primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/app-settings-descriptor.js

@@ -0,0 +1,583 @@
+/**
+ * Shared field descriptor for app-settings TOML sync (issue #1033).
+ *
+ * A single source of truth describing every app setting that round-trips
+ * through `app.toml`. It drives BOTH directions:
+ *  - pull  (`serializeAppSettingsToToml`): server settings -> `app.toml` object
+ *  - push  (`parseTomlToAppSettings`):     `app.toml` object -> settings payload
+ *
+ * Driving serializer and parser from one table means the two can never drift
+ * apart, and a single drift test can assert the descriptor stays in step with
+ * the server's `GET /settings` response and `PUT /settings` allow-list. This
+ * generalizes the earlier hand-maintained `AUTH_BOOLEAN_KEYS` /
+ * `RECOGNIZED_AUTH_KEYS` pattern to every section, and fully replaces it.
+ *
+ * Design decisions of record (issue #1033):
+ *  - Google is a typed client MAP (#2891): `googleClients` renders as
+ *    `[auth.google.clients.<type>]`, and each entry's `clientSecret` holds a
+ *    whole `{{secrets.KEY}}` reference rather than the secret itself, so the
+ *    map round-trips through `app.toml` like any other setting.
+ *  - `[cors]` is always emitted (the `mode` key is `emit: "always"`), even in
+ *    universal mode. A one-time diff on the next pull for existing apps is
+ *    acceptable.
+ *  - `[invitations]` is an additive table for the member-invitation fields.
+ *  - Nothing is writable-but-excluded any more (#2891). The legacy passkey
+ *    pair and the three Google/redirect scalars are RETIRED: not writable, not
+ *    synced, and refused by name with their own guidance when an old
+ *    `app.toml` still carries them.
+ *  - Push type mismatches are field-named validation errors — no silent
+ *    coercion of a mistyped TOML value.
+ *  - THE FILE IS THE WHOLE TRUTH (#2880, sponsor 2026-08-21). `app.toml` used
+ *    to be the one surface where an omitted key preserved the server's value,
+ *    while every other type follows "the local file is the source of truth"
+ *    (#1567). That exception is gone: push emits a value for EVERY writable
+ *    field, and a key the file does not carry clears the field or resets it to
+ *    its declared default (`APP_SETTINGS_ABSENT_VALUES`). `[app].name` and
+ *    `[app].mode` are the two exceptions — no default, identity-critical, and
+ *    `mode: null` is a 400 — so their absence is a validation error instead.
+ */
+import { findUnknownDocumentKeys, requireConfigSurface, } from "./config-surface.js";
+import { retiredConfigKey } from "./generated-config-surfaces.js";
+import { canonicalizeSecretReference } from "./server-text-normalization.js";
+/**
+ * The vendored `app-settings` definition (#2644) this module projects. Read
+ * once at load; a missing definition fails loudly rather than yielding an
+ * empty descriptor that would silently sync nothing.
+ */
+const APP_SETTINGS_SURFACE = requireConfigSurface("app-settings");
+/**
+ * Every field that round-trips through `app.toml` — DERIVED from the
+ * `app-settings` configuration-object definition (#2644), not listed.
+ *
+ * The definition already states each field's section (its table's TOML path),
+ * its `app.toml` key, its type and its `emit` rule, and the coverage guard
+ * holds it against the `App` model. Restating those 26 entries here made
+ * adding a setting two edits that a parity test then compared — the "two lists
+ * and a test they agree" shape the design gate rejected (2026-08-12). One edit
+ * in the definition now reaches the server allow-list
+ * (`settings-fields.ts`), this descriptor, and both directions of the sync.
+ *
+ * `json` in the definition is this module's `object` — the same shape under the
+ * name each side has always used for it.
+ */
+export const APP_SETTINGS_DESCRIPTOR = APP_SETTINGS_SURFACE.tables.flatMap((table) => table.fields.map((field) => ({
+    field: field.field,
+    section: table.tomlPath[0],
+    key: field.tomlKey,
+    type: (field.type === "json" ? "object" : field.type),
+    emit: field.emit,
+})));
+/**
+ * Section render order for a stable, diff-friendly `app.toml` — the
+ * definition's table order (#2644), so a new section is rendered by being
+ * declared there.
+ */
+export const APP_SETTINGS_SECTIONS = APP_SETTINGS_SURFACE.tables.map((table) => table.tomlPath[0]);
+/**
+ * `GET /settings` keys that are computed/read-only and never sync (no server
+ * setter). The external coverage drift test classifies these here.
+ */
+export const IGNORED_GET_KEYS = new Set([
+    "appId",
+    // `hasGoogleAuth`, `googleClientSecretSet` and `googleClientSecretStatus` are
+    // GONE (#2891), not ignored: the first could not describe a per-platform
+    // configuration, and the other two existed only to report a value the server
+    // refused to send back. The map states availability per entry and the stored
+    // reference is echoed, so a response still carrying any of them is a server
+    // this CLI does not understand — worth failing the drift guard over.
+    //
+    // `hasAppleAuth` / `hasPasskey` stay: the asymmetry is deliberate, since
+    // Apple and passkeys have no map to derive per-platform truth from.
+    "hasAppleAuth",
+    "hasPasskey",
+    // #2884 — compatibility fields DERIVED from the one email sign-in flow; the
+    // tenant PUT and app.toml retired them, GET still emits both for older
+    // clients. Computed, never synced.
+    "magicLinkEnabled",
+    "otpEnabled",
+    "createdAt",
+    "modifiedAt",
+]);
+/**
+ * Fields that ARE still writable server-side (present in the `PUT /settings`
+ * allow-list) but are deliberately excluded from TOML because a newer field
+ * supersedes them. Kept distinct from `IGNORED_GET_KEYS` so the coverage test's
+ * "every allow-listed field is covered" claim stays true — these are excluded,
+ * not read-only. (Codex design-review concern #1.)
+ */
+export const DEPRECATED_WRITABLE_EXCLUDED = new Set(
+// Derived (#2644): `deprecated` is exactly "still writable, superseded by
+// another field", which is what this set has always meant.
+APP_SETTINGS_SURFACE.tables.flatMap((table) => Object.entries(table.notExposed)
+    .filter(([, classification]) => classification.kind === "deprecated")
+    .map(([field]) => field)));
+export const APP_SETTINGS_ABSENT_VALUES = {
+    // [app]
+    name: { required: true },
+    mode: { required: true },
+    baseUrl: { value: null },
+    waitlistEnabled: { value: false },
+    waitlistNotifyAdmins: { value: true },
+    allowedDomains: { value: null },
+    testAccountBaseEmails: { value: null },
+    // #2816: absent ⇒ cleared, which puts the app back on the DEPLOYMENT's
+    // large-document window rather than on a number of its own. There is no
+    // default to reset to for the same reason the field has none.
+    largeDocumentWindowDays: { value: null },
+    // [auth]
+    googleOAuthEnabled: { value: null },
+    googleClients: { value: null },
+    passkeyEnabled: { value: false },
+    // #2884: the one email sign-in setting, absent ⇒ `true` because that is what
+    // `GET /settings` reports for a row storing none of the three fields
+    // (`isEmailSignInEnabled`) — the equality the table above exists to hold.
+    // Stated consequence: a hand-authored file that never carried the key pushes
+    // email sign-in ON, exactly as omitting `magicLinkEnabled` / `otpEnabled`
+    // did before the collapse. A pulled file always states the setting
+    // (`emit: "always"`), so this only bites a file authored without it.
+    emailSignInEnabled: { value: true },
+    appleSignInEnabled: { value: null },
+    appleAudiences: { value: null },
+    emailRedirectUris: { value: null },
+    passkeyRpConfig: { value: null },
+    // #3027 — absent means the default "preferred" policy, which is what
+    // `GET /settings` reports (`app.passkeyUserVerification ?? null`) for a row
+    // that stores none. A file without the key pushes null, not "preferred", so
+    // the app keeps following the default rather than pinning today's value.
+    passkeyUserVerification: { value: null },
+    // [cors]
+    corsMode: { value: "universal" },
+    corsAllowedOrigins: { value: null },
+    corsAllowCredentials: { value: false },
+    corsAllowedMethods: { value: null },
+    corsAllowedHeaders: { value: null },
+    corsExposedHeaders: { value: null },
+    corsMaxAge: { value: null },
+    // [invitations]
+    memberInvitationsEnabled: { value: false },
+    memberInvitationLimit: { value: 5 },
+};
+/**
+ * The absent-key rule for one field, or a loud failure.
+ *
+ * Deliberately a throw rather than a `?? null` fallback: under whole-truth push
+ * an unlisted field would be CLEARED on every push by a table nobody updated.
+ */
+export function appSettingAbsentValue(field) {
+    const entry = APP_SETTINGS_ABSENT_VALUES[field];
+    if (!entry) {
+        throw new Error(`app.toml: no absent-key rule declared for the setting \`${field}\`. ` +
+            `Add it to APP_SETTINGS_ABSENT_VALUES (cli/src/lib/app-settings-descriptor.ts) ` +
+            `— push sends a value for every writable field (#2880).`);
+    }
+    return entry;
+}
+/** Fields whose absence is a validation error rather than a clear (#2880). */
+export const REQUIRED_APP_SETTING_FIELDS = APP_SETTINGS_DESCRIPTOR.filter((d) => APP_SETTINGS_ABSENT_VALUES[d.field]?.required === true).map((d) => d.field);
+/**
+ * The value the SERVER would hold after accepting this one (#2880 DSO-003).
+ *
+ * The comparison runs on the local side only: push forwards what the file says
+ * and the server normalizes it, so without this an authored-but-noncanonical
+ * value (`baseUrl` with a trailing slash, a mixed-case test-account email)
+ * differs from the record the server returns FOREVER — and baseline restamping
+ * cannot save it, because after an apply the remote hash matches the new
+ * baseline while the local hash still does not, re-classifying `local-edited`
+ * on every run.
+ *
+ * Mirrors the rules in `settings-controller.ts` (`baseUrl` trim + trailing
+ * slash), `validateTestAccountBaseEmails` (trim, lower-case, dedupe) and
+ * `validateRedirectUris` (trim, dedupe). Only the NORMALIZATION is mirrored,
+ * never the rejection: an entry the server would refuse stays as authored so
+ * the server's own 400 is what the operator sees.
+ */
+export function canonicalizeAppSettingValue(field, value) {
+    if (value === null || value === undefined)
+        return value;
+    if (field === "baseUrl") {
+        if (typeof value !== "string")
+            return value;
+        const trimmed = value.trim().replace(/\/+$/, "");
+        return trimmed === "" ? null : trimmed;
+    }
+    if (field === "testAccountBaseEmails" || field === "emailRedirectUris") {
+        if (!Array.isArray(value))
+            return value;
+        const lower = field === "testAccountBaseEmails";
+        const seen = new Set();
+        const out = [];
+        for (const entry of value) {
+            if (typeof entry !== "string") {
+                out.push(entry);
+                continue;
+            }
+            const normalized = lower ? entry.trim().toLowerCase() : entry.trim();
+            if (seen.has(normalized))
+                continue;
+            seen.add(normalized);
+            out.push(normalized);
+        }
+        return out;
+    }
+    if (field === "appleAudiences") {
+        if (!Array.isArray(value))
+            return value;
+        // The controller filters non-empty strings and stores `null` for an empty
+        // result, so a list of blanks is the same state as no list at all.
+        return value.filter((v) => typeof v === "string" && v.length > 0);
+    }
+    if (field === "googleClients")
+        return canonicalizeGoogleClients(value);
+    return value;
+}
+/**
+ * The typed Google client map as the server STORES it (#2880 DSO-003).
+ *
+ * `validateGoogleClientsWrite` (`src/services/google-clients.ts`) rewrites each
+ * accepted entry: the `clientId` is trimmed, the `clientSecret` is stored as
+ * the canonical `{{secrets.KEY}}` reference, the redirect URIs are trimmed and
+ * de-duplicated (`validateRedirectUris`), and an entry that states none at all
+ * stores the empty list. Without mirroring that, an authored
+ * `clientId = " 123.apps... "` — or a `{{ secrets.KEY }}` written with the
+ * spacing TOML makes easy — is a `Modified` row on every run against a value
+ * push already applied.
+ *
+ * Normalization only, never rejection: an entry the server would refuse (a
+ * `clientSecret` that is not a reference, a URI it will not take) is left as
+ * authored so the `PUT`'s own 400 is what the operator sees.
+ */
+function canonicalizeGoogleClients(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const clients = value.clients;
+    if (!clients || typeof clients !== "object" || Array.isArray(clients)) {
+        return value;
+    }
+    const out = {};
+    for (const [type, entry] of Object.entries(clients)) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            out[type] = entry;
+            continue;
+        }
+        const source = entry;
+        const canonical = { ...source };
+        if (typeof source.clientId === "string") {
+            canonical.clientId = source.clientId.trim();
+        }
+        if (source.clientSecret !== undefined) {
+            canonical.clientSecret = canonicalizeSecretReference(source.clientSecret);
+        }
+        // Trimmed and de-duplicated, and materialized when the entry states none —
+        // the server stores `[]` either way, so "no key" and "empty list" are one
+        // state rather than a difference no push can close.
+        canonical.redirectUris = Array.isArray(source.redirectUris)
+            ? [
+                ...new Set(source.redirectUris.map((uri) => typeof uri === "string" ? uri.trim() : uri)),
+            ]
+            : [];
+        out[type] = canonical;
+    }
+    return { clients: out };
+}
+/**
+ * One field's comparable value — what `config diff` and the push gate both read.
+ *
+ * Canonicalized as above, then flattened to `null` when the value is "empty"
+ * under an `emit: "whenSet"` field's own rule. That second step is the
+ * app-settings copy of what `projectConfigForComparison` does for every other
+ * type (#2731): pull OMITS an empty `whenSet` value, so the file it round-trips
+ * to has no key, and comparing `[]` against "no key" would be a difference no
+ * push could ever converge.
+ */
+export function comparableAppSettingValue(descriptor, value) {
+    const canonical = canonicalizeAppSettingValue(descriptor.field, value);
+    if (canonical === undefined)
+        return null;
+    if (descriptor.emit === "whenSet" && isEmptyForEmit(canonical, descriptor.type)) {
+        return null;
+    }
+    return canonical ?? null;
+}
+/**
+ * Project a settings record (either side) onto the full writable field set.
+ *
+ * `excludeName` is the cross-app rule (#2880 DSO-001): while a cross-app push's
+ * name exclusion is active, BOTH sides and the stamped baseline are hashed
+ * without `name`, so `classifyPushChange`'s `remoteHash === baselineHash ⇒
+ * local-edited` arithmetic stays valid.
+ */
+export function projectAppSettingsForComparison(settings, options = {}) {
+    const projected = {};
+    for (const d of APP_SETTINGS_DESCRIPTOR) {
+        if (options.excludeName && d.field === "name")
+            continue;
+        const raw = settings?.[d.field];
+        const absent = APP_SETTINGS_ABSENT_VALUES[d.field];
+        projected[d.field] = comparableAppSettingValue(d, raw === undefined && absent && absent.required !== true
+            ? absent.value
+            : raw);
+    }
+    return projected;
+}
+const DESCRIPTOR_BY_SECTION = (() => {
+    const m = new Map();
+    for (const d of APP_SETTINGS_DESCRIPTOR) {
+        const list = m.get(d.section) ?? [];
+        list.push(d);
+        m.set(d.section, list);
+    }
+    return m;
+})();
+/** Descriptor `field` names, for parity/coverage tests. */
+export const DESCRIPTOR_FIELDS = new Set(APP_SETTINGS_DESCRIPTOR.map((d) => d.field));
+function typeOfValue(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (typeof value === "boolean")
+        return "boolean";
+    if (typeof value === "number")
+        return "number";
+    if (typeof value === "string")
+        return "string";
+    if (Array.isArray(value))
+        return "string[]";
+    if (typeof value === "object")
+        return "object";
+    return "unknown";
+}
+/** True if a value should be omitted under `emit: "whenSet"`. */
+function isEmptyForEmit(value, type) {
+    if (value === null || value === undefined)
+        return true;
+    if (type === "string")
+        return value === "";
+    if (type === "string[]")
+        return !Array.isArray(value) || value.length === 0;
+    if (type === "object")
+        return (typeof value !== "object" ||
+            value === null ||
+            Object.keys(value).length === 0);
+    return false; // booleans (false) and numbers (0) are meaningful, never empty
+}
+/**
+ * Validate a push value against its descriptor type. Returns an error string
+ * (field-named) on mismatch, or `null` when the value is acceptable. Arrays are
+ * checked element-by-element so a `["a", 1]` mistype is caught.
+ */
+function typeError(descriptor, value) {
+    const actual = typeOfValue(value);
+    if (actual === "null")
+        return null; // null clears; server owns clear semantics
+    if (descriptor.type === "string[]") {
+        if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+            return `[${descriptor.section}].${descriptor.key} must be an array of strings (got ${actual})`;
+        }
+        return null;
+    }
+    if (descriptor.type === "object") {
+        if (actual !== "object") {
+            return `[${descriptor.section}].${descriptor.key} must be a table (got ${actual})`;
+        }
+        return null;
+    }
+    if (actual !== descriptor.type) {
+        return `[${descriptor.section}].${descriptor.key} must be a ${descriptor.type} (got ${actual})`;
+    }
+    return null;
+}
+/**
+ * Build one `app.toml` section object from server settings (pull direction).
+ * Applies each field's `emit` rule; a `null` value is always omitted (TOML
+ * cannot encode null).
+ */
+export function serializeSection(settings, section) {
+    const out = {};
+    for (const d of DESCRIPTOR_BY_SECTION.get(section) ?? []) {
+        const value = settings[d.field];
+        if (value === null || value === undefined)
+            continue;
+        if (d.emit === "whenSet" && isEmptyForEmit(value, d.type))
+            continue;
+        out[d.key] = value;
+    }
+    return out;
+}
+/**
+ * Build the full `app.toml` data object (all sections) from server settings.
+ * Empty sections are omitted, though in practice every section has at least one
+ * `emit: "always"` key so all four are present.
+ */
+export function serializeAppSettingsToToml(settings) {
+    const data = {};
+    for (const section of APP_SETTINGS_SECTIONS) {
+        const obj = serializeSection(settings, section);
+        if (Object.keys(obj).length > 0)
+            data[section] = obj;
+    }
+    return data;
+}
+/**
+ * Is `[app].name` out of this call entirely? ONE reading of the two spellings
+ * the callers use (#2936), so the parse and the payload can never disagree
+ * about whether the field is in play: `isCrossAppPush` is the raw cross-app
+ * determination, `excludeName` the already-computed answer from
+ * `appSettingsNameExcluded` (which also covers the recorded-exclusion case).
+ */
+function appSettingsNameStripped(options) {
+    return !!(options.isCrossAppPush || options.excludeName);
+}
+/**
+ * Translate a parsed `app.toml` object into the settings the FILE STATES —
+ * only the keys it carries. This is the parse half; `buildAppSettingsPayload`
+ * below turns it into the whole-truth `PUT /settings` body by filling in what
+ * the file omits. An unrecognized key or table and a type
+ * mismatch are both hard errors the caller must treat as abort-before-PUT
+ * (#2644 criterion 6: push rejects what it does not recognize, for every
+ * configuration surface, so a typo fails locally instead of being ignored).
+ *
+ * A per-entry `clientSecret` that is not a whole `{{secrets.KEY}}` reference is
+ * the server's rejection to make (#2256): the push forwards the map and the
+ * `PUT` answers 400 with `GOOGLE_CLIENT_SECRET_MUST_BE_SECRET_REF`. Duplicating
+ * the shape rule here would put two definitions of "valid reference" in play.
+ *
+ * A RETIRED key (#2891) is different: it is not a value the server can judge,
+ * it is a line that has to be deleted, so the parser refuses it locally with
+ * the guidance that names its replacement.
+ *
+ * `isCrossAppPush` — or `excludeName`, the same rule as the caller computed it
+ * (#2880 DSO-001, `appSettingsNameExcluded`) — strips `name` so a cross-app
+ * push never overwrites the target app's name. The strip has to happen HERE and
+ * not only in the payload builder below (#2936): a field the body will not
+ * carry is not a field this file gets to refuse, or a slot bound to another app
+ * aborts diff and push over a `[app].name` neither of them was going to send.
+ */
+export function parseTomlToAppSettings(tomlData, options = {}) {
+    const excludeName = appSettingsNameStripped(options);
+    const settings = {};
+    const warnings = [];
+    const errors = [];
+    // #2644 criterion 6 — a top-level table the definition does not declare is a
+    // hard error, the same posture every per-entity file has. Silently ignoring
+    // it made a typo'd header (`[curs]`) push as though the section it meant were
+    // absent, so the settings it carried were never applied.
+    for (const key of findUnknownDocumentKeys(tomlData, APP_SETTINGS_SURFACE)) {
+        errors.push(`app.toml: unrecognized top-level table [${key}]. Check the spelling ` +
+            `against the tables app.toml accepts (${APP_SETTINGS_SECTIONS.map((s) => `[${s}]`).join(", ")}), or upgrade the CLI if the server is newer than this one.`);
+    }
+    for (const section of APP_SETTINGS_SECTIONS) {
+        const sectionData = tomlData?.[section];
+        if (sectionData === undefined || sectionData === null)
+            continue;
+        if (typeof sectionData !== "object" || Array.isArray(sectionData)) {
+            errors.push(`[${section}] must be a table`);
+            continue;
+        }
+        const descriptors = DESCRIPTOR_BY_SECTION.get(section) ?? [];
+        const byKey = new Map(descriptors.map((d) => [d.key, d]));
+        for (const key of Object.keys(sectionData)) {
+            const d = byKey.get(key);
+            if (!d) {
+                // A RETIRED key is not an unknown key (#2803's rule, extended to
+                // app-settings by #2891/DSO-2891-005). "Check the spelling, or upgrade
+                // the CLI" is exactly backwards for a key the platform removed on
+                // purpose, and every pre-reshape `app.toml` still carries these lines —
+                // so the parser consults the shared retired set directly and says where
+                // the value moved to. Keyed under `app`, the app-settings surface's
+                // identifier, whichever section the key was authored in.
+                const retired = retiredConfigKey("app", key);
+                if (retired) {
+                    errors.push(`app.toml: [${section}].${key} — ${retired.toml}`);
+                    continue;
+                }
+                // #2644 criterion 6 — REJECTED, not warned-and-ignored. `app.toml` is a
+                // registered configuration surface like every other file, and an
+                // ignored key is a setting the author believes they changed.
+                errors.push(`app.toml: unrecognized key [${section}].${key}. Remove it or ` +
+                    `upgrade the CLI if the server is newer than this one. ` +
+                    `Recognized keys: ${descriptors.map((x) => x.key).join(", ")}.`);
+                continue;
+            }
+            if (excludeName && d.field === "name")
+                continue;
+            const value = sectionData[key];
+            const err = typeError(d, value);
+            if (err) {
+                errors.push(err);
+                continue;
+            }
+            settings[d.field] = value;
+        }
+    }
+    return { settings, warnings, errors };
+}
+/**
+ * `[app].name` / `[app].mode` absent — the two keys whole-truth push refuses to
+ * fill in for the author (#2880).
+ *
+ * Read from the DOCUMENT rather than the parse result, so a cross-app push
+ * (which strips `name` before validating) still requires the file to state one.
+ * `mode` has no default and `mode: null` is a 400; more to the point, a deleted
+ * `mode` line silently resetting an invite-only app to public is the wrong
+ * failure to choose.
+ */
+export function missingRequiredKeyErrors(tomlData) {
+    const errors = [];
+    for (const field of REQUIRED_APP_SETTING_FIELDS) {
+        const d = APP_SETTINGS_DESCRIPTOR.find((x) => x.field === field);
+        if (!d)
+            continue;
+        const section = tomlData?.[d.section];
+        const present = section !== null &&
+            typeof section === "object" &&
+            !Array.isArray(section) &&
+            section[d.key] !== undefined;
+        if (present)
+            continue;
+        errors.push(`app.toml: [${d.section}].${d.key} is required — \`config push\` applies ` +
+            `app.toml as the whole truth, and this field has no default to fall ` +
+            `back to. Add the line (\`config pull --only app\` writes it).`);
+    }
+    return errors;
+}
+/**
+ * The whole-truth `PUT /settings` body (#2880 criterion 4).
+ *
+ * Every writable field gets a value: the authored one where the file carries
+ * the key, its `APP_SETTINGS_ABSENT_VALUES` entry where it does not. That is
+ * what makes `app.toml` mean what every other configuration file means — the
+ * local file is the state, not a patch over whatever the server happens to
+ * hold (#1567). The controller applies only the keys in the body (`if (field in
+ * updates)`), so the completeness has to come from here.
+ *
+ * Values are forwarded AS AUTHORED, never canonicalized: the server owns its
+ * own normalization, and a CLI that rewrote the value before sending it would
+ * be pushing something the operator did not write. The canonicalization in
+ * `canonicalizeAppSettingValue` is for the local COMPARISON only.
+ *
+ * `excludeName` (and `isCrossAppPush`, which implies it) leaves `name` out of
+ * the body entirely, so a cross-app push never renames the target app.
+ */
+export function buildAppSettingsPayload(tomlData, options = {}) {
+    const parsed = parseTomlToAppSettings(tomlData, options);
+    const errors = [...parsed.errors, ...missingRequiredKeyErrors(tomlData)];
+    if (errors.length > 0) {
+        return { settings: {}, warnings: parsed.warnings, errors };
+    }
+    const excludeName = appSettingsNameStripped(options);
+    const settings = {};
+    for (const d of APP_SETTINGS_DESCRIPTOR) {
+        if (excludeName && d.field === "name")
+            continue;
+        if (d.field in parsed.settings) {
+            settings[d.field] = parsed.settings[d.field];
+            continue;
+        }
+        const absent = appSettingAbsentValue(d.field);
+        // Required fields never reach here — their absence already errored above.
+        if (absent.required === true)
+            continue;
+        settings[d.field] = absent.value;
+    }
+    return { settings, warnings: parsed.warnings, errors: [] };
+}
+//# sourceMappingURL=app-settings-descriptor.js.map

package/dist/src/lib/app-settings-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-settings-descriptor.js","sourceRoot":"","sources":["../../../src/lib/app-settings-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;AA8BlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAsB;IAC/C,GAAG,EAAE,KAAK,CAAC,OAAO;IAClB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAmB;IACvE,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,CAAC,CAAC,CACJ,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAsB,CAClD,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO;IACP,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,cAAc;IACd,YAAY;IACZ,4EAA4E;IAC5E,uEAAuE;IACvE,mCAAmC;IACnC,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG;AACtE,0EAA0E;AAC1E,2DAA2D;AAC3D,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;KAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,CAAC;KACpE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAC3B,CACF,CAAC;AAgCF,MAAM,CAAC,MAAM,0BAA0B,GAEnC;IACF,QAAQ;IACR,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACxB,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IACjC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACrC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC/B,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACtC,uEAAuE;IACvE,wEAAwE;IACxE,8DAA8D;IAC9D,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACxC,SAAS;IACT,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC9B,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IAChC,6EAA6E;IAC7E,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC/B,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAClC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAChC,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACxC,SAAS;IACT,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IACtC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC3B,gBAAgB;IAChB,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IAC1C,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,KAAK,MAAM;YACpE,gFAAgF;YAChF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GACtC,uBAAuB,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC9D,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAExB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,KAAK,uBAAuB,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,KAAK,uBAAuB,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,0EAA0E;QAC1E,mEAAmE;QACnE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,OAAkC,CACnC,EAAE,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,SAAS,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,SAAS,CAAC,YAAY,GAAG,2BAA2B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5E,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,oDAAoD;QACpD,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YACzD,CAAC,CAAC;gBACE,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC3C,CACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC,EAChC,KAAc;IAEd,MAAM,SAAS,GAAG,2BAA2B,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgD,EAChD,UAAqC,EAAE;IAEvC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnD,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAC5C,CAAC,EACD,GAAG,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACrD,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,GAAG,CACR,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,qBAAqB,GACzB,CAAC,GAAG,EAAE;IACJ,MAAM,CAAC,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEP,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAC3D,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC5C,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,KAAc,EAAE,IAAoB;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAC1C,CAAC;IACJ,OAAO,KAAK,CAAC,CAAC,+DAA+D;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,UAAgC,EAChC,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,qCAAqC,MAAM,GAAG,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,yBAAyB,MAAM,GAAG,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,cAAc,UAAU,CAAC,IAAI,SAAS,MAAM,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B,EAC7B,OAA0B;IAE1B,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA6B;IAE7B,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAGhC;IACC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,UAA+D,EAAE;IAEjE,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,yDAAyD;IACzD,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CACT,2CAA2C,GAAG,wBAAwB;YACpE,wCAAwC,qBAAqB,CAAC,GAAG,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAC5E,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,mBAAmB,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,iEAAiE;gBACjE,uEAAuE;gBACvE,kEAAkE;gBAClE,wEAAwE;gBACxE,wEAAwE;gBACxE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,cAAc,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBACD,wEAAwE;gBACxE,iEAAiE;gBACjE,6DAA6D;gBAC7D,MAAM,CAAC,IAAI,CACT,+BAA+B,OAAO,KAAK,GAAG,iBAAiB;oBAC7D,wDAAwD;oBACxD,oBAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,2BAA2B,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,OAAO,GACX,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAC/B,IAAI,OAAO;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CACT,cAAc,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,yCAAyC;YACxE,qEAAqE;YACrE,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA6B,EAC7B,UAA+D,EAAE;IAEjE,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QAChD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACvC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC7D,CAAC"}

package/dist/src/lib/auth-flow.d.ts

@@ -0,0 +1,8 @@
+import type { Credentials } from "../types/index.js";
+interface AuthResult {
+    success: boolean;
+    credentials?: Credentials;
+    error?: string;
+}
+export declare function browserLogin(serverUrl: string): Promise<AuthResult>;
+export {};

package/dist/src/lib/batch.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared helpers for the CLI's batch-import commands
+ * (`databases import` and `databases import-csv`).
+ */
+/** Split an array into fixed-size chunks. */
+export declare function chunk<T>(items: T[], size: number): T[][];
+export interface ParseBatchSizeOptions {
+    /** Largest batch size the caller will accept. */
+    max: number;
+    /** Message shown when the value exceeds `max`. */
+    overMaxMessage: string;
+}
+/**
+ * Parse and validate a `--batch-size` flag value.
+ *
+ * Returns the parsed integer on success, or a human-readable error message
+ * on failure (non-integer, `< 1`, or over the caller's ceiling). Callers
+ * decide how to surface the error — typically `error(msg); process.exit(1)`.
+ * Validating up front means a bad `--batch-size` fails before any write, so
+ * there are no partial imports.
+ */
+export declare function parseBatchSize(raw: string, opts: ParseBatchSizeOptions): {
+    value: number;
+} | {
+    error: string;
+};