primitive-admin 1.2.0-alpha.7 → 1.2.0-alpha.9

package/dist/src/commands/sync.js

@@ -26,7 +26,7 @@ import { canonicalizeServerTextFields } from "../lib/server-text-normalization.j
 import { canonicalJsonStringify } from "../lib/canonical-json.js";
 import { reconcileWorkflowIncludes } from "../lib/workflow-include-preserve.js";
 import { newPullWriteTally, writePulledFile, } from "../lib/pull-write.js";
-import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, } from "../lib/app-settings-descriptor.js";
+import { serializeSection, parseTomlToAppSettings, buildAppSettingsPayload, settingsProtectionLevel, } from "../lib/app-settings-descriptor.js";
 import { collectAppSettingsPushErrors, writePulledAppSettings, diffAppSettings, appSettingsFieldDiffs, appSettingsNameExcluded, appSettingsNameExcludedForState, hashAppSettingsForDiff, } from "./sync-app-settings.js";
 import { applyWorkflowBody, legacyDraftSlotWarning } from "../lib/workflow-apply.js";
 // #2645 — named config bodies live in `workflows/<key>.configs/<name>.toml`.
@@ -59,7 +59,7 @@ import { agentFunctionChangeRefusals, agentFunctionUses, } from "../lib/generate
 import { resolvePromptStrictOutput } from "../lib/generated-config-surfaces.js";
 // #3179 — the function's two halves: the header payloads and the envelope
 // `config push` sends, and the bytes `config pull` writes back.
-import { applyFunctionPull, buildFunctionConfigPush, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
+import { applyFunctionPull, buildFunctionConfigPush, buildFunctionConfigPushDetailed, createDocumentSchemaDropWarner, documentSchemaRetentionFailure, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, functionTomlPreflightErrors, planDocumentSchemaPull, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
 import { newerVersionLine, pullNewerVersionLine, rollbackDiffHint, } from "../lib/function-versions.js";
 import { FunctionBuildError } from "../lib/function-bundle.js";
 // #3182 — the local half of capability validation. The grammar is the vendored
@@ -77,6 +77,7 @@ import { isFunctionDeclarationFile, resolveDocumentSchema, } from "../lib/functi
 // #3331 — and the compiler is actually asked: a push holds the code it ships
 // to the declarations it just generated.
 import { createFunctionTypechecker, } from "../lib/function-typecheck.js";
+import { resolveFunctionSourceRoots } from "../lib/function-source-roots.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
 import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { normalizeTestCaseKey, testCaseKeyError, } from "../lib/test-case-keys.js";
@@ -88,8 +89,6 @@ export { resolveSlugCollisions, slugifyTestCaseName, testCaseFileBasenames, } fr
 import { success, error, printApiError, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import { filterFilesBySelection, parseSyncSelectors, SelectorError, selectionIncludesKey, selectionIncludesType, selectionIncludesApp, selectionIncludesAnyVar, trackedSelectorKeys, unmatchedSelectors, } from "../lib/sync-selectors.js";
 import { confirmPrompt, ConfirmPromptError } from "../lib/confirm-prompt.js";
-import { pushFailureIsTransient, writePushFailureReport } from "../lib/push-failure-report.js";
-import { isTransientRequestFailure } from "../lib/transient-retry.js";
 import { signingSecretStatusWarning, signingSecretHealthWarning, previousSigningSecretWarning, } from "../lib/signing-secret-status.js";
 import chalk from "chalk";
 function ensureDir(dirPath) {
@@ -2688,6 +2687,9 @@ export async function runConfigPushPreflight(input) {
                     fileName: parsedApp?.app?.name,
                 }),
                 nameOptional: localEnvironment,
+                // #4564 — the protection level follows the name on a machine-local
+                // environment: out of the body, so out of what is validated.
+                excludeProtection: localEnvironment,
             });
             for (const e of appErrors) {
                 preflightValidationErrors.push(`  app.toml: ${e}`);
@@ -7217,7 +7219,6 @@ export async function pushTestCasesForBlock(params) {
     const testCaseExtra = { lookupMaps: params.lookupMaps };
     const listed = await listAllTestCases(client, appId, blockType, blockId);
     const liveOk = listed.ok;
-    const liveReadTransient = "error" in listed && isTransientRequestFailure(listed.error);
     if (!liveOk) {
         warn(`  ${blockKey} test cases: live state unavailable — falling back to last-sync content hashes`);
     }
@@ -7479,7 +7480,6 @@ export async function pushTestCasesForBlock(params) {
                             type: "test-case",
                             key: `${blockKey}/${slug}`,
                             message,
-                            transient: isTransientRequestFailure(err),
                         });
                     }
                     continue;
@@ -7527,7 +7527,7 @@ export async function pushTestCasesForBlock(params) {
                 continue;
             }
             if (degraded.action === "decline") {
-                params.declined?.("test-case", `${blockKey}/${slug}`, { action: "live-unavailable", transient: liveReadTransient }, existingEntry?.modifiedAt);
+                params.declined?.("test-case", `${blockKey}/${slug}`, { action: "live-unavailable" }, existingEntry?.modifiedAt);
                 continue;
             }
         }
@@ -7594,7 +7594,6 @@ export async function pushTestCasesForBlock(params) {
                         type: "test-case",
                         key: `${blockKey}/${slug}`,
                         message,
-                        transient: isTransientRequestFailure(err),
                     });
                     continue;
                 }
@@ -7673,7 +7672,6 @@ export async function pushTestCasesForBlock(params) {
                         type: "test-case",
                         key: `${blockKey}/${slug}`,
                         message,
-                        transient: isTransientRequestFailure(err),
                     });
                     continue;
                 }
@@ -7718,7 +7716,6 @@ export async function pushTestCasesForBlock(params) {
                     type: "attachment",
                     key: `${blockKey}/${slug}/${filename}`,
                     message,
-                    transient: isTransientRequestFailure(err),
                 });
             }
         }
@@ -8290,7 +8287,7 @@ export async function applyTestCasePrune(params) {
         catch (err) {
             const message = err?.message || String(err);
             warn(`  Failed to delete attachment ${key}: ${message}`);
-            params.failures.push({ type: "attachment", key, message, transient: isTransientRequestFailure(err) });
+            params.failures.push({ type: "attachment", key, message });
         }
     }
     for (const candidate of params.candidates) {
@@ -8325,7 +8322,7 @@ export async function applyTestCasePrune(params) {
         catch (err) {
             const message = err?.message || String(err);
             warn(`  Failed to delete test case ${key}: ${message}`);
-            params.failures.push({ type: "test-case", key, message, transient: isTransientRequestFailure(err) });
+            params.failures.push({ type: "test-case", key, message });
         }
     }
     return { deleted, deletedAttachments };
@@ -9670,6 +9667,7 @@ export function registerConfigSyncCommands(sync) {
                             // tree's name and whose baseline never includes one.
                             semanticHash: hashAppSettingsForDiff(settings, {
                                 excludeName: pullsLocalEnvironment,
+                                excludeProtection: pullsLocalEnvironment,
                             }),
                         }
                         : pullSelection
@@ -10075,13 +10073,7 @@ What a push guarantees (two stages):
              * never an unconditional write — with the type named so the operator
              * knows drift detection was not in force for it this run.
              */
-            /** Whether each live read that failed this run was transient (#4491). */
-            const liveReadFailures = [];
             const warnLiveUnavailable = (label, reason) => {
-                // A string reason names a consequence ("rule sets unavailable") of a
-                // read already recorded here.
-                if (typeof reason !== "string")
-                    liveReadFailures.push(isTransientRequestFailure(reason));
                 const message = reason instanceof Error ? reason.message : String(reason ?? "unknown");
                 warn(`  ${label}: live state unavailable (${message}) — falling back to last-sync content hashes`);
             };
@@ -10099,11 +10091,6 @@ What a push guarantees (two stages):
                     applyFailures.push({
                         type,
                         key,
-                        // A rerun can read what this one could not only when the failed
-                        // read was transient; a decliner that does not say which read
-                        // failed is judged by every read that failed this run.
-                        transient: outcome.transient ??
-                            (liveReadFailures.length > 0 && liveReadFailures.every(Boolean)),
                         message: "live state could not be read and the manifest holds no " +
                             "last-sync content hash for this file, so push cannot tell " +
                             "which side moved. Nothing was written. Run `config pull` to " +
@@ -10495,6 +10482,9 @@ What a push guarantees (two stages):
                 const { settings: appPayload, warnings: appWarnings } = buildAppSettingsPayload(tomlData, {
                     excludeName: payloadExcludesName,
                     nameOptional: localEnvironment,
+                    // #4564 — on a machine-local environment the level is the
+                    // shared tree's, like the name, and never this child's.
+                    excludeProtection: localEnvironment,
                 });
                 for (const w of appWarnings) {
                     warn(`  ${w}`);
@@ -10524,6 +10514,7 @@ What a push guarantees (two stages):
                             excludeName: localEnvironment ||
                                 options.recordExclusion !== undefined ||
                                 (options.keepExclusion && compareExcludesName),
+                            excludeProtection: localEnvironment,
                         }),
                         ...(options.recordExclusion !== undefined
                             ? { excludedName: options.recordExclusion }
@@ -10534,8 +10525,17 @@ What a push guarantees (two stages):
                 };
                 let applyAppSettings = true;
                 if (appLiveOk) {
-                    const compareOptions = { excludeName: compareExcludesName };
-                    const localHash = hashAppSettingsForDiff(appPayload, compareOptions);
+                    const compareOptions = {
+                        excludeName: compareExcludesName,
+                        excludeProtection: localEnvironment,
+                    };
+                    // The file's deprecated `protected` key reads against the live
+                    // level, as the server's write will (DSO-4564-001), so a change
+                    // made only through it is not skipped as unchanged.
+                    const localHash = hashAppSettingsForDiff(appPayload, {
+                        ...compareOptions,
+                        legacyProtectedAgainst: settingsProtectionLevel(liveSettings ?? {}),
+                    });
                     const remoteHash = hashAppSettingsForDiff(liveSettings ?? {}, compareOptions);
                     if (options.force) {
                         // `--force` is the operator saying "local wins": no direction
@@ -14201,18 +14201,31 @@ What a push guarantees (two stages):
                 // consulted per function, so one broken file refuses itself and
                 // nothing else; `--no-typecheck` is the escape hatch, and an
                 // unavailable compiler warns rather than failing the push.
+                const files = selectFiles("function", functionsPushDir, readdirSync(functionsPushDir).filter(isFunctionDeclarationFile));
+                // #4502 — the directories outside the tree that function code may
+                // import from, resolved once for the push so a dropped entry is
+                // named once rather than once per function. The bundler and the
+                // checker are handed the same list, so they agree on what is shared.
+                const functionSourceRoots = files.length > 0
+                    ? resolveFunctionSourceRoots(configDir)
+                    : { roots: [], warnings: [] };
+                for (const warning of functionSourceRoots.warnings)
+                    warn(`  ${warning}`);
+                const sourceRoots = functionSourceRoots.roots.map((root) => root.absolute);
                 let typecheckSetup = null;
                 const functionTypechecker = () => {
                     if (options.typecheck === false)
                         return null;
                     if (typecheckSetup === null) {
-                        typecheckSetup = createFunctionTypechecker(configDir);
+                        typecheckSetup = createFunctionTypechecker(configDir, {
+                            sourceRoots,
+                            onWarning: (message) => warn(`  ${message}`),
+                        });
                         for (const warning of typecheckSetup.warnings)
                             warn(`  ${warning}`);
                     }
                     return typecheckSetup.checker;
                 };
-                const files = selectFiles("function", functionsPushDir, readdirSync(functionsPushDir).filter(isFunctionDeclarationFile));
                 const functionSpec = configDiffSpec("function");
                 const liveFunctions = new Map();
                 let functionsLiveOk = true;
@@ -14273,13 +14286,15 @@ What a push guarantees (two stages):
                     // Build first: nothing is sent for a function whose code does not
                     // compile or whose imports leave the tree.
                     let push;
+                    let projectSources;
                     try {
-                        push = await buildFunctionConfigPush({
+                        ({ push, projectSources } = await buildFunctionConfigPushDetailed({
                             configDir,
                             functionKey: key,
                             filePath,
                             tomlData,
-                        });
+                            sourceRoots,
+                        }));
                     }
                     catch (err) {
                         if (!(err instanceof FunctionBuildError))
@@ -14309,7 +14324,7 @@ What a push guarantees (two stages):
                     // sent for it and whether or not this is a dry run.
                     const typechecker = functionTypechecker();
                     if (typechecker) {
-                        const failure = typechecker.check(key, push.sources.map((source) => source.path));
+                        const failure = typechecker.check(key, push.sources.map((source) => source.path), projectSources);
                         if (failure) {
                             applyFailures.push({
                                 type: "function",
@@ -14486,7 +14501,6 @@ What a push guarantees (two stages):
                             type: "function",
                             key,
                             message: String(err?.message ?? err),
-                            transient: isTransientRequestFailure(err),
                         });
                         // A refused create, or a refused push to a row the server does
                         // not hold live (an archived tombstone). A row this push created
@@ -15319,7 +15333,6 @@ What a push guarantees (two stages):
                                     type: "email-template",
                                     key: emailType,
                                     message: err?.message || String(err),
-                                    transient: isTransientRequestFailure(err),
                                 });
                             }
                         }
@@ -15856,17 +15869,6 @@ What a push guarantees (two stages):
                 else {
                     error(failureSummary);
                 }
-                writePushFailureReport(pushFailureIsTransient({
-                    applyFailures,
-                    conflicts: conflicts.length,
-                    blockedDatabaseTypes: blockedDatabaseTypes.length,
-                    schemaErrors: schemaErrors.schemaRequired.length +
-                        schemaErrors.opRefs.length +
-                        schemaErrors.schemaBreaks.length +
-                        schemaErrors.uncheckableOps.length +
-                        schemaErrors.tomlParse.length +
-                        schemaErrors.opsExist.length,
-                }));
                 process.exit(1);
             }
             else {
@@ -15907,7 +15909,6 @@ What a push guarantees (two stages):
             // Print message + structured server-side validation details
             // (issue #684; now via the shared #1173 helper).
             printApiError(err);
-            writePushFailureReport(isTransientRequestFailure(err));
             process.exit(1);
         }
     });
@@ -17093,6 +17094,7 @@ What a push guarantees (two stages):
                     const { settings: localAppSettings, errors: appErrors } = buildAppSettingsPayload(appTomlData, {
                         excludeName,
                         nameOptional: diffsLocalEnvironment,
+                        excludeProtection: diffsLocalEnvironment,
                     });
                     if (appErrors.length > 0) {
                         appRow(VALIDATION_ERROR, appErrors.join("; "));
@@ -17107,7 +17109,7 @@ What a push guarantees (two stages):
                             });
                         }
                         else {
-                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName });
+                            const fieldDiffs = appSettingsFieldDiffs(localAppSettings, settingsOutcome.value ?? {}, { excludeName, excludeProtection: diffsLocalEnvironment });
                             if (fieldDiffs.length === 0) {
                                 appRow("exists");
                             }