fix(config): Run server-side dry-run

[dmoerner]

When we implemented config diffing we started doing the diffing client-side. I think this is still generally the correct behavior. However, we should also run and display the server-side dry-run on a dry-run, since this actually runs the validation before a change, which is very valuable.

[changeset-bot]

🦋 Changeset detected

Latest commit: cec9f36

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: add71704-d0c5-4854-a537-5168d7fe214b

📥 Commits

Reviewing files that changed from the base of the PR and between fa90035 and cec9f36.

📒 Files selected for processing (3)

• .changeset/orgs-diffing-quirks.md
• packages/cli-core/src/commands/config/push.test.ts
• packages/cli-core/src/commands/config/push.ts

✅ Files skipped from review due to trivial changes (2)

• .changeset/orgs-diffing-quirks.md
• packages/cli-core/src/commands/config/push.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/cli-core/src/commands/config/push.test.ts

---

📝 Walkthrough

Walkthrough

This pull request enables true dry-run behavior for config patch and config put by sending real API requests that include ?dry_run=true instead of skipping network calls. It adds a changeset note, updates CLI docs to describe server-side validation and projected-result previewing, widens API wrapper signatures to accept a dryRun option and append dry_run=true to requests, modifies push logic to propagate dry-run and adjust confirmation/messaging, and updates unit and integration tests to assert the dry-run request behavior and validation error handling.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Detailed notes

• Control-flow changes in push.ts: removed early return for dry-run, prompts gated only when !options.dryRun && isHuman() && !options.yes, spinner and error context adjusted for dry-run, and dry-run success messaging updated (prefix changed to "[dry-run] Proposing ...").
• API layer (plapi.ts): sendInstanceConfig accepts dryRun and appends dry_run=true to request URLs; putInstanceConfig and patchInstanceConfig signatures widened to include dryRun.
• Tests: multiple unit and integration tests revised from asserting "no mutating request" to asserting a single PUT/PATCH containing dry_run=true; added a dry-run test asserting propagation of server-side validation errors (HTTP 422) surfaces the server message.
• Docs and changeset: README updated to document --dry-run behavior and endpoint query parameter; a changeset entry added for a patch release.
• Review focus: verify control-flow correctness in push.ts (confirmation gating, spinner labels, error context), ensure type widening is safe and dryRun reliably flows through to query-string construction, and confirm tests correctly reflect intended dry-run semantics.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling server-side dry-run validation in the config command.
Description check	✅ Passed	The description is directly related to the changeset, explaining the rationale for running server-side dry-run validation during config changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[rafa-thayto]

The test name says it surfaces server validation errors, but we only assert the error class. The server's message (invalid organization_settings) never gets verified, so a regression in error formatting would slip through. Tightening the assertion catches that.

Suggested change

	await expect(
	runConfigPatch({ json: '{"session":{"lifetime":3600}}', dryRun: true }),
	).rejects.toThrow("API error");
	await expect(
	runConfigPatch({ json: '{"session":{"lifetime":3600}}', dryRun: true }),
	).rejects.toThrow("invalid organization_settings");

[dmoerner]

Thank you, fixed!

[rafa-thayto]

Small one: the PATCH dry-run test above asserts the projected result on stdout and the Validation passed line. The PUT test stops earlier, so a regression in either would slip through for PUT only. Worth mirroring.

Suggested change

	await runConfigPut({ json: '{"session":{"lifetime":3600}}', dryRun: true });
	expect(putUrl).toContain("dry_run=true");
	expect(captured.err).toContain("[dry-run] Would PUT");
	});
	await runConfigPut({ json: '{"session":{"lifetime":3600}}', dryRun: true });
	expect(putUrl).toContain("dry_run=true");
	expect(captured.err).toContain("[dry-run] Would PUT");
	expect(captured.out).toContain(JSON.stringify(mockResponse, null, 2));
	expect(captured.err).toContain("[dry-run] Validation passed");

[dmoerner]

Thanks, adopted (and fixed the "Would" in the error assertion from Wyatt's comment)