primitive-admin 1.2.0-alpha.7 → 1.2.0-alpha.8

package/dist/src/commands/sync-app-settings.js

@@ -28,7 +28,7 @@ import { existsSync, readFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { createHash } from "crypto";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
-import { APP_SETTINGS_DESCRIPTOR, APP_SETTINGS_SECTIONS, buildAppSettingsPayload, projectAppSettingsForComparison, serializeAppSettingsToToml, } from "../lib/app-settings-descriptor.js";
+import { APP_SETTINGS_DESCRIPTOR, APP_SETTINGS_SECTIONS, LEGACY_PROTECTED_KEY, buildAppSettingsPayload, projectAppSettingsForComparison, requestedProtectionLevel, serializeAppSettingsToToml, settingsProtectionLevel, } from "../lib/app-settings-descriptor.js";
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
 import { writePulledFile } from "../lib/pull-write.js";
 import { resolveSyncStateReadPath } from "../lib/sync-paths.js";
@@ -149,12 +149,15 @@ export function renderAppSettings(settings) {
  * A file that already states the same settings is left as it is (#4160): the
  * comparison is the payload `config diff` and `config push` build from the
  * file, so its comments, key order and explicit defaults survive the pull.
- * `written` says which happened.
+ * A file carrying the deprecated `[app].protected` key is always rewritten,
+ * so the pull the deprecation warning advertises removes it (#4564,
+ * DSO-4564-003). `written` says which happened.
  */
 export function writePulledAppSettings(configDir, settings, options = {}) {
     ensureDir(configDir);
     const path = appTomlPath(configDir);
-    const statedName = options.keepStatedName ? readStatedAppName(path) : undefined;
+    const stated = readStatedApp(path);
+    const statedName = options.keepStatedName ? stated?.name : undefined;
     let content;
     if (!options.keepStatedName) {
         content = serializeAppSettings(settings);
@@ -166,10 +169,21 @@ export function writePulledAppSettings(configDir, settings, options = {}) {
                 data.app.name = statedName;
             else
                 delete data.app.name;
+            const statedLevel = requestedProtectionLevel(stated);
+            if (statedLevel !== undefined)
+                data.app.protection = statedLevel;
+            else
+                delete data.app.protection;
         }
         content = stringifyConfigToml(data);
     }
-    const written = writePulledFile(path, content, options.tally, sameAppSettingsAs(content, { nameOptional: options.keepStatedName }));
+    const carriesLegacyKey = !!stated && LEGACY_PROTECTED_KEY in stated;
+    const written = writePulledFile(path, content, options.tally, carriesLegacyKey
+        ? undefined
+        : sameAppSettingsAs(content, {
+            nameOptional: options.keepStatedName,
+            excludeProtection: options.keepStatedName,
+        }));
     if (written)
         options.log?.(`Wrote ${path}`);
     return {
@@ -192,6 +206,7 @@ export function writePulledAppSettings(configDir, settings, options = {}) {
 function sameAppSettingsAs(serverContent, options) {
     const payloadOf = (content) => buildAppSettingsPayload(parseConfigToml(content), {
         nameOptional: options.nameOptional,
+        excludeProtection: options.excludeProtection,
     });
     return (localContent) => {
         const local = payloadOf(localContent);
@@ -202,15 +217,16 @@ function sameAppSettingsAs(serverContent, options) {
     };
 }
 /**
- * The `[app].name` an `app.toml` states, as TOML stated it, or undefined when
- * the file is absent, unparseable or names nothing.
+ * The `[app]` table an `app.toml` states, as TOML stated it, or undefined
+ * when the file is absent, unparseable or has none.
  */
-function readStatedAppName(path) {
+function readStatedApp(path) {
     if (!existsSync(path))
         return undefined;
     try {
         const parsed = parseConfigToml(readFileSync(path, "utf-8"));
-        return parsed?.app?.name;
+        const app = parsed?.app;
+        return app && typeof app === "object" && !Array.isArray(app) ? app : undefined;
     }
     catch {
         return undefined;
@@ -291,7 +307,12 @@ export function appSettingsNameExcludedForState(state, appId, tomlData, localEnv
  * app-settings row in the full `config diff`, and the push gate.
  */
 export function appSettingsFieldDiffs(localSettings, remoteSettings, options = {}) {
-    const local = projectAppSettingsForComparison(localSettings, options);
+    // The local file's deprecated `protected` key reads against the remote
+    // level, as the server's write does (DSO-4564-001).
+    const local = projectAppSettingsForComparison(localSettings, {
+        ...options,
+        legacyProtectedAgainst: settingsProtectionLevel(remoteSettings),
+    });
     const remote = projectAppSettingsForComparison(remoteSettings, options);
     const diffs = [];
     for (const d of APP_SETTINGS_DESCRIPTOR) {
@@ -352,6 +373,7 @@ export async function diffAppSettings(client, appId, configDir, options = {}) {
         const { settings: local, errors } = buildAppSettingsPayload(tomlData, {
             excludeName,
             nameOptional: localEnvironment,
+            excludeProtection: localEnvironment,
         });
         // A file with validation errors is unpushable, so diff must not present its
         // surviving values as clean (or as a partial diff) — that would advertise
@@ -364,7 +386,10 @@ export async function diffAppSettings(client, appId, configDir, options = {}) {
             process.exit(1);
         }
         const remote = (await client.getAppSettings(appId)) ?? {};
-        const diffs = appSettingsFieldDiffs(local, remote, { excludeName });
+        const diffs = appSettingsFieldDiffs(local, remote, {
+            excludeName,
+            excludeProtection: localEnvironment,
+        });
         if (options.json) {
             json({ diffs });
             return;

package/dist/src/commands/sync-app-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-app-settings.js","sourceRoot":"","sources":["../../../src/commands/sync-app-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,0BAA0B,GAE3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAuB,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,MAAM,IAAI,WAAW,EACrB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,OAAO,mBAAmB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA6B,EAC7B,UAAuF,EAAE;IAEzF,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAEhF,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,CAAU,EAAE,CAAU;IAC3C,OAAO,sBAAsB,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAa;IAC7C,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAM,OAA6B,CACpD,CAAC;QACF,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,CAAE,QAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,QAAa,EACb,UAWI,EAAE;IAEN,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;;gBACpD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAC7B,IAAI,EACJ,OAAO,EACP,OAAO,CAAC,KAAK,EACb,iBAAiB,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CACrE,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACpC,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,UAAU,KAAK,SAAS;YACpD,CAAC,CAAC;gBACE,IAAI,EACF,GAAG,iBAAiB,sEAAsE;oBAC1F,qEAAqE;aACxE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,aAAqB,EACrB,OAAmC;IAEnC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CACpC,uBAAuB,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACL,OAAO,CAAC,YAAY,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,OAAO,CACL,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAwB,CAAC;QACnF,OAAO,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAavC;IACC,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc,CAAC,QAAiB,EAAE,QAAiB;IAC1D,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,+BAA+B,CAC7C,KAAuB,EACvB,KAAa,EACb,QAAgD,EAChD,gBAAgB,GAAG,KAAK;IAExB,OAAO,uBAAuB,CAAC;QAC7B,gBAAgB;QAChB,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QAClD,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY;QACxD,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI;KAC9B,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAkC,EAClC,cAAsD,EACtD,UAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,+BAA+B,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,+BAA+B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACxE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,SAAS;QAClC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgD,EAChD,UAAqC,EAAE;IAEvC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,sBAAsB,CACpB,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,CACnD,CACF;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,iDAAiD,CAC1F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CACH,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,gBAAgB,GAAG,yBAAyB,EAAE,CAAC,KAAK,CAAC;QAC3D,MAAM,WAAW,GAAG,+BAA+B,CACjD,KAAK,EACL,KAAK,EACL,QAAQ,EACR,gBAAgB,CACjB,CAAC;QAEF,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,QAAQ,EAAE;YACpE,WAAW;YACX,YAAY,EAAE,gBAAgB;SAC/B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,gBAAgB;QAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,gCAAgC,CAC5G,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAEpE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,oBAAoB,iBAAiB,2BAA2B,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,iBAAiB,kBAAkB,CAAC,CAAC;QACrF,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"sync-app-settings.js","sourceRoot":"","sources":["../../../src/commands/sync-app-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAuB,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,MAAM,IAAI,WAAW,EACrB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,OAAO,mBAAmB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA6B,EAC7B,UAKI,EAAE;IAEN,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAEhF,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,CAAU,EAAE,CAAU;IAC3C,OAAO,sBAAsB,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAa;IAC7C,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAM,OAA6B,CACpD,CAAC;QACF,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,CAAE,QAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,QAAa,EACb,UAcI,EAAE;IAEN,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;;gBACpD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC;;gBAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,IAAI,oBAAoB,IAAI,MAAM,CAAC;IACpE,MAAM,OAAO,GAAG,eAAe,CAC7B,IAAI,EACJ,OAAO,EACP,OAAO,CAAC,KAAK,EACb,gBAAgB;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE;YACzB,YAAY,EAAE,OAAO,CAAC,cAAc;YACpC,iBAAiB,EAAE,OAAO,CAAC,cAAc;SAC1C,CAAC,CACP,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACpC,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,UAAU,KAAK,SAAS;YACpD,CAAC,CAAC;gBACE,IAAI,EACF,GAAG,iBAAiB,sEAAsE;oBAC1F,qEAAqE;aACxE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,aAAqB,EACrB,OAAgE;IAEhE,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CACpC,uBAAuB,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACL,OAAO,CAAC,YAAY,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,OAAO,CACL,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAwB,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;QACxB,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAavC;IACC,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc,CAAC,QAAiB,EAAE,QAAiB;IAC1D,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,+BAA+B,CAC7C,KAAuB,EACvB,KAAa,EACb,QAAgD,EAChD,gBAAgB,GAAG,KAAK;IAExB,OAAO,uBAAuB,CAAC;QAC7B,gBAAgB;QAChB,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QAClD,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY;QACxD,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI;KAC9B,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAkC,EAClC,cAAsD,EACtD,UAAkE,EAAE;IAEpE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,KAAK,GAAG,+BAA+B,CAAC,aAAa,EAAE;QAC3D,GAAG,OAAO;QACV,sBAAsB,EAAE,uBAAuB,CAAC,cAAc,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,+BAA+B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACxE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,SAAS;QAClC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgD,EAChD,UAKI,EAAE;IAEN,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,sBAAsB,CACpB,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,CACnD,CACF;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,MAAM,iBAAiB,aAAa,IAAI,iDAAiD,CAC1F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CACH,kCAAkC,iBAAiB,KAAK,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,gBAAgB,GAAG,yBAAyB,EAAE,CAAC,KAAK,CAAC;QAC3D,MAAM,WAAW,GAAG,+BAA+B,CACjD,KAAK,EACL,KAAK,EACL,QAAQ,EACR,gBAAgB,CACjB,CAAC;QAEF,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,QAAQ,EAAE;YACpE,WAAW;YACX,YAAY,EAAE,gBAAgB;YAC9B,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,gBAAgB;QAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,2BAA2B,iBAAiB,gCAAgC,CAC5G,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE;YACjD,WAAW;YACX,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,oBAAoB,iBAAiB,2BAA2B,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,iBAAiB,kBAAkB,CAAC,CAAC;QACrF,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/src/commands/sync.js

@@ -26,7 +26,7 @@ import { canonicalizeServerTextFields } from "../lib/server-text-normalization.j
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
 import { reconcileWorkflowIncludes } from "../lib/workflow-include-preserve.js";
 import { newPullWriteTally, writePulledFile, } from "../lib/pull-write.js";
-import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, } from "../lib/app-settings-descriptor.js";
+import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, settingsProtectionLevel, } from "../lib/app-settings-descriptor.js";
 import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, appSettingsFieldDiffs, appSettingsNameExcluded, appSettingsNameExcludedForState, hashAppSettingsForDiff, } from "./sync-app-settings.js";
 import { applyWorkflowBody, legacyDraftSlotWarning } from "../lib/workflow-apply.js";
 // #2645 — named config bodies live in `workflows/<key>.configs/<name>.toml`.
@@ -59,7 +59,7 @@ import { agentFunctionChangeRefusals, agentFunctionUses, } from "../lib/generate
 import { resolvePromptStrictOutput } from "../lib/generated-config-surfaces.js";
 // #3179 — the function's two halves: the header payloads and the envelope
 // `config push` sends, and the bytes `config pull` writes back.
-import { applyFunctionPull, buildFunctionConfigPush, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
+import { applyFunctionPull, buildFunctionConfigPush, buildFunctionConfigPushDetailed, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
 import { newerVersionLine, pullNewerVersionLine, rollbackDiffHint, } from "../lib/function-versions.js";
 import { FunctionBuildError } from "../lib/function-bundle.js";
 // #3182 — the local half of capability validation. The grammar is the vendored
@@ -77,6 +77,7 @@ import { isFunctionDeclarationFile, resolveDocumentSchema, } from "../lib/functi
 // #3331 — and the compiler is actually asked: a push holds the code it ships
 // to the declarations it just generated.
 import { createFunctionTypechecker, } from "../lib/function-typecheck.js";
+import { resolveFunctionSourceRoots } from "../lib/function-source-roots.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
 import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { normalizeTestCaseKey, testCaseKeyError, } from "../lib/test-case-keys.js";
@@ -2688,6 +2689,9 @@ export async function runConfigPushPreflight(input) {
                     fileName: parsedApp?.app?.name,
                 }),
                 nameOptional: localEnvironment,
+                // #4564 — the protection level follows the name on a machine-local
+                // environment: out of the body, so out of what is validated.
+                excludeProtection: localEnvironment,
             });
             for (const e of appErrors) {
                 preflightValidationErrors.push(`  app.toml: ${e}`);
@@ -9670,6 +9674,7 @@ export function registerConfigSyncCommands(sync) {
                             // tree's name and whose baseline never includes one.
                             semanticHash: hashAppSettingsForDiff(settings, {
                                 excludeName: pullsLocalEnvironment,
+                                excludeProtection: pullsLocalEnvironment,
                             }),
                         }
                         : pullSelection
@@ -10495,6 +10500,9 @@ What a push guarantees (two stages):
                 const { settings: appPayload, warnings: appWarnings } = buildAppSettingsPayload(tomlData, {
                     excludeName: payloadExcludesName,
                     nameOptional: localEnvironment,
+                    // #4564 — on a machine-local environment the level is the
+                    // shared tree's, like the name, and never this child's.
+                    excludeProtection: localEnvironment,
                 });
                 for (const w of appWarnings) {
                     warn(`  ${w}`);
@@ -10524,6 +10532,7 @@ What a push guarantees (two stages):
                             excludeName: localEnvironment ||
                                 options.recordExclusion !== undefined ||
                                 (options.keepExclusion && compareExcludesName),
+                            excludeProtection: localEnvironment,
                         }),
                         ...(options.recordExclusion !== undefined
                             ? { excludedName: options.recordExclusion }
@@ -10534,8 +10543,17 @@ What a push guarantees (two stages):
                 };
                 let applyAppSettings = true;
                 if (appLiveOk) {
-                    const compareOptions = { excludeName: compareExcludesName };
-                    const localHash = hashAppSettingsForDiff(appPayload, compareOptions);
+                    const compareOptions = {
+                        excludeName: compareExcludesName,
+                        excludeProtection: localEnvironment,
+                    };
+                    // The file's deprecated `protected` key reads against the live
+                    // level, as the server's write will (DSO-4564-001), so a change
+                    // made only through it is not skipped as unchanged.
+                    const localHash = hashAppSettingsForDiff(appPayload, {
+                        ...compareOptions,
+                        legacyProtectedAgainst: settingsProtectionLevel(liveSettings ?? {}),
+                    });
                     const remoteHash = hashAppSettingsForDiff(liveSettings ?? {}, compareOptions);
                     if (options.force) {
                         // `--force` is the operator saying "local wins": no direction
@@ -14201,18 +14219,31 @@ What a push guarantees (two stages):
                 // consulted per function, so one broken file refuses itself and
                 // nothing else; `--no-typecheck` is the escape hatch, and an
                 // unavailable compiler warns rather than failing the push.
+                const files = selectFiles("function", functionsPushDir, readdirSync(functionsPushDir).filter(isFunctionDeclarationFile));
+                // #4502 — the directories outside the tree that function code may
+                // import from, resolved once for the push so a dropped entry is
+                // named once rather than once per function. The bundler and the
+                // checker are handed the same list, so they agree on what is shared.
+                const functionSourceRoots = files.length > 0
+                    ? resolveFunctionSourceRoots(configDir)
+                    : { roots: [], warnings: [] };
+                for (const warning of functionSourceRoots.warnings)
+                    warn(`  ${warning}`);
+                const sourceRoots = functionSourceRoots.roots.map((root) => root.absolute);
                 let typecheckSetup = null;
                 const functionTypechecker = () => {
                     if (options.typecheck === false)
                         return null;
                     if (typecheckSetup === null) {
-                        typecheckSetup = createFunctionTypechecker(configDir);
+                        typecheckSetup = createFunctionTypechecker(configDir, {
+                            sourceRoots,
+                            onWarning: (message) => warn(`  ${message}`),
+                        });
                         for (const warning of typecheckSetup.warnings)
                             warn(`  ${warning}`);
                     }
                     return typecheckSetup.checker;
                 };
-                const files = selectFiles("function", functionsPushDir, readdirSync(functionsPushDir).filter(isFunctionDeclarationFile));
                 const functionSpec = configDiffSpec("function");
                 const liveFunctions = new Map();
                 let functionsLiveOk = true;
@@ -14273,13 +14304,15 @@ What a push guarantees (two stages):
                     // Build first: nothing is sent for a function whose code does not
                     // compile or whose imports leave the tree.
                     let push;
+                    let projectSources;
                     try {
-                        push = await buildFunctionConfigPush({
+                        ({ push, projectSources } = await buildFunctionConfigPushDetailed({
                             configDir,
                             functionKey: key,
                             filePath,
                             tomlData,
-                        });
+                            sourceRoots,
+                        }));
                     }
                     catch (err) {
                         if (!(err instanceof FunctionBuildError))
@@ -14309,7 +14342,7 @@ What a push guarantees (two stages):
                     // sent for it and whether or not this is a dry run.
                     const typechecker = functionTypechecker();
                     if (typechecker) {
-                        const failure = typechecker.check(key, push.sources.map((source) => source.path));
+                        const failure = typechecker.check(key, push.sources.map((source) => source.path), projectSources);
                         if (failure) {
                             applyFailures.push({
                                 type: "function",
@@ -17093,6 +17126,7 @@ What a push guarantees (two stages):
                     const { settings: localAppSettings, errors: appErrors } = buildAppSettingsPayload(appTomlData, {
                         excludeName,
                         nameOptional: diffsLocalEnvironment,
+                        excludeProtection: diffsLocalEnvironment,
                     });
                     if (appErrors.length > 0) {
                         appRow(VALIDATION_ERROR, appErrors.join("; "));
@@ -17107,7 +17141,7 @@ What a push guarantees (two stages):
                             });
                         }
                         else {
-                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName });
+                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName, excludeProtection: diffsLocalEnvironment });
                             if (fieldDiffs.length === 0) {
                                 appRow("exists");
                             }