@dypai-ai/mcp 1.6.16 → 1.6.17

package/src/tools/sync/diff.js

@@ -1,26 +1,13 @@
-/**
- * dypai_diff — preview what dypai_push would change. Read-only, safe.
- *
- * The picture has THREE layers, not two:
- *   - LOCAL  : what's on disk in dypai/
- *   - DRAFT  : what's already been staged via prior pushes (system.config_drafts)
- *   - LIVE   : what the engine actually serves at <project_id>.dypai.dev
- *
- * The diff body reports LOCAL → EFFECTIVE_REMOTE (live + pending drafts) —
- * what `dypai_push` will actually queue. We additionally surface the DRAFT
- * layer metadata so the agent can spot overlap and publish/discard decisions.
- */
-
 import { resolve as resolvePath } from "path"
-import { fetchRemoteState, readLocalEffectiveState, readLocalStateSnapshot, readLocalConfig, computePlan, buildEffectiveRemoteState } from "./planner.js"
-import { proxyToolCall } from "../proxy.js"
+import { readLocalConfig } from "./planner.js"
+import { diffBackendSource } from "./source-diff.js"
 
 export const dypaiDiffTool = {
   name: "dypai_diff",
   description:
-    "Compare the local ./dypai/ folder against the remote project state without applying anything. " +
-    "Returns a plan: endpoints to create, update (with changed fields), delete, and unchanged. " +
-    "Always call this before dypai_push to preview changes safely.",
+    "Fast source diff for the local ./dypai/ folder. " +
+    "It does not compile, call remote services, or stage changes. " +
+    "Use dypai_push to compile, validate, save backend drafts, and regenerate types.",
   inputSchema: {
     type: "object",
     properties: {
@@ -35,138 +22,49 @@ export const dypaiDiffTool = {
       },
       delete_orphans: {
         type: "boolean",
-        description: "If true, endpoints present in remote but missing locally are queued for deletion. Default: false (safe).",
+        description: "Ignored by dypai_diff. Deletions are only applied by dypai_push when explicitly requested.",
         default: false,
       },
     },
   },
 
-  async execute({ project_id, root_dir = "./dypai", delete_orphans = false } = {}) {
+  async execute({ project_id, root_dir = "./dypai" } = {}) {
     const rootDir = resolvePath(process.cwd(), root_dir)
 
     const config = await readLocalConfig(rootDir)
     const targetProjectId = project_id || config?.project_id || null
+    const diff = await diffBackendSource(rootDir)
 
-    const [local, remote, stateSnapshot, draftsResult] = await Promise.all([
-      readLocalEffectiveState(rootDir, targetProjectId),
-      fetchRemoteState(targetProjectId),
-      readLocalStateSnapshot(rootDir),
-      // Pending drafts. Cheap on dev (always 0); on prod surfaces what's
-      // already staged so the agent can reason about overlap with the local
-      // change set. Old engines without the drafts API silently fall back.
-      proxyToolCall("manage_drafts", targetProjectId
-        ? { project_id: targetProjectId, operation: "list" }
-        : { operation: "list" }
-      ).catch(() => ({ total: 0, drafts: [], _unavailable: true })),
-    ])
-
-    if (local.errors.length) {
-      return {
-        success: false,
-        phase: "read_local",
-        errors: local.errors,
-        hint: "Fix the YAML/file errors before running diff again.",
-      }
-    }
-
-    if (!remote || !remote.mapsCtx) {
+    if (!diff.ok) {
       return {
         success: false,
-        phase: "fetch_remote",
-        error: "Remote state could not be fetched (mapsCtx missing). Check your DYPAI_TOKEN and project_id.",
+        phase: "source_diff",
+        reason: diff.reason,
+        error: diff.error,
+        hint: "Fix the local dypai/.dypai/backend-baseline.json or run dypai_pull/sync again.",
       }
     }
 
-    const effectiveRemote = buildEffectiveRemoteState(remote, draftsResult)
-    const plan = computePlan(local, effectiveRemote, remote.mapsCtx, {
-      deleteOrphans: delete_orphans,
-      stateSnapshot,
-      liveRemote: remote,
-    })
-
-    const groupChanges = (plan.groups?.create?.length || 0) + (plan.groups?.delete?.length || 0)
-    const totalChanges = plan.create.length + plan.update.length + plan.delete.length + groupChanges
-    const hasConflicts = (plan.warnings || []).some(w => w.type === "remote_changed_since_pull")
-
-    // ─── Drafts overlay ───────────────────────────────────────────────────
-    // Build a `pending_drafts` view that tells the agent what's already
-    // staged AND highlights the overlap with this diff's local-change set.
-    // The overlap is the agent-relevant signal: same endpoint touched on
-    // BOTH sides means pushing now will overwrite the existing draft.
-    const draftItems = Array.isArray(draftsResult?.drafts) ? draftsResult.drafts : []
-    const draftCount = draftsResult?.total || 0
-
-    const localChangeNames = new Set([
-      ...plan.create.map(p => p.name),
-      ...plan.update.map(p => p.name),
-      ...plan.delete.map(p => p.name),
-    ])
-
-    const overlap = draftItems
-      .filter(d => d.resource_type === "endpoint" && localChangeNames.has(d.resource_name))
-      .map(d => ({
-        endpoint: d.resource_name,
-        existing_draft_op: d.op,
-        local_change_op: plan.create.find(p => p.name === d.resource_name) ? "create"
-          : plan.update.find(p => p.name === d.resource_name) ? "update"
-          : "delete",
-      }))
-
-    const pendingDrafts = draftCount > 0 ? {
-      total: draftCount,
-      counts_by_type: draftsResult?.counts_by_type || {},
-      items: draftItems
-        .map(d => ({
-          resource_type: d.resource_type,
-          resource_name: d.resource_name,
-          op: d.op,
-        }))
-        .sort((a, b) => (a.resource_name || "").localeCompare(b.resource_name || "")),
-      // Endpoints that are BOTH staged AND modified locally — pushing again
-      // replaces the existing draft. Empty array = no overlap (clean signal).
-      overlap_with_local: overlap,
-    } : null
-
-    // ─── Hint priority ────────────────────────────────────────────────────
-    // 1. Conflicts and missing creds always win (block push).
-    // 2. Overlap is next: explicitly tell the agent that re-push overwrites.
-    // 3. Pending drafts (no overlap): suggest publishing or discarding before
-    //    stacking more on top.
-    const hint = hasConflicts
-      ? "Remote changed since your last pull — dypai_pull first, or dypai_push will be blocked."
-      : (plan.warnings || []).some(w => w.type === "missing_credential")
-        ? "Some YAMLs reference credentials missing remotely. Create them in the dashboard before pushing."
-        : overlap.length > 0
-          ? `${overlap.length} endpoint(s) have BOTH a pending draft AND a local change — dypai_push will REPLACE the existing draft with the new version. Review pending_drafts.overlap_with_local before pushing.`
-        : totalChanges === 0 && draftCount > 0
-          ? `${draftCount} pending backend change(s) — local matches what's already saved. Test with dypai_test_endpoint(mode:'draft'), then use dypai_deploy_production(confirm:true) when the user approves going live.`
-          : draftCount > 0 && totalChanges > 0
-            ? `${draftCount} backend change(s) already pending; this diff would save ${totalChanges} more. Keep testing in preview, or use dypai_deploy_production(confirm:true) after explicit approval.`
-            : draftCount > 0
-              ? `${draftCount} pending backend change(s) — no local changes to push. Test with dypai_test_endpoint(mode:'draft'), then use dypai_deploy_production(confirm:true) after explicit approval.`
-              : undefined
+    const totalChanges = diff.summary.create + diff.summary.update + diff.summary.delete
 
     return {
       success: true,
+      mode: "source",
+      project_id: targetProjectId,
+      baseline: diff.baseline,
       summary: {
-        create: plan.create.length,
-        update: plan.update.length,
-        delete: plan.delete.length,
-        unchanged: plan.unchanged.length,
-        orphans_ignored: plan.orphansIgnored?.length || 0,
-        groups_create: plan.groups?.create?.length || 0,
-        groups_delete: plan.groups?.delete?.length || 0,
-        groups_unchanged: plan.groups?.unchanged?.length || 0,
-        warnings: plan.warnings?.length || 0,
-        pending_drafts: draftCount,
-        drafts_overlap_with_local: overlap.length,
+        create: diff.summary.create,
+        update: diff.summary.update,
+        delete: diff.summary.delete,
+        unchanged: diff.summary.unchanged,
       },
-      // Only include plan details when there are actual changes or warnings
-      plan: (totalChanges > 0 || plan.warnings?.length) ? plan : undefined,
-      // Always present so the agent knows the key exists. `null` = nothing
-      // staged (cleaner signal than omitted-or-zero ambiguity).
-      pending_drafts: pendingDrafts,
-      hint,
+      source_changes: totalChanges > 0 ? diff.files : undefined,
+      requires_push: totalChanges > 0,
+      requires_compile: totalChanges > 0,
+      pending_drafts: null,
+      hint: totalChanges > 0
+        ? "Local backend source changed. Run dypai_push to compile, validate, save preview drafts, and regenerate types."
+        : "No local backend source changes. Nothing to push.",
     }
   },
 }

package/src/tools/sync/planner.js

@@ -40,6 +40,15 @@ function parseMaybeJson(v) {
   try { return JSON.parse(v) } catch { return v }
 }
 
+function isBackendSourcePath(path) {
+  if (typeof path !== "string") return false
+  return (
+    (path.startsWith("dypai/flows/") && /\.flow\.ts$/i.test(path)) ||
+    (path.startsWith("dypai/automations/") && /\.automation\.ts$/i.test(path)) ||
+    (path.startsWith("dypai/endpoints/") && /\.(ya?ml)$/i.test(path))
+  )
+}
+
 function hydrateRow(row) {
   return {
     ...row,
@@ -453,6 +462,7 @@ export async function readLocalEffectiveState(rootDir, projectId = null, deps =
 
   const payloads = Array.isArray(bulkResult.data?.payloads) ? bulkResult.data.payloads : []
   const diagnostics = Array.isArray(bulkResult.data?.diagnostics) ? bulkResult.data.diagnostics : []
+  const rejected = Array.isArray(bulkResult.data?.rejected) ? bulkResult.data.rejected : []
   const byName = {}
   const shadowed = []
   const flowNames = new Set()
@@ -484,12 +494,21 @@ export async function readLocalEffectiveState(rootDir, projectId = null, deps =
     })
   }
 
+  for (const item of rejected) {
+    if (!isBackendSourcePath(item?.path)) continue
+    yamlState.errors.push({
+      file: item.path,
+      error: `Backend compiler rejected source file: ${item.reason || "rejected"}`,
+      rule: "backend_compiler_rejected_source",
+    })
+  }
+
   for (const [name, entry] of Object.entries(yamlState.byName)) {
     if (flowNames.has(name)) continue
     byName[name] = { ...entry, source: "legacy-yaml" }
   }
 
-  return { byName, errors: yamlState.errors, shadowed, runnerWarning: null }
+  return { byName, errors: yamlState.errors, shadowed, runnerWarning: null, automations: bulkResult.data?.automations ?? null }
 }
 
 // ─── Normalization + diff ──────────────────────────────────────────────────

package/src/tools/sync/pull.js

@@ -84,7 +84,7 @@ function suspiciousPathWarning(resolvedPath, source) {
 
 // Subfolders that are always created so the layout is predictable. An agent
 // never has to check "does this folder exist?" before writing a new SQL/prompt/JS file.
-const CANONICAL_SUBDIRS = ["endpoints", "flows", "sql", "prompts", "code", "migrations"]
+const CANONICAL_SUBDIRS = ["endpoints", "flows", "automations", "sql", "prompts", "code", "migrations"]
 
 const README_CONTENT = `# dypai/
 
@@ -97,6 +97,8 @@ Declarative snapshot of your DYPAI project's backend.
   Subfolders represent endpoint groups, e.g. \`endpoints/Admin/foo.yaml\` → group "Admin".
 - \`flows/\` — TypeScript flow definitions (\`*.flow.ts\`). **Authoritative for new work.**
   When a flow exists for an endpoint name, it wins over legacy YAML at validate/push/test time.
+- \`automations/\` — TypeScript automation definitions (\`*.automation.ts\`) for scheduled/webhook business processes.
+  Automations compile to normal backend workflows, but also declare setup requirements, notifications, and history metadata for the organization Automations page.
 - \`capability-catalog.json\` — grouped capability catalog (synced by \`dypai_pull\`).
 - \`capability-brief.md\` — compact capability index for agents.
 - \`node-catalog.json\` — every node_type with input/output schemas.
@@ -108,7 +110,7 @@ Declarative snapshot of your DYPAI project's backend.
 ## Workflow
 
 1. \`dypai_pull\` to snapshot the remote state into this folder
-2. Edit \`flows/*.flow.ts\` (preferred) or legacy YAML, SQL, prompts, code
+2. Edit \`flows/*.flow.ts\` for callable endpoints, \`automations/*.automation.ts\` for scheduled/webhook processes, or legacy YAML, SQL, prompts, code
 3. \`dypai_validate\` / \`dypai_test_endpoint\` before push
 4. \`dypai_diff\` to preview changes
 5. \`dypai_push\` to apply to the remote
@@ -523,17 +525,36 @@ function isFlowTsSource(workflowSource) {
   return workflowSource?.kind === "flow-ts"
 }
 
+function isAutomationTsSource(workflowSource) {
+  return workflowSource?.kind === "automation-ts"
+}
+
+function isEditableTsSource(workflowSource) {
+  return isFlowTsSource(workflowSource) || isAutomationTsSource(workflowSource)
+}
+
 function isFlowSourcePath(path) {
   return typeof path === "string" && path.startsWith("dypai/flows/") && /\.flow\.ts$/i.test(path)
 }
 
-export function normalizeFlowSourceFile(workflowSource, endpointName) {
+function isAutomationSourcePath(path) {
+  return typeof path === "string" && path.startsWith("dypai/automations/") && /\.automation\.ts$/i.test(path)
+}
+
+export function normalizeEditableSourceFile(workflowSource, endpointName) {
   const raw = typeof workflowSource?.file === "string" ? workflowSource.file.trim().replace(/\\/g, "/") : ""
   if (isFlowSourcePath(raw)) return raw
+  if (isAutomationSourcePath(raw)) return raw
   if (raw.startsWith("flows/") && /\.flow\.ts$/i.test(raw)) return `dypai/${raw}`
+  if (raw.startsWith("automations/") && /\.automation\.ts$/i.test(raw)) return `dypai/${raw}`
+  if (isAutomationTsSource(workflowSource)) return `dypai/automations/${endpointName}.automation.ts`
   return `dypai/flows/${endpointName}.flow.ts`
 }
 
+export function normalizeFlowSourceFile(workflowSource, endpointName) {
+  return normalizeEditableSourceFile(workflowSource, endpointName)
+}
+
 function flowSourceRelPath(sourceFile) {
   return sourceFile.replace(/^dypai\//, "")
 }
@@ -553,7 +574,7 @@ export function buildPersistedFlowSourceMap(sourcePayload) {
   const byPath = new Map()
   for (const entry of files) {
     const path = typeof entry?.path === "string" ? entry.path.trim().replace(/\\/g, "/") : ""
-    if (!isFlowSourcePath(path)) continue
+    if (!isFlowSourcePath(path) && !isAutomationSourcePath(path)) continue
     const decoded = decodeSourceFileContent(entry)
     if (decoded == null) continue
     byPath.set(path, decoded)
@@ -607,13 +628,15 @@ async function removeEndpointYamlFiles(outDir, name, groupName = null) {
 function renderMissingFlowStub(row, sourceFile, sourceFetch) {
   const refLine = sourceFetch?.ref ? `# Checked Git source ref: ${sourceFetch.ref}\n` : ""
   const errorLine = sourceFetch?.error ? `# Source fetch error: ${sourceFetch.error}\n` : ""
+  const sourceKind = sourceFile.endsWith(".automation.ts") ? "AUTOMATION" : "FLOW"
+  const extension = sourceFile.endsWith(".automation.ts") ? ".automation.ts" : ".flow.ts"
   return (
-    `# MISSING AUTHORITATIVE FLOW SOURCE\n` +
-    `# Remote endpoint '${row.name}' is marked as Flow-authored, but dypai_pull could not find:\n` +
+    `# MISSING AUTHORITATIVE ${sourceKind} SOURCE\n` +
+    `# Remote endpoint '${row.name}' is marked as ${sourceKind.toLowerCase()}-authored, but dypai_pull could not find:\n` +
     `#   ${sourceFile}\n` +
     refLine +
     errorLine +
-    `# Do not edit this YAML stub. Restore or sync the .flow.ts source, then rerun dypai_pull.\n\n` +
+    `# Do not edit this YAML stub. Restore or sync the ${extension} source, then rerun dypai_pull.\n\n` +
     `# name: ${row.name}\n` +
     `# method: ${row.method || "POST"}\n`
   )
@@ -901,9 +924,9 @@ export const dypaiPullTool = {
       row.workflow_source = parseMaybeJson(row.workflow_source)
       try {
         const workflowSource = row.workflow_source
-        if (isFlowTsSource(workflowSource)) {
+        if (isEditableTsSource(workflowSource)) {
           const groupName = row.group_id ? (mapsCtx.groupIdToName[row.group_id] || null) : null
-          const sourceFile = normalizeFlowSourceFile(workflowSource, row.name)
+          const sourceFile = normalizeEditableSourceFile(workflowSource, row.name)
           const relFlowPath = flowSourceRelPath(sourceFile)
           const flowContent = persistedFlowSources.byPath.get(sourceFile)
           // Drop stale YAML/stubs from a previous pull. Any YAML next to a real
@@ -945,8 +968,8 @@ export const dypaiPullTool = {
           errors.push({
             endpoint: row.name,
             error:
-              `Endpoint is Flow-authored but ${sourceFile} was not found in persisted project source. ` +
-              `Restore/sync the .flow.ts source, then rerun dypai_pull.`,
+              `Endpoint is source-authored but ${sourceFile} was not found in persisted project source. ` +
+              `Restore/sync the editable TypeScript source, then rerun dypai_pull.`,
           })
           continue
         }
@@ -1129,11 +1152,11 @@ export const dypaiPullTool = {
       next_steps: pendingDrafts
         ? [
             `${draftsTotal} pending draft(s). Review with manage_drafts(operation:'list'), verify with dypai_test_endpoint(mode:'draft'), then publish or discard.`,
-            "After resolving drafts, edit Flow in dypai/flows/ (preferred) or legacy YAML in dypai/endpoints/, then dypai_diff → dypai_push to stage more.",
+            "After resolving drafts, edit Flow in dypai/flows/, Automations in dypai/automations/, or legacy YAML in dypai/endpoints/, then dypai_diff → dypai_push to stage more.",
           ]
         : (endpoints || []).length === 0
-          ? ["Empty project. Create tables via execute_sql, then write dypai/flows/<name>.flow.ts and dypai_push."]
-          : ["Read dypai/schema.sql before writing queries.", "Edit Flow in dypai/flows/ (preferred) or legacy YAML in dypai/endpoints/, then dypai_diff → dypai_push."],
+          ? ["Empty project. Create tables via execute_sql, then write dypai/flows/<name>.flow.ts for callable endpoints or dypai/automations/<name>.automation.ts for scheduled/webhook processes, then dypai_push."]
+          : ["Read dypai/schema.sql before writing queries.", "Edit Flow in dypai/flows/, Automations in dypai/automations/, or legacy YAML in dypai/endpoints/, then dypai_diff → dypai_push."],
     }
 
     return {
@@ -1155,7 +1178,7 @@ export const dypaiPullTool = {
         : draftsTotal > 0
           ? `${draftsTotal} pending draft(s) on this project — see overview.pending_drafts and decide publish vs discard before pushing more.`
         : endpoints.length === 0
-          ? "Empty project. Create tables with execute_sql, then write flows/<name>.flow.ts and dypai_push."
+          ? "Empty project. Create tables with execute_sql, then write flows/<name>.flow.ts or automations/<name>.automation.ts and dypai_push."
           : undefined,
     }
   },

package/src/tools/sync/push.js

@@ -25,6 +25,7 @@ import {
 } from "./planner.js"
 import { runValidation } from "./validate.js"
 import { runGenerateEndpointTypes } from "./generate-types.js"
+import { writeBackendSourceBaseline } from "./source-diff.js"
 // Codegen removed from v1 — see pull.js note.
 // import { regenerateTypes } from "../codegen.js"
 
@@ -34,7 +35,7 @@ const VALID_RESPONSE_CARDINALITY = new Set(["single", "many", "zero_or_one"])
 const PUSH_CONCURRENCY = Math.max(1, Number(process.env.DYPAI_PUSH_CONCURRENCY || 1))
 const PUSH_RETRY_ATTEMPTS = Math.max(1, Number(process.env.DYPAI_PUSH_RETRY_ATTEMPTS || 3))
 const PUSH_RETRY_DELAY_MS = Math.max(100, Number(process.env.DYPAI_PUSH_RETRY_DELAY_MS || 500))
-const BACKEND_SOURCE_CHECKPOINT_DIRS = ["flows", "endpoints", "migrations", "types", "lib"]
+const BACKEND_SOURCE_CHECKPOINT_DIRS = ["flows", "automations", "endpoints", "migrations", "types", "lib"]
 const BACKEND_SOURCE_CHECKPOINT_EXACT = ["schema.sql", "realtime.yaml"]
 const BACKEND_SOURCE_CHECKPOINT_EXTS = new Set([
   ".ts", ".tsx", ".js", ".jsx", ".mjs", ".mts", ".cjs", ".cts",
@@ -136,6 +137,8 @@ function normalizeWorkflowSourceFile(row) {
   const raw = typeof source?.file === "string" ? source.file.trim().replace(/\\/g, "/") : ""
   if (raw.startsWith("dypai/flows/") && raw.endsWith(".flow.ts")) return raw
   if (raw.startsWith("flows/") && raw.endsWith(".flow.ts")) return `dypai/${raw}`
+  if (raw.startsWith("dypai/automations/") && raw.endsWith(".automation.ts")) return raw
+  if (raw.startsWith("automations/") && raw.endsWith(".automation.ts")) return `dypai/${raw}`
   return null
 }
 
@@ -195,6 +198,29 @@ async function checkpointBackendSource(projectId, rootDir, plan, remote) {
   }
 }
 
+async function refreshBackendSourceBaseline(projectId, rootDir, sourceCheckpoint) {
+  if (sourceCheckpoint?.ok === false && sourceCheckpoint?.skipped !== true) {
+    return {
+      ok: false,
+      skipped: true,
+      reason: "source_checkpoint_failed",
+    }
+  }
+  try {
+    const baseline = await writeBackendSourceBaseline(rootDir, projectId)
+    return {
+      ok: true,
+      files: Array.isArray(baseline.files) ? baseline.files.length : 0,
+      path: "dypai/.dypai/backend-baseline.json",
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      error: error?.message || String(error),
+    }
+  }
+}
+
 /**
  * Run an async worker over an array with bounded concurrency. Workers never
  * throw (they handle their own errors via the push errors[] accumulator),
@@ -275,7 +301,7 @@ function assertMutationOK(result, op, name) {
  * Returns true when the API staged the change as a draft (default behavior)
  * instead of applying it directly to live. Both the draft branch and the
  * direct-write branch are valid successful outcomes — drafts just need to
- * be reported back to the user so they know to run dypai_deploy_production(confirm:true).
+ * be reported back to the user so they know to publish the drafts explicitly.
  */
 function isDraftResponse(result) {
   return result && typeof result === "object" && result.applied_to === "draft"
@@ -439,7 +465,7 @@ export const dypaiPushTool = {
       },
       dry_run: {
         type: "boolean",
-        description: "If true, compute the plan and return it without applying. Same as dypai_diff.",
+        description: "If true, compile and compute the backend plan without applying or regenerating types. For a fast source-only preview use dypai_diff.",
         default: false,
       },
       force: {
@@ -499,11 +525,13 @@ export const dypaiPushTool = {
       }
     }
 
-    let typesGenerated = null
-    try {
-      typesGenerated = await runGenerateEndpointTypes(rootDir, targetProjectId)
-    } catch (e) {
-      typesGenerated = { ok: false, error: e.message }
+    let typesGenerated = dry_run ? { ok: true, skipped: true, reason: "dry_run" } : null
+    if (!dry_run) {
+      try {
+        typesGenerated = await runGenerateEndpointTypes(rootDir, targetProjectId)
+      } catch (e) {
+        typesGenerated = { ok: false, error: e.message }
+      }
     }
 
     let local
@@ -594,6 +622,9 @@ export const dypaiPushTool = {
         ? null
         : await checkpointBackendSource(targetProjectId, rootDir, plan, remote)
       const sourceCheckpointFailed = sourceCheckpoint?.ok === false && sourceCheckpoint?.skipped !== true
+      const sourceBaseline = !dry_run && !sourceCheckpointFailed
+        ? await refreshBackendSourceBaseline(targetProjectId, rootDir, sourceCheckpoint)
+        : undefined
       return {
         success: !sourceCheckpointFailed,
         applied: false,
@@ -602,6 +633,7 @@ export const dypaiPushTool = {
         plan,
         types: typesGenerated,
         source_checkpoint: sourceCheckpoint || undefined,
+        source_baseline: sourceBaseline,
         hint: sourceCheckpointFailed
           ? "Backend runtime was unchanged, but DYPAI could not save the local dypai/ source to the Studio branch. Retry dypai_push once the GitHub/source checkpoint issue is resolved."
           : undefined,
@@ -725,7 +757,7 @@ export const dypaiPushTool = {
     ]
 
     // How many ops landed in draft state. When `draftCount > 0` the user
-    // must run dypai_deploy_production(confirm:true) to expose the changes
+    // must publish drafts explicitly to expose the changes
     // on live; tests against live won't see them yet. Realtime drafts are
     // also counted — the API returns `applied_to: "draft"` and a
     // `drafts_queued` array when realtime policies were staged.
@@ -752,6 +784,9 @@ export const dypaiPushTool = {
           reason: "push_had_errors",
         }
     const sourceCheckpointFailed = sourceCheckpoint?.ok === false && sourceCheckpoint?.skipped !== true
+    const sourceBaseline = errors.length === 0 && !sourceCheckpointFailed
+      ? await refreshBackendSourceBaseline(targetProjectId, rootDir, sourceCheckpoint)
+      : undefined
 
     return {
       success: errors.length === 0 && !sourceCheckpointFailed,
@@ -786,6 +821,7 @@ export const dypaiPushTool = {
       errors: errors.length ? errors : undefined,
       types: typesGenerated,
       source_checkpoint: sourceCheckpoint,
+      source_baseline: sourceBaseline,
       // Only one next_step — and only when it's non-obvious. Drafts win
       // over the test suggestion because tests against live won't see
       // the change until the drafts are promoted.
@@ -794,7 +830,7 @@ export const dypaiPushTool = {
           ? `${endpointTotal} endpoint(s) saved, ${failedTotal} failed. Fix failed endpoints and push again. Failed: ${errors.slice(0, 3).map((item) => item.endpoint || item.group || item.op).join(", ")}${errors.length > 3 ? "…" : ""}`
           : "Fix the offending YAMLs and push again."
         : draftCount > 0
-          ? `${draftCount} backend change(s) saved to preview — they're not live yet. Verify with dypai_test_endpoint(mode:'draft', endpoint:'<name>') or ask the user to test the preview. Publish with dypai_deploy_production(confirm:true) ONLY after explicit approval.`
+          ? `${draftCount} backend change(s) saved as drafts — they're not live yet. Review with manage_drafts(operation:'list'), verify with dypai_test_endpoint(mode:'draft', endpoint:'<name>') when useful, then publish with manage_drafts(operation:'publish', confirm:true) or dypai_deploy_production(target:'backend', confirm:true) ONLY after explicit approval.`
           : changedNames.length
             ? `Test changed endpoint(s) with dypai_test_endpoint: ${changedNames.slice(0, 3).join(", ")}${changedNames.length > 3 ? "…" : ""}`
             : undefined,