diff --git a/.github/workflows/sync-main-to-dev.yml b/.github/workflows/sync-main-to-dev.yml
new file mode 100644
index 000000000..7b82e02a7
--- /dev/null
+++ b/.github/workflows/sync-main-to-dev.yml
@@ -0,0 +1,69 @@
+name: Sync Main to Dev
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sync-commits:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+      
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+      
+      - name: Sync main commits to dev
+        run: |
+          # Fetch all branches
+          git fetch origin main:main
+          git fetch origin dev:dev
+          
+          # Switch to dev branch
+          git checkout dev
+          
+          # Find commits on main that are not on dev
+          COMMITS_TO_CHERRY_PICK=$(git rev-list --reverse main ^dev)
+          
+          if [ -z "$COMMITS_TO_CHERRY_PICK" ]; then
+            echo "No commits to sync from main to dev"
+            exit 0
+          fi
+          
+          echo "Found commits to cherry-pick:"
+          echo "$COMMITS_TO_CHERRY_PICK"
+          
+          # Cherry-pick each commit
+          SUCCESS=true
+          for COMMIT in $COMMITS_TO_CHERRY_PICK; do
+            echo "Cherry-picking commit: $COMMIT"
+            if ! git cherry-pick $COMMIT; then
+              echo "Cherry-pick failed for commit $COMMIT"
+              # Try to continue with --allow-empty in case it's already applied
+              if ! git cherry-pick --continue --allow-empty 2>/dev/null; then
+                echo "Failed to cherry-pick $COMMIT, aborting"
+                git cherry-pick --abort
+                SUCCESS=false
+                break
+              fi
+            fi
+          done
+          
+          if [ "$SUCCESS" = true ]; then
+            # Push changes to dev
+            git push origin dev
+            echo "Successfully synced commits from main to dev"
+          else
+            echo "Failed to sync some commits"
+            exit 1
+          fi
\ No newline at end of file
diff --git a/apps/backend/src/lib/config.tsx b/apps/backend/src/lib/config.tsx
index 96a31929e..93684e6af 100644
--- a/apps/backend/src/lib/config.tsx
+++ b/apps/backend/src/lib/config.tsx
@@ -1,13 +1,14 @@
 import { Prisma } from "@prisma/client";
-import { normalize, override } from "@stackframe/stack-shared/dist/config/format";
-import { BranchConfigOverride, BranchConfigOverrideOverride, BranchRenderedConfig, CompleteConfig, EnvironmentConfigOverride, EnvironmentConfigOverrideOverride, EnvironmentRenderedConfig, OrganizationConfigOverride, ProjectConfigOverride, ProjectConfigOverrideOverride, ProjectRenderedConfig, applyBranchDefaults, applyEnvironmentDefaults, applyOrganizationDefaults, applyProjectDefaults, assertNoConfigOverrideErrors, branchConfigSchema, environmentConfigSchema, migrateConfigOverride, organizationConfigSchema, projectConfigSchema, sanitizeBranchConfig, sanitizeEnvironmentConfig, sanitizeOrganizationConfig, sanitizeProjectConfig } from "@stackframe/stack-shared/dist/config/schema";
+import { Config, getInvalidConfigReason, normalize, override } from "@stackframe/stack-shared/dist/config/format";
+import { BranchConfigOverride, BranchConfigOverrideOverride, BranchIncompleteConfig, BranchRenderedConfig, CompleteConfig, EnvironmentConfigOverride, EnvironmentConfigOverrideOverride, EnvironmentIncompleteConfig, EnvironmentRenderedConfig, OrganizationConfigOverride, OrganizationConfigOverrideOverride, OrganizationIncompleteConfig, ProjectConfigOverride, ProjectConfigOverrideOverride, ProjectIncompleteConfig, ProjectRenderedConfig, applyBranchDefaults, applyEnvironmentDefaults, applyOrganizationDefaults, applyProjectDefaults, assertNoConfigOverrideErrors, branchConfigSchema, environmentConfigSchema, getConfigOverrideErrors, getIncompleteConfigWarnings, migrateConfigOverride, organizationConfigSchema, projectConfigSchema, sanitizeBranchConfig, sanitizeEnvironmentConfig, sanitizeOrganizationConfig, sanitizeProjectConfig } from "@stackframe/stack-shared/dist/config/schema";
 import { ProjectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
-import { yupMixed, yupObject } from "@stackframe/stack-shared/dist/schema-fields";
+import { yupBoolean, yupMixed, yupObject, yupRecord, yupString, yupUnion } from "@stackframe/stack-shared/dist/schema-fields";
 import { isTruthy } from "@stackframe/stack-shared/dist/utils/booleans";
-import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
+import { StackAssertionError, captureError } from "@stackframe/stack-shared/dist/utils/errors";
 import { filterUndefined, typedEntries } from "@stackframe/stack-shared/dist/utils/objects";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
 import { deindent, stringCompare } from "@stackframe/stack-shared/dist/utils/strings";
+import * as yup from "yup";
 import { RawQuery, globalPrismaClient, rawQuery } from "../prisma-client";
 import { listPermissionDefinitionsFromConfig } from "./permissions";
 import { DEFAULT_BRANCH_ID } from "./tenancies";