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, applyPrune, attemptFetch, classifyLocalOnly, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, hasUncommittedChanges, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import { confirmPrompt, ConfirmPromptError } from "../lib/confirm-prompt.js";
+import { signingSecretStatusWarning } from "../lib/signing-secret-status.js";
 import chalk from "chalk";
 function ensureDir(dirPath) {
     if (!existsSync(dirPath)) {
@@ -91,36 +94,6 @@ export function shouldPushFile(filePath, storedHash) {
         return true;
     return computeFileHash(filePath) !== storedHash;
 }
-/**
- * Canonical-JSON serializer for hash computation.
- *
- * Sorts object keys at every level so two semantically-equivalent JSON
- * blobs produce the same string. Arrays preserve order (step order
- * matters in workflows). Used by `computeExpandedContentHash`.
- */
-function canonicalJsonStringify(value) {
-    if (value === null || typeof value !== "object") {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return "[" + value.map((v) => canonicalJsonStringify(v)).join(",") + "]";
-    }
-    // Honor `toJSON` before the key walk. A `Date` — or smol-toml's `TomlDate`,
-    // what a TOML datetime literal parses to — has no enumerable own keys, so
-    // the `Object.keys()` walk below would collapse it to "{}" and every
-    // datetime would hash identically (issue #1919). Both implement `toJSON`,
-    // returning the ISO string; recursing on it makes date-like values (nested
-    // ones too) participate in the hash. Matches JSON.stringify's own semantics.
-    if (typeof value.toJSON === "function") {
-        return canonicalJsonStringify(value.toJSON());
-    }
-    const keys = Object.keys(value).sort();
-    return ("{" +
-        keys
-            .map((k) => JSON.stringify(k) + ":" + canonicalJsonStringify(value[k]))
-            .join(",") +
-        "}");
-}
 /**
  * Hash the *expanded* (post-fragment-splice) content of a workflow TOML.
  *
@@ -351,6 +324,71 @@ const MAX_VAR_VALUE_BYTES = 2048;
  * import the Worker service module.
  */
 const MAX_VARS_PER_APP = 100;
+/**
+ * Maximum number of webhooks per app — mirrors the server's
+ * `MAX_WEBHOOKS_PER_APP` (`src/app-api/services/webhook-limits.ts`, #2232).
+ * Kept in sync manually because the CLI can't import the Worker service module;
+ * a CLI integration test asserts the server's rejection message names this same
+ * number.
+ */
+const MAX_WEBHOOKS_PER_APP = 50;
+/**
+ * Validate a `sync push`'s webhook writes against the server's per-app cap.
+ * Returns a list of human-readable errors (empty when the push may proceed).
+ *
+ * Run in `sync push`'s up-front preflight (the `planVarsPush` cap pattern) so a
+ * push that would run past the cap aborts BEFORE any mutation. Without it the
+ * push creates webhooks one at a time until the server rejects one at the cap,
+ * leaving a partial push.
+ *
+ * **Only creates are capped.** The server grandfathers apps that already hold
+ * more webhooks than the cap: it refuses new creates and nothing else. A plain
+ * file count would break that — `sync pull` writes one toml per webhook, so a
+ * grandfathered app pulls more files than the cap and could then never push
+ * again, its workflows, databases and vars included. So the check compares the
+ * local keys against the keys already on the server: a push that creates
+ * nothing new is always allowed, however far over the cap the app is, and a
+ * push that does create is rejected only when the resulting row count would
+ * exceed the cap.
+ *
+ * The remote key list this runs against comes from `GET
+ * /admin/api/apps/{appId}/webhooks`, which applies no default status filter, so
+ * archived rows are in `remoteKeys` exactly as they are in the server's count.
+ * The two therefore agree on what is already on the server.
+ *
+ * Still advisory rather than authoritative: this counts creates the way the
+ * *config dir* implies, while the apply loop decides create-vs-update from
+ * local sync state, so a checkout with missing sync state issues creates this
+ * check did not predict. Those creates name keys the server already holds, and
+ * the server does not cap a create that adds no row — it answers 409
+ * `WEBHOOK_KEY_EXISTS`, which `adoptByKeyOnCreate409` converges on. A push
+ * allowed here can still be rejected server-side (concurrent writes, a stale
+ * list); that rejection carries `WEBHOOK_LIMIT_REACHED` and names the limit.
+ *
+ * Planned prunes are deliberately NOT netted out of the count: `--prune` runs
+ * after the webhook create loop, so a push that only fits once its prunes land
+ * would still fail mid-apply. Prune first, then push the additions.
+ */
+export function validateWebhookCapForPush(localKeys, remoteKeys) {
+    const remote = new Set(remoteKeys);
+    const creates = [...new Set(localKeys)].filter((k) => !remote.has(k));
+    if (creates.length === 0)
+        return [];
+    const finalCount = remote.size + creates.length;
+    if (finalCount <= MAX_WEBHOOKS_PER_APP)
+        return [];
+    // The overshoot is measured against the cap, but never ask for more files
+    // than exist: on a grandfathered over-cap app (remote.size > the cap) the
+    // overshoot exceeds `creates.length`, and removing every new file is enough
+    // — a push that creates nothing is always allowed.
+    const excess = Math.min(creates.length, finalCount - MAX_WEBHOOKS_PER_APP);
+    return [
+        `webhooks/ would create ${creates.length} new webhook(s), leaving ${finalCount} on the server ` +
+            `(it already holds ${remote.size}), exceeding the maximum of ${MAX_WEBHOOKS_PER_APP} webhooks per app. ` +
+            `Remove ${excess} new webhook file(s), or hard-delete webhooks you no longer ` +
+            `need (\`primitive webhooks delete <id> --hard\`), before pushing.`,
+    ];
+}
 /**
  * Validate a parsed `vars.toml` table against the same key/value constraints
  * the server enforces (key format, string type, non-empty, size cap) plus the
@@ -2322,6 +2360,16 @@ Directory Structure:
                 const appTomlPath = join(configDir, "app.toml");
                 writeFileSync(appTomlPath, serializeAppSettings(settings));
                 info("  Wrote app.toml");
+                // A googleClientSecret the server withheld is not in the file, so
+                // pull time is where an operator finds out: a legacy literal from
+                // before reference-only still signs in (#2256), a malformed
+                // reference does not — and either one makes a push of this file
+                // fail. Same wording as `settings pull` and `settings show`.
+                const googleSecretWarning = pulledGoogleClientSecretWarning(settings, {
+                    subject: "  app.toml: googleClientSecret",
+                });
+                if (googleSecretWarning)
+                    warn(googleSecretWarning);
             }
             // Write config vars (issue #1423). A single flat vars.toml at the
             // sync-dir root (like app.toml), holding the per-environment non-secret
@@ -2383,14 +2431,16 @@ Directory Structure:
                     modifiedAt: webhook.modifiedAt || new Date().toISOString(),
                     contentHash: computeFileHash(filePath),
                 };
-                // A row still holding a raw secret from before signing secrets became
-                // reference-only (#2254). It is never written to TOML, and every
-                // delivery to it is rejected — pull time is the only place an
-                // operator finds out before the rejections start.
-                if (webhook.signingSecretStatus === "legacy-literal") {
-                    warn(`  webhooks/${filename}: signingSecret still holds a raw value, so every signed delivery to '${webhook.webhookKey}' is rejected. ` +
-                        `Store the value with \`primitive secrets set KEY --value <value>\` and set signingSecret = "{{secrets.KEY}}".`);
-                }
+                // A stored value that is not a reference is never written to TOML, so
+                // pull time is where an operator finds out: a legacy literal from
+                // before reference-only still verifies deliveries (#2254, #2332), a
+                // malformed reference does not. Same wording as `webhooks get`.
+                const signingSecretWarning = signingSecretStatusWarning(webhook.signingSecretStatus, {
+                    subject: `  webhooks/${filename}: signingSecret for '${webhook.webhookKey}'`,
+                    blocks: "pushing this webhook is rejected",
+                });
+                if (signingSecretWarning)
+                    warn(signingSecretWarning);
             }
             info(`  Pulled ${webhooks.length} webhook(s)`);
             // Pull cron triggers. An older server without the route (or any other
@@ -2451,19 +2501,45 @@ Directory Structure:
             for (const { workflow, draft, configs } of workflows) {
                 const filename = `${workflow.workflowKey}.toml`;
                 const filePath = join(configDir, "workflows", filename);
-                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || [], (msg) => info(`  ${msg}`)));
+                const remoteToml = serializeWorkflow(workflow, draft, configs || [], (msg) => info(`  ${msg}`));
+                // #2416 — a locally fragment-authored workflow (`[[include]]`) must
+                // survive the pull. `reconcileWorkflowIncludes` leaves the file
+                // alone when it already expands to what the server runs, and
+                // re-emits it with the include blocks intact when the server
+                // drifted in a way fragments can still express. Files without an
+                // `include` key take the unchanged write-the-server-form path.
+                const reconciled = reconcileWorkflowIncludes({
+                    workflowKey: workflow.workflowKey,
+                    localPath: filePath,
+                    localContent: existsSync(filePath)
+                        ? readFileSync(filePath, "utf-8")
+                        : undefined,
+                    remoteToml,
+                    hashParsedToml: hashWorkflowTomlForDiff,
+                });
+                if (reconciled.message) {
+                    info(`  ${reconciled.message}`);
+                }
+                if (reconciled.action === "write-merged") {
+                    writeFileSync(filePath, reconciled.content);
+                }
+                else if (reconciled.action === "write-expanded") {
+                    writeFileSync(filePath, remoteToml);
+                }
                 // Hash the expanded (post-fragment-splice) form so subsequent pushes
                 // can detect fragment-only edits. See `computeExpandedContentHash`.
-                // Pulled workflows never carry `include`, so the expander is a
-                // no-op here — but we use the same canonical-JSON hash function so
-                // the push-side comparison stays consistent.
+                // `parseTomlFile` re-reads whatever is now on disk and expands it, so
+                // a preserved fragment file hashes by its expansion — the same value
+                // the fully expanded form would have produced.
                 workflowEntities[workflow.workflowKey] = {
                     id: workflow.workflowId,
                     modifiedAt: workflow.modifiedAt || new Date().toISOString(),
                     activeConfigId: workflow.activeConfigId,
                     contentHash: computeExpandedContentHash(parseTomlFile(filePath)),
                 };
-                info(`  Wrote workflows/${filename}`);
+                if (reconciled.action !== "skip") {
+                    info(`  Wrote workflows/${filename}`);
+                }
             }
             // #1660 — remove any pre-fix stray `workflows/__internal.*.toml` a prior
             // (buggy) pull exported. Match on the RESOLVED `[workflow].key`, never on
@@ -3311,6 +3387,51 @@ Directory Structure:
                         `delete unneeded vars, then push again.`);
                 }
             }
+            // Per-app webhook cap (#2232) — checked here, before ANY mutation, so a
+            // push that would run past the cap aborts instead of creating webhooks
+            // one at a time until the server rejects one and leaves a partial push.
+            //
+            // Compares the local keys against the keys already on the server rather
+            // than counting `webhooks/*.toml` files: the server grandfathers apps
+            // already over the cap and refuses only new creates, and `sync pull`
+            // writes one file per webhook, so a file count would lock a
+            // grandfathered app out of pushing anything at all.
+            const preflightWebhooksDir = join(configDir, "webhooks");
+            if (existsSync(preflightWebhooksDir)) {
+                const localWebhookKeys = readdirSync(preflightWebhooksDir)
+                    .filter((f) => f.endsWith(".toml"))
+                    .map((f) => {
+                    try {
+                        const parsed = parseTomlFile(join(preflightWebhooksDir, f));
+                        return parsed?.webhook?.key || basename(f, ".toml");
+                    }
+                    catch {
+                        // A malformed file already failed validation elsewhere in the
+                        // push; fall back to the filename so the count stays right.
+                        return basename(f, ".toml");
+                    }
+                });
+                let remoteWebhookKeys = null;
+                try {
+                    const remoteItems = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+                    remoteWebhookKeys = remoteItems.map((w) => w.webhookKey);
+                }
+                catch (err) {
+                    // Advisory check only — the server enforces the cap itself with a
+                    // `WEBHOOK_LIMIT_REACHED` 400. Skipping is better than guessing:
+                    // treating an unreadable list as "the app is empty" would block a
+                    // grandfathered app's legitimate push.
+                    warn(`  Could not list existing webhooks to pre-check the ${MAX_WEBHOOKS_PER_APP}-webhook limit ` +
+                        `(${err?.message || String(err)}); the server will enforce it.`);
+                }
+                if (remoteWebhookKeys) {
+                    const capErrors = validateWebhookCapForPush(localWebhookKeys, remoteWebhookKeys);
+                    if (capErrors.length > 0) {
+                        throw new Error(`Aborting push: ${capErrors.length} webhook limit error(s) — no changes were applied.\n` +
+                            capErrors.map((e) => `  ${e}`).join("\n"));
+                    }
+                }
+            }
             // Process app settings
             const appTomlPath = join(configDir, "app.toml");
             if (existsSync(appTomlPath)) {