primitive-admin 1.0.46 → 1.0.48

package/dist/src/commands/sync.js

@@ -676,6 +676,50 @@ export function parseTestCaseToml(tomlData) {
     }
     return payload;
 }
+/**
+ * Pull server-side `Script` rows into `transforms/*.rhai` and record
+ * each in the returned sync-state map. Issue #892 slice 7 + codex
+ * follow-up on PR #893. Exported so the unit test can drive it
+ * against a stubbed `client.listScripts`.
+ *
+ * Idempotency: every call writes the body the server returned, so
+ * re-running `sync pull` on an unchanged server overwrites with the
+ * same bytes and produces the same `contentHash`. The result map
+ * always reflects the current server state for the writes performed.
+ *
+ * Older-server graceful path: if `listScripts` rejects (e.g. older
+ * server without the route), the caller catches and treats it as
+ * "no scripts to pull", leaving the directory empty.
+ */
+export async function pullScripts(client, appId, configDir, logger = () => { }) {
+    const transformsDir = join(configDir, "transforms");
+    ensureDir(transformsDir);
+    const scriptEntities = {};
+    let items = [];
+    try {
+        const result = await client.listScripts(appId);
+        items = result.items || [];
+    }
+    catch {
+        return { scriptEntities, count: 0 };
+    }
+    for (const script of items) {
+        const name = script?.name;
+        if (!name)
+            continue;
+        const filename = `${name}.rhai`;
+        const filePath = join(transformsDir, filename);
+        const body = typeof script.body === "string" ? script.body : "";
+        writeFileSync(filePath, body);
+        scriptEntities[name] = {
+            id: script.scriptId,
+            modifiedAt: script.modifiedAt || new Date().toISOString(),
+            contentHash: computeFileHash(filePath),
+        };
+        logger(`  Wrote transforms/${filename}`);
+    }
+    return { scriptEntities, count: items.length };
+}
 async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, testCaseEntities, lookupMaps) {
     let testCases;
     try {
@@ -1012,6 +1056,7 @@ Directory Structure:
         ensureDir(join(configDir, "blob-buckets"));
         ensureDir(join(configDir, "prompts"));
         ensureDir(join(configDir, "workflows"));
+        ensureDir(join(configDir, "transforms")); // #892 slice 7 — Rhai scripts
         ensureDir(join(configDir, "database-types"));
         ensureDir(join(configDir, "rule-sets"));
         ensureDir(join(configDir, "group-type-configs"));
@@ -1116,6 +1161,7 @@ Directory Structure:
             ensureDir(join(configDir, "blob-buckets"));
             ensureDir(join(configDir, "prompts"));
             ensureDir(join(configDir, "workflows"));
+            ensureDir(join(configDir, "transforms")); // #892 slice 7 — Rhai scripts
             ensureDir(join(configDir, "database-types"));
             ensureDir(join(configDir, "rule-sets"));
             ensureDir(join(configDir, "group-type-configs"));
@@ -1229,6 +1275,16 @@ Directory Structure:
                 };
                 info(`  Wrote workflows/${filename}`);
             }
+            // Pull transforms (Rhai scripts) — issue #892, slice 7 + codex
+            // follow-up on PR #893. Mirrors the prompts pull pattern: list
+            // server-side `Script` rows, write each body to
+            // `transforms/<name>.rhai`, and record `{id, modifiedAt,
+            // contentHash}` under `entities.scripts[name]` so a subsequent
+            // `sync push` round-trips without false diffs.
+            const { scriptEntities, count: pulledScriptsCount } = await pullScripts(client, resolvedAppId, configDir, info);
+            if (pulledScriptsCount > 0) {
+                info(`  Pulled ${pulledScriptsCount} transform(s)`);
+            }
             // Build lookup maps for test case serialization
             const configIdToName = new Map();
             const promptIdToKey = new Map();
@@ -1398,6 +1454,7 @@ Directory Structure:
                     blobBuckets: Object.keys(blobBucketEntities).length > 0 ? blobBucketEntities : undefined,
                     prompts: promptEntities,
                     workflows: workflowEntities,
+                    scripts: Object.keys(scriptEntities).length > 0 ? scriptEntities : undefined,
                     emailTemplates: Object.keys(emailTemplateEntities).length > 0 ? emailTemplateEntities : undefined,
                     testCases: Object.keys(testCaseEntities).length > 0 ? testCaseEntities : undefined,
                     databaseTypes: Object.keys(databaseTypeEntities).length > 0 ? databaseTypeEntities : undefined,
@@ -1417,6 +1474,7 @@ Directory Structure:
             keyValue("Blob Buckets", blobBucketItems.length);
             keyValue("Prompts", prompts.length);
             keyValue("Workflows", workflows.length);
+            keyValue("Transforms", pulledScriptsCount);
             keyValue("Email Templates", emailTemplates.length);
             keyValue("Test Cases", totalTestCases);
             keyValue("Database Types", databaseTypesWithOps.length);
@@ -1483,6 +1541,120 @@ Directory Structure:
                 tomlParse: [],
                 opsExist: [],
             };
+            // Issue #813 (decision 4b): per-database-type partial-state disclosure.
+            // When a database type's gate fails during the validate-first pass, we
+            // skip ALL of that type's mutating calls (4a) and record an entry here
+            // so the push summary can name which type's schema/ops did NOT apply,
+            // the actionable reason, and that re-running `sync push` is convergent.
+            const blockedDatabaseTypes = [];
+            // Issue #813: render the collected conflicts + schema/op gate failures
+            // + per-type partial-state disclosure. Shared by the real-push branch
+            // and the dry-run branch (dry-run runs the same server gates via the
+            // validate-first pass, so the same failures surface).
+            const reportSchemaGateFailures = () => {
+                if (conflicts.length > 0) {
+                    console.log();
+                    warn(`${conflicts.length} conflict(s) detected:`);
+                    console.log();
+                    for (const conflict of conflicts) {
+                        console.log(`  ${chalk.red("CONFLICT")} ${conflict.type}: ${chalk.bold(conflict.key)}`);
+                        console.log(`    Local last sync: ${chalk.dim(conflict.localModifiedAt)}`);
+                        console.log(`    Server modified: ${chalk.yellow(conflict.serverModifiedAt)}`);
+                    }
+                    console.log();
+                    warn("These entities were modified on the server since your last pull.");
+                    info("Options:");
+                    console.log(`  1. Run ${chalk.cyan("primitive sync pull")} to get latest changes`);
+                    console.log(`  2. Run ${chalk.cyan("primitive sync push --force")} to overwrite server`);
+                    console.log();
+                }
+                // Report schema-feature errors (issue #666).
+                if (schemaErrors.schemaRequired.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.schemaRequired.length} operation push(es) blocked: type has no schema set.`);
+                    for (const e of schemaErrors.schemaRequired) {
+                        const type = e.key.split("/")[0];
+                        console.log(`  ${chalk.red("SCHEMA_REQUIRED")} ${e.key}`);
+                        console.log(`    Run ${chalk.cyan(`primitive databases schema generate ${type}`)} to scaffold one, then retry.`);
+                    }
+                    console.log();
+                }
+                if (schemaErrors.opRefs.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.opRefs.length} operation push(es) blocked: unresolved references.`);
+                    for (const e of schemaErrors.opRefs) {
+                        console.log(`  ${chalk.red("OPERATION_REFERENCES_UNDEFINED")} ${e.key}`);
+                        for (const ref of e.refs) {
+                            console.log(`    - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
+                        }
+                    }
+                    console.log();
+                }
+                if (schemaErrors.schemaBreaks.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.schemaBreaks.length} schema push(es) blocked: existing operations would break.`);
+                    for (const e of schemaErrors.schemaBreaks) {
+                        console.log(`  ${chalk.red("SCHEMA_BREAKS_OPERATIONS")} ${e.key}`);
+                        for (const op of e.operations) {
+                            console.log(`    ${chalk.bold(op.operation)}`);
+                            for (const ref of op.refs) {
+                                console.log(`      - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
+                            }
+                        }
+                    }
+                    console.log();
+                }
+                if (schemaErrors.uncheckableOps.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.uncheckableOps.length} schema push(es) blocked: operations with dynamic refs.`);
+                    for (const e of schemaErrors.uncheckableOps) {
+                        console.log(`  ${chalk.red("SCHEMA_HAS_UNCHECKABLE_OPS")} ${e.key}`);
+                        for (const op of e.operations) {
+                            console.log(`    ${chalk.bold(op.operation)}`);
+                            for (const loc of op.locations) {
+                                console.log(`      - ${chalk.dim(loc)}`);
+                            }
+                        }
+                    }
+                    info(`Re-run with ${chalk.cyan("--accept-warnings")} to commit anyway.`);
+                    console.log();
+                }
+                if (schemaErrors.tomlParse.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.tomlParse.length} TOML parse error(s):`);
+                    for (const e of schemaErrors.tomlParse) {
+                        const loc = e.line ? ` (line ${e.line}${e.column ? `, col ${e.column}` : ""})` : "";
+                        console.log(`  ${chalk.red("TOML_PARSE_ERROR")} ${e.key}${loc}`);
+                        console.log(`    ${e.message}`);
+                    }
+                    console.log();
+                }
+                if (schemaErrors.opsExist.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.opsExist.length} schema delete(s) blocked: operations still registered.`);
+                    for (const e of schemaErrors.opsExist) {
+                        console.log(`  ${chalk.red("OPS_EXIST")} ${e.key} — ${e.opCount} op(s)`);
+                        console.log(`    Delete or migrate the affected operations before clearing the schema.`);
+                    }
+                    console.log();
+                }
+                // Issue #813 (decision 4b): partial-state disclosure. Name which
+                // database type's schema/ops did NOT apply (the validate-first pass
+                // skipped the whole type before any mutating call), the actionable
+                // reason, and that re-running `sync push` is safe and convergent
+                // (the local TOML is the source of truth). This replaces the bare
+                // `Pushed N change(s). M blocked.` which hid that a partial state
+                // was left.
+                if (blockedDatabaseTypes.length > 0) {
+                    console.log();
+                    warn(`${blockedDatabaseTypes.length} database type(s) were NOT applied (schema + operations skipped before any write):`);
+                    for (const b of blockedDatabaseTypes) {
+                        console.log(`  ${chalk.red("SKIPPED")} ${chalk.bold(b.databaseType)} — ${b.reason}`);
+                    }
+                    info(`No partial changes were written for the skipped type(s) — fix the cause above and re-run ${chalk.cyan("primitive sync push")}. The push is convergent: your local TOML is the source of truth and applied changes are idempotent, so re-running is always safe.`);
+                    console.log();
+                }
+            };
             // Track name→ID mappings for resolving cross-references during push
             const ruleSetNameToId = new Map();
             const promptKeyToId = new Map();
@@ -2130,6 +2302,136 @@ Directory Structure:
                     }
                 }
             }
+            // Process transforms (Rhai scripts) — issue #892, slice 7 of #783.
+            //
+            // `transforms/*.rhai` files are mirrored to `Script` rows via the
+            // admin REST surface (slice 6, `/admin/api/apps/{appId}/scripts`).
+            // The script's `name` is the file basename without the `.rhai`
+            // extension; the file's content is the script body. The
+            // content-hash skip is identical to prompts: an unchanged file is
+            // a no-op; an edited file is a PUT; a new file is a POST.
+            //
+            // Deletes (files removed from `transforms/`) are intentionally
+            // NOT auto-deleted on the server — a workflow revision can still
+            // reference the named script via its frozen R2 payload, and we
+            // don't want a stray rm + push to surface as a hard delete.
+            // The admin REST DELETE remains available for explicit removal.
+            const transformsDir = join(configDir, "transforms");
+            if (existsSync(transformsDir)) {
+                const files = readdirSync(transformsDir).filter((f) => f.endsWith(".rhai"));
+                // Lazy-load the server-side script index on the first miss so
+                // we can map file-basename → existing scriptId for updates of
+                // scripts that the local sync state doesn't yet know about
+                // (e.g. first push after an `init` against a server that has
+                // pre-existing scripts).
+                let serverScripts = null;
+                const loadServerScripts = async () => {
+                    if (serverScripts === null) {
+                        try {
+                            const result = await client.listScripts(resolvedAppId);
+                            serverScripts = result.items || [];
+                        }
+                        catch (err) {
+                            // If the list endpoint isn't available (older server), we
+                            // fall back to "treat as new" — create attempts will get
+                            // a deterministic 409 on duplicate name, which the user
+                            // can reconcile.
+                            serverScripts = [];
+                        }
+                    }
+                    return serverScripts;
+                };
+                for (const file of files) {
+                    const filePath = join(transformsDir, file);
+                    const name = basename(file, ".rhai");
+                    const body = readFileSync(filePath, "utf-8");
+                    const existingId = syncState?.entities?.scripts?.[name]?.id;
+                    // Skip if unchanged since last sync (same content-hash gate
+                    // as prompts).
+                    if (!options.force &&
+                        existingId &&
+                        !shouldPushFile(filePath, syncState?.entities?.scripts?.[name]?.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    if (existingId) {
+                        changes.push({ type: "script", action: "update", key: name });
+                        if (!options.dryRun) {
+                            try {
+                                const updated = await client.updateScript(resolvedAppId, existingId, { body });
+                                info(`  Updated script: ${name}`);
+                                if (syncState) {
+                                    if (!syncState.entities.scripts) {
+                                        syncState.entities.scripts = {};
+                                    }
+                                    syncState.entities.scripts[name] = {
+                                        id: existingId,
+                                        modifiedAt: updated?.modifiedAt ||
+                                            syncState.entities.scripts[name]?.modifiedAt ||
+                                            new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "update", "script", name);
+                            }
+                        }
+                    }
+                    else {
+                        // No id in local state — could be brand new OR could be
+                        // tracked only on the server (e.g. fresh `init`). Look up
+                        // the server list once and reuse for the rest of the loop.
+                        const serverList = await loadServerScripts();
+                        const match = serverList.find((s) => s.name === name);
+                        if (match) {
+                            // Adopt the server's id and update.
+                            changes.push({ type: "script", action: "update", key: name });
+                            if (!options.dryRun) {
+                                try {
+                                    const updated = await client.updateScript(resolvedAppId, match.scriptId, { body });
+                                    info(`  Updated script: ${name} (adopted from server)`);
+                                    if (syncState) {
+                                        if (!syncState.entities.scripts) {
+                                            syncState.entities.scripts = {};
+                                        }
+                                        syncState.entities.scripts[name] = {
+                                            id: match.scriptId,
+                                            modifiedAt: updated?.modifiedAt || new Date().toISOString(),
+                                            contentHash: computeFileHash(filePath),
+                                        };
+                                    }
+                                }
+                                catch (err) {
+                                    throw wrapEntityError(err, "update", "script", name);
+                                }
+                            }
+                        }
+                        else {
+                            changes.push({ type: "script", action: "create", key: name });
+                            if (!options.dryRun) {
+                                try {
+                                    const created = await client.createScript(resolvedAppId, { name, body });
+                                    info(`  Created script: ${name}`);
+                                    if (syncState && created?.scriptId) {
+                                        if (!syncState.entities.scripts) {
+                                            syncState.entities.scripts = {};
+                                        }
+                                        syncState.entities.scripts[name] = {
+                                            id: created.scriptId,
+                                            modifiedAt: created.modifiedAt || new Date().toISOString(),
+                                            contentHash: computeFileHash(filePath),
+                                        };
+                                    }
+                                }
+                                catch (err) {
+                                    throw wrapEntityError(err, "create", "script", name);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
             // Process workflows
             const workflowsDir = join(configDir, "workflows");
             if (existsSync(workflowsDir)) {
@@ -2411,6 +2713,270 @@ Directory Structure:
                         skippedCount++;
                         continue;
                     }
+                    // ── Issue #813: pre-compute the ops being deleted in THIS push and
+                    // the type-level update payload, then run a validate-first pass
+                    // before any mutating call for this type. ──
+                    const existingOpsForType = existingEntry?.operations || {};
+                    const tomlOpNamesForType = new Set(operations.map((op) => op.name));
+                    // Ops present in SyncState but absent from the TOML = pending
+                    // deletes. The server excludes these from the schema-edit /
+                    // OPS_EXIST gate queries (Option 2B) so a single push that deletes
+                    // an op AND lands an incompatible schema is not falsely blocked.
+                    const pendingOpDeletes = Object.keys(existingOpsForType).filter((n) => !tomlOpNamesForType.has(n));
+                    // Issue #813 hardening: the desired final op set this push lands
+                    // (the bare op names declared in the TOML). The server only honors
+                    // a `pendingOpDeletes` exclusion when the named op is absent here,
+                    // proving it's gone from the target state — closing the direct-API
+                    // gate bypass (maintainer decision 2026-05-26). `pendingOpDeletes`
+                    // is derived as exactly the complement of this set, so the two
+                    // never overlap on the legitimate path.
+                    const finalOpNames = Array.from(tomlOpNamesForType);
+                    // Build the type-level `updateData` (same logic as the apply path
+                    // below) so the validate pass and the apply pass agree on whether
+                    // a schema PATCH would run and what it carries.
+                    const computeTypeUpdateData = () => {
+                        const u = {};
+                        if ("ruleSetId" in typeConfig)
+                            u.ruleSetId = typeConfig.ruleSetId || null;
+                        if ("triggers" in typeConfig)
+                            u.triggers = typeConfig.triggers || null;
+                        if ("metadataAccess" in typeConfig)
+                            u.metadataAccess = typeConfig.metadataAccess || null;
+                        if ("defaultAccess" in typeConfig)
+                            u.defaultAccess = typeConfig.defaultAccess || null;
+                        if ("autoPopulatedFields" in typeConfig) {
+                            u.autoPopulatedFields = typeConfig.autoPopulatedFields || null;
+                        }
+                        if ("timestamps" in typeConfig) {
+                            u.timestamps = typeConfig.timestamps || null;
+                        }
+                        const localHasSchema = typeof typeConfig.schema === "string" &&
+                            typeConfig.schema.trim().length > 0;
+                        if (localHasSchema) {
+                            u.schema = typeConfig.schema;
+                        }
+                        else if (existingEntry?.hasSchema) {
+                            u.schema = null;
+                        }
+                        return u;
+                    };
+                    // Validate-first pass (decision 4a): run every gate for this type
+                    // BEFORE issuing any mutating call. If a gate fails, the whole
+                    // type's mutating calls (op creates/updates/deletes AND the schema
+                    // PATCH) are skipped — eliminating the gate-failure partial commit.
+                    // The same pass IS the dry-run path for `sync push --dry-run`:
+                    // it runs the real server gates without persisting (Option 1A).
+                    let typeGateBlocked = false;
+                    // Issue #684 regression guard: track which op the op-edit gate is
+                    // dry-running so an unrecognized server error (e.g. a plain
+                    // validation 400 like `"limit" must be 1000 or less`) can be
+                    // attributed to that specific operation in the catch-all below,
+                    // instead of being coarsened to the db-type level.
+                    let opGateContext = null;
+                    const validateExpectedModifiedAt = options.force
+                        ? undefined
+                        : existingEntry?.modifiedAt;
+                    try {
+                        // 1. Schema-edit gate (type-config PATCH dry-run) — only when the
+                        //    type already exists on the server and we'd actually PATCH a
+                        //    schema-relevant field. A fresh type (no existingEntry) has no
+                        //    ops to break, so there's nothing to gate yet.
+                        if (existingEntry) {
+                            const validateUpdateData = computeTypeUpdateData();
+                            if (Object.keys(validateUpdateData).length > 0) {
+                                await client.updateDatabaseTypeConfig(resolvedAppId, dbType, pendingOpDeletes.length > 0
+                                    ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
+                                    : validateUpdateData, validateExpectedModifiedAt, {
+                                    dryRun: true,
+                                    acceptWarnings: !!options.acceptWarnings,
+                                });
+                            }
+                        }
+                        // 2. Op-edit gate (op create/update dry-run) for every op in the
+                        //    TOML. The server runs `runSchemaGate` and short-circuits
+                        //    before persisting. Skipped for a fresh type (no schema on the
+                        //    server yet → gate is a no-op anyway).
+                        //
+                        //    The op gate is run against the schema THIS push is landing
+                        //    (`schemaOverride`), not the stale stored schema — the real
+                        //    apply path PATCHes the schema before creating/updating ops,
+                        //    so an op that depends on a field this push adds must NOT be
+                        //    falsely rejected (plan edge case: "op create that depends on
+                        //    a schema landed earlier in the same push"). When the push
+                        //    isn't changing the schema, leave the override unset so the
+                        //    server uses the stored schema.
+                        if (existingEntry) {
+                            const validateUpdateData = computeTypeUpdateData();
+                            const proposedSchema = "schema" in validateUpdateData
+                                ? validateUpdateData.schema
+                                : undefined;
+                            for (const op of operations) {
+                                const existingOp = existingOpsForType[op.name];
+                                opGateContext = {
+                                    action: existingOp ? "update" : "create",
+                                    key: `${dbType}/${op.name}`,
+                                };
+                                if (existingOp) {
+                                    await client.updateDatabaseTypeOperation(resolvedAppId, dbType, op.name, {
+                                        type: op.type,
+                                        modelName: op.modelName,
+                                        access: op.access,
+                                        definition: op.definition,
+                                        params: op.params,
+                                    }, options.force ? undefined : existingOp.modifiedAt, { dryRun: true, schemaOverride: proposedSchema });
+                                }
+                                else {
+                                    await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
+                                        name: op.name,
+                                        type: op.type,
+                                        modelName: op.modelName,
+                                        access: op.access,
+                                        definition: op.definition,
+                                        params: op.params,
+                                    }, { dryRun: true, schemaOverride: proposedSchema });
+                                }
+                            }
+                            // Every op gate passed; clear the context so a later (non-op)
+                            // throw inside this try isn't misattributed to the last op.
+                            opGateContext = null;
+                        }
+                    }
+                    catch (err) {
+                        // A gate failure during validate aborts the whole type. Bucket it
+                        // into the same `schemaErrors` collectors used by the reporting
+                        // path so the summary renders it identically, and record a
+                        // disclosure entry. Conflicts and other errors fall through to
+                        // the apply path's handling (validate-first doesn't change
+                        // conflict semantics).
+                        if (err instanceof SchemaBreaksOpsError) {
+                            schemaErrors.schemaBreaks.push({
+                                type: "database-type",
+                                key: dbType,
+                                operations: err.operations,
+                                message: err.message,
+                            });
+                            blockedDatabaseTypes.push({
+                                databaseType: dbType,
+                                reason: `schema change blocked: ${err.operations.length} kept operation(s) would break under the new schema`,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof SchemaHasUncheckableOpsError) {
+                            schemaErrors.uncheckableOps.push({
+                                type: "database-type",
+                                key: dbType,
+                                operations: err.operations,
+                                message: err.message,
+                            });
+                            blockedDatabaseTypes.push({
+                                databaseType: dbType,
+                                reason: `schema change blocked: operation(s) have dynamic refs (re-run with --accept-warnings to commit)`,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof OpsExistError) {
+                            schemaErrors.opsExist.push({
+                                type: "database-type",
+                                key: dbType,
+                                opCount: err.opCount,
+                                message: err.message,
+                            });
+                            blockedDatabaseTypes.push({
+                                databaseType: dbType,
+                                reason: `schema deletion blocked: ${err.opCount} operation(s) still registered after this push's deletes`,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof SchemaRequiredError) {
+                            schemaErrors.schemaRequired.push({
+                                type: "operation",
+                                key: `${dbType}/_`,
+                                message: err.message,
+                            });
+                            blockedDatabaseTypes.push({
+                                databaseType: dbType,
+                                reason: `operation push blocked: type has no schema set`,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof OperationRefError) {
+                            schemaErrors.opRefs.push({
+                                type: "operation",
+                                key: dbType,
+                                refs: err.refs,
+                                message: err.message,
+                            });
+                            blockedDatabaseTypes.push({
+                                databaseType: dbType,
+                                reason: `operation push blocked: unresolved references in the schema`,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof ConflictError) {
+                            // Surface the conflict and skip this type (don't blow away the
+                            // server with mutating calls). Mirrors the apply path.
+                            conflicts.push({
+                                type: "database-type",
+                                key: dbType,
+                                serverModifiedAt: err.serverModifiedAt,
+                                localModifiedAt: validateExpectedModifiedAt || "unknown",
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (err instanceof TomlParseError) {
+                            schemaErrors.tomlParse.push({
+                                type: "database-type",
+                                key: dbType,
+                                line: err.line,
+                                column: err.column,
+                                message: err.message,
+                            });
+                            typeGateBlocked = true;
+                        }
+                        else if (opGateContext) {
+                            // The op-edit gate dry-run threw a plain (non-gate) error —
+                            // e.g. an invalid op `definition` the server rejects with a
+                            // 400. The validate-first loop already knows which op failed,
+                            // so name it (issue #684) instead of coarsening to the
+                            // db-type level. Mirrors the apply path's per-op wraps.
+                            throw wrapEntityError(err, opGateContext.action, "operation", opGateContext.key);
+                        }
+                        else {
+                            throw wrapEntityError(err, "update", "database type", dbType);
+                        }
+                    }
+                    // If the validate pass found a gate failure, record the change
+                    // labels (so dry-run still shows what WOULD change) but skip ALL
+                    // mutating calls for this type.
+                    if (typeGateBlocked) {
+                        const wouldUpdate = "ruleSetId" in typeConfig ||
+                            "triggers" in typeConfig ||
+                            "metadataAccess" in typeConfig ||
+                            "defaultAccess" in typeConfig ||
+                            "autoPopulatedFields" in typeConfig ||
+                            "timestamps" in typeConfig ||
+                            "schema" in typeConfig;
+                        if (existingEntry) {
+                            if (wouldUpdate) {
+                                changes.push({ type: "database-type", action: "update", key: dbType });
+                            }
+                        }
+                        else {
+                            changes.push({ type: "database-type", action: "create", key: dbType });
+                        }
+                        for (const op of operations) {
+                            const existingOp = existingOpsForType[op.name];
+                            changes.push({
+                                type: "operation",
+                                action: existingOp ? "update" : "create",
+                                key: `${dbType}/${op.name}`,
+                            });
+                        }
+                        for (const delName of pendingOpDeletes) {
+                            changes.push({ type: "operation", action: "delete", key: `${dbType}/${delName}` });
+                        }
+                        continue;
+                    }
                     if (existingEntry) {
                         // Update existing type config — only if there are type-level fields to update.
                         // Operations are handled separately below, so skipping the PATCH here when
@@ -2421,41 +2987,32 @@ Directory Structure:
                                 ? undefined
                                 : existingEntry.modifiedAt;
                             try {
-                                const updateData = {};
-                                if ("ruleSetId" in typeConfig)
-                                    updateData.ruleSetId = typeConfig.ruleSetId || null;
-                                if ("triggers" in typeConfig)
-                                    updateData.triggers = typeConfig.triggers || null;
-                                if ("metadataAccess" in typeConfig)
-                                    updateData.metadataAccess = typeConfig.metadataAccess || null;
-                                if ("defaultAccess" in typeConfig)
-                                    updateData.defaultAccess = typeConfig.defaultAccess || null;
-                                if ("autoPopulatedFields" in typeConfig) {
-                                    updateData.autoPopulatedFields =
-                                        typeConfig.autoPopulatedFields || null;
-                                }
-                                if ("timestamps" in typeConfig) {
-                                    updateData.timestamps = typeConfig.timestamps || null;
-                                }
                                 // Issue #666: forward `schema` when the local TOML declares
                                 // one (a set/update), OR when the server had one at last
                                 // sync and the local file no longer does (a deletion —
                                 // `schema: null` clears it server-side; codex review gap on
                                 // PR #766). When the type never had a schema and still
                                 // doesn't, omit it so an operations-only edit doesn't
-                                // register as an empty type-level update (issue #369).
-                                const localHasSchema = typeof typeConfig.schema === "string" &&
-                                    typeConfig.schema.trim().length > 0;
-                                if (localHasSchema) {
-                                    updateData.schema = typeConfig.schema;
-                                }
-                                else if (existingEntry.hasSchema) {
-                                    updateData.schema = null;
+                                // register as an empty type-level update (issue #369). Built
+                                // by the shared helper so the validate pass and apply pass
+                                // agree (issue #813).
+                                const updateData = computeTypeUpdateData();
+                                // Issue #813 (2B): forward the ops being deleted in this push
+                                // so the schema-edit / OPS_EXIST gates evaluate against the
+                                // post-deletion op set. The op deletes themselves still run
+                                // in step 3 below; this lets the schema PATCH (step 1) land
+                                // in the same push.
+                                if (pendingOpDeletes.length > 0) {
+                                    updateData.pendingOpDeletes = pendingOpDeletes;
+                                    // Issue #813 hardening: prove the named deletes are gone
+                                    // from the target state so the server honors the gate
+                                    // exclusion (see derivation above).
+                                    updateData.finalOpNames = finalOpNames;
                                 }
-                                if (Object.keys(updateData).length > 0) {
+                                if (Object.keys(updateData).filter((k) => k !== "pendingOpDeletes" && k !== "finalOpNames").length > 0) {
                                     changes.push({ type: "database-type", action: "update", key: dbType });
                                     const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {
-                                        dryRun: !!options.dryRun,
+                                        dryRun: false,
                                         acceptWarnings: !!options.acceptWarnings,
                                     });
                                     info(`  Updated database type: ${dbType}`);
@@ -2573,7 +3130,153 @@ Directory Structure:
                                 }
                             }
                             catch (err) {
-                                throw wrapEntityError(err, "create", "database type", dbType);
+                                // Issue #855: a database type can be auto-created at runtime by
+                                // `client.databases.create({ databaseType })`, which leaves a
+                                // minimal `DatabaseTypeConfig` (no ops/schema) on the server but
+                                // no entry in local sync state. The create-vs-update fork above
+                                // is driven only by sync state, so push takes the CREATE path
+                                // and the server returns 409 "Config for this database type
+                                // already exists". Mirror the blob-bucket 409-recovery in this
+                                // same loop: adopt the existing config into sync state and
+                                // reconcile it via PATCH instead of aborting. Recovery fires
+                                // ONLY on the 409 — the happy path takes no extra round-trip.
+                                const msg = String(err?.message || err);
+                                if (msg.includes("already exists") || err?.statusCode === 409) {
+                                    // 1. Fetch the existing config to recover its modifiedAt /
+                                    //    schema baseline.
+                                    const existing = await client.getDatabaseTypeConfig(resolvedAppId, dbType);
+                                    // Issue #855 (codex [P2]): the recovery is only safe for the
+                                    // genuine *auto-created minimal* config — the bare shape
+                                    // `databases.create({ databaseType })` stamps (appId +
+                                    // databaseType + createdBy, nothing else: no ops, no
+                                    // triggers, no non-default access/schema; see
+                                    // src/app-api/controllers/databases-controller.ts:392-400).
+                                    // For that case the adopt-without-baseline PATCH below
+                                    // cannot clobber anything, because there is nothing to
+                                    // clobber.
+                                    //
+                                    // But the 409 also fires when the local sync state is merely
+                                    // ABSENT for a type that another admin has already FULLY
+                                    // configured (or whose `.primitive-sync.json` was not copied
+                                    // alongside the TOML). PATCHing that without
+                                    // `expectedModifiedAt` would silently overwrite the existing
+                                    // triggers/access/schema with the local TOML — with no
+                                    // CONFLICT protection, since the baseline that would catch it
+                                    // is the very thing being skipped. Detect a non-minimal
+                                    // remote config and refuse to mutate it without a baseline:
+                                    // surface it as a SKIPPED type (reusing the #813 blocked-type
+                                    // disclosure + non-zero exit) so the user runs `sync pull`
+                                    // first. The op sub-loop is skipped via `continue`, so no
+                                    // operations are created against the un-reconciled type.
+                                    const existingOpsRemote = await client
+                                        .listDatabaseTypeOperations(resolvedAppId, dbType)
+                                        .catch(() => []);
+                                    const hasNonDefaultField = (v) => {
+                                        if (v === null || v === undefined)
+                                            return false;
+                                        if (typeof v === "string")
+                                            return v.trim().length > 0;
+                                        if (typeof v === "object")
+                                            return Object.keys(v).length > 0;
+                                        return true;
+                                    };
+                                    const isMinimalAutoCreated = (!Array.isArray(existingOpsRemote) ||
+                                        existingOpsRemote.length === 0) &&
+                                        !hasNonDefaultField(existing?.ruleSetId) &&
+                                        !hasNonDefaultField(existing?.triggers) &&
+                                        !hasNonDefaultField(existing?.metadataAccess) &&
+                                        !hasNonDefaultField(existing?.defaultAccess) &&
+                                        !hasNonDefaultField(existing?.autoPopulatedFields) &&
+                                        !hasNonDefaultField(existing?.timestamps) &&
+                                        !hasNonDefaultField(existing?.schema);
+                                    if (!isMinimalAutoCreated) {
+                                        // Adopt-without-mutating is NOT safe here: the remote type
+                                        // carries real config. Abort this type with actionable
+                                        // guidance instead of silently overwriting it. Seed the
+                                        // baseline FIRST so the very next push (after the user runs
+                                        // `sync pull` or re-pushes) reconciles against a real
+                                        // modifiedAt rather than re-tripping this recovery.
+                                        if (syncState) {
+                                            if (!syncState.entities.databaseTypes) {
+                                                syncState.entities.databaseTypes = {};
+                                            }
+                                            syncState.entities.databaseTypes[dbType] = {
+                                                databaseType: dbType,
+                                                modifiedAt: existing?.modifiedAt || new Date().toISOString(),
+                                                contentHash: computeFileHash(filePath),
+                                                hasSchema: typeof existing?.schema === "string" &&
+                                                    existing.schema.trim().length > 0,
+                                            };
+                                        }
+                                        blockedDatabaseTypes.push({
+                                            databaseType: dbType,
+                                            reason: `already configured remotely — run \`primitive sync pull\` to establish a local baseline before pushing (refusing to overwrite the existing config without one)`,
+                                        });
+                                        // Record the change labels for visibility (mirrors the
+                                        // validate-first blocked path) without applying them.
+                                        changes.push({
+                                            type: "database-type",
+                                            action: "update",
+                                            key: dbType,
+                                        });
+                                        for (const op of operations) {
+                                            changes.push({
+                                                type: "operation",
+                                                action: "create",
+                                                key: `${dbType}/${op.name}`,
+                                            });
+                                        }
+                                        continue;
+                                    }
+                                    info(`  reconciled auto-created database type \`${dbType}\``);
+                                    // 2. Seed sync state so subsequent pushes take the UPDATE
+                                    //    path and a re-push is idempotent.
+                                    if (syncState) {
+                                        if (!syncState.entities.databaseTypes) {
+                                            syncState.entities.databaseTypes = {};
+                                        }
+                                        syncState.entities.databaseTypes[dbType] = {
+                                            databaseType: dbType,
+                                            modifiedAt: existing?.modifiedAt || new Date().toISOString(),
+                                            contentHash: computeFileHash(filePath),
+                                            hasSchema: typeof existing?.schema === "string" &&
+                                                existing.schema.trim().length > 0,
+                                        };
+                                    }
+                                    // 3. Reconcile the TOML's type-level fields onto the
+                                    //    (formerly empty) auto-created config. Omit
+                                    //    `expectedModifiedAt` on this first adopt: there is no
+                                    //    local baseline, so passing one would falsely trip the
+                                    //    "modified since last sync" CONFLICT (Q4). Subsequent
+                                    //    pushes carry the baseline just seeded above. Skip the
+                                    //    PATCH entirely when the TOML declares no type-level
+                                    //    fields (an ops-only file) so we don't send an empty
+                                    //    body, which the server rejects with HTTP 400 (#369).
+                                    const reconcileData = computeTypeUpdateData();
+                                    if (Object.keys(reconcileData).length > 0) {
+                                        const reconciled = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, reconcileData, undefined, {
+                                            dryRun: false,
+                                            acceptWarnings: !!options.acceptWarnings,
+                                        });
+                                        if (syncState?.entities?.databaseTypes?.[dbType] &&
+                                            reconciled?.modifiedAt) {
+                                            syncState.entities.databaseTypes[dbType].modifiedAt =
+                                                reconciled.modifiedAt;
+                                            syncState.entities.databaseTypes[dbType].hasSchema =
+                                                "schema" in reconcileData
+                                                    ? reconcileData.schema !== null
+                                                    : syncState.entities.databaseTypes[dbType].hasSchema;
+                                        }
+                                    }
+                                    // Operations declared in the TOML flow through the existing
+                                    // op sub-loop below. `existingOps` is derived from
+                                    // `existingEntry` (the pre-push sync-state snapshot, which is
+                                    // empty here), so every op is CREATEd — matching the empty
+                                    // auto-created type on the server.
+                                }
+                                else {
+                                    throw wrapEntityError(err, "create", "database type", dbType);
+                                }
                             }
                         }
                     }
@@ -3029,6 +3732,16 @@ Directory Structure:
                 }
             }
             divider();
+            // Issue #813: a gate failure surfaced by the validate-first pass (which
+            // also runs in dry-run mode via the server's dry-run gate endpoints).
+            const hasGateFailure = conflicts.length > 0 ||
+                blockedDatabaseTypes.length > 0 ||
+                schemaErrors.schemaRequired.length > 0 ||
+                schemaErrors.opRefs.length > 0 ||
+                schemaErrors.schemaBreaks.length > 0 ||
+                schemaErrors.uncheckableOps.length > 0 ||
+                schemaErrors.tomlParse.length > 0 ||
+                schemaErrors.opsExist.length > 0;
             if (options.dryRun) {
                 info("Dry run - no changes applied.");
                 console.log("\nChanges that would be made:");
@@ -3038,101 +3751,18 @@ Directory Structure:
                             : chalk.yellow;
                     console.log(`  ${color(change.action)} ${change.type}: ${change.key}`);
                 }
-            }
-            else if (conflicts.length > 0 ||
-                schemaErrors.schemaRequired.length > 0 ||
-                schemaErrors.opRefs.length > 0 ||
-                schemaErrors.schemaBreaks.length > 0 ||
-                schemaErrors.uncheckableOps.length > 0 ||
-                schemaErrors.tomlParse.length > 0 ||
-                schemaErrors.opsExist.length > 0) {
-                // Handle conflicts
-                if (conflicts.length > 0) {
-                    console.log();
-                    warn(`${conflicts.length} conflict(s) detected:`);
-                    console.log();
-                    for (const conflict of conflicts) {
-                        console.log(`  ${chalk.red("CONFLICT")} ${conflict.type}: ${chalk.bold(conflict.key)}`);
-                        console.log(`    Local last sync: ${chalk.dim(conflict.localModifiedAt)}`);
-                        console.log(`    Server modified: ${chalk.yellow(conflict.serverModifiedAt)}`);
-                    }
-                    console.log();
-                    warn("These entities were modified on the server since your last pull.");
-                    info("Options:");
-                    console.log(`  1. Run ${chalk.cyan("primitive sync pull")} to get latest changes`);
-                    console.log(`  2. Run ${chalk.cyan("primitive sync push --force")} to overwrite server`);
-                    console.log();
-                }
-                // Report schema-feature errors (issue #666).
-                if (schemaErrors.schemaRequired.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.schemaRequired.length} operation push(es) blocked: type has no schema set.`);
-                    for (const e of schemaErrors.schemaRequired) {
-                        const type = e.key.split("/")[0];
-                        console.log(`  ${chalk.red("SCHEMA_REQUIRED")} ${e.key}`);
-                        console.log(`    Run ${chalk.cyan(`primitive databases schema generate ${type}`)} to scaffold one, then retry.`);
-                    }
-                    console.log();
-                }
-                if (schemaErrors.opRefs.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.opRefs.length} operation push(es) blocked: unresolved references.`);
-                    for (const e of schemaErrors.opRefs) {
-                        console.log(`  ${chalk.red("OPERATION_REFERENCES_UNDEFINED")} ${e.key}`);
-                        for (const ref of e.refs) {
-                            console.log(`    - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
-                        }
-                    }
-                    console.log();
-                }
-                if (schemaErrors.schemaBreaks.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.schemaBreaks.length} schema push(es) blocked: existing operations would break.`);
-                    for (const e of schemaErrors.schemaBreaks) {
-                        console.log(`  ${chalk.red("SCHEMA_BREAKS_OPERATIONS")} ${e.key}`);
-                        for (const op of e.operations) {
-                            console.log(`    ${chalk.bold(op.operation)}`);
-                            for (const ref of op.refs) {
-                                console.log(`      - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
-                            }
-                        }
-                    }
-                    console.log();
-                }
-                if (schemaErrors.uncheckableOps.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.uncheckableOps.length} schema push(es) blocked: operations with dynamic refs.`);
-                    for (const e of schemaErrors.uncheckableOps) {
-                        console.log(`  ${chalk.red("SCHEMA_HAS_UNCHECKABLE_OPS")} ${e.key}`);
-                        for (const op of e.operations) {
-                            console.log(`    ${chalk.bold(op.operation)}`);
-                            for (const loc of op.locations) {
-                                console.log(`      - ${chalk.dim(loc)}`);
-                            }
-                        }
-                    }
-                    info(`Re-run with ${chalk.cyan("--accept-warnings")} to commit anyway.`);
-                    console.log();
-                }
-                if (schemaErrors.tomlParse.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.tomlParse.length} TOML parse error(s):`);
-                    for (const e of schemaErrors.tomlParse) {
-                        const loc = e.line ? ` (line ${e.line}${e.column ? `, col ${e.column}` : ""})` : "";
-                        console.log(`  ${chalk.red("TOML_PARSE_ERROR")} ${e.key}${loc}`);
-                        console.log(`    ${e.message}`);
-                    }
-                    console.log();
-                }
-                if (schemaErrors.opsExist.length > 0) {
-                    console.log();
-                    warn(`${schemaErrors.opsExist.length} schema delete(s) blocked: operations still registered.`);
-                    for (const e of schemaErrors.opsExist) {
-                        console.log(`  ${chalk.red("OPS_EXIST")} ${e.key} — ${e.opCount} op(s)`);
-                        console.log(`    Delete or migrate the affected operations before clearing the schema.`);
-                    }
-                    console.log();
+                // Issue #813 (behaviors 1 & 2): dry-run actually runs the server
+                // schema-edit / op-edit gates. If the proposed state would be
+                // rejected, report it and exit non-zero so dry-run no longer reports
+                // a doomed push as clean. The dry-run gate excludes pending op
+                // deletes (2B), so a delete-then-schema push is NOT falsely flagged.
+                if (hasGateFailure) {
+                    reportSchemaGateFailures();
+                    process.exit(1);
                 }
+            }
+            else if (hasGateFailure) {
+                reportSchemaGateFailures();
                 // Update sync state for non-conflicting changes
                 if (syncState) {
                     syncState.lastSyncedAt = new Date().toISOString();
@@ -3145,12 +3775,24 @@ Directory Structure:
                     schemaErrors.uncheckableOps.length +
                     schemaErrors.tomlParse.length +
                     schemaErrors.opsExist.length;
-                const successCount = changes.length - totalBlocked;
+                // With validate-first (issue #813) a blocked type's change labels are
+                // recorded for visibility but none of them actually applied, so count
+                // skipped types' labels as not-applied for an honest success count.
+                const blockedTypeNames = new Set(blockedDatabaseTypes.map((b) => b.databaseType));
+                const skippedChangeCount = changes.filter((c) => {
+                    if (c.type === "database-type")
+                        return blockedTypeNames.has(c.key);
+                    if (c.type === "operation") {
+                        return blockedTypeNames.has(String(c.key).split("/")[0]);
+                    }
+                    return false;
+                }).length;
+                const successCount = Math.max(0, changes.length - totalBlocked - skippedChangeCount);
                 if (successCount > 0) {
-                    success(`Pushed ${successCount} change(s). ${totalBlocked} blocked.`);
+                    success(`Pushed ${successCount} change(s). ${blockedDatabaseTypes.length} database type(s) skipped, ${conflicts.length} conflict(s). Re-run \`sync push\` to converge.`);
                 }
                 else {
-                    error(`Push failed: ${totalBlocked} blocked. No changes applied.`);
+                    error(`Push failed: ${blockedDatabaseTypes.length} database type(s) skipped, ${conflicts.length} conflict(s). No schema/op changes applied to the blocked type(s).`);
                 }
                 process.exit(1);
             }