primitive-admin 1.1.0-alpha.63 → 1.1.0-alpha.65

package/dist/src/commands/settings.js

@@ -1,102 +1,54 @@
 /**
- * `primitive settings` — the app-settings sync surface (issue #1033, Phase 2).
+ * `primitive settings` — the app-settings READER (issue #1033, Phase 2;
+ * narrowed to a reader by #2645).
  *
- * A focused command for the app-settings TOML round-trip that `sync` handles as
- * part of the whole-config export/import. `settings pull` / `push` / `diff`
- * operate on the SAME `app.toml` and the SAME single `entities.app.contentHash`
- * as `sync`, so the two are interchangeable and idempotent together. `settings
- * show` renders the current server-effective settings (with `googleClientSecret`
- * redacted).
+ * App settings are authored in `app.toml` and applied with `sync push`, so
+ * this group carries the one thing the file cannot answer: what the server is
+ * actually running. `settings get` renders the server-effective settings —
+ * `get` rather than `show`, so the read verb is the same word on every
+ * configuration surface.
  *
- * The command logic lives in `sync-app-settings.ts` so `sync` and `settings`
- * share one implementation; this file only wires up the commander surface.
+ * `settings pull`, `settings diff` and `settings push` are gone. They operated
+ * on the same `app.toml` and the same `entities.app` hash `sync` owns, so they
+ * were a second pathway to one piece of state; `sync pull|diff|push --only app`
+ * is the single one. The remaining command logic lives in
+ * `sync-app-settings.ts`, shared with `sync`.
  */
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { resolveSyncDir, isAutoResolvedSyncDir, checkLegacySyncMigration, } from "../lib/sync-paths.js";
-import { info, warn } from "../lib/output.js";
-import { showAppSettings, pullAppSettings, pushAppSettings, diffAppSettings, } from "./sync-app-settings.js";
-/**
- * Resolve the sync directory and print the per-environment hint the way `sync`
- * does (suppressed under `--json` so stdout stays pure JSON).
- */
-function resolveConfigDir(appId, options) {
-    const configDir = resolveSyncDir({ appId, userDir: options.dir });
-    if (isAutoResolvedSyncDir(options.dir) && !options.json) {
-        info(`Using per-environment sync directory: ${configDir}`);
-        const legacyHint = checkLegacySyncMigration(configDir);
-        if (legacyHint)
-            warn(legacyHint);
-    }
-    return configDir;
-}
+import { showAppSettings } from "./sync-app-settings.js";
 export function registerSettingsCommands(program) {
     const settings = program
         .command("settings")
-        .description("View and sync app settings through app.toml")
+        .description("View the app settings the server is running")
         .addHelpText("after", `
 Examples:
-  $ primitive settings show                 # Render current server settings
-  $ primitive settings show --json          # Machine-readable (secret redacted)
-  $ primitive settings pull                 # Write server settings to app.toml
-  $ primitive settings diff                 # Show local app.toml vs server
-  $ primitive settings push                 # Apply app.toml edits to the server
+  $ primitive settings get                  # Render current server settings
+  $ primitive settings get --json           # Machine-readable
+  $ primitive sync pull --only app          # Write server settings to app.toml
+  $ primitive config set app app.baseUrl=https://example.com
+  $ primitive sync diff --only app          # Show local app.toml vs server
+  $ primitive sync push --only app          # Apply app.toml edits to the server
 
-app.toml is the primary way to manage app configuration. The Google OAuth
-client secret is intentionally excluded from app.toml; set it with
-'primitive apps update <app-id> --google-client-secret <secret>'.
+app.toml is the ONLY way to manage app configuration (issue #2645): a full
+\`sync push\` applies it, and \`sync push --only app\` applies it alone.
+\`primitive config fields app\` lists its keys, types and defaults. The Google OAuth
+client secret is an ordinary [auth] key holding a reference into the app's
+secret store, never the secret itself: store the value with
+'primitive secrets set GOOGLE_CLIENT_SECRET --value <secret>', then set
+googleClientSecret = "{{secrets.GOOGLE_CLIENT_SECRET}}" in app.toml. A literal
+secret there is rejected by the server.
 `);
-    // settings show
+    // settings get
     settings
-        .command("show")
+        .command("get")
         .description("Show the current server-effective app settings")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--json", "Output as JSON (googleClientSecret redacted)")
-        .action(async (appId, options) => {
-        const resolvedAppId = resolveAppId(appId, options);
-        await showAppSettings(new ApiClient(), resolvedAppId, options);
-    });
-    // settings pull
-    settings
-        .command("pull")
-        .description("Write the current server settings to app.toml")
-        .argument("[app-id]", "App ID (uses current app if not specified)")
-        .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .option("--json", "Output as JSON")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
-        const configDir = resolveConfigDir(resolvedAppId, options);
-        await pullAppSettings(new ApiClient(), resolvedAppId, configDir, options);
-    });
-    // settings diff
-    settings
-        .command("diff")
-        .description("Show per-field differences between app.toml and the server")
-        .argument("[app-id]", "App ID (uses current app if not specified)")
-        .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
-        .option("--json", "Output as JSON")
-        .action(async (appId, options) => {
-        const resolvedAppId = resolveAppId(appId, options);
-        const configDir = resolveConfigDir(resolvedAppId, options);
-        await diffAppSettings(new ApiClient(), resolvedAppId, configDir, options);
-    });
-    // settings push
-    settings
-        .command("push")
-        .description("Apply app.toml settings to the server")
-        .argument("[app-id]", "App ID (uses current app if not specified)")
-        .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
-        .option("--force", "Push even if app.toml is unchanged since the last sync")
-        .option("--dry-run", "Show what would be changed without applying")
-        .option("--json", "Output as JSON")
-        .action(async (appId, options) => {
-        const resolvedAppId = resolveAppId(appId, options);
-        const configDir = resolveConfigDir(resolvedAppId, options);
-        await pushAppSettings(new ApiClient(), resolvedAppId, configDir, options);
+        await showAppSettings(new ApiClient(), resolvedAppId, options);
     });
 }
 //# sourceMappingURL=settings.js.map

package/dist/src/commands/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,SAAS,gBAAgB,CACvB,KAAa,EACb,OAAyC;IAEzC,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,CACV,OAAO,EACP;;;;;;;;;;;CAWL,CACI,CAAC;IAEJ,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,SAAS,EAAE,wDAAwD,CAAC;SAC3E,MAAM,CAAC,WAAW,EAAE,6CAA6C,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;CAiBL,CACI,CAAC;IAEJ,eAAe;IACf,QAAQ;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sync.d.ts

@@ -84,15 +84,15 @@ export declare function resolveActiveWorkflowConfig(workflow: any, configs: any[
  *      server's accepted-value canonicalization
  *      (`src/workflows/config/workflow-field-handlers.ts`). A value the server
  *      would REJECT is left alone: push fails loudly for those, so there is
- *      nothing to preview. #2743 — without this, `status = "ACTIVE"` or
+ *      nothing to preview. #2743 — without this, `dequeueOrder = "LIFO"` or
  *      `perUserMaxRunning = 4.9` pushes fine and then reports Modified forever.
  *   4. Fill the model defaults (`WORKFLOW_MODEL_DEFAULTS`) for what the file
  *      omits. `perAppMax*` / `queueTtlSeconds` joined that list in #1177: once
  *      the pull serializer emitted them (a GET always returns them, they carry
  *      a non-null model default), an unchanged workflow hashed unequal to a
  *      local TOML that omits them — a false `modified` that made `config pull`
- *      rewrite the file just to inject defaults. `status` joined it in #2743,
- *      when push began sending `draft` for an omitted status.
+ *      rewrite the file just to inject defaults. (`status` was on this list
+ *      until #2803 took availability off the config wire entirely.)
  *   5. Fill `activeConfigName` with the name the server itself creates
  *      (`default`), so a hand-authored file that never named a config compares
  *      equal to the workflow that pushing it produces (#2743). This is the
@@ -482,23 +482,70 @@ export declare function workflowActiveConfigNameUnresolvable(configDir: string,
  * repeats forever because no push changes it. But the repo does not describe
  * which configuration is live, and only `config pull` records it, so the fact is
  * carried as a hint on the Synced row — the same way an operational disable is
- * (`operationalDisableHint`). The server-created `default` is the shape a
+ * (`outOfServiceHint`). The server-created `default` is the shape a
  * hand-authored file already means, so it is silent.
  *
  * Pure and non-throwing, like every other diff predicate. Returns the existing
  * hint untouched when there is nothing to add.
  */
 export declare function unmanagedActiveConfigHint(localParsed: any, workflow: any, configs: any[], existingHint?: string): string | undefined;
+/**
+ * Drop the archived rows from a pull listing (#2803).
+ *
+ * A tombstone is retired, not configuration. Exporting one wrote a file the
+ * repo then claimed to describe — and, once `status` left the TOML surface, a
+ * file whose very next push would fail on the `status` line it carried.
+ * `config push --prune` is the path that reclaims an archived row; pull's job
+ * is to describe what is configured.
+ */
+export declare function skipArchivedForPull<T extends {
+    status?: unknown;
+}>(items: T[]): T[];
+/**
+ * The sync-state entries a pull keeps for the archived rows it did NOT export
+ * (#2803).
+ *
+ * Pull removes a tombstone's file, and prune candidates come only from prior
+ * sync state — so dropping the state entry with the file would strand the row:
+ * no file to delete, no managed key to prune, and (for webhooks and cron
+ * triggers) a cap slot and a reserved key nothing could ever reclaim, which is
+ * the exact failure #2232 fixed. So the pull records the tombstone instead: no
+ * file, but a managed entry carrying the archived row's CURRENT `modifiedAt`,
+ * so the next opt-in, confirmed `config push --prune` point-reads it, finds it
+ * unchanged, and hard-deletes it — the reclamation path the model promises.
+ *
+ * Only keys the config tree already managed are recorded. A row archived
+ * server-side that this repo never described is not this repo's to delete.
+ *
+ * Pure, so it is unit-testable without a live server.
+ */
+export declare function archivedTombstoneEntries(items: any[], select: {
+    keyOf: (item: any) => string;
+    idOf: (item: any) => string;
+}, managedKeys: Iterable<string>): Record<string, {
+    id: string;
+    modifiedAt: string;
+}>;
 /**
  * The `config diff` annotation for an object an operator took out of service
- * (issue #2645, criterion 9).
+ * (issue #2645, criterion 9; #2803).
+ *
+ * Availability is deliberately not a TOML key, so an object that is out of
+ * service is NOT drift — the committed configuration still describes it
+ * exactly. Saying so out loud is the point: the reason the control exists is
+ * that an out-of-band write used to make `config diff` report a difference
+ * nobody intentionally created (#1976). Reporting it as a hint on an
+ * otherwise-`Synced` row is what keeps that promise visible instead of merely
+ * true.
  *
- * `operationallyDisabled` is deliberately not a TOML key, so a disabled object
- * is NOT drift — the committed configuration still describes it exactly. Saying
- * so out loud is the point: the reason the toggle exists is that an out-of-band
- * write used to make `config diff` report a difference nobody intentionally
- * created (#1976). Reporting it as a hint on an otherwise-`Synced` row is what
- * keeps that promise visible instead of merely true.
+ * Reads either spelling: the canonical `status: "inactive"` for a type that has
+ * cut over to #2803's single control, and the superseded
+ * `operationallyDisabled` boolean for one that has not yet.
+ *
+ * An ARCHIVED row gets its own annotation. `config pull` no longer exports
+ * tombstones, so without one an archived webhook or integration whose file is
+ * still in the tree read as plain `Synced` — the one status where "the server
+ * has exactly what the file says" is most misleading.
  *
  * When the row already carries a hint — a real content difference — the toggle
  * is APPENDED rather than substituted: the drift is the part that needs acting
@@ -506,7 +553,7 @@ export declare function unmanagedActiveConfigHint(localParsed: any, workflow: an
  *
  * Pure, so it is unit-testable without a live server.
  */
-export declare function operationalDisableHint(remote: any, existingHint?: string): string | undefined;
+export declare function outOfServiceHint(remote: any, existingHint?: string): string | undefined;
 /**
  * Serialize an integration DETAIL response to its `integrations/<key>.toml`.
  *
@@ -694,6 +741,16 @@ export declare function rewriteWorkflowSchemasToNative(rawToml: string, workflow
     content: string;
     changed: boolean;
 };
+/**
+ * #2644 — `config push` rejects any key the vendored definition does not
+ * recognize, so a mistyped or newer-server key fails locally instead of being
+ * silently dropped on the way to the server (design gate, 2026-08-12). Returns
+ * the error message, or null when every key is known.
+ *
+ * Works for any migrated type, single or repeated: a repeated table's entries
+ * are checked one by one and the unknown keys reported together, so a typo in
+ * the third `[[configs]]` block is as loud as one in the first.
+ */
 export declare function configUnknownKeyError(filePath: string, tomlData: any, table: ConfigTable): string | null;
 /**
  * #2644 — the document-level half of the same rejection: a top-level table the